[Webkit-unassigned] [Bug 186206] [GTK] WebKit::CoordinatedBackingStoreTile::setBackBuffer(): WebKitWebProcess killed by SIGSEGV

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=186206

--- Comment #4 from Michael Catanzaro <mcatanzaro at igalia.com> ---
There's currently no working debuginfo in the flatpak, so no way to know if it's the same crash. And even if there was, getting a backtrace out of a flatpak is far from straightforward. 2.20.2 is the latest stable release, so knowing that's affected should suffice.

Crashes like these are often not reproducible, but random occurrences, so code analysis will be required to figure it out. My first impressions:

#0  0x00007fa8cabca5a9 in WebKit::CoordinatedBackingStoreTile::setBackBuffer (this=0x8, tileRect=..., sourceRect=..., buffer=..., offset=...)
    at /usr/src/debug/webkit2gtk3-2.20.2-1.fc28.x86_64/Source/WebKit/Shared/CoordinatedGraphics/CoordinatedBackingStore.cpp:58
No locals.

The this=0x8 is suspicious. Not very likely that valid memory is allocated at address 8. It's probably being used after it was already destroyed. But after skimming CoordinatedBackingStore.cpp, I'm not sure how this could happen.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180602/17f4fa94/attachment-0001.html>