Details
P1: Critical Description
Auto-tests on Linux and Windows randomly crash with a segmentation fault, and no proper backtrace.
The tests that crashed so far in CI are:
tests/auto/widgets/qwebengineaccessibility
tests/auto/widgets/qwebenginesettings
tests/auto/widgets/qwebenginehistory
Personally I was able to reproduce locally with Ubuntu 15.10 VM using qwebenginehistory and qwebenginesettings (much faster to reproduce), by repeatedly calling the test in a bash loop, until it crashes.
I couldn't reproduce the issue on OSX.
Attaching a few stack traces from generated core dumps.
From the investigation I did so far, it seems there is a use-after-free inside libc getenv() function, supposedly because of some race-condition in multi-threaded code, that calls set/putenv, which reallocates memory, and the getenv environment pointer accesses already freed memory.
tst_qwebenginehistory #0 0x00007fe166ee3267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007fe166ee4eca in __GI_abort () at abort.c:89 #2 0x00007fe1678bfff1 in qt_message_fatal (context=..., message=...) at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/global/qlogging.cpp:1613 #3 0x00007fe1678bc29a in QMessageLogger::fatal (this=0x7fe102ffbc80, msg=0x7fe16906ea10 "Received signal %d\n Function time: %dms Total time: %dms") at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/global/qlogging.cpp:787 #4 0x00007fe169049902 in QTest::FatalSignalHandler::signal (signum=11) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:1342 #5 <signal handler called> #6 __GI_getenv (name=0x7fe164a39d63 "ENT_SHOW_METHOD") at getenv.c:85 #7 0x00007fe1623fe87c in evutil_getenv (varname=0x7fe164a39d61 "EVENT_SHOW_METHOD") at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/third_party/libevent/evutil.c:283 #8 0x00007fe1623fcae0 in event_base_new () at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/third_party/libevent/event.c:191 #9 0x00007fe160991b9b in base::MessagePumpLibevent::MessagePumpLibevent (this=0x7fe0f8001950) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/message_loop/message_pump_libevent.cc:112 #10 0x00007fe1609ef883 in base::MessageLoop::CreateMessagePumpForType (type=base::MessageLoop::TYPE_IO) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/message_loop/message_loop.cc:241 #11 0x00007fe1609f0c9a in base::MessageLoop::BindToCurrentThread (this=0x7fe0f4001cc0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/message_loop/message_loop.cc:412 #12 0x00007fe160a70fd9 in base::Thread::ThreadMain (this=0x7fe0f4001a58) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/threading/thread.cc:229 #13 0x00007fe160a63fb5 in base::(anonymous namespace)::ThreadFunc (params=0x7fe0f4001b90) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/threading/platform_thread_posix.cc:67 #14 0x00007fe15bed66aa in start_thread (arg=0x7fe102ffd700) at pthread_create.c:333 #15 0x00007fe166fb4e9d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
tst_qtwebenginesettings #0 0x00007f593662c267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007f593662deca in __GI_abort () at abort.c:89 #2 0x00007f5937008ff1 in qt_message_fatal (context=..., message=...) at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/global/qlogging.cpp:1613 #3 0x00007f593700529a in QMessageLogger::fatal (this=0x7f59387d0a80 <QTest::FatalSignalHandler::FatalSignalHandler()::alternate_stack+14976>, msg=0x7f59387b7a10 "Received signal %d\n Function time: %dms Total time: %dms") at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/global/qlogging.cpp:787 #4 0x00007f5938792902 in QTest::FatalSignalHandler::signal (signum=11) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:1342 #5 <signal handler called> #6 __GI_getenv (name=0x7f5932c818aa "") at getenv.c:85 #7 0x00007f592eb0a407 in content::TimeZoneMonitorLinux::TimeZoneMonitorLinux (this=0x24fe180) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/time_zone_monitor_linux.cc:150 #8 0x00007f592eb0a510 in content::TimeZoneMonitor::Create () at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/time_zone_monitor_linux.cc:163 #9 0x00007f592e7720e2 in content::BrowserMainLoop::BrowserThreadsStarted (this=0x2490af0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/browser_main_loop.cc:1284 #10 0x00007f592e776b31 in base::internal::RunnableAdapter<int (content::BrowserMainLoop::*)()>::Run (this=0x7ffec481f2a0, object=0x2490af0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:178 #11 0x00007f592e776865 in base::internal::InvokeHelper<false, int, base::internal::RunnableAdapter<int (content::BrowserMainLoop::*)()>, base::internal::TypeList<content::BrowserMainLoop*> >::MakeItSo (runnable=..., args#0=0x2490af0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:290 #12 0x00007f592e77643a in base::internal::Invoker<base::IndexSequence<0ul>, base::internal::BindState<base::internal::RunnableAdapter<int (content::BrowserMainLoop::*)()>, int (content::BrowserMainLoop*), base::internal::UnretainedWrapper<content::BrowserMainLoop> >, base::internal::TypeList<base::internal::UnwrapTraits<base::internal::UnretainedWrapper<content::BrowserMainLoop> > >, base::internal::InvokeHelper<false, int, base::internal::RunnableAdapter<int (content::BrowserMainLoop::*)()>, base::internal::TypeList<content::BrowserMainLoop*> >, int ()>::Run(base::internal::BindStateBase*) (base=0x24ae450) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:350 #13 0x00007f592db805c0 in base::Callback<int ()>::Run() const (this=0x24ae4a0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/callback.h:394 #14 0x00007f592eb08ad4 in content::StartupTaskRunner::RunAllTasksNow (this=0x24ae330) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/startup_task_runner.cc:45 #15 0x00007f592e76ef72 in content::BrowserMainLoop::CreateStartupTasks (this=0x2490af0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/browser_main_loop.cc:806 #16 0x00007f592e2a6169 in content::BrowserMainRunnerImpl::Initialize (this=0x2434cb0, parameters=...) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/browser_main_runner.cc:222 #17 0x00007f592cc90012 in QtWebEngineCore::WebEngineContext::WebEngineContext (this=0x2434bb0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/web_engine_context.cpp:288 #18 0x00007f592cc8f390 in QtWebEngineCore::WebEngineContext::current () at /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/web_engine_context.cpp:192 #19 0x00007f592cc96a30 in QtWebEngineCore::WebEngineSettings::initDefaults (this=0x2434450, offTheRecord=true) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/web_engine_settings.cpp:228 #20 0x00007f59387fd054 in QWebEngineProfilePrivate::QWebEngineProfilePrivate (this=0x24343f0, browserContext=Reading in symbols for /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/browser_context_adapter.cpp...done. 0x2431c20) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/webenginewidgets/api/qwebengineprofile.cpp:149 #21 0x00007f59387fd62d in QWebEngineProfile::QWebEngineProfile (this=Reading in symbols for .moc/moc_qwebengineprofile.cpp...done. 0x7ffec481f830, parent=Reading in symbols for /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/kernel/qobject.cpp...done. 0x0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/webenginewidgets/api/qwebengineprofile.cpp:238 #22 0x00000000004052b7 in tst_QWebEngineSettings::resetAttributes (this=0x7ffec48202d0) at /home/alex/Dev/qt/qt57_source/qtwebengine/tests/auto/widgets/qwebenginesettings/tst_qwebenginesettings.cpp:34 #23 0x00000000004057d3 in tst_QWebEngineSettings::qt_static_metacall (_o=0x7ffec48202d0, _c=QMetaObject::InvokeMetaMethod, _id=0, _a=0x7ffec481f9c0) at .moc/tst_qwebenginesettings.moc:70 #24 0x00007f5937280873 in QMetaMethod::invoke (this=0x242ffd0, object=0x7ffec48202d0, connectionType=Qt::DirectConnection, returnValue=..., val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/kernel/qmetaobject.cpp:2211 #25 0x00007f59387975f9 in QMetaMethod::invoke (this=0x242ffd0, object=0x7ffec48202d0, connectionType=Qt::DirectConnection, val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at ../../include/QtCore/../../../../qt57_source/qtbase/src/corelib/kernel/qmetaobject.h:123 #26 0x00007f59387907d7 in QTest::TestMethods::invokeTestOnData (this=0x7ffec4820220, index=0) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:786 #27 0x00007f593879137a in QTest::TestMethods::invokeTest (this=0x7ffec4820220, index=0, data=0x0, watchDog=0x2430300) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:967 #28 0x00007f593879260b in QTest::TestMethods::invokeTests (this=0x7ffec4820220, testObject=0x7ffec48202d0) ---Type <return> to continue, or q <return> to quit--- at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:1300 #29 0x00007f593879322c in QTest::qExec (testObject=0x7ffec48202d0, argc=1, argv=0x7ffec48203e8) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:1710 #30 0x00000000004056fd in main (Reading in symbols for libc-start.c...done. argc=1, argv=0x7ffec48203e8) at /home/alex/Dev/qt/qt57_source/qtwebengine/tests/auto/widgets/qwebenginesettings/tst_qwebenginesettings.cpp:61 (gdb) frame 6 #6 __GI_getenv (name=0x7f5932c818aa "") at getenv.c:85 85 if (name_start == ep_start && !strncmp (*ep + 2, name, len) (gdb) info locals ep_start = <error reading variable ep_start (Cannot access memory at address 0x75412e616964654d)> len = 0 ep = 0x2431510 name_start = 23124
Another tst_qwebenginesettings dump #0 0x00007f5f2b839267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007f5f2b83aeca in __GI_abort () at abort.c:89 #2 0x00007f5f2c215ff1 in qt_message_fatal (context=..., message=...) at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/global/qlogging.cpp:1613 #3 0x00007f5f2c21229a in QMessageLogger::fatal (this=0x7f5f2d9dda80 <QTest::FatalSignalHandler::FatalSignalHandler()::alternate_stack+14976>, msg=0x7f5f2d9c4a10 "Received signal %d\n Function time: %dms Total time: %dms") at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/global/qlogging.cpp:787 #4 0x00007f5f2d99f902 in QTest::FatalSignalHandler::signal (signum=11) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:1342 #5 <signal handler called> #6 __GI_getenv (name=0x7f5f0c167e4d "LSE_SINK") at getenv.c:85 #7 0x00007f5f0c1272dc in pa_client_conf_load () from /usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-6.0.so #8 0x00007f5f0c5a7364 in pa_context_new_with_proplist () from /usr/lib/x86_64-linux-gnu/libpulse.so.0 #9 0x00007f5f2282c1f5 in pa_stream_disconnect (s=0x185f338) at obj/src/3rdparty/chromium/media/media.gen/pulse_stubs.cc:193 #10 0x00007f5f22821b19 in media::AudioManagerPulse::Init (this=0x1862e40) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/media/audio/pulse/audio_manager_pulse.cc:269 #11 0x00007f5f2282058a in media::AudioManagerPulse::~AudioManagerPulse (this=0x0, __in_chrg=<optimized out>) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/media/audio/pulse/audio_manager_pulse.cc:69 #12 0x00007f5f2282038b in media::AudioManagerPulse::Create ( audio_log_factory=Reading in symbols for /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/renderer_host/media/audio_renderer_host.cc...done. 0x7f5f23c65e90 <media::AudioOutputController::EventHandler::~EventHandler()>) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/media/audio/pulse/audio_manager_pulse.cc:51 #13 0x00007f5f2281f09e in media::AudioManager::SetGlobalAppName (app_name=<error reading variable: Cannot access memory at address 0x8>) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/media/audio/audio_manager.cc:327 #14 0x00007f5f2281f0ea in media::AudioManager::GetDefaultDeviceName[abi:cxx11]() () at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/media/audio/audio_manager.cc:343 #15 0x00007f5f2397ec7f in content::BrowserMainLoop::BrowserThreadsStarted (this=0x17e9b70) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/browser_main_loop.cc:1253 #16 0x00007f5f23983cd1 in base::MessageLoopForUI::~MessageLoopForUI (this=0x7ffc08a11670, __in_chrg=<optimized out>) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/message_loop/message_loop.h:561 #17 0x00007f5f23983a05 in base::internal::BindState<base::internal::RunnableAdapter<void (content::BrowserMainLoop::*)()>, void (content::BrowserMainLoop*), base::internal::UnretainedWrapper<content::BrowserMainLoop> >::Destroy(base::internal::BindStateBase*) (self=0x0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:419 #18 0x00007f5f239835da in base::internal::BindState<base::internal::RunnableAdapter<content::GpuProcessHost* (*)(content::GpuProcessHost::GpuProcessKind, content::CauseForGpuLaunch)>, void (content::GpuProcessHost::GpuProcessKind, content::CauseForGpuLaunch), content::GpuProcessHost::GpuProcessKind, content::CauseForGpuLaunch>::Destroy(base::internal::BindStateBase*) (self=0x18077b0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:419 #19 0x00007f5f22d8d760 in base::internal::MakeRunnable<void (*)(base::Callback<void (int)> const&, int*)>(void (* const&)(base::Callback<void (int)> const&, int*)) (t=@0x1807800: 0x18077b0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:249 #20 0x00007f5f23d15c74 in content::StartupTaskRunner::WrappedTask (this=0x1807800) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/startup_task_runner.cc:78 #21 0x00007f5f2397c112 in content::BrowserMainLoop::CreateThreads (this=0x1) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/browser_main_loop.cc:817 #22 0x00007f5f234b3309 in content::BrowserMainRunnerImpl::Run (this=0x7f5f2397cb68 <content::BrowserMainLoop::RunMainMessageLoopParts()+8>) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/3rdparty/chromium/content/browser/browser_main_runner.cc:235 #23 0x00007f5f21e9d1b4 in _GLOBAL__sub_I_web_engine_context.cpp(void) () at /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/web_engine_context.cpp:321 #24 0x00007f5f21e9c450 in QtWebEngineCore::WebEngineContext::defaultBrowserContext (this=0x178d590) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/web_engine_context.cpp:202 #25 0x00007f5f21ea3bd2 in QtWebEngineCore::WebEngineSettings::initDefaults (this=0x178d490, offTheRecord=true) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/web_engine_settings.cpp:247 #26 0x00007f5f2da0a054 in QWebEngineProfilePrivate::QWebEngineProfilePrivate (this=0x178d430, browserContext=Reading in symbols for /home/alex/Dev/qt/qt57_source/qtwebengine/src/core/browser_context_adapter.cpp...done. 0x178ac60) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/webenginewidgets/api/qwebengineprofile.cpp:149 #27 0x00007f5f2da0a62d in QWebEngineProfile::QWebEngineProfile (this=Reading in symbols for .moc/moc_qwebengineprofile.cpp...done. 0x7ffc08a11c00, parent=Reading in symbols for /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/kernel/qobject.cpp...done. 0x0) at /home/alex/Dev/qt/qt57_source/qtwebengine/src/webenginewidgets/api/qwebengineprofile.cpp:238 #28 0x00000000004052b7 in tst_QWebEngineSettings::resetAttributes (this=0x7ffc08a126a0) at /home/alex/Dev/qt/qt57_source/qtwebengine/tests/auto/widgets/qwebenginesettings/tst_qwebenginesettings.cpp:34 ---Type <return> to continue, or q <return> to quit--- #29 0x00000000004057d3 in tst_QWebEngineSettings::qt_static_metacall (_o=0x7ffc08a126a0, _c=QMetaObject::InvokeMetaMethod, _id=0, _a=0x7ffc08a11d90) at .moc/tst_qwebenginesettings.moc:70 #30 0x00007f5f2c48d873 in QMetaMethod::invoke (this=0x1789010, object=0x7ffc08a126a0, connectionType=Qt::DirectConnection, returnValue=..., val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at /home/alex/Dev/qt/qt57_source/qtbase/src/corelib/kernel/qmetaobject.cpp:2211 #31 0x00007f5f2d9a45f9 in QMetaMethod::invoke (this=0x1789010, object=0x7ffc08a126a0, connectionType=Qt::DirectConnection, val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at ../../include/QtCore/../../../../qt57_source/qtbase/src/corelib/kernel/qmetaobject.h:123 #32 0x00007f5f2d99d7d7 in QTest::TestMethods::invokeTestOnData (this=0x7ffc08a125f0, index=0) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:786 #33 0x00007f5f2d99e37a in QTest::TestMethods::invokeTest (this=0x7ffc08a125f0, index=0, data=0x0, watchDog=0x1789340) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:967 #34 0x00007f5f2d99f60b in QTest::TestMethods::invokeTests (this=0x7ffc08a125f0, testObject=0x7ffc08a126a0) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:1300 #35 0x00007f5f2d9a022c in QTest::qExec (testObject=0x7ffc08a126a0, argc=1, argv=0x7ffc08a127b8) at /home/alex/Dev/qt/qt57_source/qtbase/src/testlib/qtestcase.cpp:1710 #36 0x00000000004056fd in main (Reading in symbols for libc-start.c...done. argc=1, argv=0x7ffc08a127b8) at /home/alex/Dev/qt/qt57_source/qtwebengine/tests/auto/widgets/qwebenginesettings/tst_qwebenginesettings.cpp:61 Current language: auto The current source language is "auto; currently c". (gdb) frame 6 #6 __GI_getenv (name=0x7f5f0c167e4d "LSE_SINK") at getenv.c:85 85 if (name_start == ep_start && !strncmp (*ep + 2, name, len) (gdb) info locals ep_start = <error reading variable ep_start (Cannot access memory at address 0x1d0)> len = 8 ep = 0x178a710 name_start = 21840