Bug 142692 – Segfault in `VectorBufferBase` at `../Source/WTF/wtf/Vector.h:330`

• Status: NEW
• Component: WebKitGTK

[Paul Menzel]

Created attachment 248645 [details]
(gdb) t a a bt f

Using Debian Sid/unstable with libwebkitgtk-3.0-0 2.4.8-1, Evolution crashed with a segmentation fault.

    evolution[2714]: segfault at bfd27b2c ip b5708819 sp bfd25a20 error 6 in libwebkitgtk-3.0.so.0.22.14[b54b7000+1c5c000]

Here is the output from the core dump file.

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
Core was generated by `evolution'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  VectorBufferBase (size=0, capacity=2048, buffer=0xbfd27b38, this=0xbfd27b2c) at ../Source/WTF/wtf/Vector.h:330
330     ../Source/WTF/wtf/Vector.h: Datei oder Verzeichnis nicht gefunden.
(gdb) t a a bt f
[…]
Thread 1 (Thread 0xb01e6900 (LWP 2714)):
#0  VectorBufferBase (size=0, capacity=2048, buffer=0xbfd27b38, this=0xbfd27b2c) at ../Source/WTF/wtf/Vector.h:330
No locals.
#1  VectorBuffer (this=0xbfd27b2c) at ../Source/WTF/wtf/Vector.h:404
No locals.
#2  Vector (this=0xbfd27b2c) at ../Source/WTF/wtf/Vector.h:534
No locals.
#3  GlyphBuffer (this=0xbfd25b20) at ../Source/WebCore/platform/graphics/GlyphBuffer.h:76
No locals.
#4  WebCore::Font::getGlyphsAndAdvancesForSimpleText (this=0xa9da8718, run=..., from=0, to=4, glyphBuffer=..., 
    forTextEmphasis=WebCore::Font::NotForTextEmphasis) at ../Source/WebCore/platform/graphics/FontFastPath.cpp:132
[…]
(gdb) in(gdb) info registers
eax            0xbfd25b20	-1076733152
ecx            0xbfd27b38	-1076724936
edx            0xbfd31b44	-1076683964
ebx            0xb71f1000	-1222701056
esp            0xbfd25a20	0xbfd25a20
ebp            0xbfd35b68	0xbfd35b68
esi            0xbfd25a9c	-1076733284
edi            0xbfd45d78	-1076601480
eip            0xb5708819	0xb5708819 <WebCore::Font::getGlyphsAndAdvancesForSimpleText(WebCore::TextRun const&, int, int, WebCore::GlyphBuffer&, WebCore::Font::ForTextEmphasisOrNot) const+169>
eflags         0x210282	[ SF IF RF ID ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51fo registers
eax            0xbfd25b20	-1076733152
ecx            0xbfd27b38	-1076724936
edx            0xbfd31b44	-1076683964
ebx            0xb71f1000	-1222701056
esp            0xbfd25a20	0xbfd25a20
ebp            0xbfd35b68	0xbfd35b68
esi            0xbfd25a9c	-1076733284
edi            0xbfd45d78	-1076601480
eip            0xb5708819	0xb5708819 <WebCore::Font::getGlyphsAndAdvancesForSimpleText(WebCore::TextRun const&, int, int, WebCore::GlyphBuffer&, WebCore::Font::ForTextEmphasisOrNot) const+169>
eflags         0x210282	[ SF IF RF ID ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51

[Paul Menzel]

This is report #780452 in the Debian bug tracking system.

[1] http://bugs.debian.org/780452

[Paul Menzel]

(In reply to comment #0)

[…]

The following part was pasted twice and mangled.

(gdb) info registers
eax            0xbfd25b20	-1076733152
ecx            0xbfd27b38	-1076724936
edx            0xbfd31b44	-1076683964
ebx            0xb71f1000	-1222701056
esp            0xbfd25a20	0xbfd25a20
ebp            0xbfd35b68	0xbfd35b68
esi            0xbfd25a9c	-1076733284
edi            0xbfd45d78	-1076601480
eip            0xb5708819	0xb5708819 <WebCore::Font::getGlyphsAndAdvancesForSimpleText(WebCore::TextRun const&, int, int, WebCore::GlyphBuffer&, WebCore::Font::ForTextEmphasisOrNot) const+169>
eflags         0x210282	[ SF IF RF ID ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51

[Nicolas]

Same for me on Ubuntu 14.04.2 (all updates installed), but it is not only affecting evolution!

---

Evolution:

nsk@sesta09:~$ evolution 

(evolution:16111): camel-WARNING **: Failed to initialize NSS SQL database in sql:/etc/pki/nssdb: NSS error -8126
Speicherzugriffsfehler (Speicherabzug geschrieben)

nsk@sesta09:~$ tail -1 /var/log/syslog
Apr  3 16:11:54 sesta09 kernel: [ 4646.673708] evolution[16111]: segfault at 3c78f55f ip 00007f61a5a3a9de sp 00007fff3c78f530 error 6 in libwebkitgtk-3.0.so.0.22.14[7f61a4ec3000+1c91000]
nsk@sesta09:~$ 

---

Unity Control Center, when accessing the "Information" element:

nsk@sesta09:~$ unity-control-center 
Speicherzugriffsfehler (Speicherabzug geschrieben)
nsk@sesta09:~$ tail -1 /var/log/syslog
Apr  3 16:12:57 sesta09 kernel: [ 4709.794574] unity-control-c[16747]: segfault at 4ca0de9f ip 00007fa18367c9de sp 00007fff4ca05e80 error 6 in libwebkitgtk-3.0.so.0.22.14[7fa182b05000+1c91000]
nsk@sesta09:~$ 

---

Software Center:

nsk@sesta09:~$ software-center
2015-04-03 16:16:38,647 - softwarecenter.ui.gtk3.app - INFO - setting up proxy 'None'
2015-04-03 16:16:39,625 - softwarecenter.backend.reviews - WARNING - Could not get usefulness from server, no username in config file
2015-04-03 16:16:39,627 - softwarecenter.plugin - INFO - activating plugin '<module 'webapps_activation' from '/usr/share/software-center/softwarecenter/plugins/webapps_activation.pyc'>'
2015-04-03 16:16:39,679 - softwarecenter.db.pkginfo_impl.aptcache - INFO - aptcache.open()
2015-04-03 16:16:40,517 - softwarecenter.backend.reviews - WARNING - error creating bsddb: '(22, 'Das Argument ist ung\xc3\xbcltig -- BDB0054 illegal flag combination specified to DB_ENV->open')' (corrupted?)
2015-04-03 16:16:40,518 - softwarecenter.backend.reviews - ERROR - trying to repair DB failed
Traceback (most recent call last):
  File "/usr/share/software-center/softwarecenter/backend/reviews/__init__.py", line 358, in _save_review_stats_cache_blocking
    self._dump_bsddbm_for_unity(outfile, outdir)
  File "/usr/share/software-center/softwarecenter/backend/reviews/__init__.py", line 377, in _dump_bsddbm_for_unity
    0600)
DBInvalidArgError: (22, 'Das Argument ist ung\xc3\xbcltig -- BDB0054 illegal flag combination specified to DB_ENV->open')
/usr/lib/python2.7/dist-packages/gi/overrides/GLib.py:535: Warning: Source ID 74 was not found when attempting to remove it
  return super(MainContext, self).iteration(may_block)
Speicherzugriffsfehler (Speicherabzug geschrieben)
nsk@sesta09:~$ tail -1 /var/log/syslog
Apr  3 16:16:41 sesta09 kernel: [ 4933.484896] software-center[18773]: segfault at 1544dd3f ip 00007fd466b3c9de sp 00007fff15445d10 error 6 in libwebkitgtk-3.0.so.0.22.14[7fd465fc5000+1c91000]
nsk@sesta09:~$ 

---

I am assuming this started with update of libwebkitgtk-3.0-0 from version 2.4.0-1ubuntu2 to 2.4.8-1ubuntu1~ubuntu14.04.1, but I am unable to downgrade via synaptic or apt because the dependencies wants me to uninstall half of the system then...

This is my current kernel:
nsk@sesta09:~$ uname -a
Linux sesta09 3.13.0-48-generic #80-Ubuntu SMP Thu Mar 12 11:16:15 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
nsk@sesta09:~$ 

But the behaviour did not changed with the last kernel upgrade.

I am using Gnome Flashback desktop environment with version 3.8.0-1ubuntu12.2

Additionally using compiz

nsk@sesta09:~$ compiz --version
Compiz 0.9.11.3
nsk@sesta09:~$

[Paul Menzel]

(In reply to comment #3)
> Same for me on Ubuntu 14.04.2 (all updates installed), but it is not only
> affecting evolution!

[…]

Nicolas, thank you for your reply. I am not sure, you are seeing the same bug as I do, but we’ll figure that out.

Unfortunately, there was no “official” reply from a WebKitGTK+ developer yet. I’d suggest the following to hopefully fix this issue as soon as possible.

1. Please open a ticket in Ubuntu’s bug tracker Launchpad. Please mention this upstream bug report, my Debian bug report there and note that it’s a regression. Also note all the programs this effects (evolution, unity-control-center and software-center).

2. Bad for you, lucky for finding the bug, you seem to be able to reproduce this issue easily.

3. It looks like the easiest to tackle this is with unity-control-center. Please install the debug symbols and GDB capture a backtrace [1].

α) apt-get install gdb libwebkitgtk-3.0-0-dbg
β) apt-get install package-with-debug-symbols # I couldn’t find it though for 
γ) gdb unity-control-center
(gdb) set logging on /tmp/20150406--unity-control-center--taabtf.txt
(gdb) run
[…]
(gdb) t a a bt f
[…]
(gdb) quit

Please attach the file `/tmp/20150406--unity-control-center--taabtf.txt` to this bug report.

[1] https://wiki.ubuntu.com/DebuggingProgramCrash

[Nicolas]

Created attachment 250270 [details]
gdb debug evolution crash

I made the trace with evolution, because it crashes immediately at start and I found the evolution-dbg package. Hoping I have done everything right, because the output is much smaller than yours.

[Paul Menzel]

(In reply to comment #5)
> Created attachment 250270 [details]
> gdb debug evolution crash
> 
> I made the trace with evolution, because it crashes immediately at start and
> I found the evolution-dbg package.

Thank you!

> Hoping I have done everything right, because the output is much smaller than yours.

Did you install the debug symbols for WebKitGTK+? It does not look like it.

    $ sudo apt install libwebkitgtk-3.0-0-dbg

Also some threads are missing. No idea how that can happen. Could you please upload the output of a run where the debugging symbols are installed?

[Nicolas]

Created attachment 250612 [details]
gdb evolution - with debug symbols and threads

Though I tried to install the debug symbols package the last time as well, this seemed to had not worked as I was able to install it now.

Additionally I understood the need to press ENTER multiple times within the gdb run to get the stack traces? for each thread? or kind of stuff like that... :D

The log is much longer now, so maybe now it is produced correctly.

[Paul Menzel]

(In reply to comment #7)
> Created attachment 250612 [details]
> gdb evolution - with debug symbols and threads

[…]

> The log is much longer now, so maybe now it is produced correctly.

It indeed is! Thank you!

Thanks to your work, we can see that this is a separate issue and not related to the one I reported in this ticket.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff589f9de in WebCore::Page::refreshPlugins (reload=reload@entry=false) at ../Source/WebCore/page/Page.cpp:453
453	../Source/WebCore/page/Page.cpp: Datei oder Verzeichnis nicht gefunden.

Could you please open a separate ticket for this. But more importantly, please contact the Ubuntu folks as it affects several of their programs.

This is the important backtrace of the Thread 1, “which caused the termination”.

Thread 1 (Thread 0x7ffff7f93a80 (LWP 22808)):
#0  0x00007ffff589f9de in WebCore::Page::refreshPlugins (reload=reload@entry=false) at ../Source/WebCore/page/Page.cpp:453
        it = {m_impl = {m_position = 0x7fffac522760, m_endPosition = 0x7fffac522780}}
        end = {m_impl = {m_position = 0x7fffac522780, m_endPosition = 0x7fffac522780}}
        framesNeedingReload = {<WTF::VectorBuffer<WTF::Ref<WebCore::Frame>, 0ul>> = {<WTF::VectorBufferBase<WTF::Ref<WebCore::Frame> >> = {
              m_buffer = 0x0, m_capacity = 0, m_size = 0}, <No data fields>}, <No data fields>}
#1  0x00007ffff58b59c1 in WebCore::Settings::setPluginsEnabled (this=this@entry=0x7fffac532dc0, arePluginsEnabled=<optimized out>)
    at ../Source/WebCore/page/Settings.cpp:441
No locals.
#2  0x00007ffff51a1473 in webkit_web_view_update_settings (webView=webView@entry=0x555557d90360)
    at ../Source/WebKit/gtk/webkit/webkitwebview.cpp:3563
        settingsPrivate = 0x555557d5b9a0
        debugVisualsEnvironment = <optimized out>
#3  0x00007ffff51a2189 in webkit_web_view_init (webView=0x555557d90360) at ../Source/WebKit/gtk/webkit/webkitwebview.cpp:3879
        priv = 0x555557d900e0
        pageClients = {alternativeTextClient = 0x0, chromeClient = 0x555557d8f8b0, contextMenuClient = 0x555557d8fba0, 
          editorClient = 0x555557d8fbc0, dragClient = 0x555557d4e780, inspectorClient = 0x555557d50720, plugInClient = 0x0, 
          progressTrackerClient = 0x555557d50f10, backForwardClient = {m_ptr = 0x0}, validationMessageClient = 0x0, loaderClientForMainFrame = 
    0x555557d50980}
#4  0x00007ffff4084df8 in g_type_create_instance () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#5  0x00007ffff4069355 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#6  0x00007ffff406b4c4 in g_object_new_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#7  0x00007ffff406b8a4 in g_object_new () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#8  0x00007fffc70f05b1 in mail_paned_view_constructed (object=0x555555974500) at e-mail-paned-view.c:645
        priv = 0x5555559743a0
        shell_backend = <optimized out>
        shell_window = <optimized out>
        shell_view = <optimized out>
        settings = <optimized out>
        reader = <optimized out>
        backend = <optimized out>
        session = <optimized out>
        view = <optimized out>
        message_list = <optimized out>
        container = <optimized out>
        widget = <optimized out>
#9  0x00007ffff406938a in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#10 0x00007ffff406b4c4 in g_object_new_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#11 0x00007ffff406b8a4 in g_object_new () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#12 0x00007fffc70f0a7c in e_mail_paned_view_new (shell_view=<optimized out>) at e-mail-paned-view.c:1075
        __FUNCTION__ = "e_mail_paned_view_new"
#13 0x00007fffc5d6b1cd in mail_shell_content_constructed (object=0x555557d27590) at e-mail-shell-content.c:187
        priv = 0x555557d27470
        shell_content = <optimized out>
        shell_view = 0x555557cfae30
        container = 0x555557d27590
        widget = <optimized out>
#14 0x00007ffff406938a in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#15 0x00007ffff406b4c4 in g_object_new_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#16 0x00007ffff406b8a4 in g_object_new () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#17 0x00007ffff7bc5da5 in shell_view_constructed (object=0x555557cfae30) at e-shell-view.c:613
        shell = 0x5555559741d0
        shell_view = 0x555557cfae30
        shell_backend = <optimized out>
        shell_view_class = 0x555555840640
        widget = 0x555557cfaf90
        handler_id = <optimized out>
#18 0x00007fffc5d6db1b in mail_shell_view_constructed (object=0x555557cfae30) at e-mail-shell-view.c:247
No locals.
#19 0x00007ffff406938a in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#20 0x00007ffff406b4c4 in g_object_new_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#21 0x00007ffff406b8a4 in g_object_new () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#22 0x00007ffff7bc82ae in shell_window_create_shell_view (shell_window=0x555557c8c2c0, view_name=<optimized out>) at e-shell-window.c:715
        shell = <optimized out>
        shell_view = <optimized out>
        shell_backend = <optimized out>
        loaded_views = <optimized out>
        ui_manager = <optimized out>
        notebook = 0x555557d1b190
        action = 0x555557ca0310
        widget = <optimized out>
        name = 0x7fffc5d7820f "mail"
        id = <optimized out>
        page_num = 0
        type = 93824997034784
#23 0x00007ffff7bc7d0c in e_shell_window_get_shell_view (shell_window=shell_window@entry=0x555557c8c2c0, 
    view_name=view_name@entry=0x555557d19d60 "mail") at e-shell-window.c:1139
        shell_view = <optimized out>
        class = <optimized out>
        __FUNCTION__ = "e_shell_window_get_shell_view"
#24 0x00007ffff7bc8b38 in e_shell_window_set_active_view (shell_window=0x555557c8c2c0, view_name=0x555557d19d60 "mail") at e-shell-window.c:1381
        action = <optimized out>
        shell_view = <optimized out>
        __FUNCTION__ = "e_shell_window_set_active_view"
#25 0x00007ffff7bc9486 in shell_window_set_property (object=0x555557c8c2c0, property_id=<optimized out>, value=<optimized out>, 
    pspec=<optimized out>) at e-shell-window.c:241
No locals.
#26 0x00007ffff406c6e3 in g_object_set_property () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#27 0x00007ffff435bf63 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
No symbol table info available.
#28 0x00007ffff435e9e1 in g_settings_bind_with_mapping () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
No symbol table info available.
#29 0x00007ffff435edd7 in g_settings_bind () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
No symbol table info available.
#30 0x00007ffff7bca3d3 in e_shell_window_private_constructed (shell_window=0x555557c8c2c0) at e-shell-window-private.c:414
        priv = 0x555557c8c020
        shell = 0x5555559741d0
        action = <optimized out>
        accel_group = <optimized out>
        ui_manager = 0x555557cd4830
        box = <optimized out>
        paned = <optimized out>
        widget = <optimized out>
        window = 0x555557c8c2c0
        merge_id = <optimized out>
        id = <optimized out>
        settings = 0x555557cd4970
        action_group = <optimized out>
#31 0x00007ffff7bc77cc in shell_window_constructed (object=0x555557c8c2c0) at e-shell-window.c:386
        shell_window = <optimized out>
#32 0x00007ffff406938a in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#33 0x00007ffff406b4c4 in g_object_new_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#34 0x00007ffff406b8a4 in g_object_new () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#35 0x00007ffff7bc78c8 in e_shell_window_new (shell=shell@entry=0x5555559741d0, safe_mode=1, geometry=0x0) at e-shell-window.c:1081
No locals.
#36 0x00007ffff7bba7e3 in e_shell_create_shell_window (shell=0x5555559741d0, view_name=0x0) at e-shell.c:1365
        shell_window = <optimized out>
        link = <optimized out>
        __FUNCTION__ = "e_shell_create_shell_window"
#37 0x0000555555557ccf in idle_cb (uris=0x0) at main.c:248
        shell = 0x5555559741d0
#38 0x00007ffff3d94ce5 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#39 0x00007ffff3d95048 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#40 0x00007ffff3d9530a in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#41 0x00007ffff47b8fe5 in gtk_main () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#42 0x00005555555579cf in main (argc=1, argv=0x7fffffffe068) at main.c:683
        shell = 0x5555559741d0
        settings = <optimized out>
        error = 0x0

[Nicolas]

(In reply to comment #8)
> (In reply to comment #7)
> > Created attachment 250612 [details]
> > gdb evolution - with debug symbols and threads
> 
> […]
> 
> > The log is much longer now, so maybe now it is produced correctly.
> 
> It indeed is! Thank you!
> 
> Thanks to your work, we can see that this is a separate issue and not
> related to the one I reported in this ticket.
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff589f9de in WebCore::Page::refreshPlugins
> (reload=reload@entry=false) at ../Source/WebCore/page/Page.cpp:453
> 453	../Source/WebCore/page/Page.cpp: Datei oder Verzeichnis nicht gefunden.
> 
> Could you please open a separate ticket for this. But more importantly,
> please contact the Ubuntu folks as it affects several of their programs.

I created those bug reports for my issue
- https://bugs.webkit.org/show_bug.cgi?id=144109
- https://bugs.launchpad.net/ubuntu/+source/webkitgtk/+bug/1447775

Thank you Paul for all your help!

[Paul Menzel]

Today I hit the same issue with Evolution 3.12.11 and WebKitGTK+ 2.4.9.

#0  0xffffffff in WebCore::Font::getGlyphsAndAdvancesForSimpleText(WebCore::TextRun const&, int, int, WebCore::GlyphBuffer&, WebCore::Font::ForTextEmphasisOrNot) const (this=0xaa5ae400, run=..., from=0, to=4, glyphBuffer=..., forTextEmphasis=WebCore::Font::NotForTextEmphasis)
    at ../Source/WebCore/platform/graphics/FontFastPath.cpp:130
#1  0xffffffff in WebCore::Font::drawSimpleText(WebCore::GraphicsContext*, WebCore::TextRun const&, WebCore::FloatPoint const&, int, int) const (this=0xaa5ae400, context=0xbfe0cdb0, run=..., point=..., from=0, to=4) at ../Source/WebCore/platform/graphics/FontFastPath.cpp:166
#2  0xffffffff in WebCore::Font::drawText(WebCore::GraphicsContext*, WebCore::TextRun const&, WebCore::FloatPoint const&, int, int, WebCore::Font::CustomFontNotReadyAction) const (this=0xaa5ae400, context=0xbfe0cdb0, run=..., point=..., from=0, to=4, customFontNotReadyAction=WebCore::Font::DoNotPaintIfFontNotReady) at ../Source/WebCore/platform/graphics/Font.cpp:338
#3  0xffffffff in WebCore::GraphicsContext::drawText(WebCore::Font const&, WebCore::TextRun const&, WebCore::FloatPoint const&, int, int) (this=0xbfe0cdb0, font=..., run=..., point=..., from=0, to=-1) at ../Source/WebCore/platform/graphics/GraphicsContext.cpp:447
#4  0xffffffff in WebCore::SimpleLineLayout::paintFlow(WebCore::RenderBlockFlow const&, WebCore::SimpleLineLayout::Layout const&, WebCore::PaintInfo&, WebCore::LayoutPoint const&) (flow=..., layout=..., paintInfo=..., paintOffset=...)
    at ../Source/WebCore/rendering/SimpleLineLayoutFunctions.cpp:96
#5  0xffffffff in WebCore::RenderBlockFlow::paintInlineChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7b00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlockFlow.cpp:3211
#6  0xffffffff in WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7b00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2373
#7  0xffffffff in WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7b00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2509
#8  0xffffffff in WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7b00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2186
#9  0xffffffff in WebCore::RenderTableCell::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7b00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableCell.cpp:1042
#10 0xffffffff in WebCore::RenderTableSection::paintCell(WebCore::RenderTableCell*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5060c0, cell=0xaa5a7b00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:1013
#11 0xffffffff in WebCore::RenderTableSection::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5060c0, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:1296
#12 0xffffffff in WebCore::RenderTableSection::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5060c0, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:961
#13 0xffffffff in WebCore::RenderTable::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506180, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTable.cpp:673
#14 0xffffffff in WebCore::RenderTable::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506180, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTable.cpp:642
#15 0xffffffff in WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa502080, child=..., paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at ../Source/WebCore/rendering/RenderBlock.cpp:2423
#16 0xffffffff in WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa502080, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../Source/WebCore/rendering/RenderBlock.cpp:2393
#17 0xffffffff in WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa502080, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2386
#18 0xffffffff in WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa502080, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2509
#19 0xffffffff in WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa502080, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2186
#20 0xffffffff in WebCore::RenderTableCell::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa502080, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableCell.cpp:1042
#21 0xffffffff in WebCore::RenderTableSection::paintCell(WebCore::RenderTableCell*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506240, cell=0xaa502080, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:1013
#22 0xffffffff in WebCore::RenderTableSection::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506240, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:1296
#23 0xffffffff in WebCore::RenderTableSection::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506240, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:961
#24 0xffffffff in WebCore::RenderTable::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5066c0, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTable.cpp:673
#25 0xffffffff in WebCore::RenderTable::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5066c0, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTable.cpp:642
#26 0xffffffff in WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa5a7e00, child=..., paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at ../Source/WebCore/rendering/RenderBlock.cpp:2423
#27 0xffffffff in WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa5a7e00, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../Source/WebCore/rendering/RenderBlock.cpp:2393
#28 0xffffffff in WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7e00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2386
#29 0xffffffff in WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7e00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2509
#30 0xffffffff in WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7e00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2186
#31 0xffffffff in WebCore::RenderTableCell::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5a7e00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableCell.cpp:1042
#32 0xffffffff in WebCore::RenderTableSection::paintCell(WebCore::RenderTableCell*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506600, cell=0xaa5a7e00, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:1013
#33 0xffffffff in WebCore::RenderTableSection::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506600, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:1296
#34 0xffffffff in WebCore::RenderTableSection::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506600, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTableSection.cpp:961
#35 0xffffffff in WebCore::RenderTable::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506b40, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTable.cpp:673
#36 0xffffffff in WebCore::RenderTable::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa506b40, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderTable.cpp:642
#37 0xffffffff in WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa5189d8, child=..., paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at ../Source/WebCore/rendering/RenderBlock.cpp:2423
#38 0xffffffff in WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa5189d8, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../Source/WebCore/rendering/RenderBlock.cpp:2393
#39 0xffffffff in WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5189d8, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2386
#40 0xffffffff in WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5189d8, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2509
#41 0xffffffff in WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa5189d8, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2186
#42 0xffffffff in WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa518ca8, child=..., paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at ../Source/WebCore/rendering/RenderBlock.cpp:2423
#43 0xffffffff in WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa518ca8, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../Source/WebCore/rendering/RenderBlock.cpp:2393
#44 0xffffffff in WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa518ca8, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2386
#45 0xffffffff in WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa518ca8, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2509
#46 0xffffffff in WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa518ca8, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2186
#47 0xffffffff in WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa518c30, child=..., paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at ../Source/WebCore/rendering/RenderBlock.cpp:2423
#48 0xffffffff in WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (this=0xaa518c30, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../Source/WebCore/rendering/RenderBlock.cpp:2393
#49 0xffffffff in WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa518c30, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2386
#50 0xffffffff in WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa518c30, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2509
#51 0xffffffff in WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) (this=0xaa518c30, paintInfo=..., paintOffset=...) at ../Source/WebCore/rendering/RenderBlock.cpp:2186
#52 0xffffffff in WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1u, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*) (this=0xbfd66f30, phase=WebCore::PaintPhaseForeground, layerFragments=..., context=0xbfe0cdb0, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0) at ../Source/WebCore/rendering/RenderLayer.cpp:4477
#53 0xffffffff in WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1u, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::GraphicsContext*, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*, bool, bool) (this=0xbfd66f30, layerFragments=..., context=0xbfe0cdb0, transparencyLayerContext=0xbfe0cdb0, transparencyPaintDirtyRect=..., haveTransparency=false, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0, selectionOnly=false, forceBlackText=false) at ../Source/WebCore/rendering/RenderLayer.cpp:4441
#54 0xffffffff in WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) (this=0xbfd66f30, context=0xbfe0cdb0, paintingInfo=..., paintFlags=224) at ../Source/WebCore/rendering/RenderLayer.cpp:4162
#55 0xffffffff in WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) (this=<optimized out>, context=<optimized out>, paintingInfo=..., paintFlags=<optimized out>)
    at ../Source/WebCore/rendering/RenderLayer.cpp:3858
#56 0xffffffff in WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) (this=0xbfd66f30, context=0xbfe0cdb0, paintingInfo=..., paintFlags=224) at ../Source/WebCore/rendering/RenderLayer.cpp:3839
#57 0xffffffff in WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0u, WTF::CrashOnOverflow>*, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) (this=0xa48322a8, list=0xaa5960b0, context=0xbfe0cdb0, paintingInfo=..., paintFlags=224) at ../Source/WebCore/rendering/RenderLayer.cpp:4255
#58 0xffffffff in WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) (this=0xa48322a8, context=0xbfe0cdb0, paintingInfo=..., paintFlags=224) at ../Source/WebCore/rendering/RenderLayer.cpp:4173
#59 0xffffffff in WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) (this=<optimized out>, context=<optimized out>, paintingInfo=..., paintFlags=<optimized out>)
    at ../Source/WebCore/rendering/RenderLayer.cpp:3858
#60 0xffffffff in WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) (this=0xa48322a8, context=0xbfe0cdb0, paintingInfo=..., paintFlags=0) at ../Source/WebCore/rendering/RenderLayer.cpp:3839
#61 0xffffffff in WebCore::RenderLayer::paint(WebCore::GraphicsContext*, WebCore::LayoutRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, unsigned int) (this=0xa48322a8, context=0xbfe0cdb0, damageRect=..., paintBehavior=0, subtreePaintRoot=0x0, region=0x0, paintFlags=0) at ../Source/WebCore/rendering/RenderLayer.cpp:3623
#62 0xffffffff in WebCore::FrameView::paintContents(WebCore::GraphicsContext*, WebCore::IntRect const&) (this=0xaa50c8c0, p=0xbfe0cdb0, rect=...) at ../Source/WebCore/page/FrameView.cpp:3507
#63 0xffffffff in WebCore::ScrollView::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) (this=0xaa50c8c0, context=0xbfe0cdb0, rect=...) at ../Source/WebCore/platform/ScrollView.cpp:1162
#64 0xffffffff in WebKit::ChromeClient::paint(WebCore::Timer<WebKit::ChromeClient>*) (dirtyRegion=..., frame=0xaa504e00, webView=0xb7d764c0 [EMailDisplay]) at ../Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:588
#65 0xffffffff in WebKit::ChromeClient::paint(WebCore::Timer<WebKit::ChromeClient>*) (this=0xa86394a8)
    at ../Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:631
#66 0xffffffff in std::_Function_handler<void (), std::_Bind<std::_Mem_fn<void (WebKit::ChromeClient::*)(WebCore::Timer<WebKit::ChromeClient>*)> (WebKit::ChromeClient*, WebCore::Timer<WebKit::ChromeClient>*)> >::_M_invoke(std::_Any_data const&) (__object=<optimized out>, this=<optimized out>) at /usr/include/c++/4.9/functional:569
#67 0xffffffff in std::_Function_handler<void (), std::_Bind<std::_Mem_fn<void (WebKit::ChromeClient::*)(WebCore::Timer<WebKit::ChromeClient>*)> (WebKit::ChromeClient*, WebCore::Timer<WebKit::ChromeClient>*)> >::_M_invoke(std::_Any_data const&) (__args=<optimized out>, this=<optimized out>) at /usr/include/c++/4.9/functional:1264
#68 0xffffffff in std::_Function_handler<void (), std::_Bind<std::_Mem_fn<void (WebKit::ChromeClient::*)(WebCore::Timer<WebKit::ChromeClient>*)> (WebKit::ChromeClient*, WebCore::Timer<WebKit::ChromeClient>*)> >::_M_invoke(std::_Any_data const&) (this=<optimized out>)
    at /usr/include/c++/4.9/functional:1323
#69 0xffffffff in std::_Function_handler<void (), std::_Bind<std::_Mem_fn<void (WebKit::ChromeClient::*)(WebCore::Timer<WebKit::ChromeClient>*)> (WebKit::ChromeClient*, WebCore::Timer<WebKit::ChromeClient>*)> >::_M_invoke(std::_Any_data const&) (__functor=...)
    at /usr/include/c++/4.9/functional:2039
#70 0xffffffff in WebCore::Timer<WebKit::ChromeClient>::fired() (this=0xa8639520) at /usr/include/c++/4.9/functional:2439
#71 0xffffffff in WebCore::Timer<WebKit::ChromeClient>::fired() (this=0xa86394f8) at ../Source/WebCore/platform/Timer.h:132
#72 0xffffffff in WebCore::ThreadTimers::sharedTimerFiredInternal() (this=0xaa4ff240) at ../Source/WebCore/platform/ThreadTimers.cpp:132
#73 0xffffffff in WebCore::ThreadTimers::sharedTimerFired() () at ../Source/WebCore/platform/ThreadTimers.cpp:107
#74 0xffffffff in WebCore::sharedTimerTimeoutCallback(gpointer) () at ../Source/WebCore/platform/gtk/SharedTimerGtk.cpp:49
#75 0xffffffff in g_timeout_dispatch (source=0x9f7f72b8, callback=0xb57c6de0 <WebCore::sharedTimerTimeoutCallback(gpointer)>, user_data=0x0) at /build/glib2.0-ctZcLv/glib2.0-2.44.1/./glib/gmain.c:4545
#76 0xffffffff in g_main_context_dispatch (context=<optimized out>) at /build/glib2.0-ctZcLv/glib2.0-2.44.1/./glib/gmain.c:3122
#77 0xffffffff in g_main_context_dispatch (context=0x0) at /build/glib2.0-ctZcLv/glib2.0-2.44.1/./glib/gmain.c:3737
#78 0xffffffff in g_main_context_iterate (context=0xb7af10a0, block=0, block@entry=1, dispatch=1, self=<optimized out>)
    at /build/glib2.0-ctZcLv/glib2.0-2.44.1/./glib/gmain.c:3808
#79 0xffffffff in g_main_loop_run (loop=0xa82a7570) at /build/glib2.0-ctZcLv/glib2.0-2.44.1/./glib/gmain.c:4002
#80 0xffffffff in gtk_main () at /build/gtk+3.0-IGfsio/gtk+3.0-3.14.5/./gtk/gtkmain.c:1207
#81 0xffffffff in main (argc=1, argv=0xbfe0d244) at main.c:685