Bug 169132 - [GTK] WebProcess from 2.15.91 crash in WebCore::GIFImageDecoder::haveDecodedRow()
Summary: [GTK] WebProcess from 2.15.91 crash in WebCore::GIFImageDecoder::haveDecodedR...
Status: RESOLVED DUPLICATE of bug 169199
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKitGTK (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-03-03 07:15 PST by Adrian Perez
Modified: 2017-03-06 10:30 PST (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Adrian Perez 2017-03-03 07:15:02 PST
This could be related to bug #167304 and/or bug #166838, but the
backtrace is a bit different.

The URL which triggered the crash was:
 
  http://www.anishathalye.com/2015/02/07/an-asynchronous-shell-prompt/

It does not happen all the time, only occasionally. Trying to load the
following animated GIF image directly in a new tab sometimes does not
complete loading (the missing image icon appears instead; dunno id this
is related, but mentioning it in case it helps):

  http://www.anishathalye.com/media/2015/02/07/demo.gif

Probably not relevant: this is using 2x as scale-factor (HiDPI),
running with Epiphany from “master”.

Complete backtrace follows.

---

ImageDecoder[14220]: segfault at 54 ip 00007f607fcfdb51 sp 00007f5fceffe720 error 4 in libwebkit2gtk-4.0.so.37.19.1[7f607e52f000+2718000]

Process 14172 (WebKitWebProces) of user 1000 dumped core.

Stack trace of thread 14220:
#0  0x00007f607fcfdb51 WebCore::GIFImageDecoder::haveDecodedRow(unsigned int, WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul> const&, unsigned long, unsigned long, unsigned int, bool) (libwebkit2gtk-4.0.so.37)
#1  0x00007f607fcfe2c3 GIFLZWContext::outputRow() (libwebkit2gtk-4.0.so.37)
#2  0x00007f607fcfe80a GIFLZWContext::doLZW(unsigned char const*, unsigned long) (libwebkit2gtk-4.0.so.37)
#3  0x00007f607fcff1bf GIFFrameContext::decode(unsigned char const*, unsigned long, WebCore::GIFImageDecoder*, bool*) (libwebkit2gtk-4.0.so.37)
#4  0x00007f607fd00036 GIFImageReader::decode(WebCore::GIFImageDecoder::GIFQuery, unsigned int) (libwebkit2gtk-4.0.so.37)
#5  0x00007f607fcfd1be WebCore::GIFImageDecoder::decode(unsigned int, WebCore::GIFImageDecoder::GIFQuery) (libwebkit2gtk-4.0.so.37)
#6  0x00007f607fcfe1f3 WebCore::GIFImageDecoder::frameBufferAtIndex(unsigned long) (libwebkit2gtk-4.0.so.37)
#7  0x00007f607fcf95ae WebCore::ImageDecoder::createFrameImageAtIndex(unsigned long, WebCore::SubsamplingLevel, WebCore::DecodingMode) (libwebkit2gtk-4.0.so.37)
#8  0x00007f607f7bae0f WTF::Function<void ()>::CallableWrapper<WebCore::ImageFrameCache::startAsyncDecodingQueue()::{lambda()#1}>::call() (libwebkit2gtk-4.0.so.37)
#9  0x00007f607c525505 WTF::RunLoop::performWork() (libjavascriptcoregtk-4.0.so.18)
#10 0x00007f607c5243b9 WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) (libjavascriptcoregtk-4.0.so.18)
#11 0x00007f607601a45a g_main_context_dispatch (libglib-2.0.so.0)
#12 0x00007f607601a810 n/a (libglib-2.0.so.0)
#13 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#14 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#15 0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4

#16 0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#17 0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#18 0x00007f607901b454 start_thread (libpthread.so.0)
#19 0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14175:
#0  0x00007f607902479d __nanosleep (libpthread.so.0)
#1  0x00007f607c52a254 bmalloc::Heap::scavenge(std::unique_lock<bmalloc::StaticMutex>&, std::chrono::duration<long, std::ratio<1l, 1000l> >) (libjavascriptcoregtk-4.0.so.18)
#2  0x00007f607c52a39f bmalloc::Heap::concurrentScavenge() (libjavascriptcoregtk-4.0.so.18)
#3  0x00007f607c52b61e bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadRunLoop() (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c52b7f9 bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadEntryPoint(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607316858f execute_native_thread_routine (libstdc++.so.6)
#6  0x00007f607901b454 start_thread (libpthread.so.0)
#7  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14178:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4

#5  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7  0x00007f607901b454 start_thread (libpthread.so.0)
#8  0x00007f60728dc7df __clone (libc.so.6)


Stack trace of thread 14186:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601a8bc g_main_context_iteration (libglib-2.0.so.0)
#3  0x00007f600a9fa4bd n/a (libdconfsettings.so)
#4  0x00007f6076042175 n/a (libglib-2.0.so.0)
#5  0x00007f607901b454 start_thread (libpthread.so.0)
#6  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14189:
#0  0x00007f60728d7f19 syscall (libc.so.6)
#1  0x00007f60760600ca g_cond_wait_until (libglib-2.0.so.0)
#2  0x00007f6075feee89 n/a (libglib-2.0.so.0)
#3  0x00007f6075fef4ac g_async_queue_timeout_pop (libglib-2.0.so.0)
#4  0x00007f6076042c3d n/a (libglib-2.0.so.0)
#5  0x00007f6076042175 n/a (libglib-2.0.so.0)
#6  0x00007f607901b454 start_thread (libpthread.so.0)
#7  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14176:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601a8bc g_main_context_iteration (libglib-2.0.so.0)
#3  0x00007f607601a901 n/a (libglib-2.0.so.0)
#4  0x00007f6076042175 n/a (libglib-2.0.so.0)
#5  0x00007f607901b454 start_thread (libpthread.so.0)
#6  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14177:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f6076804446 n/a (libgio-2.0.so.0)
#4  0x00007f6076042175 n/a (libglib-2.0.so.0)
#5  0x00007f607901b454 start_thread (libpthread.so.0)
#6  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14185:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7  0x00007f607901b454 start_thread (libpthread.so.0)
#8  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14215:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7  0x00007f607901b454 start_thread (libpthread.so.0)
#8  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14179:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7  0x00007f607901b454 start_thread (libpthread.so.0)
#8  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14218:
#0  0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0)
#1  0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18)
#2  0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18)
#3  0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607901b454 start_thread (libpthread.so.0)
#7  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14180:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7  0x00007f607901b454 start_thread (libpthread.so.0)
#8  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14217:
#0  0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0)
#1  0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18)
#2  0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18)
#3  0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607901b454 start_thread (libpthread.so.0)
#7  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14219:
#0  0x00007f60790214b8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0)
#1  0x00007f607c52279a WTF::ThreadCondition::timedWait(WTF::Mutex&, double) (libjavascriptcoregtk-4.0.so.18)
#2  0x00007f607c4ed0c3 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) (libjavascriptcoregtk-4.0.so.18)
#3  0x00007f607c4dcf2e std::_Function_handler<void (), WTF::AutomaticThread::start(WTF::AbstractLocker const&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607901b454 start_thread (libpthread.so.0)
#7  0x00007f60728dc7df __clone (libc.so.6)

Stack trace of thread 14172:
#0  0x00007f607fcfcd1e WebCore::GIFImageDecoder::clearFrameBufferCache(unsigned long) (libwebkit2gtk-4.0.so.37)
#1  0x00007f607f769b4f WebCore::BitmapImage::destroyDecodedData(bool) (libwebkit2gtk-4.0.so.37)
#2  0x00007f607eba0188 WebKit::NetworkProcessConnection::didCacheResource(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID) (libwebkit2gtk-4.0.so.37)
#3  0x00007f607ee28807 void IPC::handleMessage<Messages::NetworkProcessConnection::DidCacheResource, WebKit::NetworkProcessConnection, void (WebKit::NetworkProcessConnection::*)(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID)>(IPC::Decoder&, WebKit::NetworkProcessConnection*, void (WebKit::NetworkProcessConnection::*)(WebCore::ResourceRequest const&, WebKit::ShareableResource::Handle const&, WebCore::SessionID)) (libwebkit2gtk-4.0.so.37)
#4  0x00007f607ee27fbd WebKit::NetworkProcessConnection::didReceiveNetworkProcessConnectionMessage(IPC::Connection&, IPC::Decoder&) (libwebkit2gtk-4.0.so.37)
#5  0x00007f607ea3439b IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) (libwebkit2gtk-4.0.so.37)
#6  0x00007f607ea352c8 IPC::Connection::dispatchOneMessage() (libwebkit2gtk-4.0.so.37)
#7  0x00007f607c525505 WTF::RunLoop::performWork() (libjavascriptcoregtk-4.0.so.18)
#8  0x00007f607c5243b9 WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) (libjavascriptcoregtk-4.0.so.18)
#9  0x00007f607601a45a g_main_context_dispatch (libglib-2.0.so.0)
#10 0x00007f607601a810 n/a (libglib-2.0.so.0)
#11 0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#12 0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#13 0x00007f607edce5e2 int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) (libwebkit2gtk-4.0.so.37)
#14 0x00007f6072814291 __libc_start_main (libc.so.6)
#15 0x0000000000400b1a _start (WebKitWebProcess)

Stack trace of thread 14193:
#0  0x00007f60728d348d poll (libc.so.6)
#1  0x00007f607601a7a6 n/a (libglib-2.0.so.0)
#2  0x00007f607601ab32 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f607c524c50 WTF::RunLoop::run() (libjavascriptcoregtk-4.0.so.18)
#4  0x00007f607c523cb3 std::_Function_handler<void (), WTF::WorkQueue::platformInitialize(char const*, WTF::WorkQueue::Type, WTF::WorkQueue::QOS)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (libjavascriptcoregtk-4.0.so.18)
#5  0x00007f607c4f0075 WTF::threadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#6  0x00007f607c52212a WTF::wtfThreadEntryPoint(void*) (libjavascriptcoregtk-4.0.so.18)
#7  0x00007f607901b454 start_thread (libpthread.so.0)
#8  0x00007f60728dc7df __clone (libc.so.6)
Comment 1 Andres Gomez Garcia 2017-03-03 07:43:13 PST
I can reproduce the BT in bug 167304 with this GIF.

I cannot reproduce it 100% but:
 * Sometimes the GIF doesn't charge (appears the broken image icon).
 * After a while retrying (reloading), the GIF may charge.
 * If I keep reloading, eventually the WebProcess SIGSEVs
Comment 2 Michael Catanzaro 2017-03-06 10:30:10 PST

*** This bug has been marked as a duplicate of bug 169199 ***