Assertion in WTF class inside Webkit

[Fallen]

Getting a strange crash when page is loading inside an iframe (or at least I think that's it). I'm in single_process = true, I'm on Mac with CEF 3.2168.1846. Chrome_InProcRendererThread is the one that crashes.

Code: Select all

ASSERTION FAILED: !((reinterpret_cast<uintptr_t>(ptr) - reinterpret_cast<uintptr_t>(partitionPageToPointer(page))) % page->bucket->slotSize)
../../third_party/WebKit/Source/wtf/PartitionAlloc.h(424) : WTF::PartitionPage *WTF::partitionPointerToPage(void *)
1   0x1027d69d4 WTF::partitionPointerToPage(void*)
2   0x1027d68e3 WTF::partitionPointerIsValid(void*)
3   0x1027ce9ff WTF::partitionFreeGeneric(WTF::PartitionRootGeneric*, void*)
4   0x102783d2f WTF::ArrayBufferContents::freeMemory(void*, unsigned long)
5   0x102783ccf WTF::ArrayBufferContents::~ArrayBufferContents()
6   0x102783e03 WTF::ArrayBufferContents::~ArrayBufferContents()
7   0x102629ae1 WTF::ArrayBuffer::~ArrayBuffer()
8   0x102629a33 WTF::ArrayBuffer::~ArrayBuffer()
9   0x1026299d4 WTF::RefCounted<WTF::ArrayBuffer>::deref()
10  0x1054b57eb blink::V8ArrayBuffer::derefObject(blink::ScriptWrappableBase*)
11  0x103da822f blink::releaseObject(v8::Handle<v8::Object>)
12  0x103da6dd5 blink::DOMWrapperMap<blink::ScriptWrappableBase>::PersistentValueMapTraits::Dispose(v8::Isolate*, v8::UniquePersistent<v8::Object>, blink::ScriptWrappableBase*)
13  0x103da4809 v8::PersistentValueMap<blink::ScriptWrappableBase*, v8::Object, blink::DOMWrapperMap<blink::ScriptWrappableBase>::PersistentValueMapTraits>::WeakCallback(v8::WeakCallbackData<v8::Object, v8::PersistentValueMap<blink::ScriptWrappableBase*, v8::Object, blink::DOMWrapperMap<blink::ScriptWrappableBase>::PersistentValueMapTraits> > const&)
14  0x10344543a v8::internal::GlobalHandles::Node::PostGarbageCollectionProcessing(v8::internal::Isolate*)
15  0x1034431cd v8::internal::GlobalHandles::PostGarbageCollectionProcessing(v8::internal::GarbageCollector)
16  0x103477a06 v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::GCCallbackFlags)
17  0x103477008 v8::internal::Heap::CollectGarbage(v8::internal::GarbageCollector, char const*, char const*, v8::GCCallbackFlags)
18  0x1033fa93f v8::internal::Factory::NewRawOneByteString(int, v8::internal::PretenureFlag)
19  0x1033fe376 v8::internal::Factory::NewConsString(v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::String>)
20  0x103261242 v8::internal::AstConsString::Internalize(v8::internal::Isolate*)
21  0x103262259 v8::internal::AstValueFactory::Internalize(v8::internal::Isolate*)
22  0x103757b56 v8::internal::Parser::Internalize()
23  0x10375ac1a v8::internal::Parser::Parse()
24  0x10335976d v8::internal::Parser::Parse(v8::internal::CompilationInfo*, bool)
25  0x103356282 v8::internal::CompileToplevel(v8::internal::CompilationInfo*)
26  0x1033573a1 v8::internal::Compiler::CompileScript(v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::Object>, int, int, bool, v8::internal::Handle<v8::internal::Context>, v8::Extension*, v8::internal::ScriptData**, v8::ScriptCompiler::CompileOptions, v8::internal::NativesFlag)
27  0x1031fae60 v8::ScriptCompiler::CompileUnbound(v8::Isolate*, v8::ScriptCompiler::Source*, v8::ScriptCompiler::CompileOptions)
28  0x1031fb396 v8::ScriptCompiler::Compile(v8::Isolate*, v8::ScriptCompiler::Source*, v8::ScriptCompiler::CompileOptions)
29  0x105618182 blink::(anonymous namespace)::compileAndProduceCache(v8::Isolate*, v8::Handle<v8::String>, v8::ScriptOrigin, blink::ScriptResource*, v8::ScriptCompiler::CompileOptions, unsigned int, blink::Resource::MetadataCacheType)
30  0x105617a07 blink::V8ScriptRunner::compileScript(v8::Handle<v8::String>, WTF::String const&, WTF::TextPosition const&, blink::ScriptResource*, blink::ScriptStreamer*, v8::Isolate*, blink::AccessControlStatus, blink::V8CacheOptions)
31  0x105616aaf blink::V8ScriptRunner::compileScript(blink::ScriptSourceCode const&, v8::Isolate*, blink::AccessControlStatus, blink::V8CacheOptions)

[magreenblatt]

Single-process mode is not actively tested or supported. You can file the crash with Chromium at http://crbug.com but it's unlikely to be fixed.