87082 2012-05-21 23:01:03 -0700 REGRESSION(r117861): It made almost all tests crash on Qt 2012-05-22 00:10:20 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED Qt, QtTriaged P1 Blocker --- 85269 1 ossy webkit-unassigned fpizlo hausmann loki oliver ossy zherczeg oldest_to_newest 629952 0 ossy 2012-05-21 23:01:03 -0700 Unfortunately r117861 made almost all jscore and layout tests crash on 32 and 64 bit Qt: (only is release mode, in debug mode everything works) Could you check what happened? http://build.webkit.sed.hu/builders/x86-64%20Linux%20Qt%20Release/builds/37662 - jscore-test: 167 regressions found. - layout tests: Exiting early after 20 crashes and 0 timeouts. 3984 tests run. 20 failures a crash log: ------------- *** glibc detected *** /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/bin/DumpRenderTree: double free or corruption (out): 0x00007f39eb1ceb20 *** ======= Backtrace: ========= /lib/libc.so.6(+0x71bd6)[0x7f3a3c453bd6] /lib/libc.so.6(cfree+0x6c)[0x7f3a3c45894c] /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/lib/libQtWebKit.so.4(_ZN3JSC3DFG10DominatorsD1Ev+0x15)[0x7f3a44108f55] /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/lib/libQtWebKit.so.4(_ZN3JSC3DFG5GraphD1Ev+0x1d)[0x7f3a4410aa0d] /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/lib/libQtWebKit.so.4(_ZN3JSC3DFG7compileENS0_11CompileModeEPNS_9ExecStateEPNS_9CodeBlockERNS_7JITCodeEPNS_21MacroAssemblerCodePtrE+0x42e)[0x7f3a4410b89e] /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/lib/libQtWebKit.so.4(_ZN3JSC31jitCompileFunctionIfAppropriateEPNS_9ExecStateERN3WTF6OwnPtrINS_17FunctionCodeBlockEEERNS_7JITCodeERNS_21MacroAssemblerCodePtrERPNS_17SharedSymbolTableENS7_7JITTypeENS_20JITCompilationEffortE+0x1f7)[0x7f3a44277c07] /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/lib/libQtWebKit.so.4(_ZN3JSC18FunctionExecutable22compileForCallInternalEPNS_9ExecStateEPNS_14ScopeChainNodeENS_7JITCode7JITTypeE+0x157)[0x7f3a44275aa7] /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/lib/libQtWebKit.so.4(cti_optimize_from_ret+0x98)[0x7f3a441b5b88] [0x7f39f7d64122] ======= Memory map: ======== 00400000-00436000 r-xp 00000000 00:11 8816457 /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/bin/DumpRenderTree 00436000-00438000 rwxp 00035000 00:11 8816457 /ramdisk/qt-linux-64-release/build/WebKitBuild/Release/bin/DumpRenderTree 00438000-0043e000 rwxp 00000000 00:00 0 022d0000-02465000 rwxp 00000000 00:00 0 [heap] 7f39e4000000-7f39e408b000 rwxp 00000000 00:00 0 7f39e408b000-7f39e8000000 ---p 00000000 00:00 0 7f39eb010000-7f39eb031000 rwxp 00000000 00:00 0 7f39eb031000-7f39eb131000 rwxp 00000000 00:00 0 7f39eb131000-7f39eb18f000 rwxp 00000000 00:00 0 7f39eb18f000-7f39eb28f000 rwxp 00000000 00:00 0 7f39eb28f000-7f39eb290000 ---p 00000000 00:00 0 7f39eb290000-7f39eba90000 rwxp 00000000 00:00 0 7f39eba90000-7f39ebaaf000 rwxp 00000000 00:00 0 7f39ebaaf000-7f39ebab0000 ---p 00000000 00:00 0 7f39ebab0000-7f39ec2b0000 rwxp 00000000 00:00 0 7f39ec2b0000-7f39ec2bc000 r-xp 00000000 09:00 392501 /lib/libnss_files-2.11.3.so 7f39ec2bc000-7f39ec4bb000 ---p 0000c000 09:00 392501 /lib/libnss_files-2.11.3.so 7f39ec4bb000-7f39ec4bc000 r-xp 0000b000 09:00 392501 /lib/libnss_files-2.11.3.so 7f39ec4bc000-7f39ec4bd000 rwxp 0000c000 09:00 392501 /lib/libnss_files-2.11.3.so 7f39ec4d5000-7f39ec4e7000 r-xp 00000000 09:01 12415767 /home/webkitbuildbot/slaves/testfonts/n019023l.pfb 7f39ec4e7000-7f39ec4f9000 r-xp 00000000 09:01 12415766 /home/webkitbuildbot/slaves/testfonts/n019004l.pfb 7f39ec4f9000-7f39ec52e000 r-xs 00000000 09:00 1046630 /var/cache/nscd/passwd 7f39ec52e000-7f39ec54a000 r-xp 00000000 09:01 12415752 /home/webkitbuildbot/slaves/testfonts/b018012l.pfb 7f39ec54a000-7f39ec54b000 ---p 00000000 00:00 0 7f39ec54b000-7f39ecd4b000 rwxp 00000000 00:00 0 7f39ecd4b000-7f39ecd72000 r-xp 00000000 09:00 1450320 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqtwcodecs.so 7f39ecd72000-7f39ecf71000 ---p 00027000 09:00 1450320 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqtwcodecs.so 7f39ecf71000-7f39ecf72000 rwxp 00026000 09:00 1450320 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqtwcodecs.so 7f39ecf72000-7f39ecf85000 r-xp 00000000 09:00 1450319 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqkrcodecs.so 7f39ecf85000-7f39ed184000 ---p 00013000 09:00 1450319 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqkrcodecs.so 7f39ed184000-7f39ed185000 rwxp 00012000 09:00 1450319 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqkrcodecs.so 7f39ed185000-7f39ed1b0000 r-xp 00000000 09:00 1450318 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqjpcodecs.so 7f39ed1b0000-7f39ed3b0000 ---p 0002b000 09:00 1450318 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqjpcodecs.so 7f39ed3b0000-7f39ed3b2000 rwxp 0002b000 09:00 1450318 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqjpcodecs.so 7f39ed3b2000-7f39ed3d5000 r-xp 00000000 09:00 1450317 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqcncodecs.so 7f39ed3d5000-7f39ed5d5000 ---p 00023000 09:00 1450317 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqcncodecs.so 7f39ed5d5000-7f39ed5d6000 rwxp 00023000 09:00 1450317 /usr/local/Trolltech/Qt-4.8.0/plugins/codecs/libqcncodecs.so 7f39ed5d6000-7f39ed5f5000 rwxp 00000000 00:00 0 7f39ed5f5000-7f39ed5f6000 ---p 00000000 00:00 0 7f39ed5f6000-7f39eddf6000 rwxp 00000000 00:00 0 7f39eddf6000-7f39ede07000 r-xp 00000000 09:01 12415765 /home/webkitbuildbot/slaves/testfonts/n019003l.pfb 7f39ede07000-7f39ede08000 ---p 00000000 00:00 0 7f39ede08000-7f39ee608000 rwxp 00000000 00:00 0 7f39ee608000-7f39ee657000 r-xp 00000000 09:00 787896 /usr/lib/libssl.so.0.9.8 7f39ee657000-7f39ee856000 ---p 0004f000 09:00 787896 /usr/lib/libssl.so.0.9.8 7f39ee856000-7f39ee85d000 rwxp 0004e000 09:00 787896 /usr/lib/libssl.so.0.9.8 7f39ee85d000-7f39ee9d2000 r-xp 00000000 09:00 787894 /usr/lib/libcrypto.so.0.9.8 7f39ee9d2000-7f39eebd2000 ---p 00175000 09:00 787894 /usr/lib/libcrypto.so.0.9.8 7f39eebd2000-7f39eebfa000 rwxp 00175000 09:00 787894 /usr/lib/libcrypto.so.0.9.8 7f39eebfa000-7f39eebfe000 rwxp 00000000 00:00 0 7f39eebfe000-7f39eeffe000 rwxp 00000000 00:00 0 7f39eeffe000-7f39eefff000 ---p 00000000 00:00 0 7f39eefff000-7f39ef7ff000 rwxp 00000000 00:00 0 7f39ef7ff000-7f39ef800000 ---p 00000000 00:00 0 7f39ef800000-7f39f0000000 rwxp 00000000 00:00 0 7f39f0000000-7f39f0324000 rwxp 00000000 00:00 0 7f39f0324000-7f39f4000000 ---p 00000000 00:00 0 7f39f4001000-7f39f4101000 rwxp 00000000 00:00 0 7f39f4101000-7f39f421a000 rwxp 00000000 00:00 0 7f39f421a000-7f39f421b000 ---p 00000000 00:00 0 7f39f421b000-7f39f4a1b000 rwxp 00000000 00:00 0 7f39f4a1b000-7f39f4a1c000 ---p 00000000 00:00 0 7f39f4a1c000-7f39f521c000 rwxp 00000000 00:00 0 7f39f521c000-7f39f524c000 r-xp 00000000 09:00 1576409 /usr/local/Trolltech/Qt-4.8.0/plugins/bearer/libqnmbearer.so 7f39f524c000-7f39f544b000 ---p 00030000 09:00 1576409 /usr/local/Trolltech/Qt-4.8.0/plugins/bearer/libqnmbearer.so18:31:08.602 27402 worker/0 http/tests/css/shared-stylesheet-mutation-preconstruct.html crashed, no stack trace 18:31:08.602 27402 worker/0 killing driver 18:31:08.648 27402 worker/0 http/tests/css/shared-stylesheet-mutation-preconstruct.html failed: 18:31:08.648 27402 worker/0 DumpRenderTree (pid 27456) crashed 18:31:08.648 27402 http/tests/css/shared-stylesheet-mutation-preconstruct.html -> unexpected crash 630008 1 fpizlo 2012-05-22 00:01:08 -0700 Sorry about that. It turns out that Qt was catching a real bug: the FastBitVector was delete[]'ing something that it fastCalloc'd. 630009 2 143203 fpizlo 2012-05-22 00:01:30 -0700 Created attachment 143203 the patch 630014 3 143203 ossy 2012-05-22 00:07:58 -0700 Comment on attachment 143203 the patch rs=me, but cq-, because I'll land it manually. 630017 4 fpizlo 2012-05-22 00:09:56 -0700 (In reply to comment #3) > (From update of attachment 143203 [details]) > rs=me, but cq-, because I'll land it manually. Thanks! 630018 5 143203 ossy 2012-05-22 00:10:04 -0700 Comment on attachment 143203 the patch Clearing flags on attachment: 143203 Committed r117919: <http://trac.webkit.org/changeset/117919> 630019 6 ossy 2012-05-22 00:10:20 -0700 All reviewed patches have been landed. Closing bug. 143203 2012-05-22 00:01:30 -0700 2012-05-22 00:10:03 -0700 the patch fixbitvector_patch_1.diff text/plain 3618 fpizlo SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAxMTc5MTgpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBACisyMDEyLTA1LTIxICBGaWxpcCBQaXpsbyAgPGZwaXps b0BhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lPTihyMTE3ODYxKTogSXQgbWFkZSBhbG1v c3QgYWxsIHRlc3RzIGNyYXNoIG9uIFF0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD04NzA4MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorICAgICAgICAKKyAgICAgICAgVXNpbmcgT3duQXJyYXlQdHIgaXMgYSBiYWQgaWRlYSBp ZiB5b3UgYWxsb2NhdGUgYXJyYXkgd2l0aCBmYXN0Q2FsbG9jLgorCisgICAgICAgICogd3RmL0Zh c3RCaXRWZWN0b3IuaDoKKyAgICAgICAgKFdURjo6RmFzdEJpdFZlY3Rvcjo6RmFzdEJpdFZlY3Rv cik6CisgICAgICAgIChXVEY6OkZhc3RCaXRWZWN0b3I6On5GYXN0Qml0VmVjdG9yKToKKyAgICAg ICAgKEZhc3RCaXRWZWN0b3IpOgorICAgICAgICAoV1RGOjpGYXN0Qml0VmVjdG9yOjpvcGVyYXRv cj0pOgorICAgICAgICAoV1RGOjpGYXN0Qml0VmVjdG9yOjpyZXNpemUpOgorICAgICAgICAoV1RG OjpGYXN0Qml0VmVjdG9yOjpzZXRBbGwpOgorICAgICAgICAoV1RGOjpGYXN0Qml0VmVjdG9yOjpj bGVhckFsbCk6CisgICAgICAgIChXVEY6OkZhc3RCaXRWZWN0b3I6OnNldCk6CisKIDIwMTItMDUt MDEgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KIAogICAgICAgICBERkcgc2hvdWxk IGJlIGFibGUgdG8gY29tcHV0ZSBkb21pbmF0b3JzCkluZGV4OiBTb3VyY2UvV1RGL3d0Zi9GYXN0 Qml0VmVjdG9yLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dURi93dGYvRmFzdEJpdFZlY3Rvci5o CShyZXZpc2lvbiAxMTc4MjkpCisrKyBTb3VyY2UvV1RGL3d0Zi9GYXN0Qml0VmVjdG9yLmgJKHdv cmtpbmcgY29weSkKQEAgLTM1LDIwICszNSwzMiBAQCBuYW1lc3BhY2UgV1RGIHsKIAogY2xhc3Mg RmFzdEJpdFZlY3RvciB7CiBwdWJsaWM6Ci0gICAgRmFzdEJpdFZlY3RvcigpIDogbV9udW1CaXRz KDApIHsgfQorICAgIEZhc3RCaXRWZWN0b3IoKQorICAgICAgICA6IG1fYXJyYXkoMCkKKyAgICAg ICAgLCBtX251bUJpdHMoMCkKKyAgICB7CisgICAgfQogICAgIAogICAgIEZhc3RCaXRWZWN0b3Io Y29uc3QgRmFzdEJpdFZlY3RvciYgb3RoZXIpCi0gICAgICAgIDogbV9udW1CaXRzKDApCisgICAg ICAgIDogbV9hcnJheSgwKQorICAgICAgICAsIG1fbnVtQml0cygwKQogICAgIHsKICAgICAgICAg KnRoaXMgPSBvdGhlcjsKICAgICB9CiAgICAgCisgICAgfkZhc3RCaXRWZWN0b3IoKQorICAgIHsK KyAgICAgICAgaWYgKG1fYXJyYXkpCisgICAgICAgICAgICBmYXN0RnJlZShtX2FycmF5KTsKKyAg ICB9CisgICAgCiAgICAgRmFzdEJpdFZlY3RvciYgb3BlcmF0b3I9KGNvbnN0IEZhc3RCaXRWZWN0 b3ImIG90aGVyKQogICAgIHsKICAgICAgICAgc2l6ZV90IGxlbmd0aCA9IG90aGVyLmFycmF5TGVu Z3RoKCk7Ci0gICAgICAgIFBhc3NPd25BcnJheVB0cjx1aW50MzJfdD4gbmV3QXJyYXkgPSBhZG9w dEFycmF5UHRyKAotICAgICAgICAgICAgc3RhdGljX2Nhc3Q8dWludDMyX3QqPihmYXN0Q2FsbG9j KGxlbmd0aCwgNCkpKTsKLSAgICAgICAgbWVtY3B5KG5ld0FycmF5LmdldCgpLCBvdGhlci5tX2Fy cmF5LmdldCgpLCBsZW5ndGggKiA0KTsKKyAgICAgICAgdWludDMyX3QqIG5ld0FycmF5ID0gc3Rh dGljX2Nhc3Q8dWludDMyX3QqPihmYXN0Q2FsbG9jKGxlbmd0aCwgNCkpOworICAgICAgICBtZW1j cHkobmV3QXJyYXksIG90aGVyLm1fYXJyYXksIGxlbmd0aCAqIDQpOworICAgICAgICBpZiAobV9h cnJheSkKKyAgICAgICAgICAgIGZhc3RGcmVlKG1fYXJyYXkpOwogICAgICAgICBtX2FycmF5ID0g bmV3QXJyYXk7CiAgICAgICAgIG1fbnVtQml0cyA9IG90aGVyLm1fbnVtQml0czsKICAgICAgICAg cmV0dXJuICp0aGlzOwpAQCAtNjIsMjcgKzc0LDI4IEBAIHB1YmxpYzoKICAgICAgICAgLy8gdXNl IGNhc2UgZm9yIHRoaXMgbWV0aG9kIHRvIGJlIGluaXRpYWxpemluZyB0aGUgc2l6ZSBvZiB0aGUg Yml0dmVjdG9yLgogICAgICAgICAKICAgICAgICAgc2l6ZV90IG5ld0xlbmd0aCA9IChudW1CaXRz ICsgMzEpID4+IDU7Ci0gICAgICAgIFBhc3NPd25BcnJheVB0cjx1aW50MzJfdD4gbmV3QXJyYXkg PSBhZG9wdEFycmF5UHRyKAotICAgICAgICAgICAgc3RhdGljX2Nhc3Q8dWludDMyX3QqPihmYXN0 Q2FsbG9jKG5ld0xlbmd0aCwgNCkpKTsKLSAgICAgICAgbWVtY3B5KG5ld0FycmF5LmdldCgpLCBt X2FycmF5LmdldCgpLCBhcnJheUxlbmd0aCgpICogNCk7CisgICAgICAgIHVpbnQzMl90KiBuZXdB cnJheSA9IHN0YXRpY19jYXN0PHVpbnQzMl90Kj4oZmFzdENhbGxvYyhuZXdMZW5ndGgsIDQpKTsK KyAgICAgICAgbWVtY3B5KG5ld0FycmF5LCBtX2FycmF5LCBhcnJheUxlbmd0aCgpICogNCk7Cisg ICAgICAgIGlmIChtX2FycmF5KQorICAgICAgICAgICAgZmFzdEZyZWUobV9hcnJheSk7CiAgICAg ICAgIG1fYXJyYXkgPSBuZXdBcnJheTsKICAgICAgICAgbV9udW1CaXRzID0gbnVtQml0czsKICAg ICB9CiAgICAgCiAgICAgdm9pZCBzZXRBbGwoKQogICAgIHsKLSAgICAgICAgbWVtc2V0KG1fYXJy YXkuZ2V0KCksIDI1NSwgYXJyYXlMZW5ndGgoKSAqIDQpOworICAgICAgICBtZW1zZXQobV9hcnJh eSwgMjU1LCBhcnJheUxlbmd0aCgpICogNCk7CiAgICAgfQogICAgIAogICAgIHZvaWQgY2xlYXJB bGwoKQogICAgIHsKLSAgICAgICAgbWVtc2V0KG1fYXJyYXkuZ2V0KCksIDAsIGFycmF5TGVuZ3Ro KCkgKiA0KTsKKyAgICAgICAgbWVtc2V0KG1fYXJyYXksIDAsIGFycmF5TGVuZ3RoKCkgKiA0KTsK ICAgICB9CiAgICAgCiAgICAgdm9pZCBzZXQoY29uc3QgRmFzdEJpdFZlY3RvciYgb3RoZXIpCiAg ICAgewogICAgICAgICBBU1NFUlQobV9udW1CaXRzID09IG90aGVyLm1fbnVtQml0cyk7Ci0gICAg ICAgIG1lbWNweShtX2FycmF5LmdldCgpLCBvdGhlci5tX2FycmF5LmdldCgpLCBhcnJheUxlbmd0 aCgpICogNCk7CisgICAgICAgIG1lbWNweShtX2FycmF5LCBvdGhlci5tX2FycmF5LCBhcnJheUxl bmd0aCgpICogNCk7CiAgICAgfQogICAgIAogICAgIGJvb2wgc2V0QW5kQ2hlY2soY29uc3QgRmFz dEJpdFZlY3RvciYgb3RoZXIpCkBAIC0xNTksNyArMTcyLDcgQEAgcHVibGljOgogcHJpdmF0ZToK ICAgICBzaXplX3QgYXJyYXlMZW5ndGgoKSBjb25zdCB7IHJldHVybiAobV9udW1CaXRzICsgMzEp ID4+IDU7IH0KICAgICAKLSAgICBPd25BcnJheVB0cjx1aW50MzJfdD4gbV9hcnJheTsKKyAgICB1 aW50MzJfdCogbV9hcnJheTsgLy8gTm8sIHRoaXMgY2FuJ3QgYmUgYW4gT3duQXJyYXlQdHIuCiAg ICAgc2l6ZV90IG1fbnVtQml0czsKIH07CiAK