<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>89358</bug_id>
          
          <creation_ts>2012-06-18 10:04:49 -0700</creation_ts>
          <short_desc>Causes crashes in LLVMPipe</short_desc>
          <delta_ts>2012-06-22 05:41:51 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKitGTK</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Linux</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Critical</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>0</everconfirmed>
          <reporter name="Bastien Nocera">bugzilla</reporter>
          <assigned_to name="Gustavo Noronha (kov)">gustavo</assigned_to>
          <cc>airlied</cc>
    
    <cc>gustavo</cc>
    
    <cc>mrobinson</cc>
    
    <cc>mrowe</cc>
    
    <cc>wingo</cc>
    
    <cc>xan.lopez</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>651474</commentid>
    <comment_count>0</comment_count>
    <who name="Bastien Nocera">bugzilla</who>
    <bug_when>2012-06-18 10:04:49 -0700</bug_when>
    <thetext>webkitgtk3-1.8.1-2.fc17.x86_64

See https://bugzilla.gnome.org/show_bug.cgi?id=674628 and https://bugs.freedesktop.org/show_bug.cgi?id=48441

Apparently caused by gnome-control-center&apos;s GOA panel loading WebKitGTK+, which overrides the new and delete operators, which means changes the allocator and destructor defaults for all C++ code.

This makes LLVM Pipe explode.

Full explanation from Dave Airlie:
https://plus.google.com/104877287288155269055/posts/grHDgRNc1gi

#0  0x00007f823bef2c35 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007f823bef40b8 in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x00007f823bf30e5b in __libc_message () from /lib/libc.so.6
No symbol table info available.
#3  0x00007f823bf36a56 in malloc_printerr () from /lib/libc.so.6
No symbol table info available.
#4  0x00007f822bcad5d8 in std::string::reserve(unsigned long) () from /usr/lib/libstdc++.so.6
No symbol table info available.
#5  0x00007f822bcad865 in std::string::append(char const*, unsigned long) () from /usr/lib/libstdc++.so.6
No symbol table info available.
#6  0x00007f8221e4edfe in llvm::sys::getHostTriple() () from /usr/lib/xorg/modules/dri/nouveau_dri.so
No symbol table info available.
#7  0x00007f8221963e78 in llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) () from /usr/lib/xorg/modules/dri/nouveau_dri.so
No symbol table info available.
#8  0x00007f82219581ad in llvm::EngineBuilder::create() () from /usr/lib/xorg/modules/dri/nouveau_dri.so
No symbol table info available.
#9  0x00007f82219632eb in LLVMCreateJITCompilerForModule () from /usr/lib/xorg/modules/dri/nouveau_dri.so
No symbol table info available.
#10 0x00007f8221676606 in init_gallivm_state (gallivm=0x1fe51b0) at gallivm/lp_bld_init.c:257
        optlevel = &lt;optimized out&gt;
        error = 0x0
        __FUNCTION__ = &quot;init_gallivm_state&quot;
#11 0x00007f822167674b in gallivm_create () at gallivm/lp_bld_init.c:429
No locals.
#12 0x00007f82215e1325 in draw_create_context (pipe=pipe@entry=0x1fd2980, try_llvm=try_llvm@entry=1 &apos;\001&apos;, gallivm=gallivm@entry=0x0)
    at draw/draw_context.c:82
        draw = 0x1fd3530
#13 0x00007f82215e139c in draw_create (pipe=pipe@entry=0x1fd2980) at draw/draw_context.c:116
No locals.
#14 0x00007f82213bfb95 in nv50_create (pscreen=0x1fbbf30, priv=0x0) at nv50_context.c:146
        nv50 = 0x1fd2980
        pipe = 0x1fd2980
        __PRETTY_FUNCTION__ = &quot;nv50_create&quot;
#15 0x00007f8221427c4c in st_api_create_context (stapi=&lt;optimized out&gt;, smapi=0x1fbbe80, attribs=0x7fffffdfc110, error=0x7fffffdfc10c, shared_stctxi=0x0)
    at state_tracker/st_manager.c:631
        shared_ctx = &lt;optimized out&gt;
        st = &lt;optimized out&gt;
        pipe = &lt;optimized out&gt;
        mode = {rgbMode = 0 &apos;\000&apos;, floatMode = 0 &apos;\000&apos;, colorIndexMode = 0 &apos;\000&apos;, doubleBufferMode = 0, stereoMode = 938064238, 
          haveAccumBuffer = 130 &apos;\202&apos;, haveDepthBuffer = 127 &apos;\177&apos;, haveStencilBuffer = 0 &apos;\000&apos;, redBits = -2113440, greenBits = 32767, 
          blueBits = 33363936, alphaBits = 0, redMask = 4294967295, greenMask = 0, blueMask = 8, alphaMask = 0, rgbBits = -2113440, indexBits = 32767, 
          accumRedBits = 0, accumGreenBits = 0, accumBlueBits = 33275072, accumAlphaBits = 0, depthBits = 557263087, stencilBits = 32642, 
          numAuxBuffers = 568808090, level = 32642, visualRating = 33444208, transparentPixel = 0, transparentRed = 33444208, transparentGreen = 0, 
          transparentBlue = 33363936, transparentAlpha = 0, transparentIndex = 33363840, sampleBuffers = 0, samples = 0, maxPbufferWidth = 32642, 
          maxPbufferHeight = 568809008, maxPbufferPixels = 32642, optimalPbufferWidth = -2106724, optimalPbufferHeight = 32767, swapMethod = 0, 
---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
          bindToTextureRgb = 0, bindToTextureRgba = 0, bindToMipmapTexture = 0, bindToTextureTargets = 0, yInverted = 0, sRGBCapable = 1005829594}
        api = API_OPENGL
#16 0x00007f822137404a in dri_create_context (api=&lt;optimized out&gt;, visual=0x1fe4480, cPriv=&lt;optimized out&gt;, major_version=&lt;optimized out&gt;, 
    minor_version=&lt;optimized out&gt;, flags=&lt;optimized out&gt;, error=0x7fffffdfc1fc, sharedContextPrivate=0x0) at dri_context.c:110
        sPriv = 0x1fbbcc0
        screen = 0x1fbbe80
        stapi = 0x7f82223b92e0
        ctx = 0x1fd1760
        st_share = 0x0
        attribs = {profile = ST_PROFILE_DEFAULT, major = 1, minor = 0, flags = 0, visual = {buffer_mask = 19, color_format = PIPE_FORMAT_B8G8R8A8_UNORM, 
            depth_stencil_format = PIPE_FORMAT_Z24_UNORM_S8_UINT, accum_format = PIPE_FORMAT_NONE, samples = 2, render_buffer = ST_ATTACHMENT_BACK_LEFT}}
        ctx_err = ST_CONTEXT_SUCCESS
#17 0x00007f822136ffbe in dri2CreateContextAttribs (screen=0x1fbbcc0, api=&lt;optimized out&gt;, config=0x1fe4480, shared=&lt;optimized out&gt;, 
    num_attribs=num_attribs@entry=0, attribs=attribs@entry=0x0, error=error@entry=0x7fffffdfc1fc, data=0x1fd15c0)
    at ../../../../src/mesa/drivers/dri/common/dri_util.c:260
        context = &lt;optimized out&gt;
        modes = 0x1fe4480
        shareCtx = 0x0
        mesa_api = &lt;optimized out&gt;
        major_version = &lt;optimized out&gt;
        minor_version = &lt;optimized out&gt;
        flags = &lt;optimized out&gt;
        __PRETTY_FUNCTION__ = &quot;dri2CreateContextAttribs&quot;
#18 0x00007f822137017d in dri2CreateNewContextForAPI (screen=&lt;optimized out&gt;, api=&lt;optimized out&gt;, config=&lt;optimized out&gt;, shared=&lt;optimized out&gt;, 
    data=&lt;optimized out&gt;) at ../../../../src/mesa/drivers/dri/common/dri_util.c:278
        error = 0
#19 0x00007f822dee29ff in dri2_create_context (base=0x1f930a0, config_base=0x1fef470, shareList=&lt;optimized out&gt;, renderType=&lt;optimized out&gt;)
    at dri2_glx.c:213
        pcp = 0x1fd15c0
        pcp_shared = &lt;optimized out&gt;
        psc = 0x1f930a0
        config = 0x1fef470
        shared = 0x0
#20 0x00007f822debd4d7 in CreateContext (dpy=0x1bfa830, generic_id=203, config=0x1fef470, shareList_user=0x0, allowDirect=1, code=code@entry=24, 
    renderType=32788, screen=0) at glxcmds.c:276
        gc = 0x0
        psc = &lt;optimized out&gt;
        shareList = &lt;optimized out&gt;
#21 0x00007f822debd75a in glXCreateNewContext (dpy=&lt;optimized out&gt;, fbconfig=&lt;optimized out&gt;, renderType=&lt;optimized out&gt;, shareList=&lt;optimized out&gt;, 
    allowDirect=&lt;optimized out&gt;) at glxcmds.c:1647
        config = &lt;optimized out&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651476</commentid>
    <comment_count>1</comment_count>
    <who name="Bastien Nocera">bugzilla</who>
    <bug_when>2012-06-18 10:05:44 -0700</bug_when>
    <thetext>If somebody has time to debug this, compile WebKit with --disable-fast-malloc.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651492</commentid>
    <comment_count>2</comment_count>
    <who name="Gustavo Noronha (kov)">gustavo</who>
    <bug_when>2012-06-18 10:14:05 -0700</bug_when>
    <thetext>Let&apos;s see if Mark has an insight into this. I think the problem is LLVMPipe is using free instead of delete for memory allocated with new?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651506</commentid>
    <comment_count>3</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2012-06-18 10:21:36 -0700</bug_when>
    <thetext>What call is std::string::reserve making that results in malloc_printerr being called?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651518</commentid>
    <comment_count>4</comment_count>
    <who name="Bastien Nocera">bugzilla</who>
    <bug_when>2012-06-18 10:30:25 -0700</bug_when>
    <thetext>I&apos;m guessing this would be useful. Valgrind output of the crash:

==16286== Invalid free() / delete / delete[] / realloc()
==16286==    at 0x4C2972C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16286==    by 0x20D445D7: std::string::reserve(unsigned long) (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x20D44864: std::string::append(char const*, unsigned long) (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x2611D1AD: llvm::operator+=(std::string&amp;, llvm::StringRef) (StringRef.h:464)
==16286==    by 0x2618E2E4: llvm::sys::getHostTriple() (Host.inc:50)
==16286==    by 0x259B10F9: llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) (TargetSelect.cpp:38)
==16286==    by 0x259A251A: llvm::EngineBuilder::create() (ExecutionEngine.cpp:470)
==16286==    by 0x259B06DD: LLVMCreateJITCompilerForModule (ExecutionEngineBindings.cpp:129)
==16286==    by 0x259B07E9: LLVMCreateJITCompiler (ExecutionEngineBindings.cpp:162)
==16286==    by 0x25933194: init_gallivm_state (lp_bld_init.c:257)
==16286==    by 0x259334EB: gallivm_create (lp_bld_init.c:429)
==16286==    by 0x2588BA00: draw_create_context (draw_context.c:82)
==16286==  Address 0x274aa4d8 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d
==16286== 
==16286== Invalid free() / delete / delete[] / realloc()
==16286==    at 0x4C2972C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16286==    by 0x20D438CF: std::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt;::~basic_string() (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x2618E3E0: llvm::sys::getHostTriple() (Host.inc:65)
==16286==    by 0x259B10F9: llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) (TargetSelect.cpp:38)
==16286==    by 0x259A251A: llvm::EngineBuilder::create() (ExecutionEngine.cpp:470)
==16286==    by 0x259B06DD: LLVMCreateJITCompilerForModule (ExecutionEngineBindings.cpp:129)
==16286==    by 0x259B07E9: LLVMCreateJITCompiler (ExecutionEngineBindings.cpp:162)
==16286==    by 0x25933194: init_gallivm_state (lp_bld_init.c:257)
==16286==    by 0x259334EB: gallivm_create (lp_bld_init.c:429)
==16286==    by 0x2588BA00: draw_create_context (draw_context.c:82)
==16286==    by 0x2588BAA8: draw_create (draw_context.c:116)
==16286==    by 0x255B99DB: nv50_create (nv50_context.c:146)
==16286==  Address 0x274a9380 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d
==16286== 
==16286== Invalid free() / delete / delete[] / realloc()
==16286==    at 0x4C2972C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16286==    by 0x20D438CF: std::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt;::~basic_string() (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x259B112B: llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) (TargetSelect.cpp:38)
==16286==    by 0x259A251A: llvm::EngineBuilder::create() (ExecutionEngine.cpp:470)
==16286==    by 0x259B06DD: LLVMCreateJITCompilerForModule (ExecutionEngineBindings.cpp:129)
==16286==    by 0x259B07E9: LLVMCreateJITCompiler (ExecutionEngineBindings.cpp:162)
==16286==    by 0x25933194: init_gallivm_state (lp_bld_init.c:257)
==16286==    by 0x259334EB: gallivm_create (lp_bld_init.c:429)
==16286==    by 0x2588BA00: draw_create_context (draw_context.c:82)
==16286==    by 0x2588BAA8: draw_create (draw_context.c:116)
==16286==    by 0x255B99DB: nv50_create (nv50_context.c:146)
==16286==    by 0x2562A8E4: st_api_create_context (st_manager.c:631)
==16286==  Address 0x274ab6c8 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d
==16286== 
==16286== Invalid free() / delete / delete[] / realloc()
==16286==    at 0x4C2972C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16286==    by 0x20D438CF: std::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt;::~basic_string() (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x259B16AD: llvm::Triple::~Triple() (Triple.h:41)
==16286==    by 0x25AA0571: createX86MCCodeGenInfo(llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (X86MCTargetDesc.cpp:375)
==16286==    by 0x25C6725B: llvm::Target::createMCCodeGenInfo(llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) const (TargetRegistry.h:281)
==16286==    by 0x25C65080: llvm::LLVMTargetMachine::LLVMTargetMachine(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (LLVMTargetMachine.cpp:115)
==16286==    by 0x259B1A9B: llvm::X86TargetMachine::X86TargetMachine(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model, bool) (X86TargetMachine.cpp:73)
==16286==    by 0x259B1977: llvm::X86_64TargetMachine::X86_64TargetMachine(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (X86TargetMachine.cpp:61)
==16286==    by 0x259B3489: llvm::RegisterTargetMachine&lt;llvm::X86_64TargetMachine&gt;::Allocator(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (TargetRegistry.h:1015)
==16286==    by 0x259B15C0: llvm::Target::createTargetMachine(llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) const (TargetRegistry.h:337)
==16286==    by 0x259B1478: llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) (TargetSelect.cpp:90)
==16286==    by 0x259A251A: llvm::EngineBuilder::create() (ExecutionEngine.cpp:470)
==16286==  Address 0x274ab620 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d
==16286== 
==16286== Invalid free() / delete / delete[] / realloc()
==16286==    at 0x4C2972C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16286==    by 0x20D438CF: std::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt;::~basic_string() (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x259B16AD: llvm::Triple::~Triple() (Triple.h:41)
==16286==    by 0x25AA03E0: createX86MCAsmInfo(llvm::Target const&amp;, llvm::StringRef) (X86MCTargetDesc.cpp:326)
==16286==    by 0x25C6720E: llvm::Target::createMCAsmInfo(llvm::StringRef) const (TargetRegistry.h:272)
==16286==    by 0x25C6509F: llvm::LLVMTargetMachine::LLVMTargetMachine(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (LLVMTargetMachine.cpp:116)
==16286==    by 0x259B1A9B: llvm::X86TargetMachine::X86TargetMachine(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model, bool) (X86TargetMachine.cpp:73)
==16286==    by 0x259B1977: llvm::X86_64TargetMachine::X86_64TargetMachine(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (X86TargetMachine.cpp:61)
==16286==    by 0x259B3489: llvm::RegisterTargetMachine&lt;llvm::X86_64TargetMachine&gt;::Allocator(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (TargetRegistry.h:1015)
==16286==    by 0x259B15C0: llvm::Target::createTargetMachine(llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) const (TargetRegistry.h:337)
==16286==    by 0x259B1478: llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) (TargetSelect.cpp:90)
==16286==    by 0x259A251A: llvm::EngineBuilder::create() (ExecutionEngine.cpp:470)
==16286==  Address 0x274ab5e8 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d
==16286== 
==16286== Invalid free() / delete / delete[] / realloc()
==16286==    at 0x4C2972C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16286==    by 0x20D438CF: std::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt;::~basic_string() (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x259B16AD: llvm::Triple::~Triple() (Triple.h:41)
==16286==    by 0x25A9FC59: llvm::X86_MC::getDwarfRegFlavour(llvm::StringRef, bool) (X86MCTargetDesc.cpp:134)
==16286==    by 0x25A690A6: llvm::X86RegisterInfo::X86RegisterInfo(llvm::X86TargetMachine&amp;, llvm::TargetInstrInfo const&amp;) (X86RegisterInfo.cpp:59)
==16286==    by 0x25A500BB: llvm::X86InstrInfo::X86InstrInfo(llvm::X86TargetMachine&amp;) (X86InstrInfo.cpp:93)
==16286==    by 0x259B19D7: llvm::X86_64TargetMachine::X86_64TargetMachine(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (X86TargetMachine.cpp:61)
==16286==    by 0x259B3489: llvm::RegisterTargetMachine&lt;llvm::X86_64TargetMachine&gt;::Allocator(llvm::Target const&amp;, llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) (TargetRegistry.h:1015)
==16286==    by 0x259B15C0: llvm::Target::createTargetMachine(llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::Reloc::Model, llvm::CodeModel::Model) const (TargetRegistry.h:337)
==16286==    by 0x259B1478: llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) (TargetSelect.cpp:90)
==16286==    by 0x259A251A: llvm::EngineBuilder::create() (ExecutionEngine.cpp:470)
==16286==    by 0x259B06DD: LLVMCreateJITCompilerForModule (ExecutionEngineBindings.cpp:129)
==16286==  Address 0x274ab540 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d
==16286== 
==16286== Invalid free() / delete / delete[] / realloc()
==16286==    at 0x4C2972C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16286==    by 0x20D438CF: std::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt;::~basic_string() (in /usr/lib/libstdc++.so.6.0.17)
==16286==    by 0x259B16AD: llvm::Triple::~Triple() (Triple.h:41)
==16286==    by 0x259B1498: llvm::EngineBuilder::selectTarget(llvm::Module*, llvm::StringRef, llvm::StringRef, llvm::SmallVectorImpl&lt;std::string&gt; const&amp;, llvm::Reloc::Model, llvm::CodeModel::Model, std::string*) (TargetSelect.cpp:92)
==16286==    by 0x259A251A: llvm::EngineBuilder::create() (ExecutionEngine.cpp:470)
==16286==    by 0x259B06DD: LLVMCreateJITCompilerForModule (ExecutionEngineBindings.cpp:129)
==16286==    by 0x259B07E9: LLVMCreateJITCompiler (ExecutionEngineBindings.cpp:162)
==16286==    by 0x25933194: init_gallivm_state (lp_bld_init.c:257)
==16286==    by 0x259334EB: gallivm_create (lp_bld_init.c:429)
==16286==    by 0x2588BA00: draw_create_context (draw_context.c:82)
==16286==    by 0x2588BAA8: draw_create (draw_context.c:116)
==16286==    by 0x255B99DB: nv50_create (nv50_context.c:146)
==16286==  Address 0x274ab690 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651530</commentid>
    <comment_count>5</comment_count>
    <who name="Dave Airlie">airlied</who>
    <bug_when>2012-06-18 10:45:25 -0700</bug_when>
    <thetext>the C++ string stuff is calling operator delete, however it calls the delete from libstdc++, but operator new is pointing to the one from webkitgtk3.

I do wonder if its a bug in the linker but I have to find someone who knows how the linker should work first.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651534</commentid>
    <comment_count>6</comment_count>
    <who name="Dave Airlie">airlied</who>
    <bug_when>2012-06-18 10:51:23 -0700</bug_when>
    <thetext>LD_DEBUG=true gnome-control-center prints out a very long log (135MB here).

but in it you can see where it binds the mangled &quot;operater new&quot; _Znam to libwebkitgtk and the mangled &quot;operator delete&quot; _ZdlPv to libstdc++, as the symbols are lazily resolved. LD_BIND_NOW also works around it.

I&apos;ve noticed the QT version avoids replacing  the global malloc so maybe the gtk version should do the same.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651557</commentid>
    <comment_count>7</comment_count>
    <who name="Xan Lopez">xan.lopez</who>
    <bug_when>2012-06-18 11:20:12 -0700</bug_when>
    <thetext>(In reply to comment #6)
&gt; I&apos;ve noticed the QT version avoids replacing  the global malloc so maybe the gtk version should do the same.

Agreed here, I don&apos;t see any reason why we would want to do this. Just a matter of adding GTK to the global fastmalloc new thing in Platform.h I guess.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651594</commentid>
    <comment_count>8</comment_count>
      <attachid>148142</attachid>
    <who name="Gustavo Noronha (kov)">gustavo</who>
    <bug_when>2012-06-18 11:47:35 -0700</bug_when>
    <thetext>Created attachment 148142
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>651600</commentid>
    <comment_count>9</comment_count>
      <attachid>148145</attachid>
    <who name="Gustavo Noronha (kov)">gustavo</who>
    <bug_when>2012-06-18 11:51:27 -0700</bug_when>
    <thetext>Created attachment 148145
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>652463</commentid>
    <comment_count>10</comment_count>
      <attachid>148145</attachid>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2012-06-19 08:21:28 -0700</bug_when>
    <thetext>Comment on attachment 148145
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=148145&amp;action=review

&gt; Source/WTF/wtf/Platform.h:778
&gt; -#if PLATFORM(QT)
&gt; -/* We must not customize the global operator new and delete for the Qt port. */
&gt; +#if PLATFORM(QT) || PLATFORM(GTK)
&gt;  #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
&gt;  #if !OS(UNIX)
&gt;  #define USE_SYSTEM_MALLOC 1

This also has the side effect of turning off TcMalloc for Windows...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>652465</commentid>
    <comment_count>11</comment_count>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2012-06-19 08:21:51 -0700</bug_when>
    <thetext>*** Bug 89469 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>653299</commentid>
    <comment_count>12</comment_count>
    <who name="Andy Wingo">wingo</who>
    <bug_when>2012-06-20 02:27:17 -0700</bug_when>
    <thetext>(In reply to comment #10)
 &gt; Source/WTF/wtf/Platform.h:778
&gt; &gt; -#if PLATFORM(QT)
&gt; &gt; -/* We must not customize the global operator new and delete for the Qt port. */
&gt; &gt; +#if PLATFORM(QT) || PLATFORM(GTK)
&gt; &gt;  #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
&gt; &gt;  #if !OS(UNIX)
&gt; &gt;  #define USE_SYSTEM_MALLOC 1
&gt; 
&gt; This also has the side effect of turning off TcMalloc for Windows...

So that would be an r-, no?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>653499</commentid>
    <comment_count>13</comment_count>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2012-06-20 08:25:00 -0700</bug_when>
    <thetext>(In reply to comment #12)

&gt; So that would be an r-, no?

I wasn&apos;t sure in this case if it was an accident or not.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>653719</commentid>
    <comment_count>14</comment_count>
    <who name="Gustavo Noronha (kov)">gustavo</who>
    <bug_when>2012-06-20 11:45:27 -0700</bug_when>
    <thetext>I assumed this would make sense for us if it makes sense for Qt. We can add a separate ifdef if it&apos;s not desirable, though.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>653723</commentid>
    <comment_count>15</comment_count>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2012-06-20 11:47:11 -0700</bug_when>
    <thetext>(In reply to comment #14)
&gt; I assumed this would make sense for us if it makes sense for Qt. We can add a separate ifdef if it&apos;s not desirable, though.

It&apos;s probably safe either way, but perhaps for completeness it might be good to understand why Qt turns it off for Windows. Doesn&apos;t Safari use TCMalloc on Windows?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>653760</commentid>
    <comment_count>16</comment_count>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2012-06-20 12:22:39 -0700</bug_when>
    <thetext>(In reply to comment #15)

&gt; It&apos;s probably safe either way, but perhaps for completeness it might be good to understand why Qt turns it off for Windows. Doesn&apos;t Safari use TCMalloc on Windows?

In fact, it might be best to only disable global new/delete override for GTK+ now and think about whether to disable TCMalloc completely for non-Unix platforms later.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>654405</commentid>
    <comment_count>17</comment_count>
      <attachid>148772</attachid>
    <who name="Gustavo Noronha (kov)">gustavo</who>
    <bug_when>2012-06-21 05:25:47 -0700</bug_when>
    <thetext>Created attachment 148772
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>654406</commentid>
    <comment_count>18</comment_count>
    <who name="Gustavo Noronha (kov)">gustavo</who>
    <bug_when>2012-06-21 05:26:26 -0700</bug_when>
    <thetext>Sure, makes sense =)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>654430</commentid>
    <comment_count>19</comment_count>
      <attachid>148772</attachid>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2012-06-21 06:10:26 -0700</bug_when>
    <thetext>Comment on attachment 148772
Patch

Thanks!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>655382</commentid>
    <comment_count>20</comment_count>
    <who name="Gustavo Noronha (kov)">gustavo</who>
    <bug_when>2012-06-22 05:41:51 -0700</bug_when>
    <thetext>Committed r121018: &lt;http://trac.webkit.org/changeset/121018&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>148142</attachid>
            <date>2012-06-18 11:47:35 -0700</date>
            <delta_ts>2012-06-18 11:51:17 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-89358-20120618154734.patch</filename>
            <type>text/plain</type>
            <size>1209</size>
            <attacher name="Gustavo Noronha (kov)">gustavo</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTIwNTk0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n
ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IDFlNDRlYzJhMTIyZjQ5Y2MxZDJiNTFm
ODIwNWQwZWQwYzVlZDIwMGEuLjA1OGI4YTI2YTE1M2U1NjFjZDVhOTU2YmUyZTBlNDk2OGNmZTgy
ZmUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh
bmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTItMDYtMTggIEd1c3Rhdm8gTm9yb25oYSBTaWx2
YSAgPGd1c3Rhdm8ubm9yb25oYUBjb2xsYWJvcmEuY29tPgorCisgICAgICAgIENhdXNlcyBjcmFz
aGVzIGluIExMVk1QaXBlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn
LmNnaT9pZD04OTM1OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg
ICAgICAgIENoYW5nZSBzdWdnZXN0ZWQgYnkgRGF2ZSBBaXJsaWUgYW5kIFhhbiBMb3Blei4KKwor
ICAgICAgICAqIHd0Zi9QbGF0Zm9ybS5oOiBmb2xsb3cgUXQgaW4gZGlzYWJsaW5nIGdsb2JhbCBm
YXN0TWFsbG9jIGFuZCB1c2luZworICAgICAgICBzeXN0ZW0gbWFsbG9jIGZvciBub24tVU5JWAor
CiAyMDEyLTA2LTE4ICBTaGVyaWZmIEJvdCAgPHdlYmtpdC5yZXZpZXcuYm90QGdtYWlsLmNvbT4K
IAogICAgICAgICBVbnJldmlld2VkLCByb2xsaW5nIG91dCByMTIwNDg1IGFuZCByMTIwNTgyLgpk
aWZmIC0tZ2l0IGEvU291cmNlL1dURi93dGYvUGxhdGZvcm0uaCBiL1NvdXJjZS9XVEYvd3RmL1Bs
YXRmb3JtLmgKaW5kZXggNTFhODdiMjU4Y2E4M2NkOTliMDAyMTcwNDIyOWFhMDM5OGUxYzc2Zi4u
ZWEwNTkzYjVlMzhjN2MxY2MyYTEzZDIwMGVjYjhkZDEzMTA2YjVjYSAxMDA2NDQKLS0tIGEvU291
cmNlL1dURi93dGYvUGxhdGZvcm0uaAorKysgYi9Tb3VyY2UvV1RGL3d0Zi9QbGF0Zm9ybS5oCkBA
IC03NzIsNyArNzcyLDcgQEAKIAogLyogRU5BQkxFIG1hY3JvIGRlZmF1bHRzICovCiAKLSNpZiBQ
TEFURk9STShRVCkKKyNpZiBQTEFURk9STShRVCkgfHwgUExBVEZPUk0oR1RLKQogLyogV2UgbXVz
dCBub3QgY3VzdG9taXplIHRoZSBnbG9iYWwgb3BlcmF0b3IgbmV3IGFuZCBkZWxldGUgZm9yIHRo
ZSBRdCBwb3J0LiAqLwogI2RlZmluZSBFTkFCTEVfR0xPQkFMX0ZBU1RNQUxMT0NfTkVXIDAKICNp
ZiAhT1MoVU5JWCkK
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>148145</attachid>
            <date>2012-06-18 11:51:27 -0700</date>
            <delta_ts>2012-06-21 05:25:38 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-89358-20120618155125.patch</filename>
            <type>text/plain</type>
            <size>1238</size>
            <attacher name="Gustavo Noronha (kov)">gustavo</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTIwNTk0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n
ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IDFlNDRlYzJhMTIyZjQ5Y2MxZDJiNTFm
ODIwNWQwZWQwYzVlZDIwMGEuLjA1OGI4YTI2YTE1M2U1NjFjZDVhOTU2YmUyZTBlNDk2OGNmZTgy
ZmUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh
bmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTItMDYtMTggIEd1c3Rhdm8gTm9yb25oYSBTaWx2
YSAgPGd1c3Rhdm8ubm9yb25oYUBjb2xsYWJvcmEuY29tPgorCisgICAgICAgIENhdXNlcyBjcmFz
aGVzIGluIExMVk1QaXBlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn
LmNnaT9pZD04OTM1OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg
ICAgICAgIENoYW5nZSBzdWdnZXN0ZWQgYnkgRGF2ZSBBaXJsaWUgYW5kIFhhbiBMb3Blei4KKwor
ICAgICAgICAqIHd0Zi9QbGF0Zm9ybS5oOiBmb2xsb3cgUXQgaW4gZGlzYWJsaW5nIGdsb2JhbCBm
YXN0TWFsbG9jIGFuZCB1c2luZworICAgICAgICBzeXN0ZW0gbWFsbG9jIGZvciBub24tVU5JWAor
CiAyMDEyLTA2LTE4ICBTaGVyaWZmIEJvdCAgPHdlYmtpdC5yZXZpZXcuYm90QGdtYWlsLmNvbT4K
IAogICAgICAgICBVbnJldmlld2VkLCByb2xsaW5nIG91dCByMTIwNDg1IGFuZCByMTIwNTgyLgpk
aWZmIC0tZ2l0IGEvU291cmNlL1dURi93dGYvUGxhdGZvcm0uaCBiL1NvdXJjZS9XVEYvd3RmL1Bs
YXRmb3JtLmgKaW5kZXggNTFhODdiMjU4Y2E4M2NkOTliMDAyMTcwNDIyOWFhMDM5OGUxYzc2Zi4u
ZGMwMzdmYzM5NWFmYzY4NDgyOTlkZGUxZmY1ZDJjYzViOTUyOTZiMyAxMDA2NDQKLS0tIGEvU291
cmNlL1dURi93dGYvUGxhdGZvcm0uaAorKysgYi9Tb3VyY2UvV1RGL3d0Zi9QbGF0Zm9ybS5oCkBA
IC03NzIsOCArNzcyLDcgQEAKIAogLyogRU5BQkxFIG1hY3JvIGRlZmF1bHRzICovCiAKLSNpZiBQ
TEFURk9STShRVCkKLS8qIFdlIG11c3Qgbm90IGN1c3RvbWl6ZSB0aGUgZ2xvYmFsIG9wZXJhdG9y
IG5ldyBhbmQgZGVsZXRlIGZvciB0aGUgUXQgcG9ydC4gKi8KKyNpZiBQTEFURk9STShRVCkgfHwg
UExBVEZPUk0oR1RLKQogI2RlZmluZSBFTkFCTEVfR0xPQkFMX0ZBU1RNQUxMT0NfTkVXIDAKICNp
ZiAhT1MoVU5JWCkKICNkZWZpbmUgVVNFX1NZU1RFTV9NQUxMT0MgMQo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>148772</attachid>
            <date>2012-06-21 05:25:47 -0700</date>
            <delta_ts>2012-06-21 06:10:26 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-89358-20120621092546.patch</filename>
            <type>text/plain</type>
            <size>1033</size>
            <attacher name="Gustavo Noronha (kov)">gustavo</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTIwNTk0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n
ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IDFlNDRlYzJhMTIyZjQ5Y2MxZDJiNTFm
ODIwNWQwZWQwYzVlZDIwMGEuLjE4MDM1YTAzNzFkNTUwYTUyYzk1OTczNWRhZjZiZjU0N2JkM2Qy
NWUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh
bmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTItMDYtMTggIEd1c3Rhdm8gTm9yb25oYSBTaWx2
YSAgPGd1c3Rhdm8ubm9yb25oYUBjb2xsYWJvcmEuY29tPgorCisgICAgICAgIENhdXNlcyBjcmFz
aGVzIGluIExMVk1QaXBlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn
LmNnaT9pZD04OTM1OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg
ICAgICAgIENoYW5nZSBzdWdnZXN0ZWQgYnkgRGF2ZSBBaXJsaWUgYW5kIFhhbiBMb3Blei4KKwor
ICAgICAgICAqIHd0Zi9QbGF0Zm9ybS5oOiBkaXNhYmxlIGdsb2JhbCBmYXN0TWFsbG9jIGZvciBH
VEsrCisKIDIwMTItMDYtMTggIFNoZXJpZmYgQm90ICA8d2Via2l0LnJldmlldy5ib3RAZ21haWwu
Y29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxpbmcgb3V0IHIxMjA0ODUgYW5kIHIxMjA1
ODIuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL3d0Zi9QbGF0Zm9ybS5oIGIvU291cmNlL1dURi93
dGYvUGxhdGZvcm0uaAppbmRleCA1MWE4N2IyNThjYTgzY2Q5OWIwMDIxNzA0MjI5YWEwMzk4ZTFj
NzZmLi5lYjVkZDE1Mjk4NjJkZmFhNzU5ZTFkM2M5YzNlNWY3YjQ2YTA1YTliIDEwMDY0NAotLS0g
YS9Tb3VyY2UvV1RGL3d0Zi9QbGF0Zm9ybS5oCisrKyBiL1NvdXJjZS9XVEYvd3RmL1BsYXRmb3Jt
LmgKQEAgLTQ5MSw2ICs0OTEsNyBAQAogCiAjaWYgUExBVEZPUk0oR1RLKQogI2RlZmluZSBXVEZf
VVNFX0NBSVJPIDEKKyNkZWZpbmUgRU5BQkxFX0dMT0JBTF9GQVNUTUFMTE9DX05FVyAwCiAjZW5k
aWYKIAogCg==
</data>
<flag name="review"
          id="156612"
          type_id="1"
          status="+"
          setter="mrobinson"
    />
          </attachment>
      

    </bug>

</bugzilla>