Bug 206543 – [WPE][GTK] Crash in WebKit::WebCompiledContentRuleList::filtersWithoutConditionsBytecode

• Status: NEW
• Component: WebKitGTK

[Michael Catanzaro]

Random web process crash:

#0  0x00007f4d3686de5b in WebKit::WebCompiledContentRuleList::filtersWithoutConditionsBytecode() const
    (this=0x7f36940d3a00) at ../Source/WebKit/Platform/SharedMemory.h:123
#1  0x00007f4d375147b7 in WebCore::ContentExtensions::ContentExtension::ContentExtension(WTF::String const&, WTF::Ref<WebCore::ContentExtensions::CompiledContentExtension, WTF::DumbPtrTraits<WebCore::ContentExtensions::CompiledContentExtension> >&&, WebCore::ContentExtensions::ContentExtension::ShouldCompileCSS)
    (this=0x7f3765b635a0, identifier=..., compiledExtension=..., shouldCompileCSS=WebCore::ContentExtensions::ContentExtension::ShouldCompileCSS::Yes) at DerivedSources/ForwardingHeaders/wtf/DumbPtrTraits.h:43
        withoutConditions = 
          {m_bytecode = 0x21bbd1f <error: Cannot access memory at address 0x21bbd1f>, m_bytecodeLength = 0, m_topURLActions = 0x7ffc4a5be330}
        withConditions = 
          {m_bytecode = 0x7ffc4a5be270 "\001", m_bytecodeLength = 879427474, m_topURLActions = 0x7f3777930658}
#2  0x00007f4d37514a46 in WebCore::ContentExtensions::ContentExtension::create(WTF::String const&, WTF::Ref<WebCore::ContentExtensions::CompiledContentExtension, WTF::DumbPtrTraits<WebCore::ContentExtensions::CompiledContentExtension> >&&, WebCore::ContentExtensions::ContentExtension::ShouldCompileCSS)
    (identifier=..., compiledExtension=..., shouldCompileCSS=WebCore::ContentExtensions::ContentExtension::ShouldCompileCSS::Yes) at DerivedSources/ForwardingHeaders/wtf/RefCounted.h:185
#3  0x00007f4d375391f3 in WebCore::ContentExtensions::ContentExtensionsBackend::addContentExtension(WTF::String const&, WTF::Ref<WebCore::ContentExtensions::CompiledContentExtension, WTF::DumbPtrTraits<WebCore::ContentExtensions::CompiledContentExtension> >, WebCore::ContentExtensions::ContentExtension::ShouldCompileCSS)
    (this=this@entry=0x7f37fc188ae8, identifier=..., compiledContentExtension=..., shouldCompileCSS=shouldCompileCSS@entry=WebCore::ContentExtensions::ContentExtension::ShouldCompileCSS::Yes)
    at ../Source/WebCore/contentextensions/ContentExtensionsBackend.cpp:64
        contentExtension = 
          {static isRef = <error reading variable: Missing ELF symbol "WTF::Ref<WebCore::ContentExtensions::ContentExtension, WTF::DumbPtrTraits<WebCore::ContentExtensions::ContentExtension> >::isRef".>, m_ptr = 0xc5cb1f}
#4  0x00007f4d36bd9662 in WebKit::WebUserContentController::addContentRuleLists(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&) (this=0x7f37fc188a50, contentRuleLists=...)
    at /usr/include/c++/9.2.0/bits/move.h:149
        compiledContentRuleList = 
          {static isRef = <error reading variable: Missing ELF symbol "WTF::Ref<WebKit::WebCompiledContentRuleList, WTF::DumbPtrTraits<WebKit::WebCompiledContentRuleList> >::isRef".>, m_ptr = 0x0}
        contentRuleList = 
            {first = {static MaxLength = 2147483647, m_impl = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >::isRefPtr".>, m_ptr = 0x7f376b0262c0}}, second = {data = {static isRefPtr = <error reading variable: Missing ELF symbol "WTF::RefPtr<WebKit::SharedMemory, WTF::DumbPtrTraits<WebKit::SharedMemory> >::isRefPtr".>, m_ptr = 0x0}, conditionsApplyOnlyToDomainOffset = 44, actionsOffset = 18505803, actionsSize = 346417, filtersWithoutConditionsBytecodeOffset = 18852220, filtersWithoutConditionsBytecodeSize = 5845046, filtersWithConditionsBytecodeOffset = 24697266, filtersWithConditionsBytecodeSize = 10675053, topURLFiltersBytecodeOffset = 35372319, topURLFiltersBytecodeSize = 12962591}}
        __for_range = <optimized out>
        __for_begin = 0x7f3777930620
        __for_end = 0x7f3777930658
#5  0x00007f4d367542ab in IPC::callMemberFunctionImpl<WebKit::WebUserContentController, void (WebKit::WebUserContentController::*)(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&), std::tuple<WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul> >, 0ul>(WebKit::WebUserContentController*, void (WebKit::WebUserContentController::*)(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&), std::tuple<WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul> >&&, std::integer_sequence<unsigned long, 0ul>) (args=..., function=
    (void (WebKit::WebUserContentController::*)(WebKit::WebUserContentController * const, WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0, WTF::CrashOnOverflow, 16> &&)) 0x7f4d36bd95e0 <WebKit::WebUserContentController::addContentRuleLists(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&)>, object=0x7f37fc188a50) at /usr/include/c++/9.2.0/tuple:1332
        arguments = {<WTF::Optional_base<std::tuple<WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0, WTF::CrashOnOverflow, 16> > >> = {init_ = true, storage_ = {dummy_ = 32 ' ', value_ = std::tuple containing = {[1] = {<WTF::VectorBuffer<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0>> = {<WTF::VectorBufferBase<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData> >> = {m_buffer = 0x7f3777930620, m_capacity = 1, m_size = 1}, <No data fields>}, <No data fields>}}}}, <No data fields>}
#6  0x00007f4d367542ab in IPC::callMemberFunction<WebKit::WebUserContentController, void (WebKit::WebUserContentController::*)(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&), std::tuple<WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul> >, std::integer_sequence<unsigned long, 0ul> >(std::tuple<WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul> >&&, WebKit::WebUserContentController*, void (WebKit::WebUserContentController::*)(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&)) (function=(void (WebKit::WebUserContentController::*)(WebKit::WebUserContentController * const, WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0, WTF::CrashOnOverflow, 16> &&)) 0x7f4d36bd95e0 <WebKit::WebUserContentController::addContentRuleLists(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&)>, object=0x7f37fc188a50, args=...) at ../Source/WebKit/Platform/IPC/HandleMessage.h:47
        arguments = {<WTF::Optional_base<std::tuple<WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0, WTF::CrashOnOverflow, 16> > >> = {init_ = true, storage_ = {dummy_ = 32 ' ', value_ = std::tuple containing = {[1] = {<WTF::VectorBuffer<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0>> = {<WTF::VectorBufferBase<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData> >> = {m_buffer = 0x7f3777930620, m_capacity = 1, m_size = 1}, <No data fields>}, <No data fields>}}}}, <No data fields>}
#7  0x00007f4d367542ab in IPC::handleMessage<Messages::WebUserContentController::AddContentRuleLists, WebKit::WebUserContentController, void (WebKit::WebUserContentController::*)(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&)>(IPC::Decoder&, WebKit::WebUserContentController*, void (WebKit::WebUserContentController::*)(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&)) (decoder=..., object=object@entry=0x7f37fc188a50, function=(void (WebKit::WebUserContentController::*)(WebKit::WebUserContentController * const, WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0, WTF::CrashOnOverflow, 16> &&)) 0x7f4d36bd95e0 <WebKit::WebUserContentController::addContentRuleLists(WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0ul, WTF::CrashOnOverflow, 16ul>&&)>) at ../Source/WebKit/Platform/IPC/HandleMessage.h:120
        arguments = {<WTF::Optional_base<std::tuple<WTF::Vector<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0, WTF::CrashOnOverflow, 16> > >> = {init_ = true, storage_ = {dummy_ = 32 ' ', value_ = std::tuple containing = {[1] = {<WTF::VectorBuffer<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData>, 0>> = {<WTF::VectorBufferBase<std::pair<WTF::String, WebKit::WebCompiledContentRuleListData> >> = {m_buffer = 0x7f3777930620, m_capacity = 1, m_size = 1}, <No data fields>}, <No data fields>}}}}, <No data fields>}
#8  0x00007f4d3674f3f6 in WebKit::WebUserContentController::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (this=0x7f37fc188a50, connection=..., decoder=...) at DerivedSources/WebKit/WebUserContentControllerMessageReceiver.cpp:93
        protectedThis = {static isRef = <error reading variable: Missing ELF symbol "WTF::Ref<WebKit::WebUserContentController, WTF::DumbPtrTraits<WebKit::WebUserContentController> >::isRef".>, m_ptr = 0x7f37fc188a50}
#9  0x00007f4d36850d93 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) (this=this@entry=0x7f4d2f1f4068, connection=..., decoder=...) at ../Source/WebKit/Platform/IPC/MessageReceiverMap.cpp:123
        messageReceiver = <optimized out>
#10 0x00007f4d36aa1efb in WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (this=0x7f4d2f1f4000, connection=..., decoder=...) at ../Source/WebKit/Shared/AuxiliaryProcess.h:88
#11 0x00007f4d3684aca4 in IPC::Connection::dispatchMessage(IPC::Decoder&) (this=0x7f4d2f1e6000, decoder=...) at ../Source/WebKit/Platform/IPC/Connection.cpp:956
#12 0x00007f4d3684bf2d in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) (this=0x7f4d2f1e6000, message=std::unique_ptr<IPC::Decoder> = {...}) at /usr/include/c++/9.2.0/bits/unique_ptr.h:352
        isDispatchingMessageWhileWaitingForSyncReply = <optimized out>
        oldDidReceiveInvalidMessage = false
#13 0x00007f4d3684d02f in IPC::Connection::dispatchOneIncomingMessage() (this=0x7f4d2f1e6000) at /usr/include/c++/9.2.0/bits/move.h:74
        message = std::unique_ptr<IPC::Decoder> = {get() = 0x0}
#14 0x00007f4d346c0865 in WTF::Function<void ()>::operator()() const (this=<synthetic pointer>) at ../Source/WTF/wtf/Lock.h:84
        function = {m_callableWrapper = std::unique_ptr<WTF::Detail::CallableWrapperBase<void>> = {get() = 0x7f377701bc70}}
        functionsToHandle = 1
#15 0x00007f4d346c0865 in WTF::RunLoop::performWork() (this=0x7f4d2f1f5000) at ../Source/WTF/wtf/RunLoop.cpp:107
        function = {m_callableWrapper = std::unique_ptr<WTF::Detail::CallableWrapperBase<void>> = {get() = 0x7f377701bc70}}
        functionsToHandle = 1
#16 0x00007f4d3470ce1d in WTF::RunLoop::<lambda(gpointer)>::operator() (__closure=0x0, userData=<optimized out>) at ../Source/WTF/wtf/glib/RunLoopGLib.cpp:68
#17 0x00007f4d3470ce1d in WTF::RunLoop::<lambda(gpointer)>::_FUN(gpointer) () at ../Source/WTF/wtf/glib/RunLoopGLib.cpp:70
#18 0x00007f4d34d8fb5e in g_main_dispatch (context=0x55d1782abce0) at ../glib/gmain.c:3284
        dispatch = <optimized out>
        prev_source = <optimized out>
        was_in_call = 0
        user_data = 0x7f4d2f1f5000
        callback = 0x7f4d3470ce10 <WTF::RunLoop::<lambda(gpointer)>::_FUN(gpointer)>
        cb_funcs = 0x7f4d34e65280 <g_source_callback_funcs>
        cb_data = <optimized out>
        need_destroy = <optimized out>
        source = 0x55d178335f50
        current = 0x55d1782b49a0
        i = 0
        __func__ = "g_main_dispatch"
#19 0x00007f4d34d8fb5e in g_main_context_dispatch (context=0x55d1782abce0) at ../glib/gmain.c:3937
#20 0x00007f4d34d8ff10 in g_main_context_pending (context=0x7f36940d3a00) at ../glib/gmain.c:4032
        retval = <optimized out>
#21 0xaddc53a0b1567f00 in  ()
#22 0x000055d1782abce0 in  ()
#23 0x000055d17832bb98 in  ()
#24 0x000055d17832bb90 in  ()
#25 0x000055d17832bb9c in  ()
#26 0x00007ffc4a5be860 in  ()
#27 0x0000000000000000 in  ()