Qt-webkit - segment fault

[1412]

I'm developting a GUI for our HMI with qt-webkit-kiosk. But when I run qt-webkit-kiosk to display a simple demo html, I got segment fault. Below is detailed information.

Soc : AM335X

TI SDK: 08:00:00 (Kernel Ver: 3.14.26)

FS: buidt from buildroot 2017.02

TI-gfx: built from buildroot 2017.02, based on Graphics_SDK_setuplinux_hardfp_5_01_01_02.bin

Toolchain; builtfrom buildroot 2017.02, using kernel 3.14.26, glibc 2.23, binutil 2.26.1, gcc 4.8.5, armeabihf and neon FPU strage

I used gdb to debug, below is the backstrace when segment happened. It seems like a problem related with elg (see #4 below).

(gdb) bt
#0 0xb32cbb66 in ?? () from target:/lib/libc.so.6
#1 0xb32d964e in raise () from target:/lib/libc.so.6
#2 0xb32da350 in abort () from target:/lib/libc.so.6
#3 0xb362847a in qt_message_fatal (context=..., message=<synthetic pointer>...) at global/qlogging.cpp:1648
#4 QMessageLogger::fatal (this=<optimized out>, msg=0xb0b637a8 "Could not initialize egl display") at global/qlogging.cpp:790
#5 0xb0b3cb04 in QEglFSIntegration::initialize (this=<optimized out>) at qeglfsintegration.cpp:124
#6 0xb3b7c30a in QGuiApplicationPrivate::eventDispatcherReady (this=<optimized out>) at kernel/qguiapplication.cpp:1257
#7 0xb3778e0c in QCoreApplicationPrivate::init (this=this@entry=0x41020) at kernel/qcoreapplication.cpp:823
#8 0xb3b7c9f8 in QGuiApplicationPrivate::init (this=this@entry=0x41020) at kernel/qguiapplication.cpp:1267
#9 0xb403b634 in QApplicationPrivate::init (this=0x41020) at kernel/qapplication.cpp:578
#10 0xb403b6de in QApplication::QApplication (this=0xbefff540, argc=@0xbefff534: 1, argv=0xbefff6b4, _internal=329218) at kernel/qapplication.cpp:570
#11 0x00019a04 in ?? ()
#12 0xb32cb926 in __libc_start_main () from target:/lib/libc.so.6
#13 0x00019aec in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

I checked the related ko with lsmod, pvrsrvkm, bufferclass_ti, omaplfb had been inserted.

$ lsmod
Module Size Used by
vfb 3673 0
fb_sys_fops 1009 1 vfb
bufferclass_ti 5397 0
omaplfb 11385 0
pvrsrvkm 172902 2 bufferclass_ti,omaplfb

/dev/pvrsrvkm also exsited
$ ls /dev/pvrsrvkm
/dev/pvrsrvkm

Dose anyone encountered the problem before? Or any suggestion about further debugging? Thanks!

[Konstantin Tokarev]

Your EGLFS integration doesn't work properly. It has nothing to do with QtWebKit

[1412]

Hello Konstantin,
Thanks for your reply. I've made some changes to my filesystem. The error "Could not initialize egl display" disappered. But I still got the segment fault.
The gdb backstrace is showed as below
#0 WTF::VectorDestructor<true, WTF::RefPtrWebCore::StyleSheet >::destruct (end=0x4, begin=<optimized out>) at ../WTF/wtf/Vector.h:52
#1 WTF::VectorTypeOperations<WTF::RefPtrWebCore::StyleSheet >::destruct (end=0x4, begin=<optimized out>) at ../WTF/wtf/Vector.h:214
#2 WTF::Vector<WTF::RefPtrWebCore::StyleSheet, 0u, WTF::CrashOnOverflow>::shrink (size=0, this=0xbeffe5c0) at ../WTF/wtf/Vector.h:911
#3 WTF::Vector<WTF::RefPtrWebCore::StyleSheet, 0u, WTF::CrashOnOverflow>::~Vector (this=0xbeffe5c0, __in_chrg=<optimized out>) at ../WTF/wtf/Vector.h:538
#4 WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets (this=<optimized out>, updateFlag=updateFlag@entry=WebCore::DocumentStyleSheetCollection::OptimizedUpdate)
at dom/DocumentStyleSheetCollection.cpp:500
#5 0xb5aedb8a in WebCore::Document::styleResolverChanged (this=0x5b9288, updateFlag=WebCore::RecalcStyleIfNeeded) at dom/Document.cpp:3161
#6 0xb5af03a8 in WebCore::Document::didRemoveAllPendingStylesheet (this=0x5b9288) at dom/Document.cpp:2805
#7 0xb4865d84 in WebCore::DocumentStyleSheetCollection::removePendingSheet (this=<optimized out>,
notification=notification@entry=WebCore::DocumentStyleSheetCollection::RemovePendingSheetNotifyImmediately) at dom/DocumentStyleSheetCollection.cpp:229
#8 0xb5ab5bd4 in WebCore::StyleElement::sheetLoaded (this=0xa9194, document=0x5b9288) at dom/StyleElement.cpp:200
#9 0xb48576aa in WebCore::StyleSheetContents::checkLoaded (this=0x5c8268) at css/StyleSheetContents.cpp:361
#10 0xb5ad3fde in WebCore::StyleElement::createSheet (this=this@entry=0xa9194, e=e@entry=0xa9158, startLineNumber=..., text=...) at dom/StyleElement.cpp:184
#11 0xb5ad42e2 in WebCore::StyleElement::process (this=this@entry=0xa9194, e=e@entry=0xa9158) at dom/StyleElement.cpp:139
#12 0xb5ad436a in WebCore::StyleElement::insertedIntoDocument (this=this@entry=0xa9194, document=<optimized out>, element=element@entry=0xa9158) at dom/StyleElement.cpp:71
#13 0xb5863da4 in WebCore::HTMLStyleElement::insertedInto (this=0xa9158, insertionPoint=0x86c78) at html/HTMLStyleElement.cpp:172
#14 0xb5ad8b88 in WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument (this=this@entry=0xbeffe7a8, node=node@entry=0xa9158) at dom/ContainerNodeAlgorithms.h:198
#15 0xb5ad9710 in WebCore::ChildNodeInsertionNotifier::notify (this=0xbeffe7a8, node=0xa9158) at dom/ContainerNodeAlgorithms.h:226
#16 0xb5b03a64 in WebCore::updateTreeAfterInsertion (parent=parent@entry=0x86c78, child=child@entry=0xa9158, attachBehavior=attachBehavior@entry=WebCore::AttachNow) at dom/ContainerNode.cpp:1044
#17 0xb5b04a18 in WebCore::ContainerNode::appendChild (this=this@entry=0x86c78, newChild=..., ec=@0xbeffe8b0: 0, attachBehavior=attachBehavior@entry=WebCore::AttachNow) at dom/ContainerNode.cpp:681
#18 0xb58b0ed8 in WebCore::replaceChildrenWithFragment (container=container@entry=0x86c78, fragment=..., ec=@0xbeffe8b0: 0) at editing/markup.cpp:1102
#19 0xb587549e in WebCore::HTMLElement::setInnerHTML (this=this@entry=0x86c78, html=..., ec=@0xbeffe8b0: 0) at html/HTMLElement.cpp:353
#20 0xb460137c in QWebElement::setInnerXml (this=this@entry=0xbeffe918, markup=...) at qt/Api/qwebelement.cpp:347
#21 0x0001ea2a in MainWindow::disableSelection (this=this@entry=0x501a8) at mainwindow.cpp:836
#22 0x0001eca6 in MainWindow::setProgress (this=0x501a8, p=100) at mainwindow.cpp:743
#23 0xb37d98d6 in QMetaObject::activate (sender=0x8a5a0, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0xbeffea70) at kernel/qobject.cpp:3730
#24 0xb37d9fc6 in QMetaObject::activate (sender=<optimized out>, m=<optimized out>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0xbeffea70) at kernel/qobject.cpp:3595
#25 0xb6fb7e74 in QWebView::loadProgress (this=<optimized out>, _t1=100) at .moc/moc_qwebview.cpp:339
#26 0xb6fb8a50 in QWebView::qt_static_metacall (_o=<optimized out>, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>) at .moc/moc_qwebview.cpp:154
#27 0xb37d98d6 in QMetaObject::activate (sender=sender@entry=0x8a6f0, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0xbeffeb58) at kernel/qobject.cpp:3730
#28 0xb37d9fc6 in QMetaObject::activate (sender=sender@entry=0x8a6f0, m=<optimized out>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0xbeffeb58) at kernel/qobject.cpp:3595
#29 0xb6fb1fe4 in QWebPage::loadProgress (this=this@entry=0x8a6f0, _t1=100) at .moc/moc_qwebpage.cpp:815
#30 0xb6fb57a6 in QWebPage::qt_static_metacall (_o=0x8a6f0, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>) at .moc/moc_qwebpage.cpp:489
#31 0xb37d98d6 in QMetaObject::activate (sender=sender@entry=0x8da90, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0xbeffec50) at kernel/qobject.cpp:3730
#32 0xb37d9fc6 in QMetaObject::activate (sender=sender@entry=0x8da90, m=<optimized out>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0xbeffec50) at kernel/qobject.cpp:3595
#33 0xb461a418 in WebCore::FrameLoaderClientQt::loadProgress (_t1=100, this=0x8da90) at .moc/moc_FrameLoaderClientQt.cpp:162
#34 WebCore::FrameLoaderClientQt::postProgressEstimateChangedNotification (this=0x8da90) at qt/WebCoreSupport/FrameLoaderClientQt.cpp:574
#35 0xb49ba4fa in WebCore::ProgressTracker::finalProgressComplete (this=this@entry=0x5db28) at loader/ProgressTracker.cpp:170
#36 0xb49ba61a in WebCore::ProgressTracker::progressCompleted (this=0x5db28, frame=0x8f150) at loader/ProgressTracker.cpp:155
#37 0xb4997aee in WebCore::FrameLoader::checkLoadCompleteForThisFrame (this=0x8f1a0) at loader/FrameLoader.cpp:2180
#38 0xb4996dd6 in WebCore::FrameLoader::checkLoadComplete (this=<optimized out>) at loader/FrameLoader.cpp:2364
#39 0xb4984c76 in WebCore::DocumentLoader::finishedLoading (this=0xf25a0, finishTime=<optimized out>) at loader/DocumentLoader.cpp:412
#40 0xb496f69c in WebCore::CachedResource::checkNotify (this=0x802d8) at loader/cache/CachedResource.cpp:369
#41 0xb496d5b4 in WebCore::CachedResource::finishLoading (this=this@entry=0x802d8) at loader/cache/CachedResource.cpp:385
#42 0xb496b5d4 in WebCore::CachedRawResource::finishLoading (this=0x802d8, data=0x88aa0) at loader/cache/CachedRawResource.cpp:94
#43 0xb49cf69c in WebCore::SubresourceLoader::didFinishLoading (this=0x142960, finishTime=10.332084655761719) at loader/SubresourceLoader.cpp:282
#44 0xb49bf4ec in WebCore::ResourceLoader::didFinishLoading (this=<optimized out>, finishTime=<optimized out>) at loader/ResourceLoader.cpp:488
#45 0xb4c26bc2 in WebCore::QNetworkReplyHandler::finish (this=0x80d00) at platform/network/qt/QNetworkReplyHandler.cpp:533
#46 0xb4c254e6 in WebCore::QNetworkReplyHandlerCallQueue::flush (this=this@entry=0x80d24) at platform/network/qt/QNetworkReplyHandler.cpp:267
#47 0xb4c2764e in WebCore::QNetworkReplyHandlerCallQueue::flush (this=0x80d24) at platform/network/qt/QNetworkReplyHandler.cpp:261
#48 WebCore::QNetworkReplyHandlerCallQueue::push (method=<optimized out>, this=<optimized out>) at platform/network/qt/QNetworkReplyHandler.cpp:227
#49 WebCore::QNetworkReplyWrapper::didReceiveReadyRead (this=<optimized out>) at platform/network/qt/QNetworkReplyHandler.cpp:419
#50 WebCore::QNetworkReplyWrapper::qt_static_metacall (_o=<optimized out>, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>) at .moc/moc_QNetworkReplyHandler.cpp:180
#51 0xb37d98d6 in QMetaObject::activate (sender=0x14eb40, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0x0) at kernel/qobject.cpp:3730
#52 0xb37d9fc6 in QMetaObject::activate (sender=<optimized out>, m=<optimized out>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0x0) at kernel/qobject.cpp:3595
---Type <return> to continue, or q <return> to quit---
#53 0xb3ab7556 in QNetworkReply::finished (this=<optimized out>) at .moc/moc_qnetworkreply.cpp:367
#54 0xb3ab77ec in QNetworkReply::qt_static_metacall (_o=<optimized out>, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>) at .moc/moc_qnetworkreply.cpp:216
#55 0xb37d7906 in QMetaCallEvent::placeMetaCall (this=0x8bf70, object=0x14eb40) at kernel/qobject.cpp:495
#56 0xb37dab3a in QObject::event (this=<optimized out>, e=<optimized out>) at kernel/qobject.cpp:1256
#57 0xb407b95a in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x14eb40, e=0x8bf70) at kernel/qapplication.cpp:3804
#58 0xb408160a in QApplication::notify (this=0xbefff5c8, receiver=0x14eb40, e=0x8bf70) at kernel/qapplication.cpp:3561
#59 0xb37b8cd4 in QCoreApplication::notifyInternal2 (receiver=receiver@entry=0x14eb40, event=event@entry=0x8bf70) at kernel/qcoreapplication.cpp:1015
#60 0xb37ba8b2 in QCoreApplication::sendEvent (event=0x8bf70, receiver=0x14eb40) at kernel/qcoreapplication.h:225
#61 QCoreApplicationPrivate::sendPostedEvents (receiver=receiver@entry=0x0, event_type=event_type@entry=0, data=0x437d8) at kernel/qcoreapplication.cpp:1650
#62 0xb37baca2 in QCoreApplication::sendPostedEvents (receiver=receiver@entry=0x0, event_type=event_type@entry=0) at kernel/qcoreapplication.cpp:1508
#63 0xb37f7878 in postEventSourceDispatch (s=0x49c00) at kernel/qeventdispatcher_glib.cpp:270
#64 0xb12248ca in g_main_dispatch (context=0x46830) at gmain.c:3203
#65 g_main_context_dispatch (context=context@entry=0x46830) at gmain.c:3856
#66 0xb1224a66 in g_main_context_iterate (context=context@entry=0x46830, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3929
#67 0xb1224acc in g_main_context_iteration (context=0x46830, may_block=1) at gmain.c:3990
#68 0xb37f6dfe in QEventDispatcherGlib::processEvents (this=0x467c0, flags=...) at kernel/qeventdispatcher_glib.cpp:417
#69 0xb37b6eb6 in QEventLoop::processEvents (this=this@entry=0xbefff578, flags=..., flags@entry=...) at kernel/qeventloop.cpp:128
#70 0xb37b715c in QEventLoop::exec (this=this@entry=0xbefff578, flags=flags@entry=...) at kernel/qeventloop.cpp:206
#71 0xb37bd282 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1285
#72 0xb3bbdc00 in QGuiApplication::exec () at kernel/qguiapplication.cpp:1607
#73 0xb407b908 in QApplication::exec () at kernel/qapplication.cpp:2979
#74 0x0001953a in main (argc=1, argv=<optimized out>) at main.cpp:98

It's caused due to /WTF/wtf/Vector.h:52 in webkit (The context is showed below). From the gdb result, the argment end is 0x4, which seems like an invalid address. Have you got any idea what's going on here? Thanks!

struct VectorDestructor<true, T>
{
    static void destruct(T* begin, T* end) 
    {
        for (T* cur = begin; cur != end; ++cur)
            cur->~T();[0_1524818940210_bt_qt-webkit-segmentfault](Uploading 100%) 
    }
};

[0_1524818956666_bt_qt-webkit-segmentfault](Uploading 100%)

[Konstantin Tokarev]

No idea what's going on here. Do you have test case to reproduce?

[1412]

@Konstantin-Tokarev The problem has been solved. I change the float strategy from neon to vfpv3 and everything works well.