Bug 156053 – REGRESSION(r198792): [GTK] 79 new crashes on fast/profiler and inspector layout tests

• Component: WebKitGTK
• Status: RESOLVED DUPLICATE

[Carlos Alberto Lopez Perez]

Revision r198792 <http://trac.webkit.org/r198792> has caused 79 new crashes on the layout tests of the GTK+ port.

I double checked this by comparing the results of the layout test suite on r198791 and r198792 several times to discard flaky tests.

The new crashes on r198792 are:

Regressions: Unexpected crashes (79)
  fast/profiler/anonymous-event-handler.html [ Crash ]
  fast/profiler/anonymous-function-called-from-different-contexts.html [ Crash ]
  fast/profiler/anonymous-function-calls-built-in-functions.html [ Crash ]
  fast/profiler/anonymous-function-calls-eval.html [ Crash ]
  fast/profiler/anonymous-functions-with-display-names.html [ Crash ]
  fast/profiler/apply.html [ Crash ]
  fast/profiler/built-in-function-calls-anonymous.html [ Crash ]
  fast/profiler/built-in-function-calls-user-defined-function.html [ Crash ]
  fast/profiler/call.html [ Crash ]
  fast/profiler/calling-the-function-that-started-the-profiler-from-another-scope.html [ Crash ]
  fast/profiler/compare-multiple-profiles.html [ Crash ]
  fast/profiler/constructor.html [ Crash ]
  fast/profiler/dead-time.html [ Crash ]
  fast/profiler/document-dot-write.html [ Crash ]
  fast/profiler/event-handler.html [ Crash ]
  fast/profiler/execution-context-and-eval-on-same-line.html [ Crash ]
  fast/profiler/inline-event-handler.html [ Crash ]
  fast/profiler/many-calls-in-the-same-scope.html [ Crash ]
  fast/profiler/multiple-and-different-scoped-anonymous-function-calls.html [ Crash ]
  fast/profiler/multiple-and-different-scoped-function-calls.html [ Crash ]
  fast/profiler/multiple-anonymous-functions-called-from-the-same-function.html [ Crash ]
  fast/profiler/multiple-frames.html [ Crash ]
  fast/profiler/named-functions-with-display-names.html [ Crash ]
  fast/profiler/nested-anonymous-functon.html [ Crash ]
  fast/profiler/nested-start-and-stop-profiler.html [ Crash ]
  fast/profiler/one-execution-context.html [ Crash ]
  fast/profiler/profile-calls-in-included-file.html [ Crash ]
  fast/profiler/profile-with-no-title.html [ Crash ]
  fast/profiler/profiling-from-a-nested-location-but-stop-profiling-outside-the-nesting.html [ Crash ]
  fast/profiler/profiling-from-a-nested-location.html [ Crash ]
  fast/profiler/simple-event-call.html [ Crash ]
  fast/profiler/simple-no-level-change.html [ Crash ]
  fast/profiler/start-and-stop-profiler-multiple-times.html [ Crash ]
  fast/profiler/start-and-stop-profiling-in-the-same-function.html [ Crash ]
  fast/profiler/stop-profiling-after-setTimeout.html [ Crash ]
  fast/profiler/stop-then-function-call.html [ Crash ]
  fast/profiler/two-execution-contexts.html [ Crash ]
  fast/profiler/user-defined-function-calls-built-in-functions.html [ Crash ]
  fast/profiler/window-dot-eval.html [ Crash ]
  inspector/codemirror/prettyprinting-css-rules.html [ Crash ]
  inspector/codemirror/prettyprinting-css.html [ Crash ]
  inspector/codemirror/prettyprinting-javascript.html [ Crash ]
  inspector/console/addInspectedNode.html [ Crash ]
  inspector/console/clearMessages.html [ Crash ]
  inspector/console/command-line-api-copy.html [ Crash ]
  inspector/console/console-table.html [ Crash ]
  inspector/controller/runtime-controller.html [ Crash ]
  inspector/css/createStyleSheet.html [ Crash ]
  inspector/css/generate-css-rule-string.html [ Crash ]
  inspector/css/get-system-fonts.html [ Crash ]
  inspector/css/getAllStyleSheets.html [ Crash ]
  inspector/css/manager-preferredInspectorStyleSheetForFrame.html [ Crash ]
  inspector/css/matched-style-properties.html [ Crash ]
  inspector/css/pseudo-element-matches.html [ Crash ]
  inspector/css/selector-dynamic-specificity.html [ Crash ]
  inspector/css/selector-specificity.html [ Crash ]
  inspector/css/stylesheet-events-imports.html [ Crash ]
  inspector/css/stylesheet-with-mutations.html [ Crash ]
  inspector/heap/garbageCollected.html [ Crash ]
  inspector/heap/gc.html [ Crash ]
  inspector/heap/getPreview.html [ Crash ]
  inspector/heap/getRemoteObject.html [ Crash ]
  inspector/heap/snapshot.html [ Crash ]
  inspector/indexeddb/requestDatabaseNames.html [ Crash ]
  inspector/page/filter-cookies-for-domain.html [ Crash ]
  inspector/protocol/inspector-backend-invocation-return-value.html [ Crash ]
  inspector/script-profiler/event-type-Microtask.html [ Crash ]
  inspector/script-profiler/event-type-Other.html [ Crash ]
  inspector/unit-tests/array-utilities.html [ Crash ]
  inspector/unit-tests/event-listener-set.html [ Crash ]
  inspector/unit-tests/event-listener.html [ Crash ]
  inspector/unit-tests/heap-snapshot.html [ Crash ]
  inspector/unit-tests/inspector-test-dispatch-event-to-frontend.html [ Crash ]
  inspector/unit-tests/linked-list.html [ Crash ]
  inspector/unit-tests/list-multimap.html [ Crash ]
  inspector/unit-tests/number-utilities.html [ Crash ]
  inspector/unit-tests/object.html [ Crash ]
  inspector/unit-tests/test-harness-trivially-works.html [ Crash ]
  inspector/unit-tests/url-utilities.html [ Crash ]

[Carlos Alberto Lopez Perez]

Created attachment 275260 [details]
backtrace_r198875_inspector_heap_gc.txt

[Carlos Alberto Lopez Perez]

Created attachment 275261 [details]
backtrace_r198875_fast_profiler_window-dot-eval.txt

[Carlos Alberto Lopez Perez]

Created attachment 275262 [details]
backtrace_r198875_fast_profiler_call.txt

[Carlos Alberto Lopez Perez]

I have attached 3 backtraces generated on a GTK debug build at r198875.

All are crashing in the same place:

#0  strlen () at ../sysdeps/x86_64/strlen.S:106
#1  0x00007fb6e1bf3914 in WTF::StringImpl::create (string=0x3 <error: Cannot access memory at address 0x3>) at ../../Source/WTF/wtf/text/StringImpl.cpp:288
#2  0x00007fb6e1c064c3 in WTF::String::String (this=0x7fffe4fb24e8, characters=0x3 <error: Cannot access memory at address 0x3>) at ../../Source/WTF/wtf/text/WTFString.cpp:82
#3  0x00007fb6e6de7d36 in Inspector::Protocol::getEnumConstantValue (code=129) at DerivedSources/WebKit2/AutomationProtocolObjects.cpp:123


It seems WTF::String::String is trying to access an invalid memory address after Inspector::Protocol::getEnumConstantValue

[Carlos Garcia Campos]

*** This bug has been marked as a duplicate of bug 155745 ***