WPEWebProcess crash (JavaScriptCore) due to SIGSEGV

[kkanag314]

The crash has been mostly identified in the boxes like ArrisX06 and AX014. WPEWEbProcess is crashing randomly with lighteningscreensaverapp.

crashed url - http://prod.lightning-screensaver.xre.aws.r53.xcal.tv/1.0.5/ only reported in 4.2 release.

Core was generated by `/usr/bin/WPEWebProcess 36 -1'.
Program terminated with signal 11, Segmentation fault.
#0 putInline () at /usr/src/debug/wpe-webkit/0.4.3+gitAUTOINC+bc64bbadf2-r0/git/Source/JavaScriptCore/runtime/JSCellInlines.h:371
#0 putInline () at /usr/src/debug/wpe-webkit/0.4.3+gitAUTOINC+bc64bbadf2-r0/git/Source/JavaScriptCore/runtime/JSCellInlines.h:371
No locals.
#1 putInline () at /usr/src/debug/wpe-webkit/0.4.3+gitAUTOINC+bc64bbadf2-r0/git/Source/JavaScriptCore/runtime/JSCJSValueInlines.h:905
No locals.
#2 operationPutByIdStrictOptimize () at /usr/src/debug/wpe-webkit/0.4.3+gitAUTOINC+bc64bbadf2-r0/git/Source/JavaScriptCore/jit/JITOperations.cpp:453
No locals.
#3 0xb23a5194 in ?? ()
No symbol table info available.
#4 0xb23a5194 in ?? ()

Stack traces has been added for further analysis

minidump.txt
backtrace_ax04.txt

[guijemont]

Do I understand correctly that the webkit used matches rev bc64bba ? And are these platforms mips or armv7 (or something else)?

[kkanag314]

The WPE version is upgraded to 2.22 .The changes are already merged in stable2.The 4.2 release images have the older WPE version

[woutermeek]

@kkanag314 could you please tell us the exact revision from 2.22?

[kkanag314]

Hi @woutermeek "686cd2f7df15f05417537485fd02ccbe632e5b09" is the commit/reversion-tags used in wpe2.22

[guijemont]

Hi @woutermeek "686cd2f7df15f05417537485fd02ccbe632e5b09" is the commit/reversion-tags used in wpe2.22

@kkanag314** Is that wpe 2.22 or 2.28? That commit seems to be derived from 2.28. Never mind, I was mistaken

[guijemont]

@kkanag314 how frequently do you see the crash. I.e. how long should I let the app run to hope to reproduce?

[kkanag314]

@guijemont The crash is reproducing randomly in 4.2 release.I observed crash one time in 30 min

[guijemont]

I've run http://prod.lightning-screensaver.xre.aws.r53.xcal.tv/1.0.5/ on WPE 686cd2f for more than 24 hours on a rpi3 (set up as arm 32 bits) and could not reproduce.

[guijemont]

Since I can't reproduce, I've been trying to dig in more into the information we get from the stack trace in backtrace_ax04.txt, and I noticed that the line numbers in there do not match at all the code in 686cd2f, but seem to match bc64bba. I tried again to see if I could reproduce with bc64bba, but on my rpi3, I only get a black screen with that revision.
From the provided stack trace, there's not much that can be inferred, other than "some data has an inconsistent value", but I can't even pinpoint which variable is problematic.

This said, we might be able to progress a bit, if you can reproduce with the following environment variable set:
JSC_dumpDisassembly=true

and provide the whole output (which will be large and include all the assembly code for JIT'ed code) as well as the crash backtrace (bt full).

If you are able to do that with a debug build, that would be even better.

[kkanag314]

Hi @guijemont The crash is observed in 4.2 release which contains the older WPE version.I will try to reproduce the issue with following environment variable JSC_dumpDisassembly=true in 4.2 release and will let you know

[guijemont]

Hi @guijemont The crash is observed in 4.2 release which contains the older WPE version.I will try to reproduce the issue with following environment variable JSC_dumpDisassembly=true in 4.2 release and will let you know

Are you able to translate the release to a specific WebKit revision? I am sorry, but I am not aware of what "4.2" is a release of or what that means. However if it's of a public project, I'd welcome a pointer to that so that I can check it for myself.

And thanks in advance for the output with the env variable set (note that it's important that the backtrace you provide and the output from JSC_dumpDisassembly=true are from the same run, so that memory addresses match)

[kkanag314]

The 4.2_p1v release have bc64bba as a commit version of wpewebkit

[kkanag314]

Hi @guijemont Is any other logs than the stack trace is required for the analysis.please let me know