#15804: WebKit: crash in incrementPageOccupancy
----------------------------------------+----------------------------
Reporter: X512 | Owner: pulkomandy
Type: bug | Status: new
Priority: normal | Milestone: Unscheduled
Component: Applications/WebPositive | Version: R1/Development
Resolution: | Keywords:
Blocked By: | Blocking:
Has a Patch: 0 | Platform: All
----------------------------------------+----------------------------
Comment (by KapiX):
I started debugging this with above reproducer, but can't proceed further
because even printf-debugging breaks down after adding some traces (it
won't show me the Desktop [1], so I can't run the test program). Here's
what I got so far:
{{{
_vm_map_file(fd = -1, offset = 0, size = 8192, mapping 1)
create_anonymous_area [480] mem mmap area: size 0x2000
map_backing_store: aspace 0xffffffff88ab71f0, cache 0xffffffff88c301d8,
virtual 0x0000000000100000, offset 0x0, size 8192, addressSpec 1, wiring
0, protection 17, area 0xffffffff85307bd8, areaName 'mem mmap area'
err2 CREATE_AREA_DONT_COMMIT_MEMORY: 0
unmap_address_range: aspace 0xffffffff88ab71f0, address 1048576, size
8192, kernel 0
VMUserAddressSpace::_InsertAreaSlot: address space 0xffffffff88ab71f0,
start 0x100000, size 8192, end 0x101fff, addressSpec 1, area
0xffffffff88d72cc8
VMUserAddressSpace::_InsertAreaIntoReservedRegion: address space
0xffffffff88ab71f0, start 0x100000, size 8192, area 0xffffffff88d72cc8
err2 InsertArea: 0
vm_create_anonymous_area: done
_vm_map_file(fd = -1, offset = 0, size = 12288, mapping 1)
create_anonymous_area [480] mem mmap area: size 0x3000
map_backing_store: aspace 0xffffffff88ab71f0, cache 0xffffffff88c0f590,
virtual 0x0000000000100000, offset 0x0, size 12288, addressSpec 1, wiring
0, protection 17, area 0xffffffff85307bd8, areaName 'mem mmap area'
err2 CREATE_AREA_DONT_COMMIT_MEMORY: 0
unmap_address_range: aspace 0xffffffff88ab71f0, address 1048576, size
12288, kernel 0
cut_area: aspace 0xffffffff88ab71f0, address 1048576, lastAddress 1060863,
kernel 0
VMUserAddressSpace::_InsertAreaSlot: address space 0xffffffff88ab71f0,
start 0x100000, size 12288, end 0x102fff, addressSpec 1, area
0xffffffff88d03e40
VMUserAddressSpace::_InsertAreaIntoReservedRegion: address space
0xffffffff88ab71f0, start 0x100000, size 12288, area 0xffffffff88d03e40
121
err2 InsertArea: -2147483643
map_backing_store: err2
map_backing_store: err1
unmap_address_range: aspace 0xffffffff88ab71f0, address 1048576, size
12288, kernel 0
VMUserAddressSpace::_InsertAreaSlot: address space 0xffffffff88ab71f0,
start 0x100000, size 12288, end 0x102fff, addressSpec 1, area
0xffffffff88d03e40
121
_vm_map_file(fd = -1, offset = 0, size = 12288, mapping 1)
create_anonymous_area [480] mem mmap area: size 0x3000
map_backing_store: aspace 0xffffffff88ab71f0, cache 0xffffffff88c0f590,
virtual 0x0000000000100000, offset 0x0, size 12288, addressSpec 1, wiring
0, protection 17, area 0xffffffff85307bd8, areaName 'mem mmap area'
err2 CREATE_AREA_DONT_COMMIT_MEMORY: 0
unmap_address_range: aspace 0xffffffff88ab71f0, address 1048576, size
12288, kernel 0
VMUserAddressSpace::_InsertAreaSlot: address space 0xffffffff88ab71f0,
start 0x100000, size 12288, end 0x102fff, addressSpec 1, area
0xffffffff88d03e40
VMUserAddressSpace::_InsertAreaIntoReservedRegion: address space
0xffffffff88ab71f0, start 0x100000, size 12288, area 0xffffffff88d03e40
121
err2 InsertArea: -2147483643
map_backing_store: err2
map_backing_store: err1
480: DEBUGGER: crash
}}}
What I think is happening is unmapping doesn't return the area to reserved
pool, but this is just a guess. It also can't be reserved again after
unmapping. However, it's not _InsertAreaIntoReservedRegion that returns
B_BAD_VALUE (I believe it's B_ENTRY_NOT_FOUND).
I will attach a patch with these traces.
[1] It shows FirstBootPrompt but after that it goes into some kind of loop
(?) printing `get_memory_map_etc`. It doesn't hang, it just keeps going.
It seems this can be triggered by adding one TRACE too many, and even
changing trace length can fix it (not always though).
--
Ticket URL: <https://dev.haiku-os.org/ticket/15804#comment:15>
Haiku <https://dev.haiku-os.org>
The Haiku operating system.
