NetBSD-9.99.93 crashes regularly when using web browsers

[pin <voidpin%protonmail.com@localhost>]

Hi all,

I've earlier reported, https://mail-index.netbsd.org/current-users/2021/12/27/msg041840.html
severe crashes on NetBSD-9.99.93 when using WebKit based web browsers.

Early in the year, I moved to firefox-esr (v91) and been using it since, only once it brought the system down.

In the meantime another report on this appeared in this mailing list, https://mail-index.netbsd.org/current-users/2022/01/29/msg041964.html

On Friday, I've decided to try firefox-96 and the crashes and associated core dumps were back.
I've revisited lariza (WebKit based browser) and that crashes reproducibly on nearly every launch.

Once I had to run a manual fsck and remove and re-install firefox as some lib files associated with firefox were corrupted.

I hope we can figure out what is causing this before branching 10.

I have a rather standard all Intel laptop,

$ sysctl hw.machine_arch hw.model hw.ncpu
hw.machine_arch = x86_64
hw.model = Intel 686-class
hw.ncpu = 4

$ pcictl pci0 list
000:00:0: Intel Core 4G (mobile) Host Bridge, DRAM (host bridge, revision 0x0b)
000:02:0: Intel HD Graphics (GT2) (VGA display, revision 0x0b)
000:03:0: Intel Core 4G (mobile) Mini HD audio (mixed mode multimedia, revision 0x0b)
000:20:0: Intel Core 4G (mobile) USB xHCI (USB serial bus, xHCI, revision 0x04)
000:22:0: Intel Core 4G (mobile) MEI (miscellaneous communications, revision 0x04)
000:25:0: Intel I218-LM Ethernet Connection (ethernet network, revision 0x04)
000:27:0: Intel Core 4G (mobile) HD Audio (mixed mode multimedia, revision 0x04)
000:28:0: Intel Core 4G (mobile) PCIe (PCI bridge, revision 0xe4)
000:28:3: Intel Core 4G (mobile) PCIe (PCI bridge, revision 0xe4)
000:28:5: Intel Core 4G (mobile) PCIe (PCI bridge, revision 0xe4)
000:29:0: Intel Core 4G (mobile) USB EHCI (USB serial bus, EHCI, revision 0x04)
000:31:0: Intel Core 4G (mobile) LPC (ISA bridge, revision 0x04)
000:31:2: Intel Core 4G (mobile) SATA Controller (AHCI) (SATA mass storage, AHCI 1.0, revision 0x04)
000:31:3: Intel Core 4G (mobile) SMBus (SMBus serial bus, revision 0x04)
002:00:0: Intel Centrino Advanced-N 6205 WiFi (miscellaneous network, revision 0x34)
003:00:0: Realtek Semiconductor RTS5227 PCI-E Card Reader (undefined, subclass 0x00, revision 0x01)

And here's the debug output of the last core dump.
No problem to produce more if needed :(

# gdb --eval-command="file /netbsd" --eval-command="target kvm netbsd.6.core" --eval-command "bt"

...

Reading symbols from /netbsd...
Reading symbols from /usr/libdata/debug//netbsd-GENERIC.debug...
0xffffffff802261f5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:720
720	/usr/src/sys/arch/amd64/amd64/machdep.c: No such file or directory.
#0  0xffffffff802261f5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:720
#1  0xffffffff80dc6944 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:73
#2  0xffffffff80e09862 in vpanic (fmt=0xffffffff81391148 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=ap@entry=0xffffc500dbef2208) at /usr/src/sys/kern/subr_prf.c:290
#3  0xffffffff80f9edcf in kern_assert (fmt=fmt@entry=0xffffffff81391148 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ") at /usr/src/sys/lib/libkern/kern_assert.c:51
#4  0xffffffff80f85a6b in radix_tree_alloc_node () at /usr/src/sys/lib/libkern/../../../common/lib/libc/gen/radixtree.c:440
#5  radix_tree_alloc_node () at /usr/src/sys/lib/libkern/../../../common/lib/libc/gen/radixtree.c:421
#6  0xffffffff80f86404 in radix_tree_lookup_ptr (tagmask=0, alloc=true, path=0x0, idx=7680, t=0xffff8508e0ee7318) at /usr/src/sys/lib/libkern/../../../common/lib/libc/gen/radixtree.c:576
#7  radix_tree_insert_node (t=t@entry=0xffff8508e0ee7318, idx=idx@entry=7680, p=p@entry=0xffffc500013c1c80) at /usr/src/sys/lib/libkern/../../../common/lib/libc/gen/radixtree.c:668
#8  0xffffffff80d76294 in uvm_pageinsert_tree (pg=0xffffc500013c1c80, uobj=0xffff8508e0ee7300) at /usr/src/sys/uvm/uvm_page.c:245
#9  uvm_pagealloc_strat (obj=obj@entry=0xffff8508e0ee7300, off=off@entry=31457280, anon=anon@entry=0x0, flags=<optimized out>, flags@entry=67108864, strat=<optimized out>, strat@entry=0,
    free_list=free_list@entry=0) at /usr/src/sys/uvm/uvm_page.c:1307
#10 0xffffffff80d823dc in uvn_findpage (uobj=uobj@entry=0xffff8508e0ee7300, offset=offset@entry=31457280, pgp=pgp@entry=0xffffc500dbef25a0, flags=flags@entry=0,
    a=a@entry=0xffffc500dbef23d0, nleft=nleft@entry=4) at /usr/src/sys/uvm/uvm_vnode.c:336
#11 0xffffffff80d8274f in uvn_findpages (uobj=uobj@entry=0xffff8508e0ee7300, offset=offset@entry=31457280, npagesp=npagesp@entry=0xffffc500dbef2574, pgs=pgs@entry=0xffffc500dbef25a0,
    a=0xffffc500dbef23d0, a@entry=0x0, flags=flags@entry=0) at /usr/src/sys/uvm/uvm_vnode.c:263
#12 0xffffffff80e87438 in genfs_getpages (v=0xffffc500dbef2638) at /usr/src/sys/miscfs/genfs/genfs_io.c:373
#13 0xffffffff80e84cc2 in VOP_GETPAGES (vp=vp@entry=0xffff8508e0ee7300, offset=offset@entry=31457280, m=m@entry=0xffffc500dbef27d0, count=count@entry=0xffffc500dbef27c4,
    centeridx=centeridx@entry=0, access_type=<optimized out>, advice=advice@entry=0, flags=flags@entry=7718) at /usr/src/sys/kern/vnode_if.c:1874
#14 0xffffffff80d820d3 in uvn_get (uobj=0xffff8508e0ee7300, offset=31457280, pps=0xffffc500dbef27d0, npagesp=0xffffc500dbef27c4, centeridx=0, access_type=<optimized out>, advice=0,
    flags=7718) at /usr/src/sys/uvm/uvm_vnode.c:189
#15 0xffffffff80d5dffc in ubc_alloc_direct (uobj=uobj@entry=0xffff8508e0ee7300, offset=offset@entry=31457280, lenp=lenp@entry=0xffffc500dbef27c8, advice=advice@entry=0,
    flags=flags@entry=6, pgs=pgs@entry=0xffffc500dbef27d0, npages=npages@entry=0xffffc500dbef27c4) at /usr/src/sys/uvm/uvm_bio.c:880
#16 0xffffffff80d5e421 in ubc_uiomove_direct (uobj=0xffff8508e0ee7300, uobj@entry=0xffffc500dbef29e0, uio=0xffffc500dbef29e0, uio@entry=0xdbef29e0, todo=16384, advice=advice@entry=0,
    flags=6) at /usr/src/sys/uvm/uvm_bio.c:995
#17 0xffffffff80d5ff87 in ubc_uiomove (uobj=0xffffc500dbef29e0, uobj@entry=0xffff8508e0ee7300, uio=0xdbef29e0, uio@entry=0xffffc500dbef29e0, todo=<optimized out>, advice=advice@entry=0,
    flags=<optimized out>) at /usr/src/sys/uvm/uvm_bio.c:765
#18 0xffffffff80d16a59 in ffs_write (v=<optimized out>) at /usr/src/sys/ufs/ufs/ufs_readwrite.c:409
#19 0xffffffff80e836cf in VOP_WRITE (vp=vp@entry=0xffff8508e0ee7300, uio=uio@entry=0xffffc500dbef29e0, ioflag=ioflag@entry=144, cred=cred@entry=0xffff8508c3de4580) at /usr/src/sys/kern/vnode_if.c:776
#20 0xffffffff80e7b0d3 in vn_rdwr (rw=rw@entry=UIO_WRITE, vp=0xffff8508e0ee7300, base=base@entry=0x7653a602b000, len=len@entry=880640, offset=<optimized out>, segflg=<optimized out>,
    ioflg=ioflg@entry=144, cred=0xffff8508c3de4580, aresid=0x0, l=0xffff8508dff85300) at /usr/src/sys/kern/vfs_vnops.c:549
#21 0xffffffff80d94cd7 in coredump_write (io=0xffffc500dbef2c80, segflg=<optimized out>, data=0x7653a602b000, len=880640) at /usr/src/sys/kern/kern_core.c:341
#22 0xffffffff80d85967 in real_coredump_elf64 (l=<optimized out>, cookie=0xffffc500dbef2c80) at /usr/src/sys/kern/core_elf32.c:286
#23 0xffffffff80dd3098 in coredump_elf64 (l=0xffff8508dff85300, iocookie=0xffffc500dbef2c80) at /usr/src/sys/kern/kern_sig.c:2392
#24 0xffffffff80d95324 in coredump (l=0xffff8508dff85300, pattern=<optimized out>) at /usr/src/sys/kern/kern_core.c:280
#25 0xffffffff80dd29c0 in sigexit (l=l@entry=0xffff8508dff85300, signo=signo@entry=11) at /usr/src/sys/kern/kern_sig.c:2320
#26 0xffffffff80dd2e9a in postsig (signo=11) at /usr/src/sys/kern/kern_sig.c:2142
#27 0xffffffff80db5199 in lwp_userret (l=l@entry=0xffff8508dff85300) at /usr/src/sys/kern/kern_lwp.c:1633
#28 0xffffffff80228328 in mi_userret (l=l@entry=0xffff8508dff85300) at /usr/src/sys/sys/userret.h:96
#29 0xffffffff8022861d in userret (l=0xffff8508dff85300) at ./machine/userret.h:81
#30 trap (frame=0xffffc500dbef3000) at /usr/src/sys/arch/amd64/amd64/trap.c:664
#31 0xffffffff802210e3 in alltraps ()
#32 0x00007653a41b6268 in ?? ()
#33 0x000033223b0ff2c0 in ?? ()
#34 0x0000000000000001 in ?? ()
#35 0x00007f7fffc4ebe8 in ?? ()
#36 0x00007f7fffc4eb08 in ?? ()
#37 0xfff9800000000000 in ?? ()
#38 0x0000000000000000 in ?? ()

Thanks!
/pin