[Bug 1142947] Re: webkit--epiphany-browser crashed with SIGSEGV in Decoder()

[John S. Gruber]

Thanks, Brian, for looking at this and offering to look at it again
before Raring release.

I'm sure you are right that not many people are presently affected--
firefox is widely used and chromium-browser uses its own Javascript
engine. For those using straight webkit I think only the i386
architecture doesn't use the Low Level Interpreter and therefore only it
is affected. If the LLINT is enabled the present code already creates
the structure in the DFG::ShouldProfile case. (See line 811 of
Source/JavaScriptCore/jit/JIT.cpp. for where the situation is
categorized).

I'm maintaining Lernid and the current Lernid and from the current
classes I'd say Lernid isn't used with youtube often (if at all).
However I have readied a release for support of ubuntuonair which uses
hangouts, and therefore youtube. The first time I tested it I got this
crash.  I can't release Lernid with this bug outstanding in the soon-to-
be current Ubuntu release. I gather this release is also in quantal-
proposed.

Please see https://bugs.launchpad.net/lernid/+bug/1130454 filed by an
ubuntuonair organizer and Liz from the Ubuntu classroom team. The
blueprint is at https://blueprints.launchpad.net/lernid/+spec/support-
ubuntu-onair .

I believe this problem will be resolved when upstream releases r144137
for gtk. It makes the relevant test include the additional alternative,
if I read it correctly. It's too complex for me to feel comfortible
proposing for cherry picking.

I've added the patch headers you've requested and hope that they are
alright.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1142947

Title:
  webkit--epiphany-browser crashed with SIGSEGV in Decoder()

Status in Lernid:
  Invalid
Status in Webkit Direct Port:
  New
Status in “epiphany-browser” package in Ubuntu:
  Invalid
Status in “lernid” package in Ubuntu:
  Invalid
Status in “webkit” package in Ubuntu:
  Triaged
Status in “epiphany-browser” source package in Raring:
  Invalid
Status in “lernid” source package in Raring:
  Invalid
Status in “webkit” source package in Raring:
  Triaged

Bug description:
  Crash on browsing watching youtube video from http://ubuntuonair.com. Expected it to play the whole hangout video but played less than a minute. After restarting the browser it crashed again with another random video off youtube in less than 10 seconds. It appears to matter which video, or has another intermittent effect.The last failing
  video I've found is http://www.youtube.com/watch?v=Ir2TdfSwH8g.

  Also fails on lernid, which I'm testing, and midori--both also webkit
  browsers.

  Running today's live i386 CD from raring. (Today == 2013-3-3).

  No flash installed and therefore I assume that it is using html 5.
  Running flash in lernid and midori avoids the problem as webkit seems
  to use it in preference to html5--but that's just my guess.

  To reproduce:

  Install raring
  **Don't install flash**
  Install ephiphany with 'sudo apt-get install epiphany-browser'
  Start epiphany from the terminal with "epiphany "http://www.youtube.com/watch?v=Ir2TdfSwH8g
  Start the video and wait for the video to stop (coincident with the halt in the video within a minute).

  ProblemType: Crash
  DistroRelease: Ubuntu 13.04
  Package: epiphany-browser 3.6.1-2ubuntu1
  ProcVersionSignature: Ubuntu 3.8.0-9.18-generic 3.8.1
  Uname: Linux 3.8.0-9-generic i686
  ApportVersion: 2.9-0ubuntu2
  Architecture: i386
  CasperVersion: 1.330
  Date: Sun Mar  3 16:55:35 2013
  ExecutablePath: /usr/bin/epiphany-browser
  LiveMediaBuild: Ubuntu 13.04 "Raring Ringtail" - Alpha i386 (20130303)
  MarkForUpload: True
  ProcCmdline: epiphany-browser
  ProcEnviron:
   TERM=xterm
   PATH=(custom, no user)
   XDG_RUNTIME_DIR=<set>
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  SegvAnalysis:
   Segfault happened at: 0xb49fe2b9 <_ZN3JSC3DFG15AssemblyHelpers17decodedCodeMapForEPNS_9CodeBlockE+473>:	mov    0x4(%edx),%edi
   PC (0xb49fe2b9) ok
   source "0x4(%edx)" (0x00000004) not located in a known VMA region (needed readable region)!
   destination "%edi" ok
  SegvReason: reading NULL VMA
  Signal: 11
  SourcePackage: epiphany-browser
  StacktraceTop:
   JSC::DFG::AssemblyHelpers::decodedCodeMapFor(JSC::CodeBlock*) () from /usr/lib/libjavascriptcoregtk-3.0.so.0
   JSC::DFG::OSRExitCompiler::compileExit(JSC::DFG::OSRExit const&, JSC::Operands<JSC::ValueRecovery, JSC::OperandValueTraits<JSC::ValueRecovery> > const&, JSC::DFG::SpeculationRecovery*) () from /usr/lib/libjavascriptcoregtk-3.0.so.0
   ?? () from /usr/lib/libjavascriptcoregtk-3.0.so.0
   ?? ()
   JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) () from /usr/lib/libjavascriptcoregtk-3.0.so.0
  Title: epiphany-browser crashed with SIGSEGV in JSC::DFG::AssemblyHelpers::decodedCodeMapFor()
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
  XsessionErrors:
   (process:3675): GLib-GIO-WARNING **: g_settings_set_value: value for key 'visual-bell-type' in schema 'org.gnome.desktop.wm.preferences' is outside of valid range
   (process:3675): GLib-GIO-WARNING **: g_settings_set_value: value for key 'visual-bell-type' in schema 'org.gnome.desktop.wm.preferences' is outside of valid range
   (process:3675): GLib-GIO-WARNING **: g_settings_set_value: value for key 'visual-bell-type' in schema 'org.gnome.desktop.wm.preferences' is outside of valid range
   (gnome-settings-daemon:3483): libappindicator-CRITICAL **: app_indicator_set_label: assertion `IS_APP_INDICATOR (self)' failed
   (process:8224): GLib-CRITICAL **: g_slice_set_config: assertion `sys_page_size == 0' failed

To manage notifications about this bug go to:
https://bugs.launchpad.net/lernid/+bug/1142947/+subscriptions