Bug 242787

Summary: [GTK+] Crash in imported/w3c/web-platform-tests/dom/xslt/strip-space-crash.xml
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: WebKitGTKAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: bugs-noreply, dpino
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=242784

Description Ryosuke Niwa 2022-07-14 21:28:49 PDT 
e.g.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007f72fee18897 in __GI_abort () at abort.c:79
#2  0x00007f72fee73c17 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f72fef99cba "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007f72fee7bc2a in malloc_printerr (str=str@entry=0x7f72fef97934 "free(): invalid pointer") at malloc.c:5628
#4  0x00007f72fee7cedc in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:4398
#5  0x00007f72fee80ea3 in __GI___libc_free (mem=0x7f72fed82cba <xmlStringText>) at malloc.c:3309
#6  0x00007f72fecb91f6 in xmlFreeNodeList__internal_alias (cur=0x5614998aac60) at ../tree.c:3750
#7  xmlFreeNodeList__internal_alias (cur=<optimized out>) at ../tree.c:3683
#8  0x00007f72fecb8edb in xmlFreeDoc__internal_alias (cur=0x5614999f9b40) at ../tree.c:1253
#9  0x00007f730866516c in WebCore::XSLTProcessor::transformToString(WebCore::Node&, WTF::String&, WTF::String&, WTF::String&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#10 0x00007f73073e9c71 in WebCore::Document::applyPendingXSLTransformsTimerFired() [clone .part.0] () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#11 0x00007f7308668b14 in WebCore::XMLDocumentParser::doEnd() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#12 0x00007f7308666949 in WebCore::XMLDocumentParser::end() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#13 0x00007f7308666ae5 in WebCore::XMLDocumentParser::finish() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#14 0x00007f7307a70272 in WebCore::DocumentWriter::end() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#15 0x00007f7307a83269 in WebCore::DocumentLoader::finishedLoading() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#16 0x00007f7307b4ba5b in WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) [clone .part.0] () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#17 0x00007f7307b51641 in WebCore::CachedRawResource::finishLoading(WebCore::FragmentedSharedBuffer const*, WebCore::NetworkLoadMetrics const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#18 0x00007f7307b07883 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#19 0x00007f73058be243 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&)) [clone .isra.0] () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#20 0x00007f73058c2109 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0
#21 0x00007f7305ad4c55 in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.1.so.0