120246 2013-08-24 02:35:44 -0700 REGRESSION(r154498): Crashes on EFL, GTK, Qt on release configurations 2013-08-24 13:06:17 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 79668 120143 1 zan oliver barraclough benjamin cdumez cgarcia cmarcelo commit-queue eflews.bot gyuyoung.kim kadam oliver ossy zarvai oldest_to_newest 920559 0 zan 2013-08-24 02:35:44 -0700 Crashes are occurring when running JSC and layout tests on the EFL, GTK and Qt ports after r154498. http://trac.webkit.org/changeset/154498 http://build.webkit.org/builders/GTK%20Linux%2064-bit%20Release/builds/40093 http://build.webkit.org/builders/EFL%20Linux%2064-bit%20Release%20WK1/builds/1428 http://build.webkit.org/builders/Qt%20Linux%20Release/builds/62368 The crashes are occurring only on release builds due to the TcMalloc use being enforced under that configuration. The crashes disappear if ENABLE_GLOBAL_FASTMALLOC_NEW is defined to 1, or if the system malloc is also enforced for the release configuration. All the affected ports set this define to 0 (and so does the AppleWin port, but it doesn't currently build so I can't confirm crashes there). Disabling the optimizations shows that the crash occurs in WTF::deleteOwnedPtr<WTF::CompressedVector<JSC::ExpressionRangeInfo> >(WTF::CompressedVector<JSC::ExpressionRangeInfo>*), due to the `delete ptr` call. The crash occurs because the pointer was allocated through fastMalloc (in GenericCompressedData::create), but is being freed as if it were allocated by the system malloc on the affected systems. fastFree() should be used instead. 920560 1 209536 zan 2013-08-24 02:39:31 -0700 Created attachment 209536 Possible fix Instead of calling m_compressedData.clear(), its leaked pointer is fastFree()d. Not putting this up for a review yet because I'm not sure of the validity of the approach. 920630 2 oliver 2013-08-24 12:53:10 -0700 Oh, i'm a muppet -- what happens if GenericCompreesedData gets the WTF_MAKE_FAST_ALLOC or whatever it is macro? 920634 3 209553 oliver 2013-08-24 13:00:25 -0700 Created attachment 209553 Patch 920637 4 209553 eflews.bot 2013-08-24 13:05:37 -0700 Comment on attachment 209553 Patch Attachment 209553 did not pass efl-wk2-ews (efl-wk2): Output: http://webkit-queues.appspot.com/results/1543735 920638 5 oliver 2013-08-24 13:06:17 -0700 Committed r154552: <http://trac.webkit.org/changeset/154552> 209536 2013-08-24 02:39:31 -0700 2013-08-24 13:00:15 -0700 Possible fix ffreeee text/plain 571 zan ZGlmZiAtLWdpdCBhL1NvdXJjZS9XVEYvd3RmL0NvbXByZXNzaW9uLmggYi9Tb3VyY2UvV1RGL3d0 Zi9Db21wcmVzc2lvbi5oCmluZGV4IDE2MGQ0MTAuLmFjODU0NjkgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XVEYvd3RmL0NvbXByZXNzaW9uLmgKKysrIGIvU291cmNlL1dURi93dGYvQ29tcHJlc3Npb24u aApAQCAtMTMzLDcgKzEzMyw5IEBAIHByaXZhdGU6CiAgICAgICAgIGlmICghbV9jb21wcmVzc2Vk RGF0YSkKICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgbV9jb21wcmVzc2VkRGF0YS0+ZGVj b21wcmVzcyhtX2RlY29tcHJlc3NlZERhdGEpOwotICAgICAgICBtX2NvbXByZXNzZWREYXRhLmNs ZWFyKCk7CisKKyAgICAgICAgQ29tcHJlc3NlZFZlY3RvcjxUPiogY29tcHJlc3NlZERhdGEgPSBt X2NvbXByZXNzZWREYXRhLmxlYWtQdHIoKTsKKyAgICAgICAgZmFzdEZyZWUoY29tcHJlc3NlZERh dGEpOwogICAgIH0KICAgICBtdXRhYmxlIFZlY3RvcjxUPiBtX2RlY29tcHJlc3NlZERhdGE7CiAg ICAgbXV0YWJsZSBPd25QdHI8Q29tcHJlc3NlZFZlY3RvcjxUPiA+IG1fY29tcHJlc3NlZERhdGE7 Cg== 209553 2013-08-24 13:00:25 -0700 2013-08-24 13:05:37 -0700 Patch bug-120246-20130824130024.patch text/plain 1256 oliver U3VidmVyc2lvbiBSZXZpc2lvbjogMTU0NTUwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IGQwZDA4NTA0Y2UxZGFjMDQxZjYzMTMz Y2QwMzY1ZTUyZTA4N2M1ZjguLjAzOGEwODFhMDAxNmFhODk1MGI0ODA4NmQ0ZGE2Y2E5NGM2YWM3 YTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTMtMDgtMjQgIE9saXZlciBIdW50ICA8b2xpdmVy QGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OKHIxNTQ0OTgpOiBDcmFzaGVzIG9uIEVG TCwgR1RLLCBRdCBvbiByZWxlYXNlIGNvbmZpZ3VyYXRpb25zCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMjAyNDYKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBVbmRlc3Ryb3kgYWxsIHRoZSBwbGF0Zm9ybXMg dGhhdCBkb24ndCB1c2UgdGhlIGdsb2JhbCBuZXcgb3ZlcmxvYWQKKworICAgICAgICAqIHd0Zi9D b21wcmVzc2lvbi5oOgorCiAyMDEzLTA4LTIxICBNYXJrIFJvd2UgIDxtcm93ZUBhcHBsZS5jb20+ CiAKICAgICAgICAgPGh0dHBzOi8vd2Via2l0Lm9yZy9iLzEyMDE0MT4gTWFrZSBSZXRhaW5QdHIg d29yayB3aXRoIEFSQy4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XVEYvd3RmL0NvbXByZXNzaW9uLmgg Yi9Tb3VyY2UvV1RGL3d0Zi9Db21wcmVzc2lvbi5oCmluZGV4IDE2MGQ0MTA5MDY2YWI0NDI3YzE2 MDBkNmRmMTc1Y2VmMzBiMjMxZGEuLjhjOGE0Yzc4OTcxMWI5MzYwYjNmNzk4MTg3ZDc1MTRkM2Rk MWQ4YWQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvd3RmL0NvbXByZXNzaW9uLmgKKysrIGIvU291 cmNlL1dURi93dGYvQ29tcHJlc3Npb24uaApAQCAtMzMsNiArMzMsNyBAQCBuYW1lc3BhY2UgV1RG IHsKIAogY2xhc3MgR2VuZXJpY0NvbXByZXNzZWREYXRhIHsKICAgICBXVEZfTUFLRV9OT05DT1BZ QUJMRShHZW5lcmljQ29tcHJlc3NlZERhdGEpCisgICAgV1RGX01BS0VfRkFTVF9BTExPQ0FURUQ7 CiBwdWJsaWM6CiAgICAgV1RGX0VYUE9SVF9QUklWQVRFIHN0YXRpYyBQYXNzT3duUHRyPEdlbmVy aWNDb21wcmVzc2VkRGF0YT4gY3JlYXRlKGNvbnN0IHVpbnQ4X3QqLCBzaXplX3QpOwogICAgIHVp bnQzMl90IGNvbXByZXNzZWRTaXplKCkgY29uc3QgeyByZXR1cm4gbV9jb21wcmVzc2VkU2l6ZTsg fQo=