Bug 246460 – [GTK] Crash in Nicosia::CompositionLayer::updateState/accessPending

• Component: WebKitGTK
• Status: RESOLVED WORKSFORME

[Michael Catanzaro]

I think this SIGSEGV is somehow a GTK 4 regression, because I don't remember seeing this with GTK 3:

(gdb) bt
#0  std::__atomic_base<unsigned char>::compare_exchange_weak(unsigned char&, unsigned char, std::memory_order, std::memory_order)
    (__m2=std::memory_order::acquire, __m1=std::memory_order::acquire, __i2=1 '\001', __i1=<synthetic pointer>: 0 '\000', this=0x18) at /usr/include/c++/12.1.0/bits/atomic_base.h:521
#1  std::__atomic_base<unsigned char>::compare_exchange_weak(unsigned char&, unsigned char, std::memory_order)
    (__m=std::memory_order::acquire, __i2=1 '\001', __i1=<synthetic pointer>: 0 '\000', this=0x18)
    at /usr/include/c++/12.1.0/bits/atomic_base.h:542
#2  WTF::Atomic<unsigned char>::compareExchangeWeak(unsigned char, unsigned char, std::memory_order)
    (order=std::memory_order::acquire, desired=1 '\001', expected=0 '\000', this=0x18)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/_builddir/WTF/Headers/wtf/Atomics.h:89
#3  WTF::LockAlgorithm<unsigned char, (unsigned char)1, (unsigned char)2, WTF::EmptyLockHooks<unsigned char> >::lockFastAssumingZero(WTF::Atomic<unsigned char>&) (lock=...)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/_builddir/WTF/Headers/wtf/LockAlgorithm.h:53
#4  WTF::Lock::lock() (this=0x18) at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/_builddir/WTF/Headers/wtf/Lock.h:65
#5  WTF::Locker<WTF::Lock>::Locker(WTF::Lock&) (lock=..., this=<synthetic pointer>)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/_builddir/WTF/Headers/wtf/Lock.h:158
#6  Nicosia::CompositionLayer::updateState<WebCore::ScrollingTreeFixedNode::applyLayerPositions()::<lambda(Nicosia::CompositionLayer::LayerState&)> > (functor=<optimized out>, this=0x0)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebCore/platform/graphics/nicosia/NicosiaPlatformLayer.h:212
#7  WebCore::ScrollingTreeFixedNode::applyLayerPositions() (this=<optimized out>)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebCore/page/scrolling/nicosia/ScrollingTreeFixedNode.cpp:135
#8  0x00007f89a3dbd0f5 in WebCore::ScrollingTree::applyLayerPositionsRecursive(WebCore::ScrollingTreeNode&)
    (this=0x7f8992104640, node=...)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebCore/page/scrolling/ScrollingTree.cpp:467
#9  0x00007f89a3dbd43f in WebCore::ScrollingTree::applyLayerPositionsRecursive(WebCore::ScrollingTreeNode&)
    (node=<optimized out>, this=0x7f8992104640)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebCore/page/scrolling/ScrollingTree.cpp:470
#10 WebCore::ScrollingTree::applyLayerPositionsInternal() (this=0x7f8992104640)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebCore/page/scrolling/ScrollingTree.cpp:462
#11 WebCore::ScrollingTree::applyLayerPositions() (this=0x7f8992104640)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebCore/page/scrolling/ScrollingTree.cpp:453
#12 0x00007f89a3d2f585 in WebCore::Page::finalizeRenderingUpdate(WTF::OptionSet<WebCore::FinalizeRenderingUpdateFlags>) (this=0x7f89920e4680, flags=...) at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebCore/page/Page.cpp:1851
#13 0x00007f89a2704abd in WebKit::WebPage::finalizeRenderingUpdate(WTF::OptionSet<WebCore::FinalizeRenderingUpdateFlags>) (this=<optimized out>, flags=..., flags@entry=...)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebKit/WebProcess/WebPage/WebPage.cpp:4457
#14 0x00007f89a273b103 in WebKit::CompositingCoordinator::flushPendingLayerChanges(WTF::OptionSet<WebCore::FinalizeRenderingUpdateFlags>) (this=0x7f8992157620, flags=...)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:134
#15 0x00007f89a2740d3b in WebKit::LayerTreeHost::layerFlushTimerFired() (this=0x7f8992157520)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.cpp:157
#16 WebKit::LayerTreeHost::layerFlushTimerFired() (this=0x7f8992157520)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.cpp:136
#17 0x00007f89a126b545 in operator() (__closure=0x0, userData=0x7f89921575f0)
    at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:177
#18 _FUN(gpointer) () at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:181
#19 0x00007f89a126bd4d in operator()
    (__closure=0x0, userData=0x7f89921575f0, callback=0x7f89a126b4d0 <_FUN(gpointer)>, source=0x55b2eadb6830) at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:53
#20 _FUN(GSource*, GSourceFunc, gpointer) () at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:56
#21 0x00007f899dcaf661 in g_main_dispatch (context=<optimized out>) at ../glib/gmain.c:3444
#22 g_main_context_dispatch (context=<optimized out>) at ../glib/gmain.c:4162
#23 0x00007f899dcafbb8 in g_main_context_iterate (context=0x55b2eab6b870, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4238
#24 0x00007f899dcafe9f in g_main_loop_run (loop=0x55b2eab666a0) at ../glib/gmain.c:4438
#25 0x00007f89a126beb0 in WTF::RunLoop::run() () at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WTF/wtf/glib/RunLoopGLib.cpp:108
#26 0x00007f89a274cc6f in WebKit::AuxiliaryProcessMainBase<WebKit::WebProcess, true>::run(int, char**) (argc=3, argv=0x7ffedd33e4e8, this=0x7ffedd33e350) at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebKit/Shared/AuxiliaryProcessMain.h:71
#27 WebKit::AuxiliaryProcessMainBase<WebKit::WebProcess, true>::run(int, char**) (argv=0x7ffedd33e4e8, argc=3, this=0x7ffedd33e350) at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebKit/Shared/AuxiliaryProcessMain.h:58
#28 WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainGtk>(int, char**) (argc=3, argv=0x7ffedd33e4e8) at /usr/lib/debug/source/sdk/webkit2gtk-5.0.bst/Source/WebKit/Shared/AuxiliaryProcessMain.h:97
#29 0x00007f89a16e454a in __libc_start_call_main (main=main@entry=0x55b2ea596060 <main>, argc=argc@entry=3, argv=argv@entry=0x7ffedd33e4e8) at ../sysdeps/nptl/libc_start_call_main.h:58
#30 0x00007f89a16e460b in __libc_start_main_impl (main=0x55b2ea596060 <main>, argc=3, argv=0x7ffedd33e4e8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=<optimized out>) at ../csu/libc-start.c:389
#31 0x000055b2ea596095 in _start ()

[Michael Catanzaro]

Created attachment 462962 [details]
Full backtrace

[Michael Catanzaro]

I found a reproducer! Visit https://github.com/WebKit/WebKit/wiki/GLib-Stable-Branches/_edit while logged in and try to save an edit to the page. The web process will hit this crash.

I guess no more stable branch backports for a little while. D:

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #2)
> I found a reproducer! Visit
> https://github.com/WebKit/WebKit/wiki/GLib-Stable-Branches/_edit while
> logged in and try to save an edit to the page. The web process will hit this
> crash.
> 
> I guess no more stable branch backports for a little while. D:

Sadly, this reproducer is no longer consistent for me. This crash is frequent enough that we'll know when it's gone, though.

[Michael Catanzaro]

This crash is presumably going to occur in Nicosia::CompositionLayer::accessPending now after bug #247186.

[Michael Catanzaro]

I don't remember seeing this crash for a few months now. Is it possible that it went away when we disabled the threaded renderer? I'm not sure.

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #3)
> Sadly, this reproducer is no longer consistent for me. This crash is
> frequent enough that we'll know when it's gone, though.

I'll close based on this comment. I gather this used to be a very major problem, but I haven't seen this crash in ages.