Bug 146598 – Bmalloc: Crash on 32-bit Linux at bmalloc::Heap::allocateLarge() -> bmalloc::VMHeap::grow() .

• Component: New Bugs
• Status: NEW

[Carlos Alberto Lopez Perez]

Steps to reproduce the crash:

1. Build WebKitGTK+ on 32-bit Linux (I tested this with i686 and ARM builds, both are affected).

2. Open a Web page that tries to allocate a fairly amount of ram.

# For example use the test case of bug 146205 that allocates near 3GB (with the GTK port at least)
$ WebKitBuild/Release/bin/MiniBrowser http://people.igalia.com/clopez/apngmem/withapng.html

Result: The WebProcess crashes.



3. Now repeat the same but disabling bmalloc at runtime (by setting the env var Malloc=1)

$ Malloc=1 WebKitBuild/Release/bin/MiniBrowser http://people.igalia.com/clopez/apngmem/withapng.html

Now it don't crashes.


This is a different than bug 146440 because I tried the workaround of disabling the GCC tree-sra optimization but it didn't helped.

[Carlos Alberto Lopez Perez]

Created attachment 256119 [details]
GDB Backtrace on the coredump generated.

I'm attaching a GDB backtrace of the coredump when it crashes. The relevant parts:

#0  0xf4946f9c in bmalloc::VMHeap::grow() () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#1  0xf4943def in bmalloc::Heap::allocateLarge(std::lock_guard<bmalloc::StaticMutex>&, unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#2  0xf4942007 in bmalloc::Allocator::allocateLarge(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#3  0xf4942153 in bmalloc::Allocator::allocateSlowCase(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#4  0xf4942243 in bmalloc::Allocator::tryAllocate(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#5  0xf48fcfa7 in WTF::tryFastMalloc(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#6  0xf675350f in WebCore::ImageFrame::setSize(int, int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#7  0xf6760602 in WebCore::PNGImageDecoder::rowAvailable(unsigned char*, unsigned int, int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#8  0xf6760c14 in WebCore::rowAvailable(png_struct_def*, unsigned char*, unsigned long, int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37