Bug#983416: Error in javascript library

[Alberto Garcia]

Control: tags -1 - moreinfo + confirmed

On Thu, Feb 25, 2021 at 04:19:56PM +0100, Alberto Garcia wrote:
> I'll come back with my findings.

So I tried with an older computer and I can also reproduce the
crash reliably, here's the CPU information and I'm also attaching a
backtrace.

vendor_id       : GenuineIntel
cpu family      : 6
model           : 15
model name      : Intel(R) Core(TM)2 Duo CPU     L7500  @ 1.60GHz
stepping        : 11
microcode       : 0xba
cpu MHz         : 933.888
cache size      : 4096 KB
physical id     : 0
siblings        : 2
core id         : 1
cpu cores       : 2
apicid          : 1
initial apicid  : 1
fpu             : yes
fpu_exception   : yes
cpuid level     : 10
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good nopl cpuid aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm pti tpr_shadow vnmi flexpriority dtherm ida
bugs            : cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs itlb_multihit
bogomips        : 3191.95
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management:

Berto
-------------- next part --------------
Thread 1 "WebKitWebProces" received signal SIGUSR1, User defined signal 1.
futex_wake (private=<optimized out>, processes_to_wake=1, futex_word=<optimized out>)
    at ../sysdeps/unix/sysv/linux/futex-internal.h:231
231	../sysdeps/unix/sysv/linux/futex-internal.h: No such file or directory.
(gdb) bt
#0  0x00007fddff695504 in WTF::HashTable<std::pair<long, JSC::SourceCodeRepresentation>, WTF::KeyValuePair<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int> >, JSC::EncodedJSValueWithRepresentationHash, WTF::HashMap<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int, JSC::EncodedJSValueWithRepresentationHash, JSC::EncodedJSValueWithRepresentationHashTraits, WTF::HashTraits<unsigned int> >::KeyValuePairTraits, JSC::EncodedJSValueWithRepresentationHashTraits>::deallocateTable(WTF::KeyValuePair<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int>*) ()
    at DerivedSources/ForwardingHeaders/wtf/HashTable.h:1226
#1  0x00007fddff695504 in WTF::HashTable<std::pair<long, JSC::SourceCodeRepresentation>, WTF::KeyValuePair<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int> >, JSC::EncodedJSValueWithRepresentationHash, WTF::HashMap<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int, JSC::EncodedJSValueWithRepresentationHash, JSC::EncodedJSValueWithRepresentationHashTraits, WTF::HashTraits<unsigned int> >::KeyValuePairTraits, JSC::EncodedJSValueWithRepresentationHashTraits>::~HashTable() () at DerivedSources/ForwardingHeaders/wtf/HashTable.h:412
#2  0x00007fddff695504 in WTF::HashMap<std::pair<long, JSC::SourceCodeRepresentation>, unsigned int, JSC::EncodedJSValueWithRepresentationHash, JSC::EncodedJSValueWithRepresentationHashTraits, WTF::HashTraits<unsigned int> >::~HashMap() () at DerivedSources/ForwardingHeaders/wtf/HashMap.h:35
#3  0x00007fddff695504 in JSC::BytecodeGenerator::~BytecodeGenerator() ()
    at ../Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:1052
#4  0x00007fddff68b58a in std::default_delete<JSC::BytecodeGenerator>::operator()(JSC::BytecodeGenerator*) const () at /usr/include/c++/8/bits/unique_ptr.h:81
#5  0x00007fddff68b58a in std::unique_ptr<JSC::BytecodeGenerator, std::default_delete<JSC::BytecodeGenerator> >::~unique_ptr() () at /usr/include/c++/8/bits/unique_ptr.h:274
#6  0x00007fddff68b58a in JSC::BytecodeGenerator::generate<JSC::FunctionNode, JSC::UnlinkedFunctionCodeBlock>(JSC::VM&, JSC::FunctionNode*, JSC::SourceCode const&, JSC::UnlinkedFunctionCodeBlock*, WTF::OptionSet<JSC::CodeGenerationMode>, JSC::VariableEnvironment const*, JSC::ECMAMode) ()
    at ../Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:441
#7  0x00007fddff68b58a in generateUnlinkedFunctionCodeBlock ()
    at ../Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp:77
#8  0x00007fddff68b58a in JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor(JSC::VM&, JSC::SourceCode const&, JSC::CodeSpecializationKind, WTF::OptionSet<JSC::CodeGenerationMode>, JSC::ParserError&, JSC::SourceParseMode) () at ../Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp:232
#9  0x00007fddfffcbfdf in JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSFunction*, JSC::JSScope*, JSC::Exception*&) ()
    at ../Source/JavaScriptCore/runtime/ScriptExecutable.cpp:326
#10 0x00007fddfffd1f77 in JSC::ScriptExecutable::prepareForExecutionImpl(JSC::VM&, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind, JSC::CodeBlock*&) ()
    at ../Source/JavaScriptCore/runtime/ScriptExecutable.cpp:422
#11 0x00007fddffcb0161 in JSC::ScriptExecutable::prepareForExecution<JSC::FunctionExecutable>(JSC::VM&, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind, JSC::CodeBlock*&) ()
    at ../Source/JavaScriptCore/bytecode/CodeBlock.h:1086
#12 0x00007fddffcb0161 in JSC::LLInt::setUpCall(JSC::CallFrame*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) () at ../Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1664
#13 0x00007fddff41233c in llint_op_call ()
    at ../Source/JavaScriptCore/llint/LowLevelInterpreter.cpp:547
#14 0x00007ffdd9b9f130 in  ()
#15 0x00007fddff41234a in llint_op_call ()
    at ../Source/JavaScriptCore/llint/LowLevelInterpreter.cpp:547
#16 0x00007fdd7c7ea520 in  ()
#17 0x00007fdd7e51b260 in  ()
#18 0x0000000000000002 in  ()
#19 0x000000000000000a in  ()
#20 0xfffe000000000028 in  ()
#21 0x0000000000000000 in  ()