[Webkit-unassigned] [Bug 179914] WebProcess from WebKitGtk+ 2.19.2 SIGSEVs in bmalloc::IsoTLS::ensureEntries(unsigned int) at Source/bmalloc/bmalloc/IsoTLS.cpp:80

Thu Nov 30 01:08:46 PST 2017

https://bugs.webkit.org/show_bug.cgi?id=179914

Milan Crha <mcrha at redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mcrha at redhat.com

--- Comment #11 from Milan Crha <mcrha at redhat.com> ---
Right, I have the checkout at
    commit 59f33e1bb10a912c57479fab2f6bf7dc82bccea6
    [CoordGraphics] Rename CoordinatedBuffer to Nicosia::Buffer
    https://bugs.webkit.org/show_bug.cgi?id=180135

and it's still crashing, but this time in a different place, because the initial issue had been fixed with changes for bug #179463.

I added some debug prints around the code and I see that IsoTLS::get() is called three times before it's initialized, before it crashes. Unfortunately, I do not have debug symbols compiled, I'll retry, but no promises, because the last time I tried gdb didn't like it. I'll see.

   0x7fda5dce4ac0 get: not initialized
#2  0x00007fda5cc3adc8 in bmalloc::IsoTLS::get() [clone .part.118] () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#3  0x00007fda5cc4decd in WebCore::RenderView::operator new(unsigned long) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#4  0x00007fda5c4ee862 in WebCore::Document::createRenderTree() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#5  0x00007fda5c5002e0 in WebCore::Document::didBecomeCurrentDocumentInFrame() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#6  0x00007fda5c87810a in WebCore::Frame::setDocument(WTF::RefPtr<WebCore::Document>&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#7  0x00007fda5c7b93ad in WebCore::DocumentWriter::begin(WebCore::URL const&, bool, WebCore::Document*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#8  0x00007fda5c7b96fd in WebCore::DocumentLoader::commitData(char const*, unsigned long) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#9  0x00007fda5c7b9e0c in WebCore::DocumentLoader::finishedLoading() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fda5c7bbd39 in WebCore::DocumentLoader::maybeLoadEmpty() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#11 0x00007fda5c7bd3fc in WebCore::DocumentLoader::startLoadingMainResource() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#12 0x00007fda5c7cb2f3 in WebCore::FrameLoader::init() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#13 0x00007fda5bb9f6ec in WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#14 0x00007fda5bbb55f7 in WebKit::WebPage::WebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#15 0x00007fda5bbb5e5e in WebKit::WebPage::create(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#16 0x00007fda5bb0a358 in WebKit::WebProcess::createWebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#17 0x00007fda5bd9bcf7 in void IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)>(IPC::Decoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#18 0x00007fda5bd982c3 in WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&, IPC::Decoder&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#19 0x00007fda5b9b31fb in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#20 0x00007fda5b9b3a78 in IPC::Connection::dispatchOneMessage() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#21 0x00007fda582c06dd in WTF::RunLoop::performWork() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#22 0x00007fda582e6d49 in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#23 0x00007fda587c5bb7 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#24 0x00007fda587c5f60 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#25 0x00007fda587c6272 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#26 0x00007fda582e7688 in WTF::RunLoop::run() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#27 0x00007fda5bd35b08 in int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#28 0x00007fda5ad0003a in __libc_start_main () at /lib64/libc.so.6
#29 0x000000000040086a in _start ()

   0x7fda5dce4ac0 get: not initialized
#2  0x00007fda5cc3adc8 in bmalloc::IsoTLS::get() [clone .part.118] () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#3  0x00007fda5cc54005 in bmalloc::IsoTLS* bmalloc::IsoTLS::ensureHeapAndEntries<WebCore::RenderView>(bmalloc::api::IsoHeap<WebCore::RenderView>&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#4  0x00007fda5cc555be in void* bmalloc::IsoTLS::allocateSlow<bmalloc::IsoConfig<560u>, WebCore::RenderView>(bmalloc::api::IsoHeap<WebCore::RenderView>&, bool) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#5  0x00007fda5c4ee862 in WebCore::Document::createRenderTree() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#6  0x00007fda5c5002e0 in WebCore::Document::didBecomeCurrentDocumentInFrame() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#7  0x00007fda5c87810a in WebCore::Frame::setDocument(WTF::RefPtr<WebCore::Document>&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#8  0x00007fda5c7b93ad in WebCore::DocumentWriter::begin(WebCore::URL const&, bool, WebCore::Document*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#9  0x00007fda5c7b96fd in WebCore::DocumentLoader::commitData(char const*, unsigned long) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fda5c7b9e0c in WebCore::DocumentLoader::finishedLoading() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#11 0x00007fda5c7bbd39 in WebCore::DocumentLoader::maybeLoadEmpty() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#12 0x00007fda5c7bd3fc in WebCore::DocumentLoader::startLoadingMainResource() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#13 0x00007fda5c7cb2f3 in WebCore::FrameLoader::init() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#14 0x00007fda5bb9f6ec in WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#15 0x00007fda5bbb55f7 in WebKit::WebPage::WebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#16 0x00007fda5bbb5e5e in WebKit::WebPage::create(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#17 0x00007fda5bb0a358 in WebKit::WebProcess::createWebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#18 0x00007fda5bd9bcf7 in void IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)>(IPC::Decoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#19 0x00007fda5bd982c3 in WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&, IPC::Decoder&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#20 0x00007fda5b9b31fb in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#21 0x00007fda5b9b3a78 in IPC::Connection::dispatchOneMessage() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#22 0x00007fda582c06dd in WTF::RunLoop::performWork() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#23 0x00007fda582e6d49 in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#24 0x00007fda587c5bb7 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#25 0x00007fda587c5f60 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#26 0x00007fda587c6272 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#27 0x00007fda582e7688 in WTF::RunLoop::run() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#28 0x00007fda5bd35b08 in int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#29 0x00007fda5ad0003a in __libc_start_main () at /lib64/libc.so.6
#30 0x000000000040086a in _start ()

   0x7fda5dce4ac0 get: not initialized
#2  0x00007fda582f1008 in bmalloc::IsoTLS::get() [clone .part.15] () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#3  0x00007fda582f16e5 in bmalloc::IsoTLS::ensureEntries(unsigned int) () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#4  0x00007fda5cc555be in void* bmalloc::IsoTLS::allocateSlow<bmalloc::IsoConfig<560u>, WebCore::RenderView>(bmalloc::api::IsoHeap<WebCore::RenderView>&, bool) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#5  0x00007fda5c4ee862 in WebCore::Document::createRenderTree() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#6  0x00007fda5c5002e0 in WebCore::Document::didBecomeCurrentDocumentInFrame() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#7  0x00007fda5c87810a in WebCore::Frame::setDocument(WTF::RefPtr<WebCore::Document>&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#8  0x00007fda5c7b93ad in WebCore::DocumentWriter::begin(WebCore::URL const&, bool, WebCore::Document*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#9  0x00007fda5c7b96fd in WebCore::DocumentLoader::commitData(char const*, unsigned long) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fda5c7b9e0c in WebCore::DocumentLoader::finishedLoading() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#11 0x00007fda5c7bbd39 in WebCore::DocumentLoader::maybeLoadEmpty() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#12 0x00007fda5c7bd3fc in WebCore::DocumentLoader::startLoadingMainResource() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#13 0x00007fda5c7cb2f3 in WebCore::FrameLoader::init() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#14 0x00007fda5bb9f6ec in WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#15 0x00007fda5bbb55f7 in WebKit::WebPage::WebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#16 0x00007fda5bbb5e5e in WebKit::WebPage::create(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#17 0x00007fda5bb0a358 in WebKit::WebProcess::createWebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#18 0x00007fda5bd9bcf7 in void IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)>(IPC::Decoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#19 0x00007fda5bd982c3 in WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&, IPC::Decoder&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#20 0x00007fda5b9b31fb in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#21 0x00007fda5b9b3a78 in IPC::Connection::dispatchOneMessage() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#22 0x00007fda582c06dd in WTF::RunLoop::performWork() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#23 0x00007fda582e6d49 in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#24 0x00007fda587c5bb7 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#25 0x00007fda587c5f60 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#26 0x00007fda587c6272 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#27 0x00007fda582e7688 in WTF::RunLoop::run() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#28 0x00007fda5bd35b08 in int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#29 0x00007fda5ad0003a in __libc_start_main () at /lib64/libc.so.6
#30 0x000000000040086a in _start ()

   0x7fda5dce4ac0 operator(): using pthread_key_create(), key:0x11
   0x7fda5dce4ac0 get: got-tls:(nil)
   0x7fda5dce4ac0 ensureEntries: offset:136 got-tls:(nil) oldlast:(nil) layout.head():(nil)
   0x7fda5dce4ac0 set: setting-tls:0x7fda5dd34000 to key:0x11

#3  0x00007fda582e4086 in WTF::jscSignalHandler(int, siginfo_t*, void*) () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#4  0x00007fda5ad16720 in <signal handler called> () at /lib64/libc.so.6
#5  0x00007fda5cc55342 in bmalloc::IsoAllocator<bmalloc::IsoConfig<560u> >::allocateSlow(bool) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#6  0x00007fda5c4ee862 in WebCore::Document::createRenderTree() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#7  0x00007fda5c5002e0 in WebCore::Document::didBecomeCurrentDocumentInFrame() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#8  0x00007fda5c87810a in WebCore::Frame::setDocument(WTF::RefPtr<WebCore::Document>&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#9  0x00007fda5c7b93ad in WebCore::DocumentWriter::begin(WebCore::URL const&, bool, WebCore::Document*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fda5c7b96fd in WebCore::DocumentLoader::commitData(char const*, unsigned long) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#11 0x00007fda5c7b9e0c in WebCore::DocumentLoader::finishedLoading() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#12 0x00007fda5c7bbd39 in WebCore::DocumentLoader::maybeLoadEmpty() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#13 0x00007fda5c7bd3fc in WebCore::DocumentLoader::startLoadingMainResource() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#14 0x00007fda5c7cb2f3 in WebCore::FrameLoader::init() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#15 0x00007fda5bb9f6ec in WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#16 0x00007fda5bbb55f7 in WebKit::WebPage::WebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#17 0x00007fda5bbb5e5e in WebKit::WebPage::create(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#18 0x00007fda5bb0a358 in WebKit::WebProcess::createWebPage(unsigned long, WebKit::WebPageCreationParameters&&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#19 0x00007fda5bd9bcf7 in void IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)>(IPC::Decoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long, WebKit::WebPageCreationParameters&&)) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#20 0x00007fda5bd982c3 in WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&, IPC::Decoder&) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#21 0x00007fda5b9b31fb in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#22 0x00007fda5b9b3a78 in IPC::Connection::dispatchOneMessage() () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#23 0x00007fda582c06dd in WTF::RunLoop::performWork() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#24 0x00007fda582e6d49 in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#25 0x00007fda587c5bb7 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#26 0x00007fda587c5f60 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#27 0x00007fda587c6272 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#28 0x00007fda582e7688 in WTF::RunLoop::run() () at /build/test-wk2/lib/libjavascriptcoregtk-4.0.so.18
#29 0x00007fda5bd35b08 in int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) () at /build/test-wk2/lib/libwebkit2gtk-4.0.so.37
#30 0x00007fda5ad0003a in __libc_start_main () at /lib64/libc.so.6
#31 0x000000000040086a in _start ()

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171130/ea309d19/attachment-0001.html>