Web inspector crash in WebKit::CompositingCoordinator::setViewOverlayRootLayer. Truncated backtrace: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007fdcbe388352 in std::__atomic_base<int>::operator-- (this=0x7fdcc03a5878 <vtable for WTF::Function<void ()>::CallableWrapper<IPC::Connection::sendMessage(std::unique_ptr<IPC::Encoder, std::default_delete<IPC::Encoder> >, WTF::OptionSet<IPC::SendOption>)::{lambda()#1}>+24>) at /usr/include/c++/6.3.1/bits/atomic_base.h:304 304 { return __atomic_sub_fetch(&_M_i, 1, memory_order_seq_cst); } [Current thread is 1 (Thread 0x7fdcc06c6ac0 (LWP 17265))] Thread 1 (Thread 0x7fdcc06c6ac0 (LWP 17265)): #0 0x00007fdcbe388352 in std::__atomic_base<int>::operator--() (this=0x7fdcc03a5878 <vtable for WTF::Function<void ()>::CallableWrapper<IPC::Connection::sendMessage(std::unique_ptr<IPC::Encoder, std::default_delete<IPC::Encoder> >, WTF::OptionSet<IPC::SendOption>)::{lambda()#1}>+24>) at /usr/include/c++/6.3.1/bits/atomic_base.h:304 #1 0x00007fdcbe388352 in WTF::ThreadSafeRefCountedBase::derefBase() (this=0x7fdcc03a5878 <vtable for WTF::Function<void ()>::CallableWrapper<IPC::Connection::sendMessage(std::unique_ptr<IPC::Encoder, std::default_delete<IPC::Encoder> >, WTF::OptionSet<IPC::SendOption>)::{lambda()#1}>+24>) at /usr/src/debug/webkitgtk-2.14.5/Source/WTF/wtf/ThreadSafeRefCounted.h:63 #2 0x00007fdcbe388352 in WTF::ThreadSafeRefCounted<IPC::Connection::WorkQueueMessageReceiver>::deref() (this=0x7fdcc03a5878 <vtable for WTF::Function<void ()>::CallableWrapper<IPC::Connection::sendMessage(std::unique_ptr<IPC::Encoder, std::default_delete<IPC::Encoder> >, WTF::OptionSet<IPC::SendOption>)::{lambda()#1}>+24>) at /usr/src/debug/webkitgtk-2.14.5/Source/WTF/wtf/ThreadSafeRefCounted.h:78 #3 0x00007fdcbe388352 in WTF::derefIfNotNull<IPC::Connection::WorkQueueMessageReceiver>(IPC::Connection::WorkQueueMessageReceiver*) (ptr=<optimized out>) at /usr/src/debug/webkitgtk-2.14.5/Source/WTF/wtf/PassRefPtr.h:40 #4 0x00007fdcbe388352 in WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver>::~RefPtr() (this=0x7fdc2d9e1810, __in_chrg=<optimized out>) at /usr/src/debug/webkitgtk-2.14.5/Source/WTF/wtf/RefPtr.h:62 #5 0x00007fdcbe388352 in IPC::Connection::<lambda()>::~<lambda> (this=0x7fdc2d9e1808, __in_chrg=<optimized out>) at /usr/src/debug/webkitgtk-2.14.5/Source/WebKit2/Platform/IPC/Connection.cpp:609 #6 0x00007fdcbe388352 in WTF::Function<void()>::CallableWrapper<IPC::Connection::processIncomingMessage(std::unique_ptr<IPC::Decoder>)::<lambda()> >::~CallableWrapper (this=0x7fdc2d9e1800, __in_chrg=<optimized out>) at /usr/src/debug/webkitgtk-2.14.5/Source/WTF/wtf/Function.h:91 #7 0x00007fdcbe388352 in WTF::Function<void()>::CallableWrapper<IPC::Connection::processIncomingMessage(std::unique_ptr<IPC::Decoder>)::<lambda()> >::~CallableWrapper(void) (this=0x7fdc2d9e1800, __in_chrg=<optimized out>) at /usr/src/debug/webkitgtk-2.14.5/Source/WTF/wtf/Function.h:91 #8 0x00007fdcbe656000 in WebKit::CompositingCoordinator::setViewOverlayRootLayer(WebCore::GraphicsLayer*) (this=0x7fdc53596878, graphicsLayer=0x7fdc4120f800) at /usr/src/debug/webkitgtk-2.14.5/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:88 #9 0x00007fdcbf11d493 in WebCore::RenderLayerCompositor::attachRootLayer(WebCore::RenderLayerCompositor::RootLayerAttachment) (this=this@entry=0x7fdca9f8b720, attachment=attachment@entry=WebCore::RenderLayerCompositor::RootLayerAttachedViaChromeClient) at /usr/src/debug/webkitgtk-2.14.5/Source/WebCore/rendering/RenderLayerCompositor.cpp:3545 #10 0x00007fdcbf11f916 in WebCore::RenderLayerCompositor::ensureRootLayer() (this=this@entry=0x7fdca9f8b720) at /usr/src/debug/webkitgtk-2.14.5/Source/WebCore/rendering/RenderLayerCompositor.cpp:3475 expectedAttachment = WebCore::RenderLayerCompositor::RootLayerAttachedViaChromeClient See the downstream bug for the full backtrace.
This is a rendering / compositing bug. Web Inspector seems to be the test case.
Created attachment 319448 [details] Alternate backtrace
This seems to be the same crash that happens in https://bugs.webkit.org/show_bug.cgi?id=171161. Should be fixed in ToT. *** This bug has been marked as a duplicate of bug 171161 ***