181581 2018-01-11 23:05:18 -0800 [GTK] Crash in JSC JSValueIsNumber 2018-01-16 06:11:04 -0800 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build PC Linux RESOLVED DUPLICATE 181438 Gtk P3 Normal --- 1 mike webkit-unassigned bugs-noreply mcatanzaro oldest_to_newest 1388717 0 mike 2018-01-11 23:05:18 -0800 I just noticed Geary built by flatpak against gnome-nightly (WebKitGTK+ 2.19.5) is crashing in a call to JSC: Thread 1 "geary" received signal SIGSEGV, Segmentation fault. 0x00007f19b73c985c in WTFCrash () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/Assertions.cpp:272 272 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007f19b73c985c in WTFCrash() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/Assertions.cpp:272 #1 0x00007f19b72a3d05 in JSC::VM::updateStackLimits() () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/runtime/VM.cpp:814 #2 0x00007f19b7179dc4 in JSC::JSLock::lock(long) () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/runtime/JSLock.cpp:144 #3 0x00007f19b7179dc4 in JSC::JSLock::lock(long) () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/runtime/JSLock.cpp:121 #4 0x00007f19b68e208d in JSValueIsNumber() () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/API/JSValueRef.cpp:136 #5 0x0000000000637f3e in geary_js_to_number (context=context@entry=0x7f19219e00f8, value=0xffff000000000036, error=error@entry=0x7fff2e370968) at /run/build/geary/src/engine/util/util-js.vala:48 #6 0x00000000004cb203 in web_kit_util_to_number (_result_=_result_@entry=0x7f199f6fb7b0, error=error@entry=0x7fff2e370998) at /run/build/geary/src/client/util/util-webkit.vala:37 #7 0x0000000000457149 in _client_web_view_on_preferred_height_changed_client_web_view_java_script_message_handler (_result_=0x7f199f6fb7b0, self=0x320fd80 [ConversationWebView]) at /run/build/geary/src/client/components/client-web-view.vala:509 #8 0x0000000000457149 in _client_web_view_on_preferred_height_changed_client_web_view_java_script_message_handler (js_result=0x7f199f6fb7b0, self=0x320fd80) at /run/build/geary/src/client/components/client-web-view.vala:297 #12 0x00007f19bc867a2f in <emit signal script-message-received:preferredHeightChanged on instance 0x7f193c056020 [WebKitUserContentManager]> (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3447 #9 0x00007f19bc84b5f5 in g_closure_invoke (closure=0x321dfc0, return_value=return_value@entry=0x0, n_param_values=2, param_values=param_values@entry=0x7fff2e370b70, invocation_hint=invocation_hint@entry=0x7fff2e370af0) at gclosure.c:804 #10 0x00007f19bc85e8b2 in signal_emit_unlocked_R (node=node@entry=0x304bfd0, detail=detail@entry=3449, instance=instance@entry=0x7f193c056020, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7fff2e370b70) at gsignal.c:3635 #11 0x00007f19bc867648 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7fff2e370d30) at gsignal.c:3391 #13 0x00007f19b7feac09 in ScriptMessageClientGtk::didPostMessage(WebKit::WebPageProxy&, WebKit::FrameInfoData const&, WebCore::SerializedScriptValue&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/UIProcess/API/glib/WebKitUserContentManager.cpp:194 #14 0x00007f19b7e69b6d in WebKit::WebUserContentControllerProxy::didPostMessage(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.cpp:323 #15 0x00007f19b81790c6 in IPC::handleMessage<Messages::WebUserContentControllerProxy::Did---Type <return> to continue, or q <return> to quit--- PostMessage, WebKit::WebUserContentControllerProxy, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebUserContentControllerProxy*, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/HandleMessage.h:82 #16 0x00007f19b81790c6 in IPC::handleMessage<Messages::WebUserContentControllerProxy::DidPostMessage, WebKit::WebUserContentControllerProxy, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebUserContentControllerProxy*, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/HandleMessage.h:88 #17 0x00007f19b81790c6 in IPC::handleMessage<Messages::WebUserContentControllerProxy::DidPostMessage, WebKit::WebUserContentControllerProxy, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebUserContentControllerProxy*, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/HandleMessage.h:165 #18 0x00007f19b8178bfe in WebKit::WebUserContentControllerProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) () at /run/build-runtime/WebKitGTK+/DerivedSources/WebKit/WebUserContentControllerProxyMessageReceiver.cpp:40 #19 0x00007f19b7cf9f79 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/MessageReceiverMap.cpp:123 #20 0x00007f19b7df6ad2 in WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/UIProcess/WebProcessProxy.cpp:593 #21 0x00007f19b7cf4040 in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/Connection.cpp:901 #22 0x00007f19b7cf4040 in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/Connection.cpp:928 #23 0x00007f19b7cf4a18 in IPC::Connection::dispatchOneMessage() () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/Connection.cpp:959 #24 0x00007f19ba2d27a7 in WTF::RunLoop::performWork() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/Function.h:56 #25 0x00007f19ba2d27a7 in WTF::RunLoop::performWork() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/RunLoop.cpp:106 #26 0x00007f19ba316cc9 in _FUN() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/glib/RunLoopGLib.cpp:68 ---Type <return> to continue, or q <return> to quit---q Quit (gdb) bt full #0 0x00007f19b73c985c in WTFCrash() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/Assertions.cpp:272 #1 0x00007f19b72a3d05 in JSC::VM::updateStackLimits() () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/runtime/VM.cpp:814 #2 0x00007f19b7179dc4 in JSC::JSLock::lock(long) () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/runtime/JSLock.cpp:144 #3 0x00007f19b7179dc4 in JSC::JSLock::lock(long) () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/runtime/JSLock.cpp:121 #4 0x00007f19b68e208d in JSValueIsNumber() () at /run/build-runtime/WebKitGTK+/Source/JavaScriptCore/API/JSValueRef.cpp:136 #5 0x0000000000637f3e in geary_js_to_number (context=context@entry=0x7f19219e00f8, value=0xffff000000000036, error=error@entry=0x7fff2e370968) at /run/build/geary/src/engine/util/util-js.vala:48 result = 0 _tmp0_ = 0x7f19219e00f8 _tmp1_ = <optimized out> err = 0x0 number = 0 _tmp5_ = <optimized out> _tmp6_ = 0x0 _tmp7_ = <optimized out> _tmp8_ = <optimized out> _tmp10_ = <optimized out> _tmp11_ = <optimized out> _inner_error_ = 0x0 #6 0x00000000004cb203 in web_kit_util_to_number (_result_=_result_@entry=0x7f199f6fb7b0, error=error@entry=0x7fff2e370998) at /run/build/geary/src/client/util/util-webkit.vala:37 _tmp0_ = 0 _tmp1_ = 0x7f199f6fb7b0 _tmp2_ = 0x7f19219e00f8 _tmp4_ = <optimized out> _tmp5_ = <optimized out> _inner_error_ = 0x0 __func__ = "web_kit_util_to_number" #7 0x0000000000457149 in _client_web_view_on_preferred_height_changed_client_web_view_java_script_message_handler (_result_=0x7f199f6fb7b0, self=0x320fd80 [ConversationWebView]) at /run/build/geary/src/client/components/client-web-view.vala:509 _tmp1_ = 0x7f199f6fb7b0 _tmp3_ = <optimized out> _tmp0_ = 0 _tmp2_ = <optimized out> height = 0 _tmp4_ = <optimized out> _inner_error_ = 0x0 ---Type <return> to continue, or q <return> to quit--- #8 0x0000000000457149 in _client_web_view_on_preferred_height_changed_client_web_view_java_script_message_handler (js_result=0x7f199f6fb7b0, self=0x320fd80) at /run/build/geary/src/client/components/client-web-view.vala:297 #12 0x00007f19bc867a2f in <emit signal script-message-received:preferredHeightChanged on instance 0x7f193c056020 [WebKitUserContentManager]> (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3447 Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: #13 0x00007f19b7feac09 in ScriptMessageClientGtk::didPostMessage(WebKit::WebPageProxy&, WebKit::FrameInfoData const&, WebCore::SerializedScriptValue&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/UIProcess/API/glib/WebKitUserContentManager.cpp:194 #14 0x00007f19b7e69b6d in WebKit::WebUserContentControllerProxy::didPostMessage(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.cpp:323 #15 0x00007f19b81790c6 in IPC::handleMessage<Messages::WebUserContentControllerProxy::DidPostMessage, WebKit::WebUserContentControllerProxy, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebUserContentControllerProxy*, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/HandleMessage.h:82 #16 0x00007f19b81790c6 in IPC::handleMessage<Messages::WebUserContentControllerProxy::DidPostMessage, WebKit::WebUserContentControllerProxy, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebUserContentControllerProxy*, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/HandleMessage.h:88 #17 0x00007f19b81790c6 in IPC::handleMessage<Messages::WebUserContentControllerProxy::DidPostMessage, WebKit::WebUserContentControllerProxy, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebUserContentControllerProxy*, void (WebKit::WebUserContentControllerProxy::*)(IPC::Connection&, unsigned long, WebKit::FrameInfoData const&, unsigned long, IPC::DataReference const&)) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/HandleMessage.h:165 #18 0x00007f19b8178bfe in WebKit::WebUserContentControllerProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) () at /run/build-runtime/WebKitGTK+/DerivedSources/WebKit/WebUserContentControllerProxyMessageReceiver.cpp:40 #19 0x00007f19b7cf9f79 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/MessageReceiverMap.cpp:123 #20 0x00007f19b7df6ad2 in WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IP---Type <return> to continue, or q <return> to quit--- C::Decoder&) () at /run/build-runtime/WebKitGTK+/Source/WebKit/UIProcess/WebProcessProxy.cpp:593 #21 0x00007f19b7cf4040 in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/Connection.cpp:901 #22 0x00007f19b7cf4040 in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/Connection.cpp:928 #23 0x00007f19b7cf4a18 in IPC::Connection::dispatchOneMessage() () at /run/build-runtime/WebKitGTK+/Source/WebKit/Platform/IPC/Connection.cpp:959 #24 0x00007f19ba2d27a7 in WTF::RunLoop::performWork() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/Function.h:56 #25 0x00007f19ba2d27a7 in WTF::RunLoop::performWork() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/RunLoop.cpp:106 #26 0x00007f19ba316cc9 in _FUN() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/glib/RunLoopGLib.cpp:68 #27 0x00007f19ba316cc9 in _FUN() () at /run/build-runtime/WebKitGTK+/Source/WTF/wtf/glib/RunLoopGLib.cpp:70 #28 0x00007f19bc5701da in g_main_context_dispatch (context=0x1dc8060) at gmain.c:3200 dispatch = 0x7f19ba316ce0 <_FUN()> prev_source = 0x0 was_in_call = 0 user_data = 0x7f199f6f9000 callback = 0x7f19ba316cc0 <_FUN()> cb_funcs = <optimized out> cb_data = 0x1eda7d0 need_destroy = <optimized out> source = 0x1eb7290 current = 0x1def600 i = 0 #29 0x00007f19bc5701da in g_main_context_dispatch (context=context@entry=0x1dc8060) at gmain.c:3853 #30 0x00007f19bc570598 in g_main_context_iterate (context=context@entry=0x1dc8060, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3926 max_priority = 100 timeout = 0 some_ready = 1 nfds = 5 allocated_nfds = 5 fds = <optimized out> #31 0x00007f19bc57064c in g_main_context_iteration (context=context@entry=0x1dc8060, may_block=may_block@entry=1) at gmain.c:3987 retval = <optimized out> #32 0x00007f19bbce3cbd in g_application_run (application=0x1dc91d0 [GearyApplication], argc=argc@entry=2, argv=argv@entry=0x7fff2e371488) at gapplication.c:2482 ---Type <return> to continue, or q <return> to quit--- arguments = 0x1dc8d80 status = 0 context = 0x1dc8060 acquired_context = <optimized out> __func__ = "g_application_run" #33 0x0000000000424723 in _vala_main (args=0x7fff2e371488, args_length1=2) at /run/build/geary/src/client/application/main.vala:33 result = 0 app = 0x1dc91d0 [GearyApplication] _tmp0_ = 0x1dc91d0 [GearyApplication] ec = 0 _tmp1_ = 0x7fff2e371488 _tmp1__length1 = 2 _tmp2_ = <optimized out> #34 0x0000003c65a20291 in __libc_start_main (main= 0x4245b0 <main>, argc=2, argv=0x7fff2e371488, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff2e371478) at /usr/src/debug/glibc/2.24-r0/git/csu/libc-start.c:289 result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 8760660604672724399, 4343232, 140733968749696, 0, 0, -8761116703833272913, 8785632185294310831}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7fff2e3714a0, 0x3c65824170}, data = {prev = 0x0, cleanup = 0x0, canceltype = 775361696}}} not_first_call = <optimized out> #35 0x00000000004245ea in _start () at ../sysdeps/x86_64/start.S:120 1388756 1 mike 2018-01-12 02:46:17 -0800 Apparently 0xbbadbeef might indicate a gigacage issue? Setting GIGACAGE_ENABLED=0 at runtime didn't help though. 1388799 2 mcatanzaro 2018-01-12 07:49:00 -0800 2.19.5 is super broken, sorry! See bug #179914 for the original problem, and bug #181438 (which I'm working on today) for why my solution to that was a bad idea. *** This bug has been marked as a duplicate of bug 181438 *** 1389522 3 mcatanzaro 2018-01-16 06:11:04 -0800 OK, it took a few days, but this should be fixed next time you run 'flatpak update'. P.S. Unrelated: that means you should be able to review https://bugzilla.gnome.org/show_bug.cgi?id=791230 now. ;)