175196 2017-08-04 10:50:36 -0700 Web Inspector: REGRESSION (r220233): Check for null pointer passed to WebGLRenderingContextBase::deleteProgram 2017-08-04 11:57:08 -0700 1 1 1 Unclassified WebKit Web Inspector WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 mattbaker mattbaker buildbot cdumez commit-queue dino esprehn+autocc graouts gyuyoung.kim hi inspector-bugzilla-changes jlewis3 kondapallykalyan ryanhaddad webkit-bug-importer oldest_to_newest 1335328 0 mattbaker 2017-08-04 10:50:36 -0700 Summary: Check for null pointer passed to WebGLRenderingContextBase::deleteProgram. Apparently the WebGLProgram* can be null. Hit while running LayoutTests/fast/canvas/webgl/webgl-draw-buffers.html. Introduced in http://trac.webkit.org/changeset/220233. ASSERTION FAILED: program /Volumes/Data/Projects/WebKit/OpenSource/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp(1578) : void WebCore::WebGLRenderingContextBase::deleteProgram(WebCore::WebGLProgram *) 1 0x659bfc31d WTFCrash 2 0x64efd31c7 WebCore::WebGLRenderingContextBase::deleteProgram(WebCore::WebGLProgram*) 3 0x64debed62 WebCore::jsWebGLRenderingContextPrototypeFunctionDeleteProgramBody(JSC::ExecState*, WebCore::JSWebGLRenderingContext*, JSC::ThrowScope&) 4 0x64dea637e long long WebCore::IDLOperation<WebCore::JSWebGLRenderingContext>::call<&(WebCore::jsWebGLRenderingContextPrototypeFunctionDeleteProgramBody(JSC::ExecState*, WebCore::JSWebGLRenderingContext*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) 5 0x64dea610c WebCore::jsWebGLRenderingContextPrototypeFunctionDeleteProgram(JSC::ExecState*) 6 0x256524001028 7 0x659781cfd llint_entry 8 0x659781cfd llint_entry 9 0x659781d77 llint_entry 10 0x659781d77 llint_entry 11 0x659781d77 llint_entry 12 0x65977a237 vmEntryToJavaScript 13 0x6595542ce JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 14 0x659503798 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) 15 0x658d88c88 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 16 0x658d88e40 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 17 0x64e8d7bbb WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 18 0x64e8d79a8 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*) 19 0x64e8d7c9d WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*) 20 0x64e8ed562 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) 21 0x64e8ebb96 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) 22 0x64d08de20 WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&) 23 0x64d08dc8f WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement>&&, WTF::TextPosition const&) 24 0x64cfb21b2 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() 25 0x64cfb2713 WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) 26 0x64cfb13b8 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) 27 0x64cfb0f0b WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) 28 0x64cfb4119 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() 29 0x64cfb451e WebCore::HTMLDocumentParser::notifyFinished(WebCore::PendingScript&) 30 0x64cfb457c non-virtual thunk to WebCore::HTMLDocumentParser::notifyFinished(WebCore::PendingScript&) 31 0x64e3af8c7 WebCore::PendingScript::notifyClientFinished() LEAK: 1 WebPageProxy 1335329 1 webkit-bug-importer 2017-08-04 10:50:52 -0700 <rdar://problem/33727603> 1335331 2 317257 mattbaker 2017-08-04 10:52:00 -0700 Created attachment 317257 Patch 1335339 3 317257 hi 2017-08-04 10:54:14 -0700 Comment on attachment 317257 Patch r=me 1335372 4 317257 commit-queue 2017-08-04 11:57:07 -0700 Comment on attachment 317257 Patch Clearing flags on attachment: 317257 Committed r220281: <http://trac.webkit.org/changeset/220281> 1335373 5 commit-queue 2017-08-04 11:57:08 -0700 All reviewed patches have been landed. Closing bug. 317257 2017-08-04 10:52:00 -0700 2017-08-04 11:57:07 -0700 Patch bug-175196-20170804105159.patch text/plain 1629 mattbaker U3VidmVyc2lvbiBSZXZpc2lvbjogMjIwMjQ4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzIyNzNjN2FiYTljNmQ1 NDdmMGZmMzk4NTM0ZjE4MWFjNjM5NTZiNy4uZTBlN2Y5YzMyZDg3ZDU0YTU4YTAzZGUyMTk4NTAx MmYyY2RhNTc0ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDE3LTA4LTA0ICBNYXR0 IEJha2VyICA8bWF0dGJha2VyQGFwcGxlLmNvbT4KKworICAgICAgICBXZWIgSW5zcGVjdG9yOiBS RUdSRVNTSU9OIChyMjIwMjMzKTogQ2hlY2sgZm9yIG51bGwgcG9pbnRlciBwYXNzZWQgdG8gV2Vi R0xSZW5kZXJpbmdDb250ZXh0QmFzZTo6ZGVsZXRlUHJvZ3JhbQorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTc1MTk2CisgICAgICAgIDxyZGFyOi8vcHJv YmxlbS8zMzcyNzYwMz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICAqIGh0bWwvY2FudmFzL1dlYkdMUmVuZGVyaW5nQ29udGV4dEJhc2UuY3BwOgorICAg ICAgICAoV2ViQ29yZTo6V2ViR0xSZW5kZXJpbmdDb250ZXh0QmFzZTo6ZGVsZXRlUHJvZ3JhbSk6 CisKIDIwMTctMDgtMDMgIEplcmVteSBKb25lcyAgPGplcmVteWpAYXBwbGUuY29tPgogCiAgICAg ICAgIEltcHJvdmUgV2ViS2l0TGVnYWN5IHZpZGVvIGZ1bGxzY3JlZW4gYW5pbWF0aW9uIGJlZ2lu IGFuZCBlbmQgcmVjdHMuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9odG1sL2NhbnZhcy9X ZWJHTFJlbmRlcmluZ0NvbnRleHRCYXNlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvY2FudmFz L1dlYkdMUmVuZGVyaW5nQ29udGV4dEJhc2UuY3BwCmluZGV4IDMxZDA1ZDE5N2Y0MDk4ZmI5NTAz NDA1ZDY1M2Q4Y2VjMjM0ZGY0OGQuLjBmYzcxZTI3ZTBkYWM0Yzk2YTdiNDc2NDlhZWJjNzMxOWJh YjUxYWEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvY2FudmFzL1dlYkdMUmVuZGVy aW5nQ29udGV4dEJhc2UuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvY2FudmFzL1dlYkdM UmVuZGVyaW5nQ29udGV4dEJhc2UuY3BwCkBAIC0xNTc1LDggKzE1NzUsOCBAQCB2b2lkIFdlYkdM UmVuZGVyaW5nQ29udGV4dEJhc2U6OmRlbGV0ZUZyYW1lYnVmZmVyKFdlYkdMRnJhbWVidWZmZXIq IGZyYW1lYnVmZmVyKQogCiB2b2lkIFdlYkdMUmVuZGVyaW5nQ29udGV4dEJhc2U6OmRlbGV0ZVBy b2dyYW0oV2ViR0xQcm9ncmFtKiBwcm9ncmFtKQogewotICAgIEFTU0VSVChwcm9ncmFtKTsKLSAg ICBJbnNwZWN0b3JJbnN0cnVtZW50YXRpb246OndpbGxEZWxldGVQcm9ncmFtKCp0aGlzLCAqcHJv Z3JhbSk7CisgICAgaWYgKHByb2dyYW0pCisgICAgICAgIEluc3BlY3Rvckluc3RydW1lbnRhdGlv bjo6d2lsbERlbGV0ZVByb2dyYW0oKnRoaXMsICpwcm9ncmFtKTsKIAogICAgIGRlbGV0ZU9iamVj dChwcm9ncmFtKTsKICAgICAvLyBXZSBkb24ndCByZXNldCBtX2N1cnJlbnRQcm9ncmFtIHRvIDAg aGVyZSBiZWNhdXNlIHRoZSBkZWxldGlvbiBvZiB0aGUK