| Summary: | Nightly builds crash on launch in IconDatabase SQLiteStatement::prepare() for some users | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | drcarstens | ||||
| Component: | WebCore Misc. | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | NEW --- | ||||||
| Severity: | Major | CC: | ap, beidson, dbates, eren_kotan | ||||
| Priority: | P1 | Keywords: | InRadar | ||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Mac (Intel) | ||||||
| OS: | OS X 10.8 | ||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=180518 | ||||||
| Attachments: |
|
||||||
|
Description
drcarstens
2013-07-11 05:43:57 PDT
<rdar://problem/14343726> I can't reproduce this on my machine with current nightly (same OS and Safari version as in the crash log). *** Bug 118850 has been marked as a duplicate of this bug. *** Created attachment 213915 [details] A crashlog from WebKit r157214 crashing at launch The nightly builds I've tried have all crashed on launch, attaching a sample crashlog here. This seems 100% reproducible on one of my MacBook Pro, although never on my Mac Mini even though they're running the same version of OS X and WebKit nightly. Please let me know if you'd like me to gather any diagnostics from the Mac on which r157214 crashes. I've also tried a few other, slightly older nightlies, and they all crash on launch in the same manner. I've generally been the "icon database" guy but haven't touched any of this code in *a long* time. Somebody else introduced this, and somebody should try to find out what revision caused it. (It is recent, after all) Someone seeing this will have to set aside their ~/Library/Safari/WebpageIcons.db to see if it goes away. If it does, then you have a corrupt one. And we'd like to see it here. Note that attaching it would basically a leak of most URLs you've ever visited. The direct cause of this crash is that we're assuming that sqlite3_prepare_v2 always initializes the memory that pzTail points to:
const char* tail;
int error = sqlite3_prepare_v2(m_database.sqlite3Handle(), query.data(), lengthIncludingNullCharacter, &m_statement, &tail);
if (error != SQLITE_OK)
LOG(SQLDatabase, "sqlite3_prepare16 failed (%i)\n%s\n%s", error, query.data(), sqlite3_errmsg(m_database.sqlite3Handle()));
if (tail && *tail)
error = SQLITE_ERROR;
If it doesn't initialize it then tail will contain garbage and we'll happily dereference it.
|