Bug 28770 – Crashes in various layouttests on 64-bit Linux gtk+ build

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Priit Laes (IRC: plaes)]

[Thread debugging using libthread_db enabled]
[New Thread 0x7f7719927770 (LWP 30640)]
[New Thread 0x7f77096e5910 (LWP 30643)]
[New Thread 0x7f770a851910 (LWP 30642)]
[New Thread 0x7f770b79e910 (LWP 30641)]
0x00007f77103efa2f in __libc_waitpid (pid=30645, stat_loc=0x7fff597a5f50, 
    options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:41
	in ../sysdeps/unix/sysv/linux/waitpid.c
Current language:  auto; currently c
#0  0x00007f77103efa2f in __libc_waitpid (pid=30645, stat_loc=0x7fff597a5f50, 
    options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:41
#1  0x00007f770e800c76 in IA__g_spawn_sync (
    working_directory=<value optimized out>, argv=<value optimized out>, 
    envp=<value optimized out>, flags=<value optimized out>, 
    child_setup=<value optimized out>, user_data=<value optimized out>, 
    standard_output=0x0, standard_error=0x0, exit_status=0x0, 
    error=0x7fff597a60f8) at gspawn.c:386
#2  0x00007f770e800f5e in IA__g_spawn_command_line_sync (
    command_line=<value optimized out>, standard_output=0x0, 
    standard_error=0x0, exit_status=0x0, error=0x7fff597a60f8) at gspawn.c:700
#3  0x00007f770b9b4c96 in bugbuddy_segv_handle (signum=<value optimized out>)
    at gnome-breakpad.cc:369
#4  <signal handler called>
#5  JSC::FunctionExecutable::reparseExceptionInfo (this=0x7f770af95c40, 
    globalData=0x7f770af47800, scopeChainNode=0x0, 
    codeBlock=<value optimized out>)
    at ../JavaScriptCore/runtime/ScopeChain.h:65
#6  0x00000000004a934a in JSC::CodeBlock::reparseForExceptionInfoIfNecessary (
    this=) at ../JavaScriptCore/bytecode/CodeBlock.cpp:1441
#7  0x0000000000521e5d in cti_vm_throw (args=<value optimized out>)
    at ../JavaScriptCore/bytecode/CodeBlock.h:341
#8  0x000000000051dcb0 in ctiVMThrowTrampoline ()
#9  0x7fffffff00000001 in ?? ()
#10 0x00007f7708e85340 in ?? ()
#11 0x00007f77198bfaee in ?? ()
#12 0x00007f7700000002 in ?? ()
#13 0x00007f7708e80800 in ?? ()
#14 0x00007f7700000002 in ?? ()
#15 0x000000000000000f in ?? ()
#16 0x00007f7718a71d54 in WTF::fastFree (ptr=0x7fff597a69d0)
    at ../JavaScriptCore/wtf/FastMalloc.cpp:2838
#17 0x00007f7718a12d5f in JSC::Interpreter::execute (this=0x7f7708e84480, 
    functionExecutable=0x7f7703c00050, callFrame=0x7f770aed8a88, 
    function=0x7f770aeb6eb0, thisObj=<value optimized out>, 
    args=<value optimized out>, scopeChain=0x7f770af843c0, 
    exception=0x7f770af489f8) at ../JavaScriptCore/jit/JITCode.h:79
#18 0x00007f7718aa79d7 in JSC::JSFunction::call (this=0x7f7708e84480, 
    exec=0x7f770aed8a88, thisValue={m_ptr = 0x7f7708e80000}, 
    args=@0x7fff597a6b90) at ../JavaScriptCore/runtime/JSFunction.cpp:120
#19 0x00007f7718aa7a30 in JSC::call (exec=0x11, functionObject=
      {m_ptr = 0x7f770aea17c0}, callType=<value optimized out>, 
    callData=@0x0, thisValue={m_ptr = 0x0}, args=@0x11)
    at ../JavaScriptCore/runtime/CallData.cpp:39
#20 0x00007f7718b3ccd4 in WebCore::JSEventListener::handleEvent (
    this=0x7f770aeb6dc0, event=<value optimized out>, 
    isWindowEvent=<value optimized out>)
    at ../WebCore/bindings/js/JSEventListener.cpp:133
#21 0x00007f7718dccc25 in WebCore::DOMWindow::handleEvent (
    this=<value optimized out>, event=0x7f770af7c500, useCapture=false, 
    alternateListeners=<value optimized out>)
    at ../WebCore/page/DOMWindow.cpp:1254
#22 0x00007f7718dd23da in WebCore::DOMWindow::dispatchEventWithDocumentAsTarget (this=0x7f770aeb9e10, e=<value optimized out>, alternateEventListeners=0x0)
    at ../WebCore/page/DOMWindow.cpp:1334
#23 0x00007f7718dcd31b in WebCore::DOMWindow::dispatchLoadEvent (
    this=0x7f770aeb9e10) at ../WebCore/page/DOMWindow.cpp:1339
#24 0x00007f7718bff0fd in WebCore::Document::implicitClose (
    this=0x7f770aeda800) at ../WebCore/dom/Document.cpp:1657
#25 0x00007f7718d91502 in WebCore::FrameLoader::checkCompleted (
    this=0x7f770aeb3050) at ../WebCore/loader/FrameLoader.cpp:1259
#26 0x00007f7718dc0bb9 in WebCore::Loader::Host::didFinishLoading (
    this=0x7f770aeacdc0, loader=<value optimized out>)
    at ../WebCore/loader/loader.cpp:373
#27 0x00007f7718dafab3 in WebCore::SubresourceLoader::didFinishLoading (
    this=0x7f770af218c0) at ../WebCore/loader/SubresourceLoader.cpp:183
#28 0x00007f77190da409 in closeCallback (source=<value optimized out>, 
    res=0x19a8580)
    at ../WebCore/platform/network/soup/ResourceHandleSoup.cpp:680
#29 0x00007f770f311235 in async_ready_close_callback_wrapper (
    source_object=0x19a25e0, res=0x19a8580, user_data=0x0)
    at ginputstream.c:491
#30 0x00007f770f31d401 in complete_in_idle_cb_for_thread (
    _data=<value optimized out>) at gsimpleasyncresult.c:652
#31 0x00007f770e7cfadd in IA__g_main_context_dispatch (context=0x1923090)
    at gmain.c:1960
#32 0x00007f770e7d2da9 in g_main_context_iterate (context=0x1923090, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2591
#33 0x00007f770e7d2f08 in IA__g_main_context_iteration (context=0x1923090, 
    may_block=1) at gmain.c:2654
#34 0x000000000040c5ec in runTest (testPathOrURL=<value optimized out>)
    at ../WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp:433
#35 0x000000000040cd77 in main (argc=2, argv=0x7fff597a7b08)
    at ../WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp:693

Thread 4 (Thread 0x7f770b79e910 (LWP 30641)):
#0  pthread_cond_wait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:261
No locals.
#1  0x00007f7718a6f736 in WTF::TCMalloc_PageHeap::scavengerThread (
    this=0x7f771984cf00) at ../JavaScriptCore/wtf/FastMalloc.cpp:2291
No locals.
#2  0x00007f7718a6f759 in WTF::TCMalloc_PageHeap::runScavengerThread (
    context=0x7f771985afcc) at ../JavaScriptCore/wtf/FastMalloc.cpp:1429
No locals.
#3  0x00007f77103e82c7 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
	__res = <value optimized out>
	pd = (struct pthread *) 0x7f770b79e910
	unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140149270374672, 
        -4049043045532099539, 140149350407776, 140149270372768, 0, 4096, 
        4116569602862554157, 4116510719867952173}, mask_was_saved = 0}}, 
  priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
      canceltype = 0}}}
	not_first_call = <value optimized out>
	robust = <value optimized out>
#4  0x00007f770dd7238d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#5  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 3 (Thread 0x7f770a851910 (LWP 30642)):
#0  pthread_cond_wait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:261
No locals.
#1  0x0000000000416a36 in WTF::TCMalloc_PageHeap::scavengerThread (
    this=0x792f60) at ../JavaScriptCore/wtf/FastMalloc.cpp:2291
No locals.
#2  0x0000000000416a59 in WTF::TCMalloc_PageHeap::runScavengerThread (
    context=0x7a102c) at ../JavaScriptCore/wtf/FastMalloc.cpp:1429
No locals.
#3  0x00007f77103e82c7 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
	__res = <value optimized out>
	pd = (struct pthread *) 0x7f770a851910
	unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140149254330640, 
        -4049043045532099539, 140149350407776, 140149254328736, 0, 4096, 
        4116569093372058669, 4116510719867952173}, mask_was_saved = 0}}, 
  priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
      canceltype = 0}}}
	not_first_call = <value optimized out>
	robust = <value optimized out>
#4  0x00007f770dd7238d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#5  0x0000000000000000 in ?? ()
No symbol table info available.
Current language:  auto; currently asm

Thread 2 (Thread 0x7f77096e5910 (LWP 30643)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:220
No locals.
#1  0x00007f77105ff45c in g_cond_timed_wait_posix_impl (cond=0x19ac804, 
    entered_mutex=0x80, abs_time=<value optimized out>) at gthread-posix.c:242
	result = <value optimized out>
	end_time = {tv_sec = 1251372243, tv_nsec = 476762000}
	timed_out = <value optimized out>
	__PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#2  0x00007f770e7aea17 in g_async_queue_pop_intern_unlocked (queue=0x1977290, 
    try=0, end_time=0x7f77096e5000) at gasyncqueue.c:365
	retval = <value optimized out>
	__PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#3  0x00007f770e7aeb06 in IA__g_async_queue_timed_pop (queue=0x1977290, 
    end_time=<value optimized out>) at gasyncqueue.c:491
	retval = <value optimized out>
	__PRETTY_FUNCTION__ = "IA__g_async_queue_timed_pop"
#4  0x00007f770e7f51d0 in g_thread_pool_thread_proxy (
    data=<value optimized out>) at gthreadpool.c:121
	task = <value optimized out>
	pool = (GRealThreadPool *) 0x19542d0
#5  0x00007f770e7f3f7b in g_thread_create_proxy (data=0x1954390)
    at gthread.c:635
	__PRETTY_FUNCTION__ = "g_thread_create_proxy"
#6  0x00007f77103e82c7 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
	__res = <value optimized out>
	pd = (struct pthread *) 0x7f77096e5910
	unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140149236062480, 
        -4049043045532099539, 140734694580336, 140149236060576, 
        140149236062480, 4096, 4116565011005643821, 4116510719867952173}, 
      mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {
      prev = 0x0, cleanup = 0x0, canceltype = 0}}}
	not_first_call = <value optimized out>
	robust = <value optimized out>
#7  0x00007f770dd7238d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#8  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 1 (Thread 0x7f7719927770 (LWP 30640)):
#0  0x00007f77103efa2f in __libc_waitpid (pid=30645, stat_loc=0x7fff597a5f50, 
    options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:41
	oldtype = 0
	result = <value optimized out>
#1  0x00007f770e800c76 in IA__g_spawn_sync (
    working_directory=<value optimized out>, argv=<value optimized out>, 
    envp=<value optimized out>, flags=<value optimized out>, 
    child_setup=<value optimized out>, user_data=<value optimized out>, 
    standard_output=0x0, standard_error=0x0, exit_status=0x0, 
    error=0x7fff597a60f8) at gspawn.c:386
	outpipe = -1
	errpipe = -1
	pid = 30645
	fds = {__fds_bits = {0, 16, 16, 0, 140149144947176, 140734694580472, 
    26539344, 140149144947152, 3, 0, 140149144947176, 140149321008546, 
    206158430232, 140734694580048, 140734694580184, 0}}
	ret = -512
	outstr = (GString *) 0x0
	errstr = (GString *) 0x0
	failed = 0
	status = <value optimized out>
	__PRETTY_FUNCTION__ = "IA__g_spawn_sync"
#2  0x00007f770e800f5e in IA__g_spawn_command_line_sync (
    command_line=<value optimized out>, standard_output=0x0, 
    standard_error=0x0, exit_status=0x0, error=0x7fff597a60f8) at gspawn.c:700
	retval = <value optimized out>
	argv = (gchar **) 0x7f77040009d0
	__PRETTY_FUNCTION__ = "IA__g_spawn_command_line_sync"
#3  0x00007f770b9b4c96 in bugbuddy_segv_handle (signum=<value optimized out>)
    at gnome-breakpad.cc:369
	in_segv = 1
#4  <signal handler called>
No locals.
#5  JSC::FunctionExecutable::reparseExceptionInfo (this=0x7f770af95c40, 
    globalData=0x7f770af47800, scopeChainNode=0x0, 
    codeBlock=<value optimized out>)
    at ../JavaScriptCore/runtime/ScopeChain.h:65
	scopeChain = {m_node = 0x7f7708e80080}
	generator = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, m_ptr = 0x7f770af7aae0}
	newJITCode = {m_ref = {m_code = {m_value = 0x0}, 
    m_executablePool = {<WTF::FastAllocBase> = {<No data fields>}, 
      m_ptr = 0x7f7718c1fda6}, m_size = 0}}
#6  0x00000000004a934a in JSC::CodeBlock::reparseForExceptionInfoIfNecessary (
    this=) at ../JavaScriptCore/bytecode/CodeBlock.cpp:1441
	scopeChain = (class JSC::ScopeChainNode *) 0x0
#7  0x0000000000521e5d in cti_vm_throw (args=<value optimized out>)
    at ../JavaScriptCore/bytecode/CodeBlock.h:341
	callFrame = (CallFrame *) 0x7fff597a6840
	exceptionValue = {m_ptr = 0x7f77198bfaee}
	stackFrame = (JSC::JITStackFrame &) @0x7fff597a6930: {
  reserved = 0x7fffffff00000001, args = {{asPointer = 0x7f7708e85340, 
      asEncodedJSValue = 0x7f7708e85340, asInt32 = 149443392}, {
      asPointer = 0x7f77198bfaee, asEncodedJSValue = 0x7f77198bfaee, 
      asInt32 = 428604142}, {asPointer = 0x7f7700000002, 
      asEncodedJSValue = 0x7f7700000002, asInt32 = 2}, {
      asPointer = 0x7f7708e80800, asEncodedJSValue = 0x7f7708e80800, 
      asInt32 = 149424128}, {asPointer = 0x7f7700000002, 
      asEncodedJSValue = 0x7f7700000002, asInt32 = 2}, {asPointer = 0xf, 
      asEncodedJSValue = 0xf, asInt32 = 15}}, padding = {0x7f7718a71d54, 
    0x7f770af9a700}, code = 0x7f77198cc5e0, registerFile = 0x7f770aeb6ec0, 
  callFrame = 0x7f7703c00198, exception = 0x7f770af489f8, 
  enabledProfilerReference = 0x7f7719837990, globalData = 0x7f770af47800, 
  savedRBX = 0x7f7703c00000, savedR15 = 0x7f7708e84480, 
  savedR14 = 0x7f770af9a700, savedR13 = 0x7f770aed8a88, 
  savedR12 = 0x7f7703c00050, savedRBP = 0x7f770aeb6eb0, 
  savedRIP = 0x7f7718a12d5f}
	codeBlock = (class JSC::CodeBlock *) 0x7f7708300a80
	globalData = (class JSC::JSGlobalData *) 0x7f770af47800
	vPCIndex = <value optimized out>
	handler = <value optimized out>
#8  0x000000000051dcb0 in ctiVMThrowTrampoline ()
No symbol table info available.
#9  0x7fffffff00000001 in ?? ()
No symbol table info available.
#10 0x00007f7708e85340 in ?? ()
No symbol table info available.
#11 0x00007f77198bfaee in ?? ()
No symbol table info available.
#12 0x00007f7700000002 in ?? ()
No symbol table info available.
#13 0x00007f7708e80800 in ?? ()
No symbol table info available.
#14 0x00007f7700000002 in ?? ()
No symbol table info available.
#15 0x000000000000000f in ?? ()
No symbol table info available.
#16 0x00007f7718a71d54 in WTF::fastFree (ptr=0x7fff597a69d0)
    at ../JavaScriptCore/wtf/FastMalloc.cpp:2838
No locals.
#17 0x00007f7718a12d5f in JSC::Interpreter::execute (this=0x7f7708e84480, 
    functionExecutable=0x7f7703c00050, callFrame=0x7f770aed8a88, 
    function=0x7f770aeb6eb0, thisObj=<value optimized out>, 
    args=<value optimized out>, scopeChain=0x7f770af843c0, 
    exception=0x7f770af489f8) at ../JavaScriptCore/jit/JITCode.h:79
	oldEnd = (JSC::Register *) 0x7f7703c00000
	argc = <value optimized out>
	dst = <value optimized out>
	end = (const JSC::JSValue *) 0x11
#18 0x00007f7718aa79d7 in JSC::JSFunction::call (this=0x7f7708e84480, 
    exec=0x7f770aed8a88, thisValue={m_ptr = 0x7f7708e80000}, 
    args=@0x7fff597a6b90) at ../JavaScriptCore/runtime/JSFunction.cpp:120
No locals.
#19 0x00007f7718aa7a30 in JSC::call (exec=0x11, functionObject=
      {m_ptr = 0x7f770aea17c0}, callType=<value optimized out>, 
    callData=@0x0, thisValue={m_ptr = 0x0}, args=@0x11)
    at ../JavaScriptCore/runtime/CallData.cpp:39
No locals.
#20 0x00007f7718b3ccd4 in WebCore::JSEventListener::handleEvent (
    this=0x7f770aeb6dc0, event=<value optimized out>, 
    isWindowEvent=<value optimized out>)
    at ../WebCore/bindings/js/JSEventListener.cpp:133
	args = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, static inlineCapacity = <optimized out>, 
  m_buffer = 0x7fff597a6b40, m_size = 1, m_isUsingInlineBuffer = true, 
  m_vector = {<WTF::FastAllocBase> = {<No data fields>}, m_size = 1, 
    m_buffer = {<WTF::VectorBufferBase<JSC::Register>> = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, 
        m_buffer = 0x7fff597a6b40, m_capacity = 8}, 
      static m_inlineBufferSize = <optimized out>, m_inlineBuffer = {
        buffer = "@Eè\bw\177\000\000FÒë\nw\177", '\0' <repeats 26 times>, "h,ê\nw\177\000\000 Èê\nw\177\000\000h,ê\nw\177\000"}}}, m_markSet = 0x0}
	savedEvent = (class WebCore::Event *) 0x0
	retval = <value optimized out>
	globalObject = (class WebCore::JSDOMGlobalObject *) 0x7f7708e80080
	scriptExecutionContext = (class WebCore::ScriptExecutionContext
     *) 0x7f770aeda858
	callData = {native = {function = 0x7f770af9a700}, js = {
    functionExecutable = 0x7f770af9a700, scopeChain = 0x7f770af843c0}}
	callType = JSC::CallTypeJS
	jsFunction = (class JSC::JSObject *) 0x7f7708e84480
	exec = (class JSC::ExecState *) 0x7f770aed8a88
#21 0x00007f7718dccc25 in WebCore::DOMWindow::handleEvent (
    this=<value optimized out>, event=0x7f770af7c500, useCapture=false, 
    alternateListeners=<value optimized out>)
    at ../WebCore/page/DOMWindow.cpp:1254
	r = <value optimized out>
	i = 0
	listeners = <value optimized out>
	listenersCopy = {<WTF::FastAllocBase> = {<No data fields>}, 
  m_size = 1, 
  m_buffer = {<WTF::VectorBufferBase<WTF::RefPtr<WebCore::RegisteredEventListener> >> = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, m_buffer = 0x7f770af24080, 
      m_capacity = 16}, <No data fields>}}
	size = 1
#22 0x00007f7718dd23da in WebCore::DOMWindow::dispatchEventWithDocumentAsTarget (this=0x7f770aeb9e10, e=<value optimized out>, alternateEventListeners=0x0)
    at ../WebCore/page/DOMWindow.cpp:1334
No locals.
#23 0x00007f7718dcd31b in WebCore::DOMWindow::dispatchLoadEvent (
    this=0x7f770aeb9e10) at ../WebCore/page/DOMWindow.cpp:1339
	ownerElement = <value optimized out>
#24 0x00007f7718bff0fd in WebCore::Document::implicitClose (
    this=0x7f770aeda800) at ../WebCore/dom/Document.cpp:1657
	wasLocationChangePending = <value optimized out>
	f = (class WebCore::Frame *) 0x7f770aeb3000
	renderObject = <value optimized out>
#25 0x00007f7718d91502 in WebCore::FrameLoader::checkCompleted (
    this=0x7f770aeb3050) at ../WebCore/loader/FrameLoader.cpp:1259
No locals.
#26 0x00007f7718dc0bb9 in WebCore::Loader::Host::didFinishLoading (
    this=0x7f770aeacdc0, loader=<value optimized out>)
    at ../WebCore/loader/loader.cpp:373
	request = (class WebCore::Request *) 0x7f770aeaf840
	docLoader = (class WebCore::DocLoader *) 0x7f770aeacc80
	resource = (class WebCore::CachedResource *) 0x7f770af18e00
#27 0x00007f7718dafab3 in WebCore::SubresourceLoader::didFinishLoading (
    this=0x7f770af218c0) at ../WebCore/loader/SubresourceLoader.cpp:183
No locals.
#28 0x00007f77190da409 in closeCallback (source=<value optimized out>, 
    res=0x19a8580)
    at ../WebCore/platform/network/soup/ResourceHandleSoup.cpp:680
	d = (class WebCore::ResourceHandleInternal *) 0x7f770af2a000
	client = (class WebCore::ResourceHandleClient *) 0x7f770af218c0
#29 0x00007f770f311235 in async_ready_close_callback_wrapper (
    source_object=0x19a25e0, res=0x19a8580, user_data=0x0)
    at ginputstream.c:491
	stream = (GInputStream *) 0x19a25e0
#30 0x00007f770f31d401 in complete_in_idle_cb_for_thread (
    _data=<value optimized out>) at gsimpleasyncresult.c:652
	data = (RunInThreadData *) 0x7f7704000c60
	simple = (GSimpleAsyncResult *) 0x19a8580
#31 0x00007f770e7cfadd in IA__g_main_context_dispatch (context=0x1923090)
    at gmain.c:1960
No locals.
#32 0x00007f770e7d2da9 in g_main_context_iterate (context=0x1923090, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2591
	max_priority = 0
	timeout = 0
	some_ready = 1
	nfds = 3
	allocated_nfds = 243130588
	fds = <value optimized out>
	__PRETTY_FUNCTION__ = "g_main_context_iterate"
#33 0x00007f770e7d2f08 in IA__g_main_context_iteration (context=0x1923090, 
    may_block=1) at gmain.c:2654
	retval = <value optimized out>
#34 0x000000000040c5ec in runTest (testPathOrURL=<value optimized out>)
    at ../WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp:433
	pathOrURL = {static npos = 18446744073709551615, 
  _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, 
    _M_p = 0x1952518 "/home/plaes/code/WebKit/LayoutTests/dom/html/level1/core/documentinvalidcharacterexceptioncreateentref.html"}}
	url = (gchar *) 0x1952740 ""
	testURL = {static npos = 18446744073709551615, 
  _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, 
    _M_p = 0x1952948 "file:///home/plaes/code/WebKit/LayoutTests/dom/html/level1/core/documentinvalidcharacterexceptioncreateentref.html"}}
	bfList = <value optimized out>
	expectedPixelHash = {static npos = 18446744073709551615, 
  _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x77b978 ""}}
	separatorPos = <value optimized out>
	size = {x = 0, y = 0, width = 800, height = 600}
#35 0x000000000040cd77 in main (argc=2, argv=0x7fff597a7b08)
    at ../WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp:693
	filenameBuffer = "/home/plaes/code/WebKit/LayoutTests/dom/html/level1/core/documentinvalidcharacterexceptioncreateentref.html\000\000\177\000\000\220qzYÿ\177\000\000\000\000\000\000\000\000\000\000\2147@\000\000\000\000\000w¼\206\031w\177\000\000\001\000\000\000w\177\000\000È\004¥\031w\177\000\000ÀqzYÿ\177\000\000\000\000\000\000\000\000\000\000\2017@\000\000\000\000\000w¼\206\031w\177\000\000\001\000\000\000w\177\000\000"...
	options = {{name = 0x540b4e "notree", has_arg = 0, flag = 0x77b780, 
    val = 0}, {name = 0x540b55 "pixel-tests", has_arg = 0, flag = 0x77da50, 
    val = 1}, {name = 0x540b50 "tree", has_arg = 0, flag = 0x77b780, 
    val = 1}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
	option = -1
	window = (GtkWidget *) 0x19203b0
0x00007f77103efa2f	41	in ../sysdeps/unix/sysv/linux/waitpid.c
Current language:  auto; currently c

[Jan Alonzo]

Is there a test case, or list of layout tests, so it's easier to replicate this?

[Priit Laes (IRC: plaes)]

Created attachment 38784 [details]
results.html

The stderr report is mostly complains about missing bug-buddy..

[Jan Alonzo]

How are you running the layout tests, what version of toolchain and configure options to build webkit will definitely help. Are you running the test in a debug build?

[Priit Laes (IRC: plaes)]

(In reply to comment #3)
> How are you running the layout tests, what version of toolchain and configure
> options to build webkit will definitely help. Are you running the test in a
> debug build?

* WebKit configuration (no debugging enabled, only option used is --prefix), using WebKitBuild directory:
../configure --prefix=/home/plaes/opt/

* Toolchain
gcc version 4.4.1 (Gentoo 4.4.1 p1.0)
GNU Binutils 2.19.1

* Running layout tests (from WebKitBuild dir):
../WebKitTools/Scripts/run-webkit-tests --gtk --no-http --no-launch-safari

[Priit Laes (IRC: plaes)]

I assume this is related to GCC's aliasing rules (which GCC warns about), as I'm not getting these crashes when building without optimizations.

[Eric Seidel (no email)]

I'm not sure if this is still an actionable bug.  Should this still be open?

[Priit Laes (IRC: plaes)]

Yeah, this issue was fixed a while ago in different bug (and thus this one was forgotten).