106796 2013-01-14 07:43:46 -0800 [TexMap] Composited CSS shaders crash when using non-GL TextureMapper 2013-01-16 03:01:37 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 allan.jensen allan.jensen dino eric noam ojan.autocc webkit.review.bot oldest_to_newest 806349 0 allan.jensen 2013-01-14 07:43:46 -0800 If custom CSS filter aka CSS shaders are used together with animations, they will fail to work or crash. The problem appears to be caused by BitmapTextureImageBuffer trying to build a FilterEffectRenderer and passing a null pointer RenderObject. This will work for all other filters than custom ones. In custom ones it will fail to build a valid filter, which then causes FilterEffectRenderer::apply() to crash. 807195 1 182739 allan.jensen 2013-01-15 04:47:50 -0800 Created attachment 182739 Patch 807303 2 182739 jturcotte 2013-01-15 07:56:47 -0800 Comment on attachment 182739 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=182739&action=review > Source/WebCore/rendering/FilterEffectRenderer.cpp:424 > + if (!effect) > + return; By looking at the rest of FilterEffectRenderer, it looks like lastEffect is expected not to be null, so I'm not sure if this is the best fix longer term. It feels like none of this code makes sense if the list of effect is empty. Is there a way you could fix it at the caller? 807307 3 allan.jensen 2013-01-15 08:02:44 -0800 (In reply to comment #2) > (From update of attachment 182739 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=182739&action=review > > > Source/WebCore/rendering/FilterEffectRenderer.cpp:424 > > + if (!effect) > > + return; > > By looking at the rest of FilterEffectRenderer, it looks like lastEffect is expected not to be null, so I'm not sure if this is the best fix longer term. > It feels like none of this code makes sense if the list of effect is empty. Is there a way you could fix it at the caller? The rest of the patch is fixing it at the caller, so this change on it is own is not needed to fix the crash (though it was here it crashed), but since a FilterEffectRenderer can be left "invalid" after a failed build() call, I felt it would be a good idea not to crash on a state that FilterEffectRenderer has left itself in. 807344 4 182782 allan.jensen 2013-01-15 08:45:49 -0800 Created attachment 182782 Patch 808219 5 allan.jensen 2013-01-16 03:01:37 -0800 Committed r139864: <http://trac.webkit.org/changeset/139864> 182739 2013-01-15 04:47:50 -0800 2013-01-15 08:45:40 -0800 Patch bug-106796-20130115134413.patch text/plain 3106 allan.jensen U3VidmVyc2lvbiBSZXZpc2lvbjogMTM5NzMyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTNiODU3NWFlM2I5MTI5 ZDc3NWQ2ODgwYzU0MjVlOGViNmNjNTRmZi4uNDFiZmJiZDlhNzVhNDA2MDBmNjQxODgyMzU2ZGY5 NjExMDhmNDVmNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEzLTAxLTE1ICBBbGxh biBTYW5kZmVsZCBKZW5zZW4gIDxhbGxhbi5qZW5zZW5AZGlnaWEuY29tPgorCisgICAgICAgIFtU ZXhNYXBdIEFuaW1hdGVkIENTUyBzaGFkZXJzIGNyYXNoCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMDY3OTYKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBGYWlsIGdyYWNlZnVsbHkgd2hlbiBGaWx0ZXJFZmZl Y3RSZW5kZXJlciBmYWlscyB0byBidWlsZCB0aGUgZmlsdGVyIGVmZmVjdHMuCisKKyAgICAgICAg KiBwbGF0Zm9ybS9ncmFwaGljcy90ZXhtYXAvVGV4dHVyZU1hcHBlckltYWdlQnVmZmVyLmNwcDoK KyAgICAgICAgKFdlYkNvcmU6OkJpdG1hcFRleHR1cmVJbWFnZUJ1ZmZlcjo6YXBwbHlGaWx0ZXJz KToKKyAgICAgICAgKiByZW5kZXJpbmcvRmlsdGVyRWZmZWN0UmVuZGVyZXIuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6RmlsdGVyRWZmZWN0UmVuZGVyZXI6OmFwcGx5KToKKwogMjAxMy0wMS0xNSAg VG9tbXkgV2lkZW5mbHljaHQgIDx0b21teXdAZ29vZ2xlLmNvbT4KIAogICAgICAgICBNZWRpYVN0 cmVhbSBBUEk6IEZpeGluZyBjcmFzaGluZyBidWcgaW4gTWVkaWFTdHJlYW0KZGlmZiAtLWdpdCBh L1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9UZXh0dXJlTWFwcGVySW1h Z2VCdWZmZXIuY3BwIGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvdGV4bWFwL1Rl eHR1cmVNYXBwZXJJbWFnZUJ1ZmZlci5jcHAKaW5kZXggOTI5MDUzYjEyYjc0MDI1ODRjNTQ4N2Ez OGFiODBmY2RiMWExMTBiOC4uZDlkYmM4MGU2ZDJjZDQ5NzFkYWMwYTc1MGYzNGI4MjkyYzcyMTU2 NiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvdGV4bWFwL1Rl eHR1cmVNYXBwZXJJbWFnZUJ1ZmZlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0v Z3JhcGhpY3MvdGV4bWFwL1RleHR1cmVNYXBwZXJJbWFnZUJ1ZmZlci5jcHAKQEAgLTE3MSwxMiAr MTcxLDEzIEBAIFBhc3NSZWZQdHI8Qml0bWFwVGV4dHVyZT4gQml0bWFwVGV4dHVyZUltYWdlQnVm ZmVyOjphcHBseUZpbHRlcnMoVGV4dHVyZU1hcHBlciosCiAgICAgcmVuZGVyZXItPnNldFNvdXJj ZUltYWdlUmVjdChGbG9hdFJlY3QoRmxvYXRQb2ludDo6emVybygpLCBjb250ZW50VGV4dHVyZS5z aXplKCkpKTsKIAogICAgIC8vIFRoZSByZW5kZXJlciBwYXJhbWV0ZXIgaXMgb25seSBuZWVkZWQg Zm9yIENTUyBzaGFkZXJzIGFuZCByZWZlcmVuY2UgZmlsdGVycy4KLSAgICByZW5kZXJlci0+YnVp bGQoMCAvKnJlbmRlcmVyICovLCBmaWx0ZXJzKTsKLSAgICByZW5kZXJlci0+YWxsb2NhdGVCYWNr aW5nU3RvcmVJZk5lZWRlZCgpOwotICAgIEdyYXBoaWNzQ29udGV4dCogY29udGV4dCA9IHJlbmRl cmVyLT5pbnB1dENvbnRleHQoKTsKLSAgICBjb250ZXh0LT5kcmF3SW1hZ2VCdWZmZXIoc3RhdGlj X2Nhc3Q8Y29uc3QgQml0bWFwVGV4dHVyZUltYWdlQnVmZmVyJj4oY29udGVudFRleHR1cmUpLm1f aW1hZ2UuZ2V0KCksIENvbG9yU3BhY2VEZXZpY2VSR0IsIEludFBvaW50Ojp6ZXJvKCkpOwotICAg IHJlbmRlcmVyLT5hcHBseSgpOwotICAgIG1faW1hZ2UtPmNvbnRleHQoKS0+ZHJhd0ltYWdlQnVm ZmVyKHJlbmRlcmVyLT5vdXRwdXQoKSwgQ29sb3JTcGFjZURldmljZVJHQiwgcmVuZGVyZXItPm91 dHB1dFJlY3QoKSk7CisgICAgaWYgKHJlbmRlcmVyLT5idWlsZCgwIC8qcmVuZGVyZXIgKi8sIGZp bHRlcnMpKSB7CisgICAgICAgIHJlbmRlcmVyLT5hbGxvY2F0ZUJhY2tpbmdTdG9yZUlmTmVlZGVk KCk7CisgICAgICAgIEdyYXBoaWNzQ29udGV4dCogY29udGV4dCA9IHJlbmRlcmVyLT5pbnB1dENv bnRleHQoKTsKKyAgICAgICAgY29udGV4dC0+ZHJhd0ltYWdlQnVmZmVyKHN0YXRpY19jYXN0PGNv bnN0IEJpdG1hcFRleHR1cmVJbWFnZUJ1ZmZlciY+KGNvbnRlbnRUZXh0dXJlKS5tX2ltYWdlLmdl dCgpLCBDb2xvclNwYWNlRGV2aWNlUkdCLCBJbnRQb2ludDo6emVybygpKTsKKyAgICAgICAgcmVu ZGVyZXItPmFwcGx5KCk7CisgICAgICAgIG1faW1hZ2UtPmNvbnRleHQoKS0+ZHJhd0ltYWdlQnVm ZmVyKHJlbmRlcmVyLT5vdXRwdXQoKSwgQ29sb3JTcGFjZURldmljZVJHQiwgcmVuZGVyZXItPm91 dHB1dFJlY3QoKSk7CisgICAgfQogICAgIHJldHVybiB0aGlzOwogfQogI2VuZGlmCmRpZmYgLS1n aXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvRmlsdGVyRWZmZWN0UmVuZGVyZXIuY3BwIGIv U291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL0ZpbHRlckVmZmVjdFJlbmRlcmVyLmNwcAppbmRleCAx NDc0YmM4NDQ1MGQ2M2FkODIwMzdjNDUwYTk2NjE0MDg3ZDUyYTA3Li4wNDdlYjIxOGRlY2EwODA4 MTgwZGZkOGMzMzY3YzUwYmI1NWRlNzVkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5k ZXJpbmcvRmlsdGVyRWZmZWN0UmVuZGVyZXIuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRl cmluZy9GaWx0ZXJFZmZlY3RSZW5kZXJlci5jcHAKQEAgLTQyMCw2ICs0MjAsOCBAQCB2b2lkIEZp bHRlckVmZmVjdFJlbmRlcmVyOjpjbGVhckludGVybWVkaWF0ZVJlc3VsdHMoKQogdm9pZCBGaWx0 ZXJFZmZlY3RSZW5kZXJlcjo6YXBwbHkoKQogewogICAgIFJlZlB0cjxGaWx0ZXJFZmZlY3Q+IGVm ZmVjdCA9IGxhc3RFZmZlY3QoKTsKKyAgICBpZiAoIWVmZmVjdCkKKyAgICAgICAgcmV0dXJuOwog ICAgIGVmZmVjdC0+YXBwbHkoKTsKICAgICBlZmZlY3QtPnRyYW5zZm9ybVJlc3VsdENvbG9yU3Bh Y2UoQ29sb3JTcGFjZURldmljZVJHQik7CiB9Cg== 182782 2013-01-15 08:45:49 -0800 2013-01-15 10:16:55 -0800 Patch bug-106796-20130115174212.patch text/plain 2471 allan.jensen U3VidmVyc2lvbiBSZXZpc2lvbjogMTM5NzQ0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMjJkZjcyODA3YjIwNDZl MmZlOTEyYjU0MTRhYzYxOTFkODViYTVlMS4uOTY5NWIzZGRhOGYzYmExMjY1NDIwOGYwMTRjNDdm ZWJlNmVhNDMzZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSw1ICsxLDE3IEBACiAyMDEzLTAxLTE1ICBBbGxh biBTYW5kZmVsZCBKZW5zZW4gIDxhbGxhbi5qZW5zZW5AZGlnaWEuY29tPgogCisgICAgICAgIFtU ZXhNYXBdIEFuaW1hdGVkIENTUyBzaGFkZXJzIGNyYXNoCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMDY3OTYKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBGYWlsIGdyYWNlZnVsbHkgd2hlbiBGaWx0ZXJFZmZl Y3RSZW5kZXJlciBmYWlscyB0byBidWlsZCB0aGUgZmlsdGVyIGVmZmVjdHMuCisKKyAgICAgICAg KiBwbGF0Zm9ybS9ncmFwaGljcy90ZXhtYXAvVGV4dHVyZU1hcHBlckltYWdlQnVmZmVyLmNwcDoK KyAgICAgICAgKFdlYkNvcmU6OkJpdG1hcFRleHR1cmVJbWFnZUJ1ZmZlcjo6YXBwbHlGaWx0ZXJz KToKKworMjAxMy0wMS0xNSAgQWxsYW4gU2FuZGZlbGQgSmVuc2VuICA8YWxsYW4uamVuc2VuQGRp Z2lhLmNvbT4KKwogICAgICAgICBbUXRdIFdlYkdMIGRvZXMgbm90IHJlcXVpcmUgYWNjZWxlcmF0 ZWQgY29tcG9zaXRpbmcKICAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTEwNjg5MgogCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFw aGljcy90ZXhtYXAvVGV4dHVyZU1hcHBlckltYWdlQnVmZmVyLmNwcCBiL1NvdXJjZS9XZWJDb3Jl L3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9UZXh0dXJlTWFwcGVySW1hZ2VCdWZmZXIuY3BwCmlu ZGV4IDkyOTA1M2IxMmI3NDAyNTg0YzU0ODdhMzhhYjgwZmNkYjFhMTEwYjguLmQ5ZGJjODBlNmQy Y2Q0OTcxZGFjMGE3NTBmMzRiODI5MmM3MjE1NjYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3Jl L3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9UZXh0dXJlTWFwcGVySW1hZ2VCdWZmZXIuY3BwCisr KyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9UZXh0dXJlTWFwcGVy SW1hZ2VCdWZmZXIuY3BwCkBAIC0xNzEsMTIgKzE3MSwxMyBAQCBQYXNzUmVmUHRyPEJpdG1hcFRl eHR1cmU+IEJpdG1hcFRleHR1cmVJbWFnZUJ1ZmZlcjo6YXBwbHlGaWx0ZXJzKFRleHR1cmVNYXBw ZXIqLAogICAgIHJlbmRlcmVyLT5zZXRTb3VyY2VJbWFnZVJlY3QoRmxvYXRSZWN0KEZsb2F0UG9p bnQ6Onplcm8oKSwgY29udGVudFRleHR1cmUuc2l6ZSgpKSk7CiAKICAgICAvLyBUaGUgcmVuZGVy ZXIgcGFyYW1ldGVyIGlzIG9ubHkgbmVlZGVkIGZvciBDU1Mgc2hhZGVycyBhbmQgcmVmZXJlbmNl IGZpbHRlcnMuCi0gICAgcmVuZGVyZXItPmJ1aWxkKDAgLypyZW5kZXJlciAqLywgZmlsdGVycyk7 Ci0gICAgcmVuZGVyZXItPmFsbG9jYXRlQmFja2luZ1N0b3JlSWZOZWVkZWQoKTsKLSAgICBHcmFw aGljc0NvbnRleHQqIGNvbnRleHQgPSByZW5kZXJlci0+aW5wdXRDb250ZXh0KCk7Ci0gICAgY29u dGV4dC0+ZHJhd0ltYWdlQnVmZmVyKHN0YXRpY19jYXN0PGNvbnN0IEJpdG1hcFRleHR1cmVJbWFn ZUJ1ZmZlciY+KGNvbnRlbnRUZXh0dXJlKS5tX2ltYWdlLmdldCgpLCBDb2xvclNwYWNlRGV2aWNl UkdCLCBJbnRQb2ludDo6emVybygpKTsKLSAgICByZW5kZXJlci0+YXBwbHkoKTsKLSAgICBtX2lt YWdlLT5jb250ZXh0KCktPmRyYXdJbWFnZUJ1ZmZlcihyZW5kZXJlci0+b3V0cHV0KCksIENvbG9y U3BhY2VEZXZpY2VSR0IsIHJlbmRlcmVyLT5vdXRwdXRSZWN0KCkpOworICAgIGlmIChyZW5kZXJl ci0+YnVpbGQoMCAvKnJlbmRlcmVyICovLCBmaWx0ZXJzKSkgeworICAgICAgICByZW5kZXJlci0+ YWxsb2NhdGVCYWNraW5nU3RvcmVJZk5lZWRlZCgpOworICAgICAgICBHcmFwaGljc0NvbnRleHQq IGNvbnRleHQgPSByZW5kZXJlci0+aW5wdXRDb250ZXh0KCk7CisgICAgICAgIGNvbnRleHQtPmRy YXdJbWFnZUJ1ZmZlcihzdGF0aWNfY2FzdDxjb25zdCBCaXRtYXBUZXh0dXJlSW1hZ2VCdWZmZXIm Pihjb250ZW50VGV4dHVyZSkubV9pbWFnZS5nZXQoKSwgQ29sb3JTcGFjZURldmljZVJHQiwgSW50 UG9pbnQ6Onplcm8oKSk7CisgICAgICAgIHJlbmRlcmVyLT5hcHBseSgpOworICAgICAgICBtX2lt YWdlLT5jb250ZXh0KCktPmRyYXdJbWFnZUJ1ZmZlcihyZW5kZXJlci0+b3V0cHV0KCksIENvbG9y U3BhY2VEZXZpY2VSR0IsIHJlbmRlcmVyLT5vdXRwdXRSZWN0KCkpOworICAgIH0KICAgICByZXR1 cm4gdGhpczsKIH0KICNlbmRpZgo=