[Webkit-unassigned] [Bug 37608] New: crash in webkit_download_received_data

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Apr 14 14:24:26 PDT 2010


https://bugs.webkit.org/show_bug.cgi?id=37608

           Summary: crash in webkit_download_received_data
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Mac OS X 10.5
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: WebKit Gtk
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: otte at gnome.org


Here's a crash I just experienced while browsing some mailing lists.
Unfortunately I selected "Don't recover" so the link is lost. :(

Program terminated with signal 11, Segmentation fault.
#0  0x000000377851014e in webkit_download_received_data (download=
    0xe9d2d20 [WebKitDownload], data=0x7fffb56f77b0 "", length=1143)
    at ../WebKit/gtk/webkit/webkitdownload.cpp:845
845        ASSERT(priv->outputStream);

Thread 3 (Thread 18266):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:212
No locals.
#1  0x000000336f202382 in g_cond_timed_wait_posix_impl (
    cond=<value optimized out>, entered_mutex=<value optimized out>, 
    abs_time=<value optimized out>) at gthread-posix.c:242
        result = <value optimized out>
        end_time = {tv_sec = 1271278593, tv_nsec = 733369000}
        timed_out = <value optimized out>
        __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#2  0x000000336ea170b1 in g_async_queue_pop_intern_unlocked (queue=0x23155b0, 
    try=0, end_time=0x7f990a6bec00) at gasyncqueue.c:365
        retval = <value optimized out>
        __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#3  0x000000336ea171f7 in IA__g_async_queue_timed_pop (queue=0x23155b0, 
    end_time=0x7f990a6bec00) at gasyncqueue.c:491
        retval = <value optimized out>
        __PRETTY_FUNCTION__ = "IA__g_async_queue_timed_pop"
#4  0x000000336ea66cba in g_thread_pool_wait_for_new_pool (
    data=<value optimized out>) at gthreadpool.c:171
        end_time = {tv_sec = 1271278593, tv_usec = 733369}
        pool = <value optimized out>
        local_max_idle_time = 15000
        local_wakeup_thread_serial = <value optimized out>
        local_max_unused_threads = 2
        last_wakeup_thread_serial = 0
        have_relayed_thread_marker = <value optimized out>
#5  g_thread_pool_thread_proxy (data=<value optimized out>)
    at gthreadpool.c:374
        free_pool = <value optimized out>
        task = <value optimized out>
        pool = <value optimized out>
#6  0x000000336ea64e84 in g_thread_create_proxy (data=0xc254f40)
    at gthread.c:1893
        thread = 0xc254f40
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7  0x000000336d607861 in start_thread (arg=0x7f990a6bf710)
    at pthread_create.c:301
        __res = <value optimized out>
        pd = 0x7f990a6bf710
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140295281571600, 
    401216311817550912, 140736237364768, 140295281572304, 0, 3, 
    -386327928365237184, 430008951420632128}, mask_was_saved = 0}}, priv = {
            pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        sp = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#8  0x000000336cee4b3d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
No locals.

Thread 2 (Thread 2255):
#0  pthread_cond_wait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x000000377862ad28 in WTF::ThreadCondition::wait (this=0x26487f0, mutex=
    ...) at ../JavaScriptCore/wtf/ThreadingPthreads.cpp:355
        result = 0
        __PRETTY_FUNCTION__ = "void WTF::ThreadCondition::wait(WTF::Mutex&)"
#2  0x000000377832f98f in WebCore::IconDatabase::syncThreadMainLoop (this=
    0x2648720) at ../WebCore/loader/icon/IconDatabase.cpp:1412
        timeStamp = 1271278572.5618551
        didAnyWork = false
        newstamp = 1271278572.6419439
        __PRETTY_FUNCTION__ = 
    "void* WebCore::IconDatabase::syncThreadMainLoop()"
        shouldReenableSuddenTermination = true
#3  0x000000377832de96 in WebCore::IconDatabase::iconDatabaseSyncThread (this=
    0x2648720) at ../WebCore/loader/icon/IconDatabase.cpp:1038
        __PRETTY_FUNCTION__ = 
    "void* WebCore::IconDatabase::iconDatabaseSyncThread()"
        startTime = 1270827943.2105401
        journalFilename = {m_impl = {<WTF::FastAllocBase> = 
    {<No data fields>}, m_ptr = 0x7f9920000990}}
        timeStamp = 1270827943.949223
        newStamp = 1270827943.9866011
#4  0x000000377832d9dc in WebCore::IconDatabase::iconDatabaseSyncThreadStart (
    vIconDatabase=0x2648720) at ../WebCore/loader/icon/IconDatabase.cpp:941
        iconDB = 0x2648720
#5  0x000000377862a0ed in WTF::threadEntryPoint (contextData=0x2648d50)
    at ../JavaScriptCore/wtf/Threading.cpp:65
        context = 0x2648d50
        entryPoint = 
    0x377832d9bc <WebCore::IconDatabase::iconDatabaseSyncThreadStart(void*)>
        data = 0x2648720
#6  0x000000336d607861 in start_thread (arg=0x7f99281c0710)
    at pthread_create.c:301
        __res = <value optimized out>
        pd = 0x7f99281c0710
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140295779649296, 
    401216311817550912, 220878411840, 140295779650000, 0, 3, 
    -386403381813822400, 430008951420632128}, mask_was_saved = 0}}, priv = {
            pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        sp = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#7  0x000000336cee4b3d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
No locals.

Thread 1 (Thread 1890):
#0  0x000000377851014e in webkit_download_received_data (download=
    0xe9d2d20 [WebKitDownload], data=0x7fffb56f77b0 "", length=1143)
    at ../WebKit/gtk/webkit/webkitdownload.cpp:845
        __PRETTY_FUNCTION__ = 
    "void webkit_download_received_data(WebKitDownload*, const gchar*, int)"
        bytes_written = 20890720932550
        priv = 0xe9d2d40
        error = 0xc87c5e0
        lastProgress = 1
        lastElapsed = 0.13414262900000001
        currentElapsed = 6.365987363014504e-314
        currentProgress = 8.4967421651618715e-316
#1  0x000000377851057f in DownloadClient::didReceiveData (this=0xca6b430, 
    data=0x7fffb56f77b0 "", length=1143, lengthReceived=0)
    at ../WebKit/gtk/webkit/webkitdownload.cpp:927
No locals.
#2  0x00000037784eb2a7 in WebCore::gotChunkCallback (msg=
    0xb1c41e0 [SoupMessage], chunk=0xccd24d0, data=0xa402520)
    at ../WebCore/platform/network/soup/ResourceHandleSoup.cpp:292
        handle = {<WTF::FastAllocBase> = {<No data fields>}, m_ptr = 
    0xa402520}
        d = 0xe1d9900
        client = 0xca6b430
#3  0x000000336f60b98e in IA__g_closure_invoke (closure=0x603a930, 
    return_value=0x0, n_param_values=2, param_values=0xbfd7330, 
    invocation_hint=0x7fffb56f74e0) at gclosure.c:767
        marshal = <value optimized out>
        marshal_data = <value optimized out>
        in_marshal = <value optimized out>
        __PRETTY_FUNCTION__ = "IA__g_closure_invoke"
#4  0x000000336f61f957 in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:3248
        tmp = <value optimized out>
        handler = 0x90a2290
        accumulator = <value optimized out>
        emission = {next = 0x7fffb56f99d0, instance = 0xb1c41e0, ihint = {
            signal_id = 414, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, 
          state = EMISSION_RUN, chain_type = 4}
        class_closure = <value optimized out>
        handler_list = 0x90a2290
        return_accu = <value optimized out>
        accu = {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, 
              v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 
    0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, 
              v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, 
              v_pointer = 0x0}}}
        signal_id = <value optimized out>
        max_sequential_handler_number = <value optimized out>
        return_value_altered = <value optimized out>
#5  0x000000336f620df6 in IA__g_signal_emit_valist (
    instance=<value optimized out>, signal_id=<value optimized out>, 
    detail=<value optimized out>, var_args=0x7fffb56f76d0) at gsignal.c:2981
        instance_and_params = <value optimized out>
        signal_return_type = <value optimized out>
        param_values = <value optimized out>
        node = 0x2d92cf0
        i = <value optimized out>
        n_params = <value optimized out>
        __PRETTY_FUNCTION__ = "IA__g_signal_emit_valist"
#6  0x000000336f6213b3 in IA__g_signal_emit (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>)
    at gsignal.c:3038
        var_args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 
    0x7fffb56f77b0, reg_save_area = 0x7fffb56f76f0}}
#7  0x000000338862eeeb in read_body_chunk (msg=0xb1c41e0 [SoupMessage])
    at soup-message-io.c:461
        cancelled = <value optimized out>
        priv = 0xb1c4230
        io = <value optimized out>
        status = <value optimized out>
        stack_buf = 0x7fffb56f77b0 ""
        len = <value optimized out>
        read_to_eof = 1
        nread = 1143
        error = 0x0
        buffer = <value optimized out>
#8  0x000000338862f668 in io_read (sock=0xa175190 [SoupSocket], msg=
    0xb1c41e0 [SoupMessage]) at soup-message-io.c:916
        priv = 0xb1c4230
        io = 0x387a980
        status = 1830293024
        __PRETTY_FUNCTION__ = "io_read"
#9  0x000000336f60b98e in IA__g_closure_invoke (closure=0xe10bdd0, 
    return_value=0x0, n_param_values=1, param_values=0x7f98e0143540, 
    invocation_hint=0x7fffb56f99e0) at gclosure.c:767
        marshal = <value optimized out>
        marshal_data = <value optimized out>
        in_marshal = <value optimized out>
        __PRETTY_FUNCTION__ = "IA__g_closure_invoke"
#10 0x000000336f61f957 in signal_emit_unlocked_R (node=<value optimized out>, 
    detail=<value optimized out>, instance=<value optimized out>, 
    emission_return=<value optimized out>, 
    instance_and_params=<value optimized out>) at gsignal.c:3248
        tmp = <value optimized out>
        handler = 0xbfd7580
        accumulator = <value optimized out>
        emission = {next = 0x0, instance = 0xa175190, ihint = {signal_id = 
    421, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, 
          chain_type = 4}
        class_closure = <value optimized out>
        handler_list = 0xbfd7580
        return_accu = <value optimized out>
        accu = {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, 
              v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 
    0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, 
              v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, 
              v_pointer = 0x0}}}
        signal_id = <value optimized out>
        max_sequential_handler_number = <value optimized out>
        return_value_altered = <value optimized out>
#11 0x000000336f620df6 in IA__g_signal_emit_valist (
    instance=<value optimized out>, signal_id=<value optimized out>, 
    detail=<value optimized out>, var_args=0x7fffb56f9bd0) at gsignal.c:2981
        instance_and_params = <value optimized out>
        signal_return_type = <value optimized out>
        param_values = <value optimized out>
        node = 0x2dcf640
        i = <value optimized out>
        n_params = <value optimized out>
        __PRETTY_FUNCTION__ = "IA__g_signal_emit_valist"
#12 0x000000336f6213b3 in IA__g_signal_emit (instance=<value optimized out>, 
    signal_id=<value optimized out>, detail=<value optimized out>)
    at gsignal.c:3038
        var_args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 
    0x7fffb56f9cb0, reg_save_area = 0x7fffb56f9bf0}}
#13 0x000000338863acf1 in socket_read_watch (chan=<value optimized out>, 
    cond=<value optimized out>, user_data=0xa175190) at soup-socket.c:1245
        sock = 0xa175190 [SoupSocket]
        priv = 0xa1751b0
#14 0x000000336ea3bd02 in g_main_dispatch (context=0x22c2a50) at gmain.c:1960
        dispatch = <value optimized out>
        was_in_call = 0
        user_data = 0xa175190
        callback = 0x338863ac90 <socket_read_watch>
        cb_funcs = 0x336ecfabd0
        cb_data = <value optimized out>
        current_source_link = {data = 0xbb47380, next = 0x0}
        need_destroy = <value optimized out>
        source = 0xbb47380
        current = 0x2314150
        i = <value optimized out>
#15 IA__g_main_context_dispatch (context=0x22c2a50) at gmain.c:2513
No locals.
#16 0x000000336ea3fae8 in g_main_context_iterate (context=0x22c2a50, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2591
        max_priority = 2147483647
        timeout = 110
        some_ready = 1
        nfds = 16
        allocated_nfds = <value optimized out>
        fds = <value optimized out>
        __PRETTY_FUNCTION__ = "g_main_context_iterate"
#17 0x000000336ea3fff5 in IA__g_main_loop_run (loop=0x2322950) at gmain.c:2799
        self = 0x228cf90
        __PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#18 0x0000003772183f9b in IA__gtk_main () at gtkmain.c:1219
        tmp_list = 0x0
        functions = 0x0
        init = 0x0
        loop = 0x2322950
#19 0x00000000004310b3 in main (argc=1, argv=0x7fffb56fb088)
    at ephy-main.c:739
        option_context = <value optimized out>
        option_group = <value optimized out>
        proxy = <value optimized out>
        error = 0x0
        user_time = 57971

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list