Bug 18456 – segmentation fault crash on Acid3 test 64 and 79 under Linux

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: WebKitGTK

[wellofsouls]

For both WebKitQt and WebKitGtk, any browser utilizing either of them crashes at test 65 of the Acid3 test with a segmentation fault error message.

[wellofsouls]

actually it's test 64 and 79 that can cause WebKitGtk to crash with segmentation fault

[wellofsouls]

code that caused the segmentation fault in test 64:

// non-existent attributes
var test = document.createElement('p');
test.setAttribute('TWVvdywgbWV3Li4u', 'woof');

code that caused the segmentation fault in test 79:

 doc.documentElement.appendChild(e('font', { 'horiz-adv-x': '10000'}, [e('font-face', { 'font-family': 'HCl', 'units-per-em': '100', 'ascent': '1000', 'descent': '500'}), e('missing-glyph', null, [e('path', { 'd': 'M100,0 h800 v-100 h-800 z'})]), e('glyph', { 'unicode': 'A', 'd': 'M100,0 h100 v-100 h-100 z'}), e('glyph', { 'unicode': 'BC', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '200'}), e('glyph', { 'unicode': 'B', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '300'}), e('glyph', { 'unicode': 'C', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '500'}), e('glyph', { 'unicode': 'BD', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '700'}), e('glyph', { 'unicode': 'D', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '1100'}), e('glyph', { 'unicode': 'EE', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '1300',  'glyph-name': 'grapefruit'}), e('glyph', { 'unicode': 'U+0046', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '1700'}), e('glyph', { 'unicode': 'F', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '1900'}), e('glyph', { 'unicode': 'G', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '2300', 'glyph-name': 'gee'}), e('glyph', { 'unicode': '\uD800\uDC85', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '2900', 'id': 'astral'}), e('glyph', { 'unicode': 'H', 'horiz-adv-x': '3100'}, [e('path', { 'd': 'M100,0 h100 v-100 h-100 z'})]), e('glyph', { 'unicode': 'I', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '4100', 'lang': 'zh'}), e('glyph', { 'unicode': 'I', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '4300'}), e('glyph', { 'unicode': 'J', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '4700'}), e('glyph', { 'unicode': 'K', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '5300', 'orientation': 'v'}), e('glyph', { 'unicode': 'K', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '5900'}), e('glyph', { 'unicode': ' ', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '6100', 'glyph-name': 'L'}), e('glyph', { 'unicode': 'L', 'd': 'M100,0 h100 v-100 h-100 z', 'horiz-adv-x': '6700', 'glyph-name': 'space'}), e('hkern', { 'u1': 'A', 'u2': 'EE', 'k': '1000'}), e('hkern', { 'u1': 'A', 'g2': 'grapefruit', 'k': '-200'}), e('hkern', { 'u1': 'U+0046', 'u2': 'U+0046', 'k': '-200'}), e('hkern', { 'u1': 'U+0047-0047', 'g2': 'gee', 'k': '-200'}), e('hkern', { 'u1': 'J', 'u2': 'A', 'k': '4700'})]));
      doc.documentElement.appendChild(e('text', { 'y': '100', 'font-family': 'HCl', 'font-size': '100px', 'letter-spacing': '0px', 'word-spacing': '0px'}, ['ABCBDAEEU+0046U+0046GGHI', e('tspan', { 'xml:lang': 'zh'}, ['I']), 'JAK L', e('altGlyph', { 'xlink:href': '#astral'}, ['A']), '\uD800\uDC85A']));

[wellofsouls]

Created attachment 20523 [details]
modified acid3 test 

Acid3 test with the parts that cause the segmentation faults commented out, still WebKitGtk and WebKitQt can't reach 100/100 though.

[Mark Rowe (bdash)]

Which revision of WebKit?  What CPU architecture?  What compiler version?

[wellofsouls]

> Which revision of WebKit?  What CPU architecture?  What compiler version?

all the latest revisions, from as far back as 314xx (can't remember exactly) to (currently tested) 31860. I do recall 312xx from the end of March didn't have this problem.

x86 CPU, gcc 4.3.0

[wellofsouls]

I've tried the latest 31896 revision, and it's still the same segmentation fault probelms. Interestingly, WebKitQt only crashes at test 64, while unaffected by test 79, but only scores 88/100 at the modified Acid3. WebKitGtk crashes at both test 64 and test 79, but scores 90/100 at the modified Acid3.

[wellofsouls]

Created attachment 20550 [details]
part of test 64 that makes WebKitGtk and WebKitQt crash

[wellofsouls]

Created attachment 20551 [details]
part of test 79 that makes WebKitGtk crash

[wellofsouls]

Created attachment 20552 [details]
the svg.xml that's needed for test 79

[ossh4x]

My backtrace for segfault at 64% on acid3...
(without fast-malloc, it still bombs after adopt() at the same place)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb567a8e0 (LWP 25866)]
0xb7eb4e4f in WTF::fastMalloc () from /usr/lib/libwebkit-1.0.so.1
(gdb) backtrace
#0  0xb7eb4e4f in WTF::fastMalloc () from /usr/lib/libwebkit-1.0.so.1
#1  0xb7bd90d6 in WebCore::StringImpl::adopt () from /usr/lib/libwebkit-1.0.so.1
#2  0xb7bd97ab in WebCore::StringImpl::lower () from /usr/lib/libwebkit-1.0.so.1
#3  0xb7bd3d33 in WebCore::String::lower () from /usr/lib/libwebkit-1.0.so.1
#4  0xb7a3b945 in WebCore::Element::removeAttribute () from /usr/lib/libwebkit-1.0.so.1
#5  0xb7df4929 in WebCore::jsElementPrototypeFunctionRemoveAttribute () from /usr/lib/libwebkit-1.0.so.1
#6  0xb7ea779e in KJS::PrototypeFunction::callAsFunction () from /usr/lib/libwebkit-1.0.so.1
#7  0xb7ed42c2 in KJS::JSObject::call () from /usr/lib/libwebkit-1.0.so.1
#8  0xb7eedbd0 in KJS::FunctionCallDotNode::evaluate () from /usr/lib/libwebkit-1.0.so.1
#9  0xb7ee497b in KJS::ExprStatementNode::execute () from /usr/lib/libwebkit-1.0.so.1
#10 0xb7ea9115 in KJS::BlockNode::execute () from /usr/lib/libwebkit-1.0.so.1
#11 0xb7ef868c in KJS::FunctionImp::callAsFunction () from /usr/lib/libwebkit-1.0.so.1
#12 0xb7ed42c2 in KJS::JSObject::call () from /usr/lib/libwebkit-1.0.so.1
#13 0xb79b787e in WebCore::ScheduledAction::execute () from /usr/lib/libwebkit-1.0.so.1
#14 0xb799bd29 in WebCore::JSDOMWindowBase::timerFired () from /usr/lib/libwebkit-1.0.so.1
#15 0xb799bf14 in WebCore::DOMWindowTimer::fired () from /usr/lib/libwebkit-1.0.so.1
#16 0xb7bdea7c in WebCore::TimerBase::fireTimers () from /usr/lib/libwebkit-1.0.so.1
#17 0xb7bdeb38 in WebCore::TimerBase::sharedTimerFired () from /usr/lib/libwebkit-1.0.so.1
#18 0xb797f285 in WebCore::timeout_cb () from /usr/lib/libwebkit-1.0.so.1
#19 0xb6db06b6 in g_timeout_dispatch () from /usr/lib/libglib-2.0.so.0
#20 0xb6daff88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#21 0xb6db34eb in g_main_context_iterate () from /usr/lib/libglib-2.0.so.0
#22 0xb6db39ba in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#23 0xb718cb19 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#24 0x0807bdb8 in main ()

[Audren Cezar]

using: 
WebKit-r34153.tar.bz2 
'''
./autogen.sh --prefix=/usr --enable-svg-experimental --with-http-backend=soup --with-font-backend=pango --with-target=x11 --enable-svg-animation --enable-fast-malloc --enable-video --enable-debug
'''
I have "segmentation fault" msg too when i run acid3 test around 60.

[Audren Cezar]

Created attachment 21431 [details]
log of debug message

Linux negresco 2.6.25-ARCH #1 SMP PREEMPT Fri May 16 14:52:43 CEST 2008 i686 AMD Sempron(tm) Processor 2500+ AuthenticAMD GNU/Linux.
gcc 4.3.0-1

In my last test i run nightly build WebKit-r34153.tar.bz2
With some build options (every crash on test):
----------------------------------------------------------
  ./autogen.sh --prefix=/usr \
   --enable-offline-web-applications=no \
   --enable-dom-storage=no \
   --enable-database=no \
   --enable-icon-database=no \
   --enable-video=no \
   --enable-xpath=no \
   --enable-xslt=no \
   --enable-svg=no \
   --enable-fast-malloc=no \
   --enable-dashboard-support=no \
   --with-gnu-ld=yes --enable-debug
----------------------------------------------------------
  ./autogen.sh --prefix=/usr \
  --disable-debug \
  --enable-dashboard-support \
  --enable-offline-web-applications \
  --enable-dom-storage \
  --enable-database \
  --enable-icon-database \
  --enable-video \
  --enable-xpath \
  --enable-xslt \
  --enable-svg \
  --enable-svg-animation \
  --enable-svg-filters \
  --enable-svg-fonts \
  --enable-svg-foreign-object \
  --enable-svg-as-image  \
  --enable-svg-use-element \
  --disable-coverage \
  --enable-fast-malloc \
  --with-target=x11 \
  --without-hildon \
  --with-http-backend=curl \
  --with-font-backend=pango
--------------------------------------------------------------
  ./autogen.sh --prefix=/usr \
  --enable-debug \
  --disable-dashboard-support \
  --disable-offline-web-applications \
  --disable-dom-storage \
  --disable-database \
  --disable-icon-database \
  --disable-video \
  --enable-xpath \
  --enable-xslt \
  --enable-svg \
  --disable-svg-animation \
  --disable-svg-filters \
  --disable-svg-fonts \
  --disable-svg-foreign-object \
  --disable-svg-as-image  \
  --disable-svg-use-element \
  --disable-coverage \
  --enable-fast-malloc \
  --with-target=x11 \
  --without-hildon \
  --with-http-backend=curl \
  --with-font-backend=pango

[Alexander Butenko]

webkit passing acid3 now. I think bug is already fixed. 

[Audren Cezar]

(In reply to comment #13)
> webkit passing acid3 now. I think bug is already fixed. 
> 

Yes, I believe too.

Now I see 100/100 without crash!

[Dirk Schulze]

It works for me too and I haven't heard of crashes for a long time now. Please reopen the bug if someone still see a crash.

[Michael Catanzaro]

*** Bug 18696 has been marked as a duplicate of this bug. ***