| Summary: | REGRESSION(256018@main): [WPE][GTK] Crash in WebCore::AVIFImageReader::parseHeader, deep in dav1d | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Michael Catanzaro <mcatanzaro> | ||||
| Component: | WebKitGTK | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | bugs-noreply, mcatanzaro, mmaxfield | ||||
| Priority: | P2 | ||||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
|
Description
Michael Catanzaro
2023-01-11 14:42:31 PST
Dump of assembler code for function dav1d_msac_decode_symbol_adapt16_avx2: 0x00007f1160373360 <+0>: lea 0x14acb9(%rip),%rax # 0x7f11604be020 0x00007f1160373367 <+7>: vpbroadcastw 0x18(%rdi),%ymm2 0x00007f116037336d <+13>: vmovdqa (%rsi),%ymm0 0x00007f1160373371 <+17>: vpbroadcastw 0x16(%rdi),%ymm3 0x00007f1160373377 <+23>: vbroadcasti128 (%rax),%ymm4 0x00007f116037337c <+28>: mov 0x20(%rdi),%ecx 0x00007f116037337f <+31>: mov %edx,%r8d 0x00007f1160373382 <+34>: not %rdx 0x00007f1160373385 <+37>: vpsrlw $0x6,%ymm0,%ymm1 0x00007f116037338a <+42>: vmovd %xmm2,-0x3c(%rsp) 0x00007f1160373390 <+48>: vpand %ymm4,%ymm2,%ymm2 0x00007f1160373394 <+52>: vpsllw $0x7,%ymm1,%ymm1 0x00007f1160373399 <+57>: vpmulhuw %ymm2,%ymm1,%ymm1 0x00007f116037339d <+61>: vpaddw (%rax,%rdx,2),%ymm1,%ymm1 => 0x00007f11603733a2 <+66>: vmovdqa %ymm1,-0x38(%rsp) 0x00007f11603733a8 <+72>: vpmaxuw %ymm3,%ymm1,%ymm1 0x00007f11603733ad <+77>: vpcmpeqw %ymm3,%ymm1,%ymm1 0x00007f11603733b1 <+81>: vpmovmskb %ymm1,%eax 0x00007f11603733b5 <+85>: test %ecx,%ecx 0x00007f11603733b7 <+87>: je 0x7f11603733ef <dav1d_msac_decode_symbol_adapt16_avx2.renorm> 0x00007f11603733b9 <+89>: movzwl (%rsi,%r8,2),%ecx 0x00007f11603733be <+94>: vpcmpeqw %ymm2,%ymm2,%ymm2 0x00007f11603733c2 <+98>: lea 0x50(%rcx),%edx 0x00007f11603733c5 <+101>: shr $0x4,%edx 0x00007f11603733c8 <+104>: cmp $0x20,%ecx 0x00007f11603733cb <+107>: adc $0x0,%ecx 0x00007f11603733ce <+110>: vmovd %edx,%xmm3 0x00007f11603733d2 <+114>: vpavgw %ymm1,%ymm2,%ymm2 0x00007f11603733d6 <+118>: vpsubw %ymm0,%ymm2,%ymm2 0x00007f11603733da <+122>: vpsubw %ymm1,%ymm0,%ymm0 0x00007f11603733de <+126>: vpsraw %xmm3,%ymm2,%ymm2 0x00007f11603733e2 <+130>: vpaddw %ymm2,%ymm0,%ymm0 0x00007f11603733e6 <+134>: vmovdqa %ymm0,(%rsi) 0x00007f11603733ea <+138>: mov %cx,(%rsi,%r8,2) End of assembler dump. (gdb) info registers rax 0x7f11604be020 139712606756896 rbx 0x1 1 rcx 0x1 1 rdx 0xfffffffffffffff6 -10 rsi 0x564572901760 94856274777952 rdi 0x564572904800 94856274790400 rbp 0x7ffc4c68cbc0 0x7ffc4c68cbc0 rsp 0x7ffc4c68cb48 0x7ffc4c68cb48 r8 0x9 9 r9 0xc8 200 r10 0x564572904b50 94856274791248 r11 0x72 114 r12 0x8 8 r13 0x5645728fb550 94856274752848 r14 0x7f10f3f24040 139710788943936 r15 0x5645728feea0 94856274767520 rip 0x7f11603733a2 0x7f11603733a2 <dav1d_msac_decode_symbol_adapt16_avx2+66> eflags 0x10202 [ IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 I discussed this with the dav1d developers and we think LTO is breaking the required 32-bit stack alignment (known issue with clang, but possibly happening with GCC too?). freedesktop-sdk enables LTO only for projects that use Meson. (In reply to Michael Catanzaro from comment #3) > I discussed this with the dav1d developers and we think LTO is breaking the > required 32-bit stack alignment (known issue with clang, but possibly > happening with GCC too?). freedesktop-sdk enables LTO only for projects that > use Meson. This was the problem. Fixed by disabling LTO. Upstream bug report: https://code.videolan.org/videolan/dav1d/-/issues/402 |