Steps to reproduce the crash: 1. Build WebKitGTK+ on 32-bit Linux (I tested this with i686 and ARM builds, both are affected). 2. Open a Web page that tries to allocate a fairly amount of ram. # For example use the test case of bug 146205 that allocates near 3GB (with the GTK port at least) $ WebKitBuild/Release/bin/MiniBrowser http://people.igalia.com/clopez/apngmem/withapng.html Result: The WebProcess crashes. 3. Now repeat the same but disabling bmalloc at runtime (by setting the env var Malloc=1) $ Malloc=1 WebKitBuild/Release/bin/MiniBrowser http://people.igalia.com/clopez/apngmem/withapng.html Now it don't crashes. This is a different than bug 146440 because I tried the workaround of disabling the GCC tree-sra optimization but it didn't helped.
Created attachment 256119 [details] GDB Backtrace on the coredump generated. I'm attaching a GDB backtrace of the coredump when it crashes. The relevant parts: #0 0xf4946f9c in bmalloc::VMHeap::grow() () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #1 0xf4943def in bmalloc::Heap::allocateLarge(std::lock_guard<bmalloc::StaticMutex>&, unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #2 0xf4942007 in bmalloc::Allocator::allocateLarge(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #3 0xf4942153 in bmalloc::Allocator::allocateSlowCase(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #4 0xf4942243 in bmalloc::Allocator::tryAllocate(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #5 0xf48fcfa7 in WTF::tryFastMalloc(unsigned int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #6 0xf675350f in WebCore::ImageFrame::setSize(int, int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #7 0xf6760602 in WebCore::PNGImageDecoder::rowAvailable(unsigned char*, unsigned int, int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #8 0xf6760c14 in WebCore::rowAvailable(png_struct_def*, unsigned char*, unsigned long, int) () from /home/clopez/webkit/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37