106228 2013-01-07 09:39:22 -0800 [Qt] SVG tests with huge paths and with small dashes are crashing 2014-02-03 03:24:19 -0800 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Linux RESOLVED INVALID P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned fmalita kling pdr schenney zimmermann oldest_to_newest 801343 0 rhodovan.u-szeged 2013-01-07 09:39:22 -0800 During SVG fuzzing I got a crash with the attached test case. The test contains one huge path with small dashes. The problem is that too many small dash fragments are generated and there is memory is allocated for each of them. This way we run out of memory. The same problem was detected in skia too. They limited the maximum number of dashes per paths to 1 million. How about a similar solution in Qt too? Backtrace: #0 memcpy () at ../sysdeps/x86_64/memcpy.S:437 #1 0x00007fffe95ce7ef in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #2 0x00007fffe9612c12 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #3 0x00007fffe960b205 in QPainterPath::lineTo(QPointF const&) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #4 0x00007fffe960b3d7 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #5 0x00007fffe963fce0 in QStroker::joinPoints(double, double, QLineF const&, QStroker::LineJoinMode) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #6 0x00007fffe9644847 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #7 0x00007fffe964294b in QStroker::processCurrentSubpath() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #8 0x00007fffe964071f in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #9 0x00007fffe964114c in QDashStroker::processCurrentSubpath() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #10 0x00007fffe9642acb in QStrokerOps::strokePath(QPainterPath const&, void*, QTransform const&) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #11 0x00007fffe960d08b in QPainterPathStroker::createStroke(QPainterPath const&) const () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Gui.so.5 #12 0x00007ffff48335da in WebCore::Path::strokeBoundingRect (this=0x9936c0, applier=0x7fffffffc060) at /home/reni/WebKit-git/Source/WebCore/platform/graphics/qt/PathQt.cpp:177 #13 0x00007ffff4994316 in WebCore::RenderSVGShape::calculateStrokeBoundingBox (this=0x99b3d8) at /home/reni/WebKit-git/Source/WebCore/rendering/svg/RenderSVGShape.cpp:398 #14 0x00007ffff4992a3b in WebCore::RenderSVGShape::updateShapeFromElement (this=0x99b3d8) at /home/reni/WebKit-git/Source/WebCore/rendering/svg/RenderSVGShape.cpp:77 .... 801578 1 pdr 2013-01-07 13:00:18 -0800 +fmalita, who just solved this (or a closely related) issue. 895321 2 kling 2013-05-29 20:47:23 -0700 (In reply to comment #0) > During SVG fuzzing I got a crash with the attached test case. The test case has gone missing! 895393 3 203319 rhodovan.u-szeged 2013-05-30 00:51:26 -0700 Created attachment 203319 Test case 895397 4 rhodovan.u-szeged 2013-05-30 00:53:57 -0700 (In reply to comment #2) > (In reply to comment #0) > > During SVG fuzzing I got a crash with the attached test case. > > The test case has gone missing! Indeed :$ It's supplemented already. 975642 5 jturcotte 2014-02-03 03:24:19 -0800 === Bulk closing of Qt bugs === If you believe that this bug report is still relevant for a non-Qt port of webkit.org, please re-open it and remove [Qt] from the summary. If you believe that this is still an important QtWebKit bug, please fill a new report at https://bugreports.qt-project.org and add a link to this issue. See http://qt-project.org/wiki/ReportingBugsInQt for additional guidelines. 203319 2013-05-30 00:51:26 -0700 2013-05-30 00:51:26 -0700 Test case dashes.svg image/svg+xml 5472 rhodovan.u-szeged PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRw Oi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KCTxwYXRoIHN0eWxlPSJzdHJva2U6YmxhY2s7c3Ry b2tlLXdpZHRoOjAuNTtzdHJva2UtZGFzaGFycmF5OjAuNSwgMC41OyIgZD0iTSA0NTIxOCAzMzg5 NDEgTCAxODM4MjcgNjU3NzAzIE0gMTQ4ODU1IDEyNDU3MyBNIDQxNTA0MSA1NDA3ODYgTCA1MzI2 NjYgMzc2NDUwIEwgNjE0OTM3IDU3ODIyIE0gNDA5MDk2IDU1MTI3MSBMIDc3NDYwNSA4NzI0Nzgg TCA1NDQ5NDggMzc2NzkgTSA4ODM4OTAgOTg5NCBNIDY3NzE2IDY2NzU5OCBMIDc5MjE3MSAxNDIz NzcgTCA3MjM1NSA3NTcwNTIgTCA3NTI3MjkgNDg1Mzk4IE0gODEwNTUyIDYzMjEwOSBNIDM2MTgy MiA0NjMxNTYgTSAxMzY0MjcgMzM1NjM0IEwgODgwNTgyIDYzMjU3MyBMIDY0MjQ2NyAyNTMwMjAg TCAxNTUyNzcgNDg3NTkgTSAyOTc2NTUgNjgwMzczIE0gMzcwMDEwIDQzNzQyNCBNIDgxODgxNiAx OTAxNTMgTCA3MDQgNDE4MzIxIE0gMzYyNTI3IDg4MTQ3OCBNIDQ5ODk1NCAyMTcxMTEgTCA5NzY5 MyA2MTY3MjcgTCAyNTkxOTQgMTc4MjkgTCAxNzMxMDcgNzQzMTEzIEwgNDIzNDg1IDEwNjY4NiBM IDQwNzUwMiA2NTk1ODggTSAxOTM3MTUgNTQyMTQ3IE0gNjEyMDM3IDg5NzU0NSBNIDQ5MzUxNCAy ODY4MDUgTCAyNzA5NTkgODY0NTU2IEwgNjI5MzY1IDY3MDQ4MyBNIDY0NzE5NSAzNjQ4MzUgTCAx MDc5NDcgMzg3NjMyIE0gNTMxNDMzIDQ5NDMxOSBNIDM5MjM0MiA5MDE4MjIgTCA5NTUzNiAzMzM1 NzEgTSA3MDc1NzMgMjMxMTE2IEwgNTE3OTIxIDgyMjcxNCBMIDY4NzI3MCA3MjAwMjkgTCAzOTA1 MTEgODIzNDQ1IEwgNTM5NTgzIDc4NDEzMSBMIDc1MTk0IDM5NDcyNiBNIDIwNzAzMCA3ODcwNjkg TSA5OTg0NTYgMjMwNDczIE0gMzMyMDI3IDcyNTY0NiBNIDU2MzE0MyA2MzUxMTIgTSA4MTA2MyA0 NTc4MjUgTSA4Njk5NDMgMTQ1MDk0IEwgNDYxNzI5IDM0OTgwMiBNIDQyNTU1OCAxMDUxNDggTCA5 Njg0NDIgODM2NzUyIE0gMzYzMTY4IDI1ODI4NiBNIDE1MDIzNyA1ODE2NDIgTSAzODA3MTAgNTMz IEwgMTI2OTk3IDM4NTUzOCBMIDQ2NjYwMSAxOTkyOTMgTCAzNDQzODggNjUzMDk5IEwgMjkwMCAy NTMwMDUgTSAxMDgwNDggMTYyNTQxIE0gNzY0OTAgOTk5MjkzIEwgMjU3NTc4IDIxODE2MSBMIDcw ODUzMCA5NzA2MDcgTCA3Njk2MiA5NjY3NTEgTCA0MjEyOTcgMzgzMDY1IE0gMTE1MTA2IDcxOTYx MCBNIDc2ODIwNSA2MDI2NjIgTSA3NzExMDUgODU1NjY4IE0gODc5MTU0IDE4MjA4IEwgMTc1MDAg NTY3NTE3IE0gMjc1MDc5IDc4NTY3OCBMIDQ5NDIwOCA5NTU4MDYgTCAzMjc2NyA5MjA4MDIgTCAz NDIwOTkgMzI0NjYyIEwgNDQyNzIgMjMxMDM2IE0gNjQ2OTM0IDM5OTI2NiBMIDc5OTE3MiA4NzU2 NjggTCA4MzEzMTIgNTM4MzEwIE0gMjI2NjE0IDgxMzM4OSBMIDkyNzY4OCA0ODc4NDQgTSA4ODE3 MzkgNTEyOTc3IE0gODAyNTQxIDQ1NDU3NSBNIDE0NDYzOSA3NzkyMzggTCA4MjM1MTAgMTUxNTQz IEwgNTUwODA5IDgyMzc2OSBMIDY5OTQzNiA0OTM4NTQgTCAzMjE2NCAxOTgzODAgTCAxOTIwMTYg OTY5MTc0IEwgMTM2NzkxIDY1NDk4MCBNIDMzNzE3NyA0NTc1MjAgTCA2MDIxNjAgNDI2NjUwIE0g MjA0MDA0IDI1MDE1OSBNIDMxMjU4IDcyMDYwMyBNIDg1NTAyOCA2OTM2NDggTSA1NTQ0NjMgMTg3 NTAyIE0gODUyMTAgMjE5NjY3IEwgNjUyMjAgNzQyNDIyIEwgNDIyMjgyIDk0ODUzOCBNIDYxNTEy MCAyODU3MTQgTCA2NzQ0NzYgNTUzMTIxIEwgNzU3MTI2IDkzOTM0MiBNIDc4ODM4NSA2NTk5NDUg TSA2NDM0MTIgMzUzNTkzIEwgNTQxMDk2IDE2OTgwOCBNIDc2MDc2MyA3MjAyMTMgTSA4MjU5ODQg NDYyNjM1IEwgODg0OTE3IDg4NTk0MSBNIDUwMDAzNiAxNzE2NTQgTSA3NjI1NjkgODQ2MTMxIEwg ODI5ODc2IDQxOTA5NSBNIDI3NDQzMyAyMDc0NzkgTSA3MzA2MTQgODUwODkxIE0gNTQ4Mzk2IDQ4 NzY1IEwgMzMxODUxIDcwNjQ5MSBNIDQ1NzUwOSA1MzI0NzQgTCAxOTY5MTggNzg1OTY5IE0gMzU0 ODA1IDI4NjAwNSBNIDQ2MzY1MiA0ODU3NCBNIDEyNTYyMSA1MDAzMjUgTSA1NDQ3MTYgODkxNDE5 IE0gNzUyMTk1IDk0MjQ1NyBNIDYwMzA4NiAzNDcwODggTCAyOTI4MTYgNDAwMTYxIEwgODM4NTc4 IDQ0MTIxMiBMIDgzNjEyNCA3Mjg2OTkgTCA4MzUwMyA4MTE2MDQgTCA4NjAxNzggODY4MTIxIEwg OTk2NjM0IDIxNzQ5MiBNIDM5OTU4MCA5Njk2ODggTSA1MzMxNDAgNTcyNzczIEwgMjI0NjI0IDgz NDI4MyBMIDgzMzU4OSA0NTM4MzUgTCAxOTM0NjUgNDg1NjYzIE0gNzE5MDY0IDYwMjYzOSBNIDUz MDY2OCAxNzIxMjIgTCA0MDI0MiAzOTc1MDQgTCA2MTQ5OTcgMzI3MSBNIDU4NDY4NSAxOTc2NDkg TCA3MzkxMTcgMTg0NjkzIE0gNTczMzk5IDc5OTk1MSBMIDI1Mzc4NiAyMzk5NDkgTCA3MjU2MTIg ODY2NDI1IE0gMzI4MjUxIDQzOTk1IEwgNzY4NzIzIDg3ODMwIEwgODM5MTgwIDU3NzQ5MyBMIDEz OTQ5IDM2NTkwOSBNIDk4MzU0NyA1MjMzNjcgTCA5MDU0NDkgMzUyNjE2IEwgNzU5NjA0IDIyMTk3 NyBMIDY2OTIyOSA0NjE0MTkgTSA4MzU1NDUgNzg5NjcxIE0gNTMyNTI4IDI5MDA0NCBNIDYyMDM1 OCA4MzA2NjEgTSA0NTk1MzggNDA4MTUzIE0gMzAxOTg5IDQyMjEwMyBMIDQwNTY1MCA0NzgzMiBN IDU3Mzg5MSA5NTMyODIgTSA1NDIwODIgNDQ5MTQwIE0gNzY0MDYwIDE4NDk0NyBMIDY0NjM2NyAx NjM4NzQgTSA0MzYwMzcgNjA2MjU1IEwgODE3MzYwIDQyMTcxOCBMIDg4MTI1NyA5NjQ4OTYgTSAx ODMyNDUgMzg2OTk5IEwgNzkyNjQ5IDkyNTU0NSBMIDg3ODgyNiAxMjA1NjUgTCAzNTQwOTMgNjcy NjgxIEwgMTA1OTY5IDE1OTI3OSBNIDM3NDgwMiA1OTUzMTcgTCAzMjEzOTggNzA3MDcxIEwgOTAx NzYyIDQ3OTEzNyBMIDY2MjM4MiAyMzAwMzUgTSAxODc3MTcgMjI2ODQgTSA4MzQzNjAgMzg5MjI0 IEwgMjk3ODQ2IDI2NTA1NyBNIDk3MDUyOCA3Nzc5NzEgTSA3NjQ5NiA5MzcyNTEgTCA1MzI1Njcg NjAxNzY4IEwgMzA4ODM5IDIyNTM0MSBMIDcwNDQ3OCA1NzUxNDIgTSAzNjY4NjAgODA1MTc3IEwg ODI3ODYxIDY1NjU5NyBNIDIxNzA4NSA1OTM2ODkgTSA1MTQ5MzEgODU4NzQ2IEwgNjM2NzE2IDgx NDgxIEwgNzkzNTM4IDEzMjUzIE0gMzk1MzA2IDY0MDcxNCBMIDg2NjA1NiA2OTI2MDYgTCAyNjc3 NDcgMzgwMzU1IEwgOTc4Njg2IDQ5MTk3MiBMIDg4MDkwOSAxMTc4NzEgTSAyMjQ3NzAgNjMyODAy IE0gODc3NjUxIDExODI2MCBMIDY4MDIxNiAyOTgzOTkgTCA0MDQ5MzMgMTQ3OTc2IE0gMzY1NDMy IDg1MjEyMiBNIDU4MDM3IDc2Njg2OCBMIDE0NzIyMyA3MDgxNjcgTSAxMjU5MDggMjAwMTM5IE0g NzYxMTkxIDgxMDQ3IE0gOTkwMTYyIDMwNTgxOCBNIDc3ODc4IDE4MzQ2OSBNIDgwMjMxMiAxNDI2 MDEgTCA4OTUyNzIgNTQyMTE0IEwgODc2Mjk4IDg3MTA3NiBMIDkyOTExNCA2NjIyMzkgTCA4MDk0 NjIgNTU1NDc2IEwgNzU1NjE1IDk1MzEwNSBMIDM3MDQ3MSA2ODY3MjMgTSA0MjA2NDAgNzY0NjAx IE0gNTg5MDY5IDU2NjkxMiBNIDQzNzcxMyA2Njc2MjMgTSA5Nzk4MjcgMTczMjY2IE0gODU2MTI0 IDQ0MzQyIE0gOTMyNjYxIDk3MzQ1NiBMIDIyODM1NSA3NzQxNDUgTSA4ODE5NjQgNzA5NTE1IE0g ODM1MDY5IDQwNjA3NiBMIDkyNzk5IDcwMjA0IEwgMzk2MTU1IDIxNTI0NyBNIDg2NDcwNyA2NTI5 NjEgTSAyMjg1MzEgNjMyNzg4IE0gNjM1NjA0IDQ4ODkxMiBNIDkzODA0OCA0MjE1NzIgTSA5MDI3 MzEgMjAxNTQxIEwgNTM2OTg4IDM5MzMxOSBNIDYyODA0OSAyMjgzODcgTCA0MzM5MjcgODg1MjY3 IEwgNzQyNjY3IDIyMTMyIE0gMTY2OTc5IDg4Njg0MCBMIDExNTM3MCA1NjExMDIgTCA1MDAxMyA4 MzM2NjIgTCAxMTY2NjEgNTkxNzUzIEwgMjY4NjI4IDIxMDExNSBNIDY1NTAxOSA4MzgxNjQgTSA0 NDc0ODYgMzkzOTM2IEwgMTk5MTMgNzQzNzU2IE0gNDIwNDUgMTkxMDkgTSA5Mjg4ODUgOTQ3NDIz IEwgNTA4NTI0IDI1NDI4IEwgODU5MDkwIDQ4NDI1MSBNIDk3NTc1MiA3NjAwMyBMIDM0NDYzMSA5 MTMzNjYgTCA3NTE1MjkgODc0ODI5IE0gMTQ1NDY1IDU1ODQ4MCBMIDMwMjIzNSA4NTUzMDYgTSAz MjEzNDQgOTc3MDMgTSAyNjg3NjcgNTk5MDE1IE0gNzc3MjkyIDYyNDQ0NCBMIDQ4MzUzNCA0NjAw NDMgTSA0NTkyODYgNTM2MDQ3IE0gNjMwNTUgODgwNjc5IEwgODgwMzI5IDczNDA5OCBMIDg3OTU2 MyAxMjE0NjggTSA0NDk0MSA0MjM3MDQgTCA3NDUwNDkgNjAzNjEgTSAxMzgxNiA2NTkzNzcgTCAy ODM4MjAgNTQ1MDMwIE0gNzY3MzU1IDUwNzIgTSAyMjY2NDEgNTQxMTIwIEwgNDIxNzk4IDU0NDY2 NCBMIDI3ODc2MSA1NDA4NDYgTCA2NjIzMTUgNzM2OTQ0IE0gODYwMTggNjk5NjAyIE0gODMxMDY4 IDc1OTk2MyBMIDQxOTMzOSA0MTM1NDEgTCA5NTg1NzEgNzYyOTMyIE0gOTYzNjQ0IDI1NTgyMyBM IDgxNzkxOSA5ODY4NTIgTCA5NjQ3MDkgMjI4Njg5IEwgODU4MjgxIDc5OTY2OCBNIDU5NTIyNSAy OTMzIE0gMjk0ODI2IDQ1ODU2NCBNIDU0Nzg5IDMwMjg2OCBMIDcxNjQwOSA1NjU4MzIgTSA2NzQ5 ODAgMzI4NzY0IEwgNTg0NTg3IDM0NDk2MCBNIDQwMjUwNSAzMzE4MTIgTSA3NjUwODggMjk2NTIw IE0gNDA2NDMxIDgwMjA3NCBNIDIwNjA5OSA5Njk5NDMgTCAyMjM4MjkgNDY5NjggTCAxMDE3NTgg OTcwNDY1IE0gNTc1ODg4IDY4Njg3MyBMIDM2MTg1MyAxMzMyMTkgTSA0NzYgNzE3ODA3IEwgMTIw MzEyIDc3NzUzIE0gODg1NDAwIDM3NDI3MyBMIDE3NjM0NyA2NjkzNjUgTSAxNDYyODkgNDIxNTA4 IEwgNDY4NDc3IDM3NDU1OSBMIDM0NTAyMyA5MTc1MjYgTSAzMTg5NiA3MjE5ODEgTCA4NTUyMDEg MzAwMjgwIE0gNTczMDA4IDQ2MjIxIEwgMTIzOTc0IDc1MTg5OSBMIDI2NDM0NiA4NzA1NTIgTCAz Njg0ODEgODIwODg0IE0gNzU0NDMgMTkxMDAyIEwgODY5OTA1IDM5MzkzMCBMIDU0MDA1MyA4MjY5 MjIgTCAyMjA2NzEgMzY0NjEyIEwgOTM3NjIwIDc4NTg1NSBNIDYzMDk0MCA5MDk4MzAgTCA0MDgw NzcgMTY5MjI4IE0gODI2NzIgMTAyOTM5IE0gOTAzNTU3IDQ1ODE1OCBMIDI4MTg1NCA5NzQxMzkg TCA3NjkxNjQgNzUxODk1IE0gNTk2MDg2IDI2MTMwNiBMIDYyNTkxOSAzOTQ4MjQgTSA1NjM1Mzgg MTgwNjc5IEwgOTA1MDkgNDg5NTE5IE0gNDk4NTg2IDY1ODc0NyBNIDU4MTI1OCA3NjE2ODYgTCAy MTk4NDQgNDU3MTc3IEwgNDMxMzE2IDU0MzgzNyBNIDIwMDQ3OSAyOTU3MzEgTSA3OTY1NjUgNTU3 MDM3IE0gNjEzMzIyIDE4Mjk1NSBNIDQ0OTc0IDc0NjQ5NCBMIDk0MDk3MiA3MTQ1MjQgTSAzNDUx MTAgMjEzMTEwIEwgNzk0MzY5IDUzOTU2MiBMIDc1OTQwNiAyMTk2NzcgTCA2NTA5OTMgNDAyMzky IE0gODUxNDczIDY5ODEyNCBMIDI1NTE2MCA4ODA0MTkgTSA0MzgxMTYgMzIzNzU0IE0gMTg0NjEw IDk0Nzc3MCBMIDY2MjI5MyA1NTA3MiBNIDg3NTQwMyA4MzI5NDggeiI+PC9wYXRoPgo8L3N2Zz4K