<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [GTK] WebProcess from 2.15.91 crash in WebCore::GIFImageDecoder::haveDecodedRow()"
href="https://bugs.webkit.org/show_bug.cgi?id=169132">169132</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[GTK] WebProcess from 2.15.91 crash in WebCore::GIFImageDecoder::haveDecodedRow()
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>Other
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>WebKit Gtk
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>aperez@igalia.com
</td>
</tr>
<tr>
<th>CC</th>
<td>bugs-noreply@webkitgtk.org
</td>
</tr></table>
<p>
<div>
<pre>This could be related to <a class="bz_bug_link
bz_status_NEW "
title="NEW - [GTK] WebProcess from WebKitGtk+ 2.15.x SIGSEVs in GIFLZWContext::doLZW(unsigned char const*, unsigned long) at Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp:303"
href="show_bug.cgi?id=167304">bug #167304</a> and/or <a class="bz_bug_link
bz_status_NEW "
title="NEW - [GTK] WebProcess from WebKitGtk+ 2.15.x SIGSEGVs in GIFLZWContext::outputRow() at Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp:150"
href="show_bug.cgi?id=166838">bug #166838</a>, but the
backtrace is a bit different.
The URL which triggered the crash was:
<a href="http://www.anishathalye.com/2015/02/07/an-asynchronous-shell-prompt/">http://www.anishathalye.com/2015/02/07/an-asynchronous-shell-prompt/</a>
It does not happen all the time, only occasionally. Trying to load the
following animated GIF image directly in a new tab sometimes does not
complete loading (the missing image icon appears instead; dunno id this
is related, but mentioning it in case it helps):
<a href="http://www.anishathalye.com/media/2015/02/07/demo.gif">http://www.anishathalye.com/media/2015/02/07/demo.gif</a>
Probably not relevant: this is using 2x as scale-factor (HiDPI),
running with Epiphany from “master”.
Complete backtrace follows.
---
ImageDecoder[14220]: segfault at 54 ip 00007f607fcfdb51 sp 00007f5fceffe720 error 4 in libwebkit2gtk-4.0.so.37.19.1[7f607e52f000+2718000]
Process 14172 (WebKitWebProces) of user 1000 dumped core.
Stack trace of thread 14220:
#0 0x00007f607fcfdb51 WebCore::GIFImageDecoder::haveDecodedRow(unsigned int, WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul> const&, unsigned long, unsigned long, unsigned int, bool) (libwebkit2gtk-4.0.so.37)
#1 0x00007f607fcfe2c3 GIFLZWContext::outputRow() (libwebkit2gtk-4.0.so.37)
#2 0x00007f607fcfe80a GIFLZWContext::doLZW(unsigned char const*, unsigned long) (libwebkit2gtk-4.0.so.37)
#3 0x00007f607fcff1bf GIFFrameContext::decode(unsigned char const*, unsigned long, WebCore::GIFImageDecoder*, bool*) (libwebkit2gtk-4.0.so.37)
#4 0x00007f607fd00036 GIFImageReader::decode(WebCore::GIFImageDecoder::GIFQuery, unsigned int) (libwebkit2gtk-4.0.so.37)
#5 0x00007f607fcfd1be WebCore::GIFImageDecoder::decode(unsigned int, WebCore::GIFImageDecoder::GIFQuery) (libwebkit2gtk-4.0.so.37)
#6 0x00007f607fcfe1f3 WebCore::GIFImageDecoder::frameBufferAtIndex(unsigned long) (libwebkit2gtk-4.0.so.37)
#7 0x00007f607fcf95ae WebCore::ImageDecoder::createFrameImageAtIndex(unsigned long, WebCore::SubsamplingLevel, WebCore::DecodingMode) (libwebkit2gtk-4.0.so.37)
#8 0x00007f607f7bae0f WTF::Function<void ()>::CallableWrapper<WebCore::ImageFrameCache::startAsyncDecodingQueue()::{lambda()#1}>::call() (libwebkit2gtk-4.0.so.37)
#9 0x00007f607c525505 WTF::RunLoop::performWork() (libjavascriptcoregtk-4.0.so.18)
#10 0x00007f607c5243b9 WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) (libjavascriptcoregtk-4.0.so.18)
#11 0x00007f607601a45a g_main_context_dispatch (libglib-2.0.so.0)
#12 0x00007f607601a810 n/a (libglib-2.0.so.0)
#13 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#14 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#15 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4
#16 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#17 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#18 0x00007f607901b454 start_thread (libpthread.so.0)
#19 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14175:
#0 0x00007f607902479d __nanosleep (libpthread.so.0)
#1 0x00007f607c52a254 bmalloc::Heap::scavenge(std::unique_lock<bmalloc::StaticMutex>&, std::chrono::duration<long, std::ratio<1l, 1000l> >) (libjavascriptcoregtk-4.0.so.18)
#2 0x00007f607c52a39f bmalloc::Heap::concurrentScavenge() (libjavascriptcoregtk-4.0.so.18)
#3 0x00007f607c52b61e bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadRunLoop() (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c52b7f9 bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadEntryPoint(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607316858f execute_native_thread_routine (libstdc++.so.6)
#6 0x00007f607901b454 start_thread (libpthread.so.0)
#7 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14178:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4
#5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7 0x00007f607901b454 start_thread (libpthread.so.0)
#8 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14186:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601a8bc g_main_context_iteration (libglib-2.0.so.0)
#3 0x00007f600a9fa4bd n/a (libdconfsettings.so)
#4 0x00007f6076042175 n/a (libglib-2.0.so.0)
#5 0x00007f607901b454 start_thread (libpthread.so.0)
#6 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14189:
#0 0x00007f60728d7f19 syscall (libc.so.6)
#1 0x00007f60760600ca g_cond_wait_until (libglib-2.0.so.0)
#2 0x00007f6075feee89 n/a (libglib-2.0.so.0)
#3 0x00007f6075fef4ac g_async_queue_timeout_pop (libglib-2.0.so.0)
#4 0x00007f6076042c3d n/a (libglib-2.0.so.0)
#5 0x00007f6076042175 n/a (libglib-2.0.so.0)
#6 0x00007f607901b454 start_thread (libpthread.so.0)
#7 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14176:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601a8bc g_main_context_iteration (libglib-2.0.so.0)
#3 0x00007f607601a901 n/a (libglib-2.0.so.0)
#4 0x00007f6076042175 n/a (libglib-2.0.so.0)
#5 0x00007f607901b454 start_thread (libpthread.so.0)
#6 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14177:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3 0x00007f6076804446 n/a (libgio-2.0.so.0)
#4 0x00007f6076042175 n/a (libglib-2.0.so.0)
#5 0x00007f607901b454 start_thread (libpthread.so.0)
#6 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14185:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7 0x00007f607901b454 start_thread (libpthread.so.0)
#8 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14215:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7 0x00007f607901b454 start_thread (libpthread.so.0)
#8 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14179:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7 0x00007f607901b454 start_thread (libpthread.so.0)
#8 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14218:
#0 0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0)
#1 0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18)
#2 0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18)
#3 0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607901b454 start_thread (libpthread.so.0)
#7 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14180:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7 0x00007f607901b454 start_thread (libpthread.so.0)
#8 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14217:
#0 0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0)
#1 0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18)
#2 0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18)
#3 0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607901b454 start_thread (libpthread.so.0)
#7 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14219:
#0 0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0)
#1 0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18)
#2 0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18)
#3 0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607901b454 start_thread (libpthread.so.0)
#7 0x00007f60728dc7df __clone (libc.so.6)
Stack trace of thread 14172:
#0 0x00007f607fcfcd1e WebCore::GIFImageDecoder::clearFrameBufferCache(unsigned long) (libwebkit2gtk-4.0.so.37)
#1 0x00007f607f769b4f WebCore::BitmapImage::destroyDecodedData(bool) (libwebkit2gtk-4.0.so.37)
#2 0x00007f607eba0188 WebKit::NetworkProcessConnection::didCacheResource(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID) (libwebkit2gtk-4.0.so.37)
#3 0x00007f607ee28807 void IPC::handleMessage<Messages::NetworkProcessConnection::DidCacheResource, WebKit::NetworkProcessConnection, void (WebKit::NetworkProcessConnection::*)(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID)>(IPC::Decoder&, WebKit::NetworkProcessConnection*, void (WebKit::NetworkProcessConnection::*)(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID)) (libwebkit2gtk-4.0.so.37)
#4 0x00007f607ee27fbd WebKit::NetworkProcessConnection::didReceiveNetworkProcessConnectionMessage(IPC::Connection&, IPC::Decoder&) (libwebkit2gtk-4.0.so.37)
#5 0x00007f607ea3439b IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) (libwebkit2gtk-4.0.so.37)
#6 0x00007f607ea352c8 IPC::Connection::dispatchOneMessage() (libwebkit2gtk-4.0.so.37)
#7 0x00007f607c525505 WTF::RunLoop::performWork() (libjavascriptcoregtk-4.0.so.18)
#8 0x00007f607c5243b9 WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) (libjavascriptcoregtk-4.0.so.18)
#9 0x00007f607601a45a g_main_context_dispatch (libglib-2.0.so.0)
#10 0x00007f607601a810 n/a (libglib-2.0.so.0)
#11 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#12 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#13 0x00007f607edce5e2 int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) (libwebkit2gtk-4.0.so.37)
#14 0x00007f6072814291 __libc_start_main (libc.so.6)
#15 0x0000000000400b1a _start (WebKitWebProcess)
Stack trace of thread 14193:
#0 0x00007f60728d348d poll (libc.so.6)
#1 0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7 0x00007f607901b454 start_thread (libpthread.so.0)
#8 0x00007f60728dc7df __clone (libc.so.6)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>