Bug 48906 – Random crash after some tens of minutes of use in r71186/WinXP

• Component: WebKit Misc.
• Status: RESOLVED FIXED

[Jyrki Wahlstedt]

crash dump attached, this crash is not related with any certain page, some (Flash) plugin action going on at the moment of crash, but that does not seem to be the immediate cause, as that had been running earlier quite ok...

[Jyrki Wahlstedt]

Created attachment 72812 [details]
Crash in _tailMerge_QTMovieWin_dll from r71186

[Jyrki Wahlstedt]

Hm, this might be caused by system issues, not having to do anything at all with Webkit...
If I get more crashes, I'll add crash dump, but atm no action necessary.

[Jyrki Wahlstedt]

I'll attach a new crash dump, this is from r71499... I managed to take a look at the situation in Task Manager. It showed that the memory usage was over 1GB! I have a few pages open, but that kind of an amount is extraordinary.

NB! Not sure, though, that the crash dumps have anything to do with each other:(

[Jyrki Wahlstedt]

Created attachment 73488 [details]
Crash in CoreGraphics (ycc_rgbx_convert) from r71499

[Jyrki Wahlstedt]

Additional crash a few minutes after the previous, with no huge memory usage at this time... The additional feature here was that Windows decided to closed the program 'to protect the system':(
Crash dump attached from this, too

[Jyrki Wahlstedt]

Created attachment 73491 [details]
Crash in CSSStyleSelector::applyProperty from r71499 (closed by Windows)

[Adam Roben (:aroben)]

Comment on attachment 73488 [details]
Crash in CoreGraphics (ycc_rgbx_convert) from r71499

This crash is inside CoreGraphics in the ycc_rgbx_convert function, and is covered by <rdar://problem/7440748>.

[Adam Roben (:aroben)]

Comment on attachment 72812 [details]
Crash in _tailMerge_QTMovieWin_dll from r71186

Here's the !analyze output for this crash:


FAULTING_IP: 
kernel32!RaiseException+53
7c812afb 5e              pop     esi

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c812afb (kernel32!RaiseException+0x00000053)
   ExceptionCode: c06d007e
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 0012f1a4

BUGCHECK_STR:  c06d007e

DEFAULT_BUCKET_ID:  APPLICATION_FAULT

PROCESS_NAME:  Safari.exe

ERROR_CODE: (NTSTATUS) 0xc06d007e - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc06d007e - <Unable to get error code text>

EXCEPTION_PARAMETER1:  0012f1a4

FAULTING_THREAD:  000001b4

LAST_CONTROL_TRANSFER:  from 037e6062 to 7c812afb

STACK_TEXT:  
0012f180 037e6062 c06d007e 00000000 00000001 kernel32!RaiseException+0x53
0012f1e8 037e5c7b 00000104 0012f1a4 757ecf30 WebKit!__delayLoadHelper2+0x13b [f:\dd\vctools\delayimp\delayhlp.cpp @ 331]
0012f2e0 033d5000 0012f300 0012f304 06a40158 WebKit!_tailMerge_QTMovieWin_dll+0xd
00000000 00000000 00000000 00000000 00000000 WebKit!WebCore::jsDOMParserPrototypeFunctionParseFromString+0x1f0 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\build-release\obj\webcore\derivedsources\jsdomparser.cpp @ 200]


STACK_COMMAND:  ~0s; .ecxr ; kb

FOLLOWUP_IP: 
WebKit!_tailMerge_QTMovieWin_dll+d
037e5c7b 5a              pop     edx

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  WebKit!_tailMerge_QTMovieWin_dll+d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WebKit

IMAGE_NAME:  WebKit.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4cd0e3c4

BUCKET_ID:  c06d007e_WebKit!_tailMerge_QTMovieWin_dll+d

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

FAILURE_BUCKET_ID:  APPLICATION_FAULT_c06d007e_WebKit.dll!_tailMerge_QTMovieWin_dll

Followup: MachineOwner

[Adam Roben (:aroben)]

(In reply to comment #8)
> (From update of attachment 72812 [details])
> SYMBOL_NAME:  WebKit!_tailMerge_QTMovieWin_dll+d

This mean that QTMovieWin.dll could not be found. Jyrki, could you please confirm that your r71186 WebKit nightly included QTMovieWin.dll?

[Adam Roben (:aroben)]

Comment on attachment 73491 [details]
Crash in CSSStyleSelector::applyProperty from r71499 (closed by Windows)

The backtrace shows that this crash happened when Safari's Preferences dialog was being opened. Here's the !analyze output for this crash:


FAULTING_IP: 
+478bffff
478bffff ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 478bffff
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000008
   Parameter[1]: 478bffff
Attempt to execute non-executable address 478bffff

DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT

PROCESS_NAME:  Safari.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  478bffff

WRITE_ADDRESS:  478bffff 

FOLLOWUP_IP: 
WebKit!WebCore::CSSStyleSelector::applyProperty+27 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\css\cssstyleselector.cpp @ 3139]
035e9347 84c0            test    al,al

FAILED_INSTRUCTION_ADDRESS: 
+478bffff
478bffff ??              ???

IP_ON_HEAP:  478bffff

FAULTING_THREAD:  000019f8

PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT

BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_INSTRUCTION_PTR

LAST_CONTROL_TRANSFER:  from 035e9347 to 478bffff

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013e478 035e9347 6fd54ee0 7fecfaac 00000001 0x478bffff
0013e818 035f8593 00000000 002e0030 7eec8040 WebKit!WebCore::CSSStyleSelector::applyProperty+0x27 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\css\cssstyleselector.cpp @ 3139]
0013e834 035e54fd 7eec8040 00000000 00000004 WebKit!WebCore::CSSStyleSelector::applyDeclarations<1>+0x63 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\css\cssstyleselector.cpp @ 2982]
0013e870 03297894 0013e8ac 7ecca540 00000000 WebKit!WebCore::CSSStyleSelector::styleForElement+0x81d [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\css\cssstyleselector.cpp @ 1337]
0013e8b4 0328b786 00000004 7fe9c204 00000000 WebKit!WebCore::Element::recalcStyle+0x164 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\dom\element.cpp @ 968]
0013e8dc 03796f1e 00000004 05d7f014 77124ba2 WebKit!WebCore::Document::recalcStyle+0x176 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\dom\document.cpp @ 1511]
0013e964 0379617d 7ef07480 785da4b0 785da428 WebKit!WebView::notifyPreferencesChanged+0xd6e [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webkit\win\webview.cpp @ 4792]
0013e988 03785504 7ef0749c 7fe0da68 7fe9c200 WebKit!WebView::onNotify+0x10d [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webkit\win\webview.cpp @ 4466]
0013e9bc 03785895 7fe96130 7fe0da68 7fe9c200 WebKit!WebNotificationCenter::postNotificationInternal+0x84 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webkit\win\webnotificationcenter.cpp @ 131]
0013e9d8 037865d2 7fe96130 00178454 7fe9c200 WebKit!WebNotificationCenter::postNotificationName+0x45 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webkit\win\webnotificationcenter.cpp @ 189]
0013e9f4 037929f8 7fe9c200 7ae0b3c0 00000000 WebKit!WebPreferences::postPreferencesChangesNotification+0x42 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webkit\win\webpreferences.cpp @ 146]
0013ea6c 00cb12cc 75aee120 00000000 00000000 WebKit!WebView::initWithFrame+0x538 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webkit\win\webview.cpp @ 2637]
0013eab8 00cb11a0 75aee120 7ae0b3cc 00bdcee8 Safari_b30000!WebViewControlBase::initializeWebView+0x11c
0013eac4 00bdcee8 00000000 00bdcf87 000e0844 Safari_b30000!WebViewControlBase::onCreate+0x30
0013eacc 00bdcf87 000e0844 00000001 00000000 Safari_b30000!WebViewControlBase::ProcessWindowMessage+0x18
0013eae8 00b71d68 000e0844 00000001 00000000 Safari_b30000!WebViewControl::ProcessWindowMessage+0x27
0013eb30 7e418734 7ae0b3cc 00000000 00000000 Safari_b30000!ATL::CWindowImplBaseT<ATL::CWindow,ATL::CWinTraits<101646336,0> >::WindowProc+0x58
0013eb5c 7e418816 05dc90c0 000e0844 00000001 user32!InternalCallWinProc+0x28
0013ebc4 7e428ea0 00000000 05dc90c0 000e0844 user32!UserCallWinProcCheckWow+0x150
0013ec18 7e42ce7c 008e4ad0 00000001 00000000 user32!DispatchClientMessage+0xa3
0013ec48 7c90e473 0013ec58 00000068 00000068 user32!__fnINLPCREATESTRUCT+0x8b
0013ecbc 7e42e389 7e42e34f 00000004 0013f1b0 ntdll!KiUserCallbackDispatcher+0x13
0013f160 7e4269c7 00000004 0013f1b0 0013f1c4 user32!NtUserCreateWindowEx+0xc
0013f238 7e42683e 00000000 009174b0 00000068 user32!InternalCreateDialog+0x929
0013f25c 7e41ea84 00b30000 01268eec 000c0792 user32!CreateDialogIndirectParamAorW+0x33
0013f288 00bf3aac 00b30000 000009c6 000c0792 user32!CreateDialogParamW+0x49
0013f2a0 00bf3a1e 000c0792 7483d500 00bf4907 Safari_b30000!ATL::CDialogImpl<WebViewMetalDialog,ATL::CWindow>::Create+0x7c
0013f2ac 00bf4907 000c0792 7e42929a 00000001 Safari_b30000!PreferencePane::createWindow+0xe
0013f2d4 00bf434a 7d3766c0 7779b460 00b30000 Safari_b30000!PreferencesDlg::addPage+0x97
0013f2fc 00bf5d3f 0064090c 00000000 0013f354 Safari_b30000!PreferencesDlg::customInitDialog+0xfa
0013f320 00bf5a80 7779b460 0064090c 00000000 Safari_b30000!SafariDialog<PreferencesDlg>::onInitDialog+0x11f
0013f338 00bf5a20 000c0792 00000110 0064090c Safari_b30000!SafariDialog<PreferencesDlg>::ProcessWindowMessage+0x30
0013f368 00bf3ef0 000c0792 00000110 0064090c Safari_b30000!MetalDialog<PreferencesDlg>::ProcessWindowMessage+0x60
0013f398 00b8ca89 000c0792 00000110 0064090c Safari_b30000!PreferencesDlg::ProcessWindowMessage+0x330
0013f3e0 7e418734 00000000 00000000 0064090c Safari_b30000!ATL::CDialogImplBaseT<ATL::CWindow>::DialogProc+0x59
0013f40c 7e423ce4 05dc2148 000c0792 00000110 user32!InternalCallWinProc+0x28
0013f478 7e423b30 00000000 05dc2148 000c0792 user32!UserCallDlgProcCheckWow+0x146
0013f4c0 7e421d9a 00000000 00000110 0064090c user32!DefDlgProcWorker+0xa8
0013f4f0 7e42651a 00930528 00917250 0064090c user32!SendMessageWorker+0x448
0013f5a8 7e42683e 00000000 00930528 0000005c user32!InternalCreateDialog+0x9df
0013f5cc 7e41ea84 00b30000 01268a60 00000000 user32!CreateDialogIndirectParamAorW+0x33
0013f5f8 00bc7568 00b30000 00000082 00000000 user32!CreateDialogParamW+0x49
0013f614 00bbb4c0 0001515e 00b34a53 7fc4ca00 Safari_b30000!ATL::CDialogImpl<PreferencesDlg,ATL::CWindow>::Create+0x78
0013f61c 00b34a53 7fc4ca00 0001515e 7fc4ca00 Safari_b30000!SafariWindow::onShowPrefsDialog+0x40
0013f640 00b71d68 00050b8c 00000111 0001515e Safari_b30000!SafariWindow::ProcessWindowMessage+0xa73
0013f688 7e418734 00000000 00000000 0001515e Safari_b30000!ATL::CWindowImplBaseT<ATL::CWindow,ATL::CWinTraits<101646336,0> >::WindowProc+0x58
0013f6b4 7e418816 05db6ed8 00050b8c 00000111 user32!InternalCallWinProc+0x28
0013f71c 7e42a013 00000000 05db6ed8 00050b8c user32!UserCallWinProcCheckWow+0x150
0013f74c 7e42a039 05db6ed8 00050b8c 00000111 user32!CallWindowProcAorW+0x98
0013f76c 00bf5bb2 05db6ed8 00050b8c 00000111 user32!CallWindowProcW+0x1b
0013f7b0 7e418734 00000000 00000111 0001515e Safari_b30000!ATL::CContainedWindowT<WTL::CTabCtrlT<ATL::CWindow>,ATL::CWinTraits<1442840576,0> >::WindowProc+0x82
0013f7dc 7e418816 05d82200 00050b8c 00000111 user32!InternalCallWinProc+0x28
0013f844 7e42a013 00000000 05d82200 00050b8c user32!UserCallWinProcCheckWow+0x150
0013f874 7e42a039 05d82200 00050b8c 00000111 user32!CallWindowProcAorW+0x98
0013f894 0355c1df 05d82200 00050b8c 00000111 user32!CallWindowProcW+0x1b
0013f8cc 7e418734 00050b8c 00000111 0001515e WebKit!WebCore::WindowMessageBroadcaster::SubclassedWndProc+0xbf [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\platform\win\windowmessagebroadcaster.cpp @ 128]
0013f8f8 7e418816 0355c120 00050b8c 00000111 user32!InternalCallWinProc+0x28
0013f960 7e428ea0 00000000 0355c120 00050b8c user32!UserCallWinProcCheckWow+0x150
0013f9b4 7e428eec 0094b278 00000111 0001515e user32!DispatchClientMessage+0xa3
0013f9dc 7c90e473 0013f9ec 00000018 0094b278 user32!__fnDWORD+0x24
0013fa00 7e42fb07 7e4366c8 00050b8c 0355061b ntdll!KiUserCallbackDispatcher+0x13
0013fa18 00b479d3 00050b8c 0355061b 0013fc8c user32!NtUserTranslateAccelerator+0xc
0013fa28 00bab897 00000000 7fe90480 0013fcac Safari_b30000!WTL::CFrameWindowImplBase<ATL::CWindow,ATL::CWinTraits<101646336,0> >::PreTranslateMessage+0x13
0013fc58 00b4bc80 00000000 7fe9c2a0 7c80e400 Safari_b30000!RunMessagePump+0x227
0013fcac 00bac3c6 0000000a 7c80ae40 00b30000 Safari_b30000!run+0x130
0013fcdc 00bacad8 00b30000 000208f8 0000000a Safari_b30000!safariMain+0x5a6
0013fcf0 00401457 00400000 00000000 000208f8 Safari_b30000!safariDLLMain+0x38
0013ff20 0040301c 00000000 a0041012 0040161b Safari!wWinMain+0x217
0013ffc0 7c817077 43424160 47464544 7ffdd000 Safari!envp
0013fff0 00000000 00401787 00000000 00000000 kernel32!BaseProcessStart+0x23


STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  WebKit!WebCore::CSSStyleSelector::applyProperty+27

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WebKit

IMAGE_NAME:  WebKit.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4cd7a4c3

FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_c0000005_WebKit.dll!WebCore::CSSStyleSelector::applyProperty

BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_INSTRUCTION_PTR_BAD_IP_WebKit!WebCore::CSSStyleSelector::applyProperty+27

Followup: MachineOwner

[Adam Roben (:aroben)]

(In reply to comment #10)
> (From update of attachment 73491 [details])
> FOLLOWUP_IP: 
> WebKit!WebCore::CSSStyleSelector::applyProperty+27 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\css\cssstyleselector.cpp @ 3139]
> 035e9347 84c0            test    al,al

Line 3139 is the if statement in the following code:

void CSSStyleSelector::applyProperty(int id, CSSValue *value)
{
    CSSPrimitiveValue* primitiveValue = 0;
    if (value->isPrimitiveValue())
        primitiveValue = static_cast<CSSPrimitiveValue*>(value);

[Adam Roben (:aroben)]

These crashes seem clearly unrelated. Jyrki, could you file new bugs for the _tailMerge_QTMovieWin_dll crash and the CSSStyleSelector::applyProperty crash? Then we can close this one.

[Jyrki Wahlstedt]

(In reply to comment #9)
> (In reply to comment #8)
> > (From update of attachment 72812 [details] [details])
> > SYMBOL_NAME:  WebKit!_tailMerge_QTMovieWin_dll+d
> 
> This mean that QTMovieWin.dll could not be found. Jyrki, could you please confirm that your r71186 WebKit nightly included QTMovieWin.dll?

Yes, I checked, it's there.

[Jyrki Wahlstedt]

I've changed from WinXP to Win7 (broken disk, change not necessarily to better, but anyhow), so I am not able to provide any status checks anymore. Generally, however, I saw no repeatable crashes before the (disk & OS) change, so I'd say by me it's ok.

[Adam Roben (:aroben)]

Thanks for the update, Jyrki!

This bug originally described three different crashes: one in CoreGraphics (<rdar://problem/7440748>), one in CSSStyleSelector::applyProperty (bug 49531), and one while trying to load QTMovieWin.dll (bug 52198). I think we can close this bug now, since all the individual crashes are covered elsewhere. I guess "fixed" is the best resolution, though it's not that great.