Hi folks,
I am currently testing some applications on the RPI 2. Some work
pretty well, others not yet. As for webkit-gtk based browsers, I am
experiencing crashes from time to time.
One problem that occurs often seems to be related to g_dpgettext2 ()
from glib2. The top of the stack looks like this:
(gdb) bt
#0 0x636f7452 in ?? ()
#1 0x45ff3fa8 in g_dpgettext2 () from /usr/pkg/lib/libglib-2.0.so.0
#2 0x42ad6030 in gtk_stock_lookup () from /usr/pkg/lib/libgtk-x11-2.0.so.0
#3 0x42987b98 in gtk_action_set_stock_id () from
/usr/pkg/lib/libgtk-x11-2.0.so.0
#4 0x45f55cfc in g_object_set_valist () from /usr/pkg/lib/libgobject-2.0.so.0
#5 0x45f5642c in g_object_set () from /usr/pkg/lib/libgobject-2.0.so.0
#6 0x4298a27c in gtk_action_group_add_actions_full () from
/usr/pkg/lib/libgtk-x11-2.0.so.0
#7 0x4298a388 in gtk_action_group_add_actions () from
/usr/pkg/lib/libgtk-x11-2.0.so.0
#8 0x0004238c in ?? ()
#9 0x45f5322c in g_object_new_internal () from /usr/pkg/lib/libgobject-2.0.so.0
#10 0x45f5587c in g_object_new_valist () from /usr/pkg/lib/libgobject-2.0.so.0
#11 0x45f55a24 in g_object_new () from /usr/pkg/lib/libgobject-2.0.so.0
#12 0x00043ff0 in ephy_window_new_with_chrome ()
#13 0x0003ac94 in ephy_shell_new_tab_full ()
#14 0x0003f81c in ?? ()
#15 0x40a090e8 in webkit_marshal_OBJECT__OBJECT () from
/usr/pkg/lib/libwebkitgtk-1.0.so.0
#16 0x45f4e070 in g_closure_invoke () from /usr/pkg/lib/libgobject-2.0.so.0
#17 0x45f6154c in signal_emit_unlocked_R () from
/usr/pkg/lib/libgobject-2.0.so.0
#18 0x45f69278 in g_signal_emit_valist () from /usr/pkg/lib/libgobject-2.0.so.0
#19 0x45f69cac in g_signal_emit_by_name () from /usr/pkg/lib/libgobject-2.0.so.0
#20 0x409d9074 in
WebKit::FrameLoaderClient::dispatchCreatePage(WebCore::NavigationAction
const&) () from /usr/pkg/lib/libwebkitgtk-1.0.so.0
...
The call to the topmost frame happens from 0x45ff3fa4 in the said
funtion. The disassembly from within gdb loos like this:
(gdb) disass g_dpgettext2
Dump of assembler code for function g_dpgettext2:
0x45ff3f44 <+0>: mov r12, sp
0x45ff3f48 <+4>: push {r4, r5, r6, r7, r8, r9, r10, r11, r12, lr, pc}
0x45ff3f4c <+8>: sub r11, r12, #4
0x45ff3f50 <+12>: sub sp, sp, #12
0x45ff3f54 <+16>: mov r9, r0
0x45ff3f58 <+20>: mov r0, r1
0x45ff3f5c <+24>: mov r6, r2
0x45ff3f60 <+28>: str r1, [r11, #-48] ; 0x30
0x45ff3f64 <+32>: bl 0x45fd3f44
0x45ff3f68 <+36>: mov r5, r0
0x45ff3f6c <+40>: mov r0, r6
0x45ff3f70 <+44>: bl 0x45fd3f44
0x45ff3f74 <+48>: add r10, r5, #1
0x45ff3f78 <+52>: add r8, r0, #1
0x45ff3f7c <+56>: add r3, r8, r10
0x45ff3f80 <+60>: add r3, r3, #14
0x45ff3f84 <+64>: bic r3, r3, #7
0x45ff3f88 <+68>: sub sp, sp, r3
0x45ff3f8c <+72>: mov r3, sp
0x45ff3f90 <+76>: lsr r7, r3, #3
0x45ff3f94 <+80>: lsl r4, r7, #3
0x45ff3f98 <+84>: ldr r1, [r11, #-48] ; 0x30
0x45ff3f9c <+88>: mov r2, r5
0x45ff3fa0 <+92>: mov r0, r4
0x45ff3fa4 <+96>: bl 0x45fd3efc
0x45ff3fa8 <+100>: mov r3, #4
0x45ff3fac <+104>: mov r2, r8
0x45ff3fb0 <+108>: strb r3, [r5, r7, lsl #3]
...
Now the jump target actually seems to be some random memory:
(gdb) info symbol 0x45fd3efc
No symbol matches 0x45fd3efc.
At least it is mapped to the text section of libglib2. It decodes like
follows which just looks like random garbage:
(gdb) x/5i 0x45fd3efc
0x45fd3efc: add r12, pc, #1048576 ; 0x100000
0x45fd3f00: add r12, r12, #4096 ; 0x1000
0x45fd3f04: ldr pc, [r12, #1652]! ; 0x674
0x45fd3f08: add r12, pc, #1048576 ; 0x100000
0x45fd3f0c: add r12, r12, #4096 ; 0x1000
The disassembly of g_dpgettext2() from objdump looks weird as well:
00033f44 <g_dpgettext2>:
33f44: e1a0c00d mov ip, sp
33f48: e92ddff0 push {r4, r5, r6, r7, r8, r9, sl,
fp, ip, lr, pc}
33f4c: e24cb004 sub fp, ip, #4
33f50: e24dd00c sub sp, sp, #12
33f54: e1a09000 mov r9, r0
33f58: e1a00001 mov r0, r1
33f5c: e1a06002 mov r6, r2
33f60: e50b1030 str r1, [fp, #-48] ; 0x30
33f64: ebff7ff6 bl 13f44 <g_mem_chunk_new-0x7c>
33f68: e1a05000 mov r5, r0
33f6c: e1a00006 mov r0, r6
33f70: ebff7ff3 bl 13f44 <g_mem_chunk_new-0x7c>
33f74: e285a001 add sl, r5, #1
33f78: e2808001 add r8, r0, #1
33f7c: e088300a add r3, r8, sl
33f80: e283300e add r3, r3, #14
33f84: e3c33007 bic r3, r3, #7
33f88: e04dd003 sub sp, sp, r3
33f8c: e1a0300d mov r3, sp
33f90: e1a071a3 lsr r7, r3, #3
33f94: e1a04187 lsl r4, r7, #3
33f98: e51b1030 ldr r1, [fp, #-48] ; 0x30
33f9c: e1a02005 mov r2, r5
33fa0: e1a00004 mov r0, r4
33fa4: ebff7fd4 bl 13efc <g_mem_chunk_new-0xc4>
33fa8: e3a03004 mov r3, #4
33fac: e1a02008 mov r2, r8
33fb0: e7c53187 strb r3, [r5, r7, lsl #3]
33fb4: e1a01006 mov r1, r6
33fb8: e084000a add r0, r4, sl
33fbc: ebff7fce bl 13efc <g_mem_chunk_new-0xc4>
33fc0: e1a00009 mov r0, r9
33fc4: e1a01004 mov r1, r4
33fc8: ebffff8a bl 33df8 <g_dgettext>
33fcc: e1500004 cmp r0, r4
33fd0: e1a08000 mov r8, r0
The jumps refer to negative function offsets (for example
<g_mem_chunk_new-0x7c>). Glibc (2.42.2) is from pkgsrc from
ftp.netbsd.org. I compiled an own one which has exactly the same
issue.
Ideas?