137956 2014-10-22 05:51:55 -0700 ASSERTION FAILED: !m_bufferInUse in WebCore::ScratchBuffer::getScratchBuffer 2016-08-04 10:10:19 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified NEW InRadar P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham mitz simon.fraser webkit-bug-importer oldest_to_newest 1043429 0 240269 rhodovan.u-szeged 2014-10-22 05:51:55 -0700 Created attachment 240269 Test case The failing test case: <!DOCTYPE html> <style> * { min-width:9896vmin; box-shadow:black 200px -4000vh 7000pc } * { -webkit-border-radius:7000mm; -webkit-writing-mode:vertical-rl; margin-bottom:-7000pc; } </style> Backtrace: ASSERTION FAILED: !m_bufferInUse ../../Source/WebCore/platform/graphics/ShadowBlur.cpp(70) : WebCore::ImageBuffer* WebCore::ScratchBuffer::getScratchBuffer(const WebCore::IntSize&) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff98c1f700 (LWP 6776)] 0x00007fffedae91b5 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007fffedae91b5 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff37eac8c in WebCore::ScratchBuffer::getScratchBuffer (this=0x889a10, size=...) at ../../Source/WebCore/platform/graphics/ShadowBlur.cpp:70 #2 0x00007ffff37e909e in WebCore::ShadowBlur::drawRectShadowWithTiling (this=0x84d2f0, graphicsContext=0x7a0f70, shadowedRect=..., templateSize=..., edgeSize=...) at ../../Source/WebCore/platform/graphics/ShadowBlur.cpp:743 #3 0x00007ffff37e8019 in WebCore::ShadowBlur::drawRectShadow (this=0x84d2f0, graphicsContext=0x7a0f70, shadowedRect=...) at ../../Source/WebCore/platform/graphics/ShadowBlur.cpp:537 #4 0x00007ffff3e7634a in WebCore::GraphicsContext::platformFillRoundedRect (this=0x7a0f70, rect=..., color=...) at ../../Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp:1033 #5 0x00007ffff37ba08c in WebCore::GraphicsContext::fillRoundedRect (this=0x7a0f70, rect=..., color=..., colorSpace=WebCore::ColorSpaceDeviceRGB, blendMode=WebCore::BlendModeNormal) at ../../Source/WebCore/platform/graphics/GraphicsContext.cpp:703 #6 0x00007ffff3986ba5 in WebCore::RenderBoxModelObject::paintBoxShadow (this=0x94d2a0, info=..., paintRect=..., style=..., shadowStyle=WebCore::Normal, includeLogicalLeftEdge=true, includeLogicalRightEdge=true) at ../../Source/WebCore/rendering/RenderBoxModelObject.cpp:2448 #7 0x00007ffff39594c5 in WebCore::RenderBox::paintBoxDecorations (this=0x94d2a0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBox.cpp:1259 #8 0x00007ffff38fd92f in WebCore::RenderBlock::paintObject (this=0x94d2a0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1595 #9 0x00007ffff38fcc8a in WebCore::RenderBlock::paint (this=0x94d2a0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1466 #10 0x00007ffff38fd34b in WebCore::RenderBlock::paintChild (this=0x94c5a0, child=..., paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../../Source/WebCore/rendering/RenderBlock.cpp:1536 #11 0x00007ffff38fcf45 in WebCore::RenderBlock::paintChildren (this=0x94c5a0, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../../Source/WebCore/rendering/RenderBlock.cpp:1506 #12 0x00007ffff38fcee1 in WebCore::RenderBlock::paintContents (this=0x94c5a0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1499 #13 0x00007ffff38fdad8 in WebCore::RenderBlock::paintObject (this=0x94c5a0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1627 #14 0x00007ffff38fcc8a in WebCore::RenderBlock::paint (this=0x94c5a0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1466 #15 0x00007ffff3a14819 in WebCore::RenderLayer::paintForegroundForFragmentsWithPhase (this=0x94cad0, phase=WebCore::PaintPhaseChildBlockBackgrounds, layerFragments=..., context=0x7a0f70, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0) at ../../Source/WebCore/rendering/RenderLayer.cpp:4569 #16 0x00007ffff3a14451 in WebCore::RenderLayer::paintForegroundForFragments (this=0x94cad0, layerFragments=..., context=0x7a0f70, transparencyLayerContext=0x7a0f70, transparencyPaintDirtyRect=..., haveTransparency=false, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0, selectionOnly=false) at ../../Source/WebCore/rendering/RenderLayer.cpp:4529 #17 0x00007ffff3a1280f in WebCore::RenderLayer::paintLayerContents (this=0x94cad0, context=0x7a0f70, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4158 #18 0x00007ffff3a1140e in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x94cad0, context=0x7a0f70, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:3848 #19 0x00007ffff3a112ed in WebCore::RenderLayer::paintLayer (this=0x94cad0, context=0x7a0f70, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:3830 #20 0x00007ffff3a12fbb in WebCore::RenderLayer::paintList (this=0x789a60, list=0x8c02d0, context=0x7a0f70, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4252 #21 0x00007ffff3a128d2 in WebCore::RenderLayer::paintLayerContents (this=0x789a60, context=0x7a0f70, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4169 #22 0x00007ffff3a1140e in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x789a60, context=0x7a0f70, paintingInfo=..., paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3848 #23 0x00007ffff3a112ed in WebCore::RenderLayer::paintLayer (this=0x789a60, context=0x7a0f70, paintingInfo=..., paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3830 #24 0x00007ffff3a1032d in WebCore::RenderLayer::paint (this=0x789a60, context=0x7a0f70, damageRect=..., subpixelAccumulation=..., paintBehavior=0, subtreePaintRoot=0x0, paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3633 #25 0x00007ffff3668cf5 in WebCore::FrameView::paintContents (this=0x786210, context=0x7a0f70, dirtyRect=...) at ../../Source/WebCore/page/FrameView.cpp:3808 #26 0x00007ffff372c179 in WebCore::ScrollView::paint (this=0x786210, context=0x7a0f70, rect=...) at ../../Source/WebCore/platform/ScrollView.cpp:1203 #27 0x00007ffff29dec81 in WebKit::WebPage::drawRect (this=0x9e4520, graphicsContext=..., rect=...) at ../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:1305 #28 0x00007ffff2ac79c4 in WebKit::DrawingAreaImpl::display (this=0x8c1d00, updateInfo=...) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:634 #29 0x00007ffff2ac725a in WebKit::DrawingAreaImpl::display (this=0x8c1d00) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:550 #30 0x00007ffff2ac7118 in WebKit::DrawingAreaImpl::displayTimerFired (this=0x8c1d00) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:529 #31 0x00007ffff2ac95f9 in WTF::RunLoop::Timer<WebKit::DrawingAreaImpl>::fired (this=0x8c1ef8) at ../../Source/WTF/wtf/RunLoop.h:121 #32 0x00007ffff457c893 in WTF::RunLoop::TimerBase::__lambda1::operator() (__closure=0x94d370) at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:121 #33 0x00007ffff457cd39 in std::_Function_handler<bool(), WTF::RunLoop::TimerBase::start(double, bool)::__lambda1>::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/4.8/functional:2057 #34 0x00007ffff457bf14 in std::function<bool ()>::operator()() const (this=0x7fffffffd518) at /usr/include/c++/4.8/functional:2464 #35 0x00007fffedb32bbc in WTF::GMainLoopSource::boolCallback (this=0x8c1f08) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:404 #36 0x00007fffedb33021 in WTF::GMainLoopSource::boolSourceCallback (source=0x8c1f08, source@entry=<error reading variable: value has been optimized out>) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:460 #37 0x00007fffeaad2453 in g_timeout_dispatch (source=0x7c86b0, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4472 #38 0x00007fffeaad1a2d in g_main_dispatch (context=0x6777f0) at gmain.c:3064 #39 g_main_context_dispatch (context=context@entry=0x6777f0) at gmain.c:3663 #40 0x00007fffeaad1d98 in g_main_context_iterate (context=0x6777f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734 #41 0x00007fffeaad205a in g_main_loop_run (loop=0xb00db0) at gmain.c:3928 #42 0x00007ffff457c386 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #43 0x00007ffff2ad6a46 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd8b8) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #44 0x00007ffff2ad68ab in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd8b8) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #45 0x0000000000400871 in main (argc=2, argv=0x7fffffffd8b8) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44 1217446 1 bfulgham 2016-08-04 10:09:56 -0700 This reproduces in r204037. 1217447 2 webkit-bug-importer 2016-08-04 10:10:19 -0700 <rdar://problem/27701909> 240269 2014-10-22 05:51:55 -0700 2014-10-22 05:51:55 -0700 Test case crash.html text/html 210 rhodovan.u-szeged PCFET0NUWVBFIGh0bWw+CjxzdHlsZT4KKiB7CiAgICBtaW4td2lkdGg6OTg5NnZtaW47CiAgICBi b3gtc2hhZG93OmJsYWNrIDIwMHB4IC00MDAwdmggNzAwMHBjCn0KCiogewogICAgLXdlYmtpdC1i b3JkZXItcmFkaXVzOjcwMDBtbTsKICAgIC13ZWJraXQtd3JpdGluZy1tb2RlOnZlcnRpY2FsLXJs OwogICAgbWFyZ2luLWJvdHRvbTotNzAwMHBjOwp9Cjwvc3R5bGU+