169132 2017-03-03 07:15:02 -0800 [GTK] WebProcess from 2.15.91 crash in WebCore::GIFImageDecoder::haveDecodedRow() 2017-03-06 10:30:10 -0800 1 1 1 Unclassified WebKit WebKitGTK Other Unspecified Unspecified RESOLVED DUPLICATE 169199 https://bugs.webkit.org/show_bug.cgi?id=167304 P2 Normal --- 1 aperez webkit-unassigned agomez bugs-noreply mcatanzaro oldest_to_newest 1283148 0 aperez 2017-03-03 07:15:02 -0800 This could be related to bug #167304 and/or bug #166838, but the backtrace is a bit different. The URL which triggered the crash was: http://www.anishathalye.com/2015/02/07/an-asynchronous-shell-prompt/ It does not happen all the time, only occasionally. Trying to load the following animated GIF image directly in a new tab sometimes does not complete loading (the missing image icon appears instead; dunno id this is related, but mentioning it in case it helps): http://www.anishathalye.com/media/2015/02/07/demo.gif Probably not relevant: this is using 2x as scale-factor (HiDPI), running with Epiphany from “master”. Complete backtrace follows. --- ImageDecoder[14220]: segfault at 54 ip 00007f607fcfdb51 sp 00007f5fceffe720 error 4 in libwebkit2gtk-4.0.so.37.19.1[7f607e52f000+2718000] Process 14172 (WebKitWebProces) of user 1000 dumped core. Stack trace of thread 14220: #0 0x00007f607fcfdb51 WebCore::GIFImageDecoder::haveDecodedRow(unsigned int, WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul> const&, unsigned long, unsigned long, unsigned int, bool) (libwebkit2gtk-4.0.so.37) #1 0x00007f607fcfe2c3 GIFLZWContext::outputRow() (libwebkit2gtk-4.0.so.37) #2 0x00007f607fcfe80a GIFLZWContext::doLZW(unsigned char const*, unsigned long) (libwebkit2gtk-4.0.so.37) #3 0x00007f607fcff1bf GIFFrameContext::decode(unsigned char const*, unsigned long, WebCore::GIFImageDecoder*, bool*) (libwebkit2gtk-4.0.so.37) #4 0x00007f607fd00036 GIFImageReader::decode(WebCore::GIFImageDecoder::GIFQuery, unsigned int) (libwebkit2gtk-4.0.so.37) #5 0x00007f607fcfd1be WebCore::GIFImageDecoder::decode(unsigned int, WebCore::GIFImageDecoder::GIFQuery) (libwebkit2gtk-4.0.so.37) #6 0x00007f607fcfe1f3 WebCore::GIFImageDecoder::frameBufferAtIndex(unsigned long) (libwebkit2gtk-4.0.so.37) #7 0x00007f607fcf95ae WebCore::ImageDecoder::createFrameImageAtIndex(unsigned long, WebCore::SubsamplingLevel, WebCore::DecodingMode) (libwebkit2gtk-4.0.so.37) #8 0x00007f607f7bae0f WTF::Function<void ()>::CallableWrapper<WebCore::ImageFrameCache::startAsyncDecodingQueue()::{lambda()#1}>::call() (libwebkit2gtk-4.0.so.37) #9 0x00007f607c525505 WTF::RunLoop::performWork() (libjavascriptcoregtk-4.0.so.18) #10 0x00007f607c5243b9 WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) (libjavascriptcoregtk-4.0.so.18) #11 0x00007f607601a45a g_main_context_dispatch (libglib-2.0.so.0) #12 0x00007f607601a810 n/a (libglib-2.0.so.0) #13 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #14 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #15 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4 #16 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #17 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #18 0x00007f607901b454 start_thread (libpthread.so.0) #19 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14175: #0 0x00007f607902479d __nanosleep (libpthread.so.0) #1 0x00007f607c52a254 bmalloc::Heap::scavenge(std::unique_lock<bmalloc::StaticMutex>&, std::chrono::duration<long, std::ratio<1l, 1000l> >) (libjavascriptcoregtk-4.0.so.18) #2 0x00007f607c52a39f bmalloc::Heap::concurrentScavenge() (libjavascriptcoregtk-4.0.so.18) #3 0x00007f607c52b61e bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadRunLoop() (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c52b7f9 bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadEntryPoint(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607316858f execute_native_thread_routine (libstdc++.so.6) #6 0x00007f607901b454 start_thread (libpthread.so.0) #7 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14178: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4 #5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #7 0x00007f607901b454 start_thread (libpthread.so.0) #8 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14186: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601a8bc g_main_context_iteration (libglib-2.0.so.0) #3 0x00007f600a9fa4bd n/a (libdconfsettings.so) #4 0x00007f6076042175 n/a (libglib-2.0.so.0) #5 0x00007f607901b454 start_thread (libpthread.so.0) #6 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14189: #0 0x00007f60728d7f19 syscall (libc.so.6) #1 0x00007f60760600ca g_cond_wait_until (libglib-2.0.so.0) #2 0x00007f6075feee89 n/a (libglib-2.0.so.0) #3 0x00007f6075fef4ac g_async_queue_timeout_pop (libglib-2.0.so.0) #4 0x00007f6076042c3d n/a (libglib-2.0.so.0) #5 0x00007f6076042175 n/a (libglib-2.0.so.0) #6 0x00007f607901b454 start_thread (libpthread.so.0) #7 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14176: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601a8bc g_main_context_iteration (libglib-2.0.so.0) #3 0x00007f607601a901 n/a (libglib-2.0.so.0) #4 0x00007f6076042175 n/a (libglib-2.0.so.0) #5 0x00007f607901b454 start_thread (libpthread.so.0) #6 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14177: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f6076804446 n/a (libgio-2.0.so.0) #4 0x00007f6076042175 n/a (libglib-2.0.so.0) #5 0x00007f607901b454 start_thread (libpthread.so.0) #6 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14185: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #7 0x00007f607901b454 start_thread (libpthread.so.0) #8 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14215: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #7 0x00007f607901b454 start_thread (libpthread.so.0) #8 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14179: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #7 0x00007f607901b454 start_thread (libpthread.so.0) #8 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14218: #0 0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18) #2 0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18) #3 0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607901b454 start_thread (libpthread.so.0) #7 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14180: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #7 0x00007f607901b454 start_thread (libpthread.so.0) #8 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14217: #0 0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18) #2 0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18) #3 0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607901b454 start_thread (libpthread.so.0) #7 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14219: #0 0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18) #2 0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18) #3 0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607901b454 start_thread (libpthread.so.0) #7 0x00007f60728dc7df __clone (libc.so.6) Stack trace of thread 14172: #0 0x00007f607fcfcd1e WebCore::GIFImageDecoder::clearFrameBufferCache(unsigned long) (libwebkit2gtk-4.0.so.37) #1 0x00007f607f769b4f WebCore::BitmapImage::destroyDecodedData(bool) (libwebkit2gtk-4.0.so.37) #2 0x00007f607eba0188 WebKit::NetworkProcessConnection::didCacheResource(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID) (libwebkit2gtk-4.0.so.37) #3 0x00007f607ee28807 void IPC::handleMessage<Messages::NetworkProcessConnection::DidCacheResource, WebKit::NetworkProcessConnection, void (WebKit::NetworkProcessConnection::*)(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID)>(IPC::Decoder&, WebKit::NetworkProcessConnection*, void (WebKit::NetworkProcessConnection::*)(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID)) (libwebkit2gtk-4.0.so.37) #4 0x00007f607ee27fbd WebKit::NetworkProcessConnection::didReceiveNetworkProcessConnectionMessage(IPC::Connection&, IPC::Decoder&) (libwebkit2gtk-4.0.so.37) #5 0x00007f607ea3439b IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) (libwebkit2gtk-4.0.so.37) #6 0x00007f607ea352c8 IPC::Connection::dispatchOneMessage() (libwebkit2gtk-4.0.so.37) #7 0x00007f607c525505 WTF::RunLoop::performWork() (libjavascriptcoregtk-4.0.so.18) #8 0x00007f607c5243b9 WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) (libjavascriptcoregtk-4.0.so.18) #9 0x00007f607601a45a g_main_context_dispatch (libglib-2.0.so.0) #10 0x00007f607601a810 n/a (libglib-2.0.so.0) #11 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #12 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #13 0x00007f607edce5e2 int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) (libwebkit2gtk-4.0.so.37) #14 0x00007f6072814291 __libc_start_main (libc.so.6) #15 0x0000000000400b1a _start (WebKitWebProcess) Stack trace of thread 14193: #0 0x00007f60728d348d poll (libc.so.6) #1 0x00007f607601a7a6 n/a (libglib-2.0.so.0) #2 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18) #4 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18) #5 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #6 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18) #7 0x00007f607901b454 start_thread (libpthread.so.0) #8 0x00007f60728dc7df __clone (libc.so.6) 1283151 1 agomez 2017-03-03 07:43:13 -0800 I can reproduce the BT in bug 167304 with this GIF. I cannot reproduce it 100% but: * Sometimes the GIF doesn't charge (appears the broken image icon). * After a while retrying (reloading), the GIF may charge. * If I keep reloading, eventually the WebProcess SIGSEVs 1283816 2 mcatanzaro 2017-03-06 10:30:10 -0800 *** This bug has been marked as a duplicate of bug 169199 ***