118613 2013-07-12 14:20:49 -0700 [CoordinatedGraphics] Crash at CoordinatedGraphicsScene::updateImageBacking 2022-07-29 10:53:31 -0700 1 1 1 Unclassified WebKit WebKit Qt 528+ (Nightly build) Unspecified Unspecified RESOLVED INVALID P2 Normal --- 1 luciano.wolf luciano.wolf cmarcelo commit-queue hugo.lima luiz marcelo.lira noam yoon oldest_to_newest 908065 0 luciano.wolf 2013-07-12 14:20:49 -0700 If you run this demo: http://dev.sencha.com/deploy/touch/examples/production/kitchensink/#demo/touchevents and click on "Console" button, it produces a segmentation fault: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff6491d85 in WebCore::CoordinatedGraphicsScene::updateImageBacking(unsigned long, WTF::PassRefPtr<WebCore::CoordinatedSurface>) () It was tested with Nix (MiniBrowser --ipad) and with Qt (MiniBrowser --user-agent "Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10") I was able to fix the problem but I'm not sure if it's the right fix. Inside CoordinatedGraphicsScene::syncImageBackings(const CoordinatedGraphicsState& state) function there are some iterations to deal with images that must be created, removed, updated and cleared. The thing is that it tries to create/remove/update the very same ID thus generating a segfault - as it tries to updated an ID that was killed. I can "fix" the problem just changing the order of these operations: execute the removals prior any other operation. I'm not considering this as a proper fix because it's weird to have the same ID scheduled for all operations. What do you guys think? 908068 1 206572 luciano.wolf 2013-07-12 14:26:39 -0700 Created attachment 206572 Proposed fix 908429 2 206669 luciano.wolf 2013-07-15 09:31:35 -0700 Created attachment 206669 Proposed fix. 908439 3 206669 noam 2013-07-15 09:54:49 -0700 Comment on attachment 206669 Proposed fix. View in context: https://bugs.webkit.org/attachment.cgi?id=206669&action=review > Source/WebCore/ChangeLog:9 > + operation - solves the issue. > + You should mention why :) It works because when an image is replaced the old one is deleted before the new one is created, and IDs are not unique in cairo (they're based on the image pointer) 908445 4 206673 luciano.wolf 2013-07-15 10:07:39 -0700 Created attachment 206673 Proposed fix. 908459 5 206673 commit-queue 2013-07-15 10:50:24 -0700 Comment on attachment 206673 Proposed fix. Clearing flags on attachment: 206673 Committed r152647: <http://trac.webkit.org/changeset/152647> 914061 6 noam 2013-08-02 01:42:26 -0700 This crash still appears, the patch makes it more rare but doesn't fix it. The right fix for this is to stop using the Cairo pointer as an image ID, but rather have a map in the WebProcess between a referenced cairo surface and an image ID. 914062 7 noam 2013-08-02 01:42:56 -0700 See previous comment. 1887690 8 ap 2022-07-29 10:53:31 -0700 The Qt port has been removed from WebKit, resolving this bug. 206572 2013-07-12 14:26:39 -0700 2013-07-15 09:31:30 -0700 Proposed fix operations-order.patch text/plain 1074 luciano.wolf ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9jb29y ZGluYXRlZC9Db29yZGluYXRlZEdyYXBoaWNzU2NlbmUuY3BwIGIvU291cmNlL1dlYkNvcmUvcGxh dGZvcm0vZ3JhcGhpY3MvdGV4bWFwL2Nvb3JkaW5hdGVkL0Nvb3JkaW5hdGVkR3JhcGhpY3NTY2Vu ZS5jcHAKaW5kZXggOWRkMmQ3MS4uMzJjN2RhYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUv cGxhdGZvcm0vZ3JhcGhpY3MvdGV4bWFwL2Nvb3JkaW5hdGVkL0Nvb3JkaW5hdGVkR3JhcGhpY3NT Y2VuZS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvdGV4bWFwL2Nv b3JkaW5hdGVkL0Nvb3JkaW5hdGVkR3JhcGhpY3NTY2VuZS5jcHAKQEAgLTUyOCwxMiArNTI4LDEy IEBAIHZvaWQgQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lOjpyZW1vdmVVcGRhdGVBdGxhcyh1aW50 MzJfdCBhdGxhc0lEKQogCiB2b2lkIENvb3JkaW5hdGVkR3JhcGhpY3NTY2VuZTo6c3luY0ltYWdl QmFja2luZ3MoY29uc3QgQ29vcmRpbmF0ZWRHcmFwaGljc1N0YXRlJiBzdGF0ZSkKIHsKLSAgICBm b3IgKHNpemVfdCBpID0gMDsgaSA8IHN0YXRlLmltYWdlc1RvQ3JlYXRlLnNpemUoKTsgKytpKQot ICAgICAgICBjcmVhdGVJbWFnZUJhY2tpbmcoc3RhdGUuaW1hZ2VzVG9DcmVhdGVbaV0pOwotCiAg ICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPCBzdGF0ZS5pbWFnZXNUb1JlbW92ZS5zaXplKCk7ICsr aSkKICAgICAgICAgcmVtb3ZlSW1hZ2VCYWNraW5nKHN0YXRlLmltYWdlc1RvUmVtb3ZlW2ldKTsK IAorICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgc3RhdGUuaW1hZ2VzVG9DcmVhdGUuc2l6ZSgp OyArK2kpCisgICAgICAgIGNyZWF0ZUltYWdlQmFja2luZyhzdGF0ZS5pbWFnZXNUb0NyZWF0ZVtp XSk7CisKICAgICBmb3IgKHNpemVfdCBpID0gMDsgaSA8IHN0YXRlLmltYWdlc1RvVXBkYXRlLnNp emUoKTsgKytpKQogICAgICAgICB1cGRhdGVJbWFnZUJhY2tpbmcoc3RhdGUuaW1hZ2VzVG9VcGRh dGVbaV0uZmlyc3QsIHN0YXRlLmltYWdlc1RvVXBkYXRlW2ldLnNlY29uZCk7CiAK 206669 2013-07-15 09:31:35 -0700 2013-07-15 09:54:48 -0700 Proposed fix. bug-118613-20130715133042.patch text/plain 2107 luciano.wolf U3VidmVyc2lvbiBSZXZpc2lvbjogMTUyNjMxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzNjNThlOWI3ZGJmYTVl NDVhMDMyNzM2MDdkNjJjYzM4MTFmODcyMC4uNTc4Mzc3ZDBmMjc3NzEwOTU4NjRhOWJhZTI5N2Jh NTVkYzk5YjgwNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEzLTA3LTE1ICBMdWNp YW5vIFdvbGYgIDxsdWNpYW5vLndvbGZAb3BlbmJvc3NhLm9yZz4KKworICAgICAgICBbQ29vcmRp bmF0ZWRHcmFwaGljc10gQ3Jhc2ggYXQgQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lOjp1cGRhdGVJ bWFnZUJhY2tpbmcKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTExODYxMworCisgICAgICAgIFRoZSBvcGVyYXRpb25zIG9mIGNyZWF0aW5nL3JlbW92aW5n L3VwZGF0aW5nL2NsZWFyaW5nIHdlcmVuJ3QgaW4gdGhlCisgICAgICAgIHJpZ2h0IHNlcXVlbmNl LiBDaGFuZ2luZyB0aGUgb3JkZXIgLSB0byBleGVjdXRlIHRoZSByZW1vdmFscyBwcmlvciBhbnkg b3RoZXIKKyAgICAgICAgb3BlcmF0aW9uIC0gc29sdmVzIHRoZSBpc3N1ZS4KKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNz L3RleG1hcC9jb29yZGluYXRlZC9Db29yZGluYXRlZEdyYXBoaWNzU2NlbmUuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6Q29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lOjpzeW5jSW1hZ2VCYWNraW5ncyk6 CisKIDIwMTMtMDctMTUgIEJyaWFuIEhvbHQgIDxicmlhbi5ob2x0QHNhbXN1bmcuY29tPgogCiAg ICAgICAgIFtBVEtdIExlYWs6IExlYWsgaW4gV2ViS2l0QWNjZXNzaWJsZVRleHRHZXRUZXh0CmRp ZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy90ZXhtYXAvY29vcmRp bmF0ZWQvQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3BsYXRm b3JtL2dyYXBoaWNzL3RleG1hcC9jb29yZGluYXRlZC9Db29yZGluYXRlZEdyYXBoaWNzU2NlbmUu Y3BwCmluZGV4IGVkN2E1ZDBjOGYwMWI5ZjI4ZDcyOGYwODNjMjk0ZTU3ZjIyZmFkZWIuLmViMjk1 N2Y4NWEwNzZiYTQ0NGYzZjlmNWY3N2M1YzRlNDIwZWRiN2UgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9jb29yZGluYXRlZC9Db29yZGluYXRlZEdy YXBoaWNzU2NlbmUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3Rl eG1hcC9jb29yZGluYXRlZC9Db29yZGluYXRlZEdyYXBoaWNzU2NlbmUuY3BwCkBAIC01MjksMTIg KzUyOSwxMiBAQCB2b2lkIENvb3JkaW5hdGVkR3JhcGhpY3NTY2VuZTo6cmVtb3ZlVXBkYXRlQXRs YXModWludDMyX3QgYXRsYXNJRCkKIAogdm9pZCBDb29yZGluYXRlZEdyYXBoaWNzU2NlbmU6OnN5 bmNJbWFnZUJhY2tpbmdzKGNvbnN0IENvb3JkaW5hdGVkR3JhcGhpY3NTdGF0ZSYgc3RhdGUpCiB7 Ci0gICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPCBzdGF0ZS5pbWFnZXNUb0NyZWF0ZS5zaXplKCk7 ICsraSkKLSAgICAgICAgY3JlYXRlSW1hZ2VCYWNraW5nKHN0YXRlLmltYWdlc1RvQ3JlYXRlW2ld KTsKLQogICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgc3RhdGUuaW1hZ2VzVG9SZW1vdmUuc2l6 ZSgpOyArK2kpCiAgICAgICAgIHJlbW92ZUltYWdlQmFja2luZyhzdGF0ZS5pbWFnZXNUb1JlbW92 ZVtpXSk7CiAKKyAgICBmb3IgKHNpemVfdCBpID0gMDsgaSA8IHN0YXRlLmltYWdlc1RvQ3JlYXRl LnNpemUoKTsgKytpKQorICAgICAgICBjcmVhdGVJbWFnZUJhY2tpbmcoc3RhdGUuaW1hZ2VzVG9D cmVhdGVbaV0pOworCiAgICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPCBzdGF0ZS5pbWFnZXNUb1Vw ZGF0ZS5zaXplKCk7ICsraSkKICAgICAgICAgdXBkYXRlSW1hZ2VCYWNraW5nKHN0YXRlLmltYWdl c1RvVXBkYXRlW2ldLmZpcnN0LCBzdGF0ZS5pbWFnZXNUb1VwZGF0ZVtpXS5zZWNvbmQpOwogCg== 206673 2013-07-15 10:07:39 -0700 2013-07-15 10:50:24 -0700 Proposed fix. bug-118613-20130715140647.patch text/plain 2219 luciano.wolf U3VidmVyc2lvbiBSZXZpc2lvbjogMTUyNjMxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzNjNThlOWI3ZGJmYTVl NDVhMDMyNzM2MDdkNjJjYzM4MTFmODcyMC4uYzcwMzkyNzM2NDIzNjIxZDIzMzBhNzUxOTA0OGEz ZmFhOGM3MWQzNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDEzLTA3LTE1ICBMdWNp YW5vIFdvbGYgIDxsdWNpYW5vLndvbGZAb3BlbmJvc3NhLm9yZz4KKworICAgICAgICBbQ29vcmRp bmF0ZWRHcmFwaGljc10gQ3Jhc2ggYXQgQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lOjp1cGRhdGVJ bWFnZUJhY2tpbmcKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTExODYxMworCisgICAgICAgIFRoZSBvcGVyYXRpb25zIG9mIGNyZWF0aW5nL3JlbW92aW5n L3VwZGF0aW5nL2NsZWFyaW5nIHdlcmVuJ3QgaW4gdGhlCisgICAgICAgIHJpZ2h0IHNlcXVlbmNl LiBDaGFuZ2luZyB0aGUgb3JkZXIgc29sdmVzIHRoZSBpc3N1ZSBiZWNhdXNlIHdoZW4gYW4gaW1h Z2UgaXMKKyAgICAgICAgcmVwbGFjZWQgdGhlIG9sZCBvbmUgaXMgZGVsZXRlZCBiZWZvcmUgdGhl IG5ldyBvbmUgaXMgY3JlYXRlZCwgYW5kIElEcyBhcmUKKyAgICAgICAgbm90IHVuaXF1ZSBpbiBj YWlybyAodGhleSdyZSBiYXNlZCBvbiB0aGUgaW1hZ2UgcG9pbnRlcikuCisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTm9hbSBSb3NlbnRoYWwuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy90 ZXhtYXAvY29vcmRpbmF0ZWQvQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lLmNwcDoKKyAgICAgICAg KFdlYkNvcmU6OkNvb3JkaW5hdGVkR3JhcGhpY3NTY2VuZTo6c3luY0ltYWdlQmFja2luZ3MpOgor CiAyMDEzLTA3LTE1ICBCcmlhbiBIb2x0ICA8YnJpYW4uaG9sdEBzYW1zdW5nLmNvbT4KIAogICAg ICAgICBbQVRLXSBMZWFrOiBMZWFrIGluIFdlYktpdEFjY2Vzc2libGVUZXh0R2V0VGV4dApkaWZm IC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvdGV4bWFwL2Nvb3JkaW5h dGVkL0Nvb3JkaW5hdGVkR3JhcGhpY3NTY2VuZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9y bS9ncmFwaGljcy90ZXhtYXAvY29vcmRpbmF0ZWQvQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lLmNw cAppbmRleCBlZDdhNWQwYzhmMDFiOWYyOGQ3MjhmMDgzYzI5NGU1N2YyMmZhZGViLi5lYjI5NTdm ODVhMDc2YmE0NDRmM2Y5ZjVmNzdjNWM0ZTQyMGVkYjdlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi Q29yZS9wbGF0Zm9ybS9ncmFwaGljcy90ZXhtYXAvY29vcmRpbmF0ZWQvQ29vcmRpbmF0ZWRHcmFw aGljc1NjZW5lLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy90ZXht YXAvY29vcmRpbmF0ZWQvQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lLmNwcApAQCAtNTI5LDEyICs1 MjksMTIgQEAgdm9pZCBDb29yZGluYXRlZEdyYXBoaWNzU2NlbmU6OnJlbW92ZVVwZGF0ZUF0bGFz KHVpbnQzMl90IGF0bGFzSUQpCiAKIHZvaWQgQ29vcmRpbmF0ZWRHcmFwaGljc1NjZW5lOjpzeW5j SW1hZ2VCYWNraW5ncyhjb25zdCBDb29yZGluYXRlZEdyYXBoaWNzU3RhdGUmIHN0YXRlKQogewot ICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgc3RhdGUuaW1hZ2VzVG9DcmVhdGUuc2l6ZSgpOyAr K2kpCi0gICAgICAgIGNyZWF0ZUltYWdlQmFja2luZyhzdGF0ZS5pbWFnZXNUb0NyZWF0ZVtpXSk7 Ci0KICAgICBmb3IgKHNpemVfdCBpID0gMDsgaSA8IHN0YXRlLmltYWdlc1RvUmVtb3ZlLnNpemUo KTsgKytpKQogICAgICAgICByZW1vdmVJbWFnZUJhY2tpbmcoc3RhdGUuaW1hZ2VzVG9SZW1vdmVb aV0pOwogCisgICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPCBzdGF0ZS5pbWFnZXNUb0NyZWF0ZS5z aXplKCk7ICsraSkKKyAgICAgICAgY3JlYXRlSW1hZ2VCYWNraW5nKHN0YXRlLmltYWdlc1RvQ3Jl YXRlW2ldKTsKKwogICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgc3RhdGUuaW1hZ2VzVG9VcGRh dGUuc2l6ZSgpOyArK2kpCiAgICAgICAgIHVwZGF0ZUltYWdlQmFja2luZyhzdGF0ZS5pbWFnZXNU b1VwZGF0ZVtpXS5maXJzdCwgc3RhdGUuaW1hZ2VzVG9VcGRhdGVbaV0uc2Vjb25kKTsKIAo=