Bug 67626 - [Qt] Crash in WTF::double_conversion on news.sina.com.cn
Summary: [Qt] Crash in WTF::double_conversion on news.sina.com.cn
Status: RESOLVED DUPLICATE of bug 67562
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Linux
: P1 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-09-05 20:51 PDT by zhouwg
Modified: 2011-09-06 23:02 PDT (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description zhouwg 2011-09-05 20:51:09 PDT
Program received signal SIGSEGV, Segmentation fault.
0x027e259f in WTF::double_conversion::PowersOfTenCache::GetCachedPowerForBinaryExponentRange(int, int, WTF::double_conversion::DiyFp*, int*) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
(gdb) bt
#0  0x027e259f in WTF::double_conversion::PowersOfTenCache::GetCachedPowerForBinaryExponentRange(int, int, WTF::double_conversion::DiyFp*, int*) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#1  0x026cedbc in WTF::double_conversion::FastDtoa(double, WTF::double_conversion::FastDtoaMode, int, WTF::double_conversion::Vector<char>, int*, int*)
    () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#2  0x026ccd45 in WTF::double_conversion::DoubleToStringConverter::DoubleToAscii(double, WTF::double_conversion::DoubleToStringConverter::DtoaMode, int, char*, int, bool*, int*, int*) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#3  0x026cd522 in WTF::double_conversion::DoubleToStringConverter::ToShortest(double, WTF::double_conversion::StringBuilder*) const ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#4  0x026bc237 in WTF::numberToString(double, char*) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#5  0x027cd77f in JSC::UString::number(double) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#6  0x02728685 in JSC::JSValue::toPrimitiveString(JSC::ExecState*) const ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#7  0x02724167 in cti_op_add ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#8  0x03de5fac in ?? ()
#9  0x027129f1 in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#10 0x02730d6a in JSC::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&, JSC::JSValue) ()
---Type <return> to continue, or q <return> to quit---  
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#11 0x01ce9aec in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#12 0x01cea359 in WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#13 0x01e07037 in WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#14 0x01f5a8ed in WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#15 0x01f5b0ba in WebCore::HTMLScriptRunner::executeParsingBlockingScript()
    () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#16 0x01f5b408 in WebCore::HTMLScriptRunner::executeParsingBlockingScripts() () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#17 0x01f5b48d in WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad(WebCore::CachedResource*) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#18 0x01f56fc3 in WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#19 0x01ff46ac in WebCore::CachedResource::checkNotify() ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#20 0x01ff737b in WebCore::CachedScript::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool) () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#21 0x025a95cd in WebCore::CachedResourceRequest::didFinishLoading(WebCore::SubresourceLoader*, double) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
---Type <return> to continue, or q <return> to quit---
#22 0x0204e707 in WebCore::SubresourceLoader::didFinishLoading(double) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#23 0x0204389c in WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double) () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#24 0x022875d5 in WebCore::QNetworkReplyHandler::finish() ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#25 0x02286f43 in WebCore::QNetworkReplyHandlerCallQueue::flush() ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#26 0x022871d4 in WebCore::QNetworkReplyHandlerCallQueue::push(void (WebCore::QNetworkReplyHandler::*)()) ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#27 0x02287ccf in WebCore::QNetworkReplyWrapper::didReceiveFinished() ()
   from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#28 0x02288413 in WebCore::QNetworkReplyWrapper::qt_metacall(QMetaObject::Call, int, void**) () from ../../WebKitBuild/Release/lib/libQtWebKit.so.4
#29 0x00f916ba in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) () from /usr/lib/libQtCore.so.4
#30 0x00fa14ff in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib/libQtCore.so.4
#31 0x00de1577 in QNetworkReply::finished() ()
   from /usr/lib/libQtNetwork.so.4
#32 0x00d7add4 in ?? () from /usr/lib/libQtNetwork.so.4
#33 0x00d602d0 in ?? () from /usr/lib/libQtNetwork.so.4
#34 0x00d662c1 in ?? () from /usr/lib/libQtNetwork.so.4
#35 0x00d66620 in ?? () from /usr/lib/libQtNetwork.so.4
#36 0x00d78fc6 in ?? () from /usr/lib/libQtNetwork.so.4
#37 0x00d79023 in ?? () from /usr/lib/libQtNetwork.so.4
---Type <return> to continue, or q <return> to quit---
#38 0x003b9d24 in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /usr/lib/libQtGui.so.4
#39 0x003be8ce in QApplication::notify(QObject*, QEvent*) ()
   from /usr/lib/libQtGui.so.4
#40 0x00f8b0bb in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
   from /usr/lib/libQtCore.so.4
#41 0x00f8ec79 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/lib/libQtCore.so.4
#42 0x00f8ee0d in QCoreApplication::sendPostedEvents(QObject*, int) ()
   from /usr/lib/libQtCore.so.4
#43 0x00fb83c4 in ?? () from /usr/lib/libQtCore.so.4
#44 0x03403aa8 in g_main_context_dispatch ()
   from /lib/i386-linux-gnu/libglib-2.0.so.0
#45 0x03404270 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#46 0x03404524 in g_main_context_iteration ()
   from /lib/i386-linux-gnu/libglib-2.0.so.0
#47 0x00fb853c in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#48 0x004701e5 in ?? () from /usr/lib/libQtGui.so.4
#49 0x00f8a289 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#50 0x00f8a522 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
    () from /usr/lib/libQtCore.so.4
#51 0x00f8eecc in QCoreApplication::exec() () from /usr/lib/libQtCore.so.4
#52 0x003b78e7 in QApplication::exec() () from /usr/lib/libQtGui.so.4
#53 0x0806aefd in launcherMain(QApplication const&) ()
#54 0x0806e64a in main ()
Comment 1 zhouwg 2011-09-05 21:19:46 PDT
running gdb ./QtTestBrowser in Tools/QtTestBrowser,
input url news.sina.com.cn,the webkit crashed
Comment 2 Alexey Proskuryakov 2011-09-06 11:50:16 PDT
I cannot reproduce this with WebKit ToT build on Mac. Also, there have been some fixes for Qt in this area (like bug 67562), so maybe this is already fixed?
Comment 3 Mark Hahnenberg 2011-09-06 12:38:04 PDT
(In reply to comment #2)
> I cannot reproduce this with WebKit ToT build on Mac. Also, there have been some fixes for Qt in this area (like bug 67562), so maybe this is already fixed?

I believe this is due to the fact that prior to r94514 on Qt, WTF::double_conversion::initialize() is never called, thus kCachedPowers is still null when it is derefed, causing a segfault.  As Alexey suggested, this issue should be fixed in bug 67562.

*** This bug has been marked as a duplicate of bug 67652 ***
Comment 4 Justin Novosad 2011-09-06 12:47:13 PDT

*** This bug has been marked as a duplicate of bug 67562 ***
Comment 5 zhouwg 2011-09-06 22:28:18 PDT
(In reply to comment #2)
> I cannot reproduce this with WebKit ToT build on Mac. Also, there have been some fixes for Qt in this area (like bug 67562), so maybe this is already fixed?

The OS I used is ubuntu-11.04-desktop-i386;
The Qt libraries I used are fetech via apt-get install libqt4-dev libqt4-gui 
The source package I used is WebKit-r94508.tar.bz2

Best regards
Comment 6 zhouwg 2011-09-06 22:53:19 PDT
(In reply to comment #3)
> (In reply to comment #2)
> > I cannot reproduce this with WebKit ToT build on Mac. Also, there have been some fixes for Qt in this area (like bug 67562), so maybe this is already fixed?
> I believe this is due to the fact that prior to r94514 on Qt, WTF::double_conversion::initialize() is never called, thus kCachedPowers is still null when it is derefed, causing a segfault.  As Alexey suggested, this issue should be fixed in bug 67562.
> *** This bug has been marked as a duplicate of bug 67652 ***



I add the patch found attached with Bug 67652(Changeset 94514) and rebuild webkit,
the bug disappeared and QtTestBrowser runing well until now.

thanks.
Comment 7 zhouwg 2011-09-06 23:02:26 PDT
(In reply to comment #6)
> (In reply to comment #3)
> > (In reply to comment #2)
> > > I cannot reproduce this with WebKit ToT build on Mac. Also, there have been some fixes for Qt in this area (like bug 67562), so maybe this is already fixed?
> > I believe this is due to the fact that prior to r94514 on Qt, WTF::double_conversion::initialize() is never called, thus kCachedPowers is still null when it is derefed, causing a segfault.  As Alexey suggested, this issue should be fixed in bug 67562.
> > *** This bug has been marked as a duplicate of bug 67652 ***
> I add the patch found attached with Bug 67652(Changeset 94514) and rebuild webkit,
> the bug disappeared and QtTestBrowser runing well until now.
> thanks.

sorry that made spell error. patch found attached with Bug 67562, not Bug 67652.