Bug 208473

Created attachment 392192 [details]
Backtrace

Core was generated by `/usr/libexec/webkit2gtk-4.0/WebKitWebProcess 419 144'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  WTF::StringHasher::computeHashImpl<char16_t, WTF::StringHasher::DefaultConverter> (length=<optimized out>, 
    characters=0x7f913b726000 <error: Cannot access memory at address 0x7f913b726000>)
    at ../Source/WTF/wtf/text/StringHasher.h:297
297	        result += firstCharacter;

Short backtrace:

   #0  0x00007f9146201e50 in WTF::StringHasher::computeHashImpl<char16_t, WTF::StringHasher::DefaultConverter>(char16_t const*, unsigned int)
    (length=<optimized out>, characters=0x7f913b726000 <error: Cannot access memory at address 0x7f913b726000>)
    at ../Source/WTF/wtf/text/StringHasher.h:297
#1  0x00007f9146201e50 in WTF::StringHasher::computeHashAndMaskTop8Bits<char16_t, WTF::StringHasher::DefaultConverter>(char16_t const*, unsigned int) (length=8388608, data=0x7f913b6410e0 u"Ӽ")
    at ../Source/WTF/wtf/text/StringHasher.h:177
#2  0x00007f9146201e50 in WTF::StringHasher::computeHashAndMaskTop8Bits<char16_t>(char16_t const*, unsigned int)
    (length=8388608, data=0x7f913b6410e0 u"Ӽ") at ../Source/WTF/wtf/text/StringHasher.h:187
#3  0x00007f9146201e50 in WTF::StringImpl::hashSlowCase() const (this=0x7f776c8d7fa0)
    at ../Source/WTF/wtf/text/StringImpl.cpp:1897
#4  0x00007f91461f9bcd in WTF::StringImpl::hash() const (this=<optimized out>) at ../Source/WTF/wtf/FastMalloc.h:228
#5  0x00007f91461f9bcd in WTF::StringHash::hash(WTF::Packed<WTF::StringImpl*> const&) (key=...)
    at ../Source/WTF/wtf/text/StringHash.h:59
#6  0x00007f91461f9bcd in WTF::IdentityHashTranslator<WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::StringHash>::hash<WTF::Packed<WTF::StringImpl*> >(WTF::Packed<WTF::StringImpl*> const&) (key=...)
    at ../Source/WTF/wtf/HashTable.h:289
#7  0x00007f91461f9bcd in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::lookupForWriting<WTF::IdentityHashTranslator<WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::StringHash>, WTF::Packed<WTF::StringImpl*> >(WTF::Packed<WTF::StringImpl*> const&) (key=..., this=0x7f7744933ee8)
    at ../Source/WTF/wtf/HashTable.h:724
#8  0x00007f91461f9bcd in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::lookupForWriting(WTF::Packed<WTF::StringImpl*> const&) (key=..., this=0x7f7744933ee8)
    at ../Source/WTF/wtf/HashTable.h:514
#9  0x00007f91461f9bcd in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::reinsert(WTF::Packed<WTF::StringImpl*>&&) (entry=..., this=0x7f7744933ee8)
    at ../Source/WTF/wtf/HashTable.h:1050
#10 0x00007f91461f9bcd in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::rehash(unsigned int, WTF::Packed<WTF::StringImpl*>*)
    (this=this@entry=0x7f7744933ee8, newTableSize=<optimized out>, entry=entry@entry=0x0)
    at ../Source/WTF/wtf/HashTable.h:1343
#11 0x00007f91461fa1ea in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::shrink() (this=0x7f7744933ee8) at ../Source/WTF/wtf/HashTable.h:531
#12 0x00007f91461fa1ea in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::remove(WTF::Packed<WTF::StringImpl*>*) (this=this@entry=0x7f7744933ee8, pos=<optimized out>)
    at ../Source/WTF/wtf/HashTable.h:1125
#13 0x00007f91461f9744 in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::removeAndInvalidateWithoutEntryConsistencyCheck(WTF::Packed<WTF::StringImpl*>*)
    (pos=<optimized out>, this=0x7f7744933ee8) at ../Source/WTF/wtf/HashTable.h:1096
#14 0x00007f91461f9744 in WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::removeWithoutEntryConsistencyCheck(WTF::HashTableConstIterator<WTF::Packed<WTF::StringImpl*>, WTF::Packed<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >) (this=<optimized out>, it=...) at ../Source/WTF/wtf/HashTable.h:1154
#15 0x00007f91461f9744 in WTF::HashSet<WTF::Packed<WTF::StringImpl*>, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >::remove(WTF::HashTableConstIteratorAdapter<WTF::HashTable<WTF::Packed<WTF::StringImpl*>, WTF::Packe--Type <RET> for more, q to quit, c to continue without paging--c
d<WTF::StringImpl*>, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> >, WTF::HashTraits<WTF::Packed<WTF::StringImpl*> > >, WTF::Packed<WTF::StringImpl*> >) (this=0x7f7744933ee8, it=...) at ../Source/WTF/wtf/HashSet.h:279
#16 0x00007f91461f9744 in WTF::AtomStringImpl::remove(WTF::AtomStringImpl*) (string=0x7f76edf49da0) at ../Source/WTF/wtf/text/AtomStringImpl.cpp:498
#17 0x00007f91461fed95 in WTF::StringImpl::~StringImpl() (this=0x7f76edf49da0, __in_chrg=<optimized out>) at ../Source/WTF/wtf/text/StringImpl.cpp:120
#18 0x00007f91461fedfd in WTF::StringImpl::destroy(WTF::StringImpl*) (stringImpl=0x7f76edf49da0) at ../Source/WTF/wtf/text/StringImpl.cpp:152
#19 0x00007f9145fcf3b0 in JSC::JSString::destroy(JSC::JSCell*) (cell=0x7f76ee45f070) at ../Source/JavaScriptCore/runtime/JSString.h:97
#20 0x00007f9145fcf3b0 in JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const (cell=0x7f76ee45f070, this=<optimized out>) at ../Source/JavaScriptCore/heap/IsoInlinedHeapCellType.h:44
#21 0x00007f9145fcf3b0 in JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc const&)::{lambda(void*)#1}::operator()(void*) const (this=<optimized out>, cell=0x7f76ee45f070) at ../Source/JavaScriptCore/heap/MarkedBlockInlines.h:260
#22 0x00007f9145fcf3b0 in JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc const&)::{lambda(void*)#1}::operator()(void*) const (this=<synthetic pointer>, cell=0x7f76ee45f070) at ../Source/JavaScriptCore/heap/MarkedBlockInlines.h:257
#23 0x00007f9145fcf3b0 in JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc const&) (this=0x7f7745aef420, freeList=freeList@entry=0x0, emptyMode=emptyMode@entry=JSC::MarkedBlock::Handle::IsEmpty, sweepMode=sweepMode@entry=JSC::MarkedBlock::Handle::SweepOnly, destructionMode=destructionMode@entry=JSC::MarkedBlock::Handle::BlockHasDestructors, scribbleMode=scribbleMode@entry=JSC::MarkedBlock::Handle::DontScribble, newlyAllocatedMode=JSC::MarkedBlock::Handle::DoesNotHaveNewlyAllocated, marksMode=JSC::MarkedBlock::Handle::MarksStale, destroyFunc=...) at ../Source/JavaScriptCore/heap/MarkedBlockInlines.h:294
#24 0x00007f9145fd09fd in JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc>(JSC::FreeList*, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc const&)::{lambda()#1}::operator()() const (this=<synthetic pointer>) at ../Source/JavaScriptCore/heap/MarkedBlockInlines.h:483
#25 0x00007f9145fd09fd in JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc>(JSC::FreeList*, JSC::IsoInlinedHeapCellType<JSC::JSString>::DestroyFunc const&) (this=<optimized out>, freeList=<optimized out>, destroyFunc=...) at ../Source/JavaScriptCore/heap/MarkedBlockInlines.h:435
#26 0x00007f9145fd0aa8 in JSC::IsoInlinedHeapCellType<JSC::JSString>::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) (this=<optimized out>, handle=..., freeList=<optimized out>) at ../Source/JavaScriptCore/heap/IsoInlinedHeapCellType.h:48
#27 0x00007f9145a3c726 in JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) (this=this@entry=0x7f7745aef420, freeList=freeList@entry=0x0) at ../Source/JavaScriptCore/heap/MarkedBlock.cpp:419
#28 0x00007f9145a27f4b in JSC::IncrementalSweeper::sweepNextBlock(JSC::VM&) (this=this@entry=0x7f774490b038, vm=...) at ../Source/JavaScriptCore/heap/IncrementalSweeper.cpp:89
#29 0x00007f9145a27fc1 in JSC::IncrementalSweeper::doSweep(JSC::VM&, WTF::MonotonicTime) (this=0x7f774490b038, vm=..., sweepBeginTime=...) at ../Source/JavaScriptCore/heap/IncrementalSweeper.cpp:59
#30 0x00007f9145e9e55c in JSC::JSRunLoopTimer::timerDidFire() (this=0x7f774490b038) at ../Source/JavaScriptCore/runtime/JSRunLoopTimer.cpp:305
#31 0x00007f9145ea0ccc in JSC::JSRunLoopTimer::Manager::timerDidFire() (this=<optimized out>) at DerivedSources/ForwardingHeaders/wtf/DumbPtrTraits.h:43
#32 0x00007f9146214b78 in WTF::RunLoop::TimerBase::<lambda(gpointer)>::operator() (__closure=0x0, userData=0x7f774491e100) at ../Source/WTF/wtf/glib/RunLoopGLib.cpp:177
#33 0x00007f9146214b78 in WTF::RunLoop::TimerBase::<lambda(gpointer)>::_FUN(gpointer) () at ../Source/WTF/wtf/glib/RunLoopGLib.cpp:183
#34 0x00007f9146950bde in g_main_dispatch (context=0x7f7770002690) at ../glib/gmain.c:3309
#35 0x00007f9146950bde in g_main_context_dispatch (context=context@entry=0x7f7770002690) at ../glib/gmain.c:3974
#36 0x00007f9146950f90 in g_main_context_iterate (context=context@entry=0x7f7770002690, block=block@entry=0, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4047
#37 0x00007f9146951033 in g_main_context_iteration (context=context@entry=0x7f7770002690, may_block=may_block@entry=0) at ../glib/gmain.c:4108
#38 0x00007f9149ed73fa in WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode) (this=this@entry=0x7f774472abf0, context=context@entry=0x7f908444e830, predicate=..., waitMode=waitMode@entry=WebCore::WorkerRunLoop::WaitForMessage) at ../Source/WebCore/workers/WorkerRunLoop.cpp:176
#39 0x00007f9149ed75d0 in WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*) (this=0x7f774472abf0, context=0x7f908444e830) at ../Source/WebCore/workers/WorkerRunLoop.cpp:142
#40 0x00007f9149ed9db8 in WebCore::WorkerThread::workerThread() (this=0x7f774472abd0) at ../Source/WebCore/workers/WorkerThread.cpp:205
#41 0x00007f91461c7148 in WTF::Function<void ()>::operator()() const (this=<synthetic pointer>) at ../Source/WTF/wtf/Function.h:81
#42 0x00007f91461c7148 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) (newThreadContext=0x7f7744928558) at ../Source/WTF/wtf/Threading.cpp:148
#43 0x00007f914621644d in WTF::wtfThreadEntryPoint(void*) (context=<optimized out>) at ../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:200
#44 0x00007f91448bf5e2 in start_thread (arg=<optimized out>) at pthread_create.c:479
#45 0x00007f91478c6413 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Full backtrace attached