Bug#771150: Webkit browser crashs while accessing Tumblr login page.

[Yoshizumi Endo]

2014-11-30 6:38 GMT+09:00 Alberto Garcia <berto at igalia.com>:

> On Thu, Nov 27, 2014 at 02:34:01PM +0900, Yoshizumi Endo wrote:
>> Package: gir1.2-webkit-3.0
>> Version: 2.4.7-2
>>
>> When I access the Tumblr login page with a Webkit browser and
>> enter some letters on the login entry, the browser crashs with
>> segmentation fault.  I am using Debian GNU/Linux jessie.
>
> Hi, thanks a lot for the test case. However I cannot reproduce the
> problem. Were you able to obtain a backtrace?

(gdb) bt
#0  0xe467b53b in ?? ()
#1  0xf346f2ab in ?? () from
/usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#2  0xf346f2ab in ?? () from
/usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#3  0xf346f2ab in ?? () from
/usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#4  0xf346f2ab in ?? () from
/usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#5  0xf346f2ab in ?? () from
/usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#6  0xf346bd09 in ?? () from
/usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#7  0xf34082a6 in JSC::JITCode::execute(JSC::VM*,
JSC::ProtoCallFrame*, JSC::Register*) () from
/usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#8  0xf33e64ec in JSC::Interpreter::executeCall(JSC::ExecState*,
JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue,
JSC::ArgList const&) ()
   from /usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#9  0xf3529824 in JSC::call(JSC::ExecState*, JSC::JSValue,
JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList
const&) ()
   from /usr/lib/i386-linux-gnu/libjavascriptcoregtk-3.0.so.0
#10 0xf3b3a61d in ?? () from /usr/lib/i386-linux-gnu/libwebkitgtk-3.0.so.0
#11 0xf3b3ae7d in ?? () from /usr/lib/i386-linux-gnu/libwebkitgtk-3.0.so.0
#12 0xf3b3af52 in ?? () from /usr/lib/i386-linux-gnu/libwebkitgtk-3.0.so.0
#13 0xf40e18c8 in ?? () from /usr/lib/i386-linux-gnu/libwebkitgtk-3.0.so.0
#14 0xf3a6cfeb in ?? () from /usr/lib/i386-linux-gnu/libwebkitgtk-3.0.so.0
#15 0xf3a6d042 in ?? () from /usr/lib/i386-linux-gnu/libwebkitgtk-3.0.so.0
#16 0xf3a8feee in ?? () from /usr/lib/i386-linux-gnu/libwebkitgtk-3.0.so.0
#17 0xf77bb8d1 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#18 0xf77bacb3 in g_main_context_dispatch () from
/lib/i386-linux-gnu/libglib-2.0.so.0
#19 0xf77bb0c9 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#20 0xf77bb479 in g_main_loop_run () from /lib/i386-linux-gnu/libglib-2.0.so.0
#21 0xf6c968de in gtk_main () from /usr/lib/i386-linux-gnu/libgtk-3.so.0
#22 0xf777094a in ffi_call_SYSV () from /usr/lib/i386-linux-gnu/libffi.so.6
#23 0xf77703d9 in ffi_call () from /usr/lib/i386-linux-gnu/libffi.so.6
#24 0xf79636df in ?? () from /usr/lib/python2.7/dist-packages/gi/_gi.so
#25 0xf7964214 in ?? () from /usr/lib/python2.7/dist-packages/gi/_gi.so
#26 0xf7965160 in ?? () from /usr/lib/python2.7/dist-packages/gi/_gi.so
#27 0xf7963eb0 in ?? () from /usr/lib/python2.7/dist-packages/gi/_gi.so
#28 0xf7963ef1 in ?? () from /usr/lib/python2.7/dist-packages/gi/_gi.so
#29 0xf7957d91 in ?? () from /usr/lib/python2.7/dist-packages/gi/_gi.so
#30 0x08124c09 in PyObject_Call (kw=<unknown at remote 0xf7d08acc>,
arg=<type at remote 0x839de40>, func=<gi.FunctionInfo at remote
0xf62240c0>) at ../Objects/abstract.c:2529
#31 do_call (nk=<optimized out>, na=<optimized out>,
pp_stack=0xffffcf58, func=<gi.FunctionInfo at remote 0xf62240c0>) at
../Python/ceval.c:4239
#32 call_function (oparg=<optimized out>, pp_stack=0xffffcf58) at
../Python/ceval.c:4044
#33 PyEval_EvalFrameEx () at ../Python/ceval.c:2667
#34 0x08122695 in PyEval_EvalCodeEx () at ../Python/ceval.c:3253
#35 0x081579bc in PyEval_EvalCode (
    locals={'WebKitTest': <GObjectMeta(__gtype__=<gobject.GType at
remote 0xf7d7aa30>, __module__='__main__', __doc__=None,
__init__=<function at remote 0xf74e8dbc>) at remote 0xf61fa02c>,
'__builtins__': <module at remote 0xf7d3f11c>, '__file__': './www.py',
'Gtk': <DynamicModule(_overrides_module=<module at remote 0xf74ff284>,
_namespace='Gtk',
_introspection_module=<IntrospectionModule(SizeGroup=<GObjectMeta(set_ignore_hidden=<gi.FunctionInfo
at remote 0xf72b2920>, __module__='gi.repository.Gtk',
set_mode=<gi.FunctionInfo at remote 0xf72b2940>,
get_mode=<gi.FunctionInfo at remote 0xf72b28c0>,
get_widgets=<gi.FunctionInfo at remote 0xf72b28e0>,
remove_widget=<gi.FunctionInfo at remote 0xf72b2900>,
add_widget=<gi.FunctionInfo at remote 0xf72b2880>, __gsignals__={},
parent_instance=<property at remote 0xf72b348c>,
get_ignore_hidden=<gi.FunctionInfo at remote 0xf72b28a0>,
new=<gi.FunctionInfo at remote 0xf72b2860>, __gtype__=<gobject.GType
at remote 0xf7d7a6e0>, __info__=<ObjectInfo at remote 0xf72ab608>,
__doc__=None, p...(truncated),
    globals={'WebKitTest': <GObjectMeta(__gtype__=<gobject.GType at
remote 0xf7d7aa30>, __module__='__main__', __doc__=None,
__init__=<function at remote 0xf74e8dbc>) at remote 0xf61fa02c>,
'__builtins__': <module at remote 0xf7d3f11c>, '__file__': './www.py',
'Gtk': <DynamicModule(_overrides_module=<module at remote 0xf74ff284>,
_namespace='Gtk',
_introspection_module=<IntrospectionModule(SizeGroup=<GObjectMeta(set_ignore_hidden=<gi.FunctionInfo
at remote 0xf72b2920>, __module__='gi.repository.Gtk',
set_mode=<gi.FunctionInfo at remote 0xf72b2940>,
get_mode=<gi.FunctionInfo at remote 0xf72b28c0>,
get_widgets=<gi.FunctionInfo at remote 0xf72b28e0>,
remove_widget=<gi.FunctionInfo at remote 0xf72b2900>,
add_widget=<gi.FunctionInfo at remote 0xf72b2880>, __gsignals__={},
parent_instance=<property at remote 0xf72b348c>,
get_ignore_hidden=<gi.FunctionInfo at remote 0xf72b28a0>,
new=<gi.FunctionInfo at remote 0xf72b2860>, __gtype__=<gobject.GType
at remote 0xf7d7a6e0>, __info__=<ObjectInfo at remote 0xf72ab608>,
__doc__=None, p...(truncated), co=0xf7cddf50)
    at ../Python/ceval.c:667
#36 run_mod.lto_priv () at ../Python/pythonrun.c:1371
#37 0x0814ead9 in PyRun_FileExFlags () at ../Python/pythonrun.c:1357
#38 0x0814d93a in PyRun_SimpleFileExFlags () at ../Python/pythonrun.c:949
#39 0x080f81d2 in Py_Main () at ../Modules/main.c:640
#40 0x080f7a7b in main (argc=2, argv=0xffffd254) at ../Modules/python.c:23

> Does it also happen with the MiniBrowser?
>
> $ /usr/lib/*/webkit2gtk-3.0/libexec/MiniBrowser https://www.tumblr.com/login

I enterd "12345678". The web page becames black out and the browser is freezed.

(gdb) run
Starting program:
/usr/lib/i386-linux-gnu/webkit2gtk-3.0/libexec/MiniBrowser
https://www.tumblr.com/login
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
[New Thread 0xf191fb40 (LWP 3148)]
[New Thread 0xf0f76b40 (LWP 3149)]
[New Thread 0xf0651b40 (LWP 3150)]
[New Thread 0xefbddb40 (LWP 3151)]
[New Thread 0xef1ffb40 (LWP 3152)]
[New Thread 0xede42b40 (LWP 3163)]
[New Thread 0xe8386b40 (LWP 3167)]
[New Thread 0xed49ab40 (LWP 3199)]
[Thread 0xede42b40 (LWP 3163) exited]
^C
Program received signal SIGINT, Interrupt.
0xf7fdad45 in __kernel_vsyscall ()
(gdb) bt
#0  0xf7fdad45 in __kernel_vsyscall ()
#1  0xf524d5bb in poll () at ../sysdeps/unix/syscall-template.S:81
#2  0xf538c0b0 in g_poll () from /lib/i386-linux-gnu/libglib-2.0.so.0
#3  0xf537d054 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#4  0xf537d479 in g_main_loop_run () from /lib/i386-linux-gnu/libglib-2.0.so.0
#5  0xf5a678de in gtk_main () from /usr/lib/i386-linux-gnu/libgtk-3.so.0
#6  0x0804e233 in main ()
(gdb)

Thanks,

-- 
Yoshizumi Endo