Crash on oldiesradio.cz

[pepalogik]

Fifth usually crashes when loading that page.

[clbr]

Cannot reproduce; reloaded ten times and no crash. Please try to get a backtrace.

[pepalogik]

This is strange. For me, it also ceased crashing, but soon after the installation, it used to crash always. Please try starting Fifth after renaming your profile folder (~/.fifth), so that it will behave as a fresh install. Then load oldiesradio.cz .

If your build still does not crash, how do I get a backtrace? Do I have to build Fifth with debugging symbols and then start it within gdb, or is there an easier method?

[clbr]

Perhaps a malicious ad on the site, shown only at some times? I'm afraid I can't reproduce still, I already used clean profiles in my earlier tests. Yes, a debug build and gdb is needed, I know how painful building webkit is :(

[pepalogik]

It has crashed again. To my surprise, it seems that both Fifth and WebkitFLTK are already built with debugging symbols, as -g is included in CXXFLAGS in both makefiles. I do not know why it does not have the proclaimed size of 10.5 GB. Perhaps because I prepended CXXFLAGS=-DNDEBUG?

Anyway, I have simply executed gdb fifth and it seems to work fine. According to Murphy's Law, oldiesradio.cz now refuses to crash. I have however triggered another crash, so I will file another issue.

[pepalogik]

So the crash has come. It seems to happen more likely when loading the page as the first one after starting Fifth and if it is the first Fifth run since turning the PC on (or rebooting it).

(gdb) run
Starting program: /usr/bin/fifth 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Detected stale lock file, but no crash report?
[New Thread 0x7ffff7faf700 (LWP 6156)]
[New Thread 0x7ffff7f2e700 (LWP 6157)]
[New Thread 0x7fffabc70700 (LWP 6158)]
[New Thread 0x7fffab578700 (LWP 6159)]
[New Thread 0x7fffab377700 (LWP 6160)]
[New Thread 0x7fffab0fa700 (LWP 6161)]
[Thread 0x7fffab0fa700 (LWP 6161) exited]
[New Thread 0x7fffab0fa700 (LWP 6162)]
[Thread 0x7fffab0fa700 (LWP 6162) exited]
[New Thread 0x7fffab0fa700 (LWP 6163)]
[New Thread 0x7fffa9ff4700 (LWP 6164)]
[Thread 0x7fffab0fa700 (LWP 6163) exited]
[Thread 0x7fffa9ff4700 (LWP 6164) exited]
[New Thread 0x7fffa9ff4700 (LWP 6165)]
[New Thread 0x7fffab0fa700 (LWP 6166)]
[Thread 0x7fffa9ff4700 (LWP 6165) exited]
[Thread 0x7fffab0fa700 (LWP 6166) exited]
[New Thread 0x7fffab0fa700 (LWP 6168)]

Program received signal SIGSEGV, Segmentation fault.
0x00000000007f1804 in WebCore::RenderStyle::NonInheritedFlags::getBoolean(unsigned long) const ()
(gdb) bt
#0  0x00000000007f1804 in WebCore::RenderStyle::NonInheritedFlags::getBoolean(unsigned long) const ()
#1  0x0000000000819b7b in WebCore::RenderStyle::NonInheritedFlags::hasViewportUnits() const ()
#2  0x0000000000819b9a in WebCore::RenderStyle::hasViewportUnits() const ()
#3  0x0000000000875941 in WebCore::StyleResolver::styleForElement(WebCore::Element*, WebCore::RenderStyle*, WebCore::StyleSharingBehavior, WebCore::RuleMatchingBehavior, WebCore::RenderRegion*) ()
#4  0x000000000123d415 in WebCore::Style::styleForElement(WebCore::Element&, WebCore::ContainerNode&) ()
#5  0x000000000123edfc in WebCore::Style::resolveLocal(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#6  0x000000000123f500 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#7  0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#8  0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#9  0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#10 0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#11 0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#12 0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#13 0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#14 0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#15 0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#16 0x000000000123f741 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#17 0x000000000123fa02 in WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change) ()
#18 0x00000000008213e8 in WebCore::Document::recalcStyle(WebCore::Style::Change) ()
#19 0x0000000000821620 in WebCore::Document::updateStyleIfNeeded() ()
#20 0x00000000008216ca in WebCore::Document::updateLayout() ()
#21 0x0000000000821818 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) ()
#22 0x00000000007f5816 in WebCore::Element::offsetWidth() ()
#23 0x00000000010a10be in WebCore::jsElementOffsetWidth(JSC::ExecState*, JSC::JSObject*, long, JSC::PropertyName) ()
#24 0x0000000000b1c43b in JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const ()
#25 0x0000000001731249 in llint_slow_path_get_by_id ()
#26 0x000000000172b84b in llint_entry ()
#27 0x000000000172e9e6 in llint_entry ()
#28 0x000000000172e9e6 in llint_entry ()
#29 0x000000000172e97b in llint_entry ()
#30 0x000000000172e97b in llint_entry ()
#31 0x000000000172e97b in llint_entry ()
#32 0x000000000172e97b in llint_entry ()
#33 0x000000000172e97b in llint_entry ()
#34 0x000000000172e97b in llint_entry ()
#35 0x000000000172e9e6 in llint_entry ()
#36 0x000000000172e97b in llint_entry ()
#37 0x000000000172e9e6 in llint_entry ()
#38 0x000000000172e97b in llint_entry ()
#39 0x000000000172e97b in llint_entry ()
#40 0x000000000172e97b in llint_entry ()
#41 0x000000000172e97b in llint_entry ()
#42 0x000000000172e9e6 in llint_entry ()
#43 0x000000000172ebb0 in llint_entry ()
#44 0x000000000172e9e6 in llint_entry ()
#45 0x000000000172e9e6 in llint_entry ()
#46 0x000000000172e9e6 in llint_entry ()
#47 0x0000000001728ee7 in callToJavaScript ()
#48 0x00007fffa9383620 in ?? ()
#49 0x00007fffa8bb7f30 in ?? ()
#50 0x000002b000000002 in ?? ()
#51 0x00007fffa971fd70 in ?? ()
#52 0x00007fffa8aa4290 in ?? ()
#53 0x000000000000000a in ?? ()
#54 0x000000000000000a in ?? ()
#55 0x00007fffffffb550 in ?? ()
#56 0x0000000000ce97ef in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Notes:

• The lock without crash file is a remnant of the crash on email.seznam.cz. Crash on oldiesradio.cz does produce a crash file, but the crash on email.seznam.cz does not.
• The crash occurred after loading 49.4 % of the page, according to the progress bar.

Is the backtrace helpful? Should I build Fifth and WebkitFLTK without -DNDEBUG?

[clbr]

This is a good backtrace, thanks. It's in the shared webkit code, which means other webkit browsers should also be affected, or it could be fixed in more recent upstream webkit code. If you could do a build without DNDEBUG, the asserts might help find the exact fix, so it could be backported (or locate the open bug on bugs.webkit.org, if any).

[clbr]

Notes:

• The lock without crash file is a remnant of the crash on email.seznam.cz. Crash on oldiesradio.cz does produce a crash file, but the crash on email.seznam.cz does not.

On this, the email crash is not technically a crash, but an unhandled
notification. It should never happen, and so is not bound to the
crash-dump function - neither Fifth nor webkit use pipes anywhere,
curl/openssl do, and it's their responsibility to handle the signal.

I realize from the user POV it is the same, but I can't start adding
hooks for things my program does not use, that is a slippery slope
trying to carry the world.

[pepalogik]

Rebuilt without -DNDEBUG, launched through gdb, crash recovery, loading oldiesradio.cz, no failed assertion, the same crash (backtrace just shows one extra call compared to yesterday's crash).

Program received signal SIGSEGV, Segmentation fault.
0x0000000000838e6e in WebCore::RenderStyle::NonInheritedFlags::getBoolean(unsigned long) const ()
(gdb) bt
#0  0x0000000000838e6e in WebCore::RenderStyle::NonInheritedFlags::getBoolean(unsigned long) const ()
#1  0x0000000000867541 in WebCore::RenderStyle::NonInheritedFlags::hasViewportUnits() const ()
#2  0x0000000000867560 in WebCore::RenderStyle::hasViewportUnits() const ()
#3  0x00000000008cca27 in WebCore::StyleResolver::styleForElement(WebCore::Element*, WebCore::RenderStyle*, WebCore::StyleSharingBehavior, WebCore::RuleMatchingBehavior, WebCore::RenderRegion*) ()
#4  0x000000000127dedd in WebCore::Style::styleForElement(WebCore::Element&, WebCore::ContainerNode&) ()
#5  0x000000000127f86c in WebCore::Style::resolveLocal(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#6  0x000000000127ff74 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#7  0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#8  0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#9  0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#10 0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#11 0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#12 0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#13 0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#14 0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#15 0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#16 0x00000000012801b5 in WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) ()
#17 0x0000000001280470 in WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change) ()
#18 0x000000000086e26e in WebCore::Document::recalcStyle(WebCore::Style::Change) ()
#19 0x000000000086e513 in WebCore::Document::updateStyleIfNeeded() ()
#20 0x000000000086e607 in WebCore::Document::updateLayout() ()
#21 0x000000000086e754 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) ()
#22 0x000000000083d4d8 in WebCore::Element::offsetWidth() ()
#23 0x00000000010cf672 in WebCore::jsElementOffsetWidth(JSC::ExecState*, JSC::JSObject*, long, JSC::PropertyName) ()
#24 0x00000000006a9cc1 in JSC::PropertySlot::getValue(JSC::ExecState*, JSC::PropertyName) const ()
#25 0x0000000000b94fd7 in JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const ()
#26 0x00000000017b2d01 in llint_slow_path_get_by_id ()
#27 0x00000000017acecf in llint_entry ()
#28 0x00000000017b0099 in llint_entry ()
#29 0x00000000017b0104 in llint_entry ()
#30 0x00000000017b0099 in llint_entry ()
#31 0x00000000017b0099 in llint_entry ()
#32 0x00000000017b0099 in llint_entry ()
#33 0x00000000017b0099 in llint_entry ()
#34 0x00000000017b0099 in llint_entry ()
#35 0x00000000017b0099 in llint_entry ()
#36 0x00000000017b0104 in llint_entry ()
#37 0x00000000017b0099 in llint_entry ()
#38 0x00000000017b0104 in llint_entry ()
#39 0x00000000017b0099 in llint_entry ()
#40 0x00000000017b0099 in llint_entry ()
#41 0x00000000017b0099 in llint_entry ()
#42 0x00000000017b0099 in llint_entry ()
#43 0x00000000017b0104 in llint_entry ()
#44 0x00000000017b02ce in llint_entry ()
#45 0x00000000017b0104 in llint_entry ()
#46 0x00000000017b0104 in llint_entry ()
#47 0x00000000017b0104 in llint_entry ()
#48 0x00000000017aa531 in callToJavaScript ()
#49 0x00007fffa9853580 in ?? ()
#50 0x00007fffa9486eb0 in ?? ()
#51 0x000002b000000002 in ?? ()
#52 0x00007fffaab3fd70 in ?? ()
#53 0x00007fffa9393d50 in ?? ()
#54 0x000000000000000a in ?? ()
#55 0x000000000000000a in ?? ()
#56 0x00007fffffffb710 in ?? ()
#57 0x0000000000d07d03 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Regarding the broken pipe, I have realized that not all broken pipes cause program termination. I get quite a lot of these:

Program received signal SIGPIPE, Broken pipe.
0x00007ffff608735d in write () at ../sysdeps/unix/syscall-template.S:81
81  in ../sysdeps/unix/syscall-template.S

If I keep on entering cont in gdb, Fifth finally becomes "alive" again. (This is, however, probably not the case of the broken pipe in libpthread, which you identified as a curl bug.)

[clbr]

I'm afraid it's hard to find out the real bug then. If you had a 100% reproducer, a bisect over webkit would work, but as you don't, this will probably be unsolved unless additional clues show up.