178852 2017-10-26 00:48:58 -0700 [GTK][Stable] Crash on WebCore::SharedBuffer::data() on 2.18.1 2017-10-31 11:10:25 -0700 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugzilla.redhat.com/show_bug.cgi?id=1505755 https://bugzilla.redhat.com/show_bug.cgi?id=1508044 P2 Normal --- 1 magomez magomez bugs-noreply cgarcia fujii mcatanzaro oldest_to_newest 1364733 0 magomez 2017-10-26 00:48:58 -0700 We have a crash when decoding a GIF image. This is the backtrace: Thread no. 1 (9 frames) #0 WebCore::SharedBuffer::data() const at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/SharedBuffer.cpp:100 #1 GIFImageReader::data(unsigned long) const at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/image-decoders/gif/GIFImageReader.h:298 #2 GIFImageReader::parse(unsigned long, unsigned long, bool) at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp:412 #3 GIFImageReader::decode(WebCore::GIFImageDecoder::GIFQuery, unsigned int) at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp:360 #4 WebCore::GIFImageDecoder::decode(unsigned int, WebCore::GIFImageDecoder::GIFQuery, bool) at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:349 #5 WebCore::GIFImageDecoder::frameCount() const at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:67 #6 WebCore::GIFImageDecoder::frameBufferAtIndex(unsigned long) at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:144 #7 WebCore::ImageDecoder::createFrameImageAtIndex(unsigned long, WebCore::SubsamplingLevel, WebCore::DecodingOptions const&) at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/image-decoders/ImageDecoder.cpp:218 #8 WebCore::ImageFrameCache::<lambda()>::operator() at /usr/src/debug/webkitgtk4-2.18.1-1.fc27.x86_64/Source/WebCore/platform/graphics/ImageFrameCache.cpp:294 1364741 1 magomez 2017-10-26 02:11:03 -0700 The data is null when trying to decode the 1364746 2 fujii 2017-10-26 02:55:08 -0700 Bug 178510? 1364748 3 cgarcia 2017-10-26 03:04:29 -0700 (In reply to Fujii Hironori from comment #2) > Bug 178510? The bt is the same but ScalableImageDecoder doesn't exist in 2.18, I guess we need a similar fix for 2.18 or bring back the locks we had in the GIF decoder. 1364757 4 magomez 2017-10-26 03:30:50 -0700 (In reply to Carlos Garcia Campos from comment #3) > (In reply to Fujii Hironori from comment #2) > > Bug 178510? > > The bt is the same but ScalableImageDecoder doesn't exist in 2.18, I guess > we need a similar fix for 2.18 or bring back the locks we had in the GIF > decoder. ImageDecoder was renamed to ScalableImageDecoder because a multiplatform ImageDecoder class added, and ScalableImageDecoder inherits from it. But I think you're right and this is the fix for the problem. I hadn't realized at all that those locks were added, and I was wondering why I couldn't reproduce the problem with current ToT. And I guess this is the reason. I'll backport the locks patch and check whether they fix the crash. Thanks for your help Fujii!! 1364792 5 324993 magomez 2017-10-26 05:25:38 -0700 Created attachment 324993 Patch 1364806 6 324993 cgarcia 2017-10-26 06:13:15 -0700 Comment on attachment 324993 Patch Thanks 1364807 7 cgarcia 2017-10-26 06:14:16 -0700 Committed r224017 324993 2017-10-26 05:25:38 -0700 2017-10-26 06:13:15 -0700 Patch bug-178852-20171026142537.patch text/plain 4290 magomez U3VidmVyc2lvbiBSZXZpc2lvbjogMjIzNTk4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzVmNDE2OGUxZWY5OWM0 NWI2ZTBjM2FhY2I3MDI2YzhlZjRhZThjZi4uZGViMzE0ODI4MGU4N2U1MDZhNTBkOWFjMzdmMTBm NmEzOTZlMzc4NyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI3IEBACisyMDE3LTEwLTI2ICBNaWd1 ZWwgR29tZXogIDxtYWdvbWV6QGlnYWxpYS5jb20+CisKKyAgICAgICAgW0dUS11bU3RhYmxlXSBD cmFzaCBvbiBXZWJDb3JlOjpTaGFyZWRCdWZmZXI6OmRhdGEoKSBvbiAyLjE4LjEKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3ODg1MgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCBhIG11dGV4IHRvIGNv bnRyb2wgdGhhdCB0aGUgaW1hZ2UgZGVjb2RlcnMgYXJlIG5vdCB1c2VkIGF0IHRoZSBzYW1lCisg ICAgICAgIHRpbWUgZnJvbSB0aGUgbWFpbiB0aHJlYWQgYW5kIHRoZSBkZWNvZGluZyB0aHJlYWQu CisKKyAgICAgICAgQmFja3BvcnQgb2YgdGhlIGZpeCB0byBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTc4NTEwCisgICAgICAgIGNyZWF0ZWQgYnkgRnVqaWkgSGlyb25v cmkgPEhpcm9ub3JpLkZ1amlpQHNvbnkuY29tPi4KKworICAgICAgICBDb3ZlcmVkIGJ5IGV4aXN0 ZW50IHRlc3RzLgorCisgICAgICAgICogcGxhdGZvcm0vaW1hZ2UtZGVjb2RlcnMvSW1hZ2VEZWNv ZGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkltYWdlRGVjb2Rlcjo6ZnJhbWVJc0NvbXBsZXRl QXRJbmRleCk6CisgICAgICAgIChXZWJDb3JlOjpJbWFnZURlY29kZXI6OmZyYW1lSGFzQWxwaGFB dEluZGV4IGNvbnN0KToKKyAgICAgICAgKFdlYkNvcmU6OkltYWdlRGVjb2Rlcjo6ZnJhbWVCeXRl c0F0SW5kZXggY29uc3QpOgorICAgICAgICAoV2ViQ29yZTo6SW1hZ2VEZWNvZGVyOjpmcmFtZUR1 cmF0aW9uQXRJbmRleCk6CisgICAgICAgIChXZWJDb3JlOjpJbWFnZURlY29kZXI6OmNyZWF0ZUZy YW1lSW1hZ2VBdEluZGV4KToKKyAgICAgICAgKiBwbGF0Zm9ybS9pbWFnZS1kZWNvZGVycy9JbWFn ZURlY29kZXIuaDoKKyAgICAgICAgKFdlYkNvcmU6OkltYWdlRGVjb2Rlcjo6c2V0RGF0YSk6CisK IDIwMTctMTAtMTcgIENhcmxvcyBHYXJjaWEgQ2FtcG9zICA8Y2dhcmNpYUBpZ2FsaWEuY29tPgog CiAgICAgICAgIFtHVEtdW1N0YWJsZV0gQmFja2luZ1N0b3JlQmFja2VuZENhaXJvSW1wbC5oOjIz OjEwOiBmYXRhbCBlcnJvcjogV2ViQ29yZS9IeXN0ZXJlc2lzQWN0aXZpdHkuaApkaWZmIC0tZ2l0 IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vaW1hZ2UtZGVjb2RlcnMvSW1hZ2VEZWNvZGVyLmNw cCBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2ltYWdlLWRlY29kZXJzL0ltYWdlRGVjb2Rlci5j cHAKaW5kZXggNGJhNGRiMmE2MjFjZmMyZjU4YTc2NGJlNGRhZmUyMzUxYzViNzU4ZC4uMzNiM2M4 NDU5Zjg0MDgxZjg5Y2I4Y2NjYThmNzIyYjMwYTUzYTE1NiAxMDA2NDQKLS0tIGEvU291cmNlL1dl YkNvcmUvcGxhdGZvcm0vaW1hZ2UtZGVjb2RlcnMvSW1hZ2VEZWNvZGVyLmNwcAorKysgYi9Tb3Vy Y2UvV2ViQ29yZS9wbGF0Zm9ybS9pbWFnZS1kZWNvZGVycy9JbWFnZURlY29kZXIuY3BwCkBAIC0x NzIsMTIgKzE3MiwxNCBAQCB0ZW1wbGF0ZSA8TWF0Y2hUeXBlIHR5cGU+IGludCBnZXRTY2FsZWRW YWx1ZShjb25zdCBWZWN0b3I8aW50PiYgc2NhbGVkVmFsdWVzLCBpbgogCiBib29sIEltYWdlRGVj b2Rlcjo6ZnJhbWVJc0NvbXBsZXRlQXRJbmRleChzaXplX3QgaW5kZXgpCiB7CisgICAgTG9ja0hv bGRlciBsb2NrSG9sZGVyKG1fbXV0ZXgpOwogICAgIEltYWdlRnJhbWUqIGJ1ZmZlciA9IGZyYW1l QnVmZmVyQXRJbmRleChpbmRleCk7CiAgICAgcmV0dXJuIGJ1ZmZlciAmJiBidWZmZXItPmlzQ29t cGxldGUoKTsKIH0KIAogYm9vbCBJbWFnZURlY29kZXI6OmZyYW1lSGFzQWxwaGFBdEluZGV4KHNp emVfdCBpbmRleCkgY29uc3QKIHsKKyAgICBMb2NrSG9sZGVyIGxvY2tIb2xkZXIobV9tdXRleCk7 CiAgICAgaWYgKG1fZnJhbWVCdWZmZXJDYWNoZS5zaXplKCkgPD0gaW5kZXgpCiAgICAgICAgIHJl dHVybiB0cnVlOwogICAgIGlmIChtX2ZyYW1lQnVmZmVyQ2FjaGVbaW5kZXhdLmlzQ29tcGxldGUo KSkKQEAgLTE4Nyw2ICsxODksNyBAQCBib29sIEltYWdlRGVjb2Rlcjo6ZnJhbWVIYXNBbHBoYUF0 SW5kZXgoc2l6ZV90IGluZGV4KSBjb25zdAogCiB1bnNpZ25lZCBJbWFnZURlY29kZXI6OmZyYW1l Qnl0ZXNBdEluZGV4KHNpemVfdCBpbmRleCkgY29uc3QKIHsKKyAgICBMb2NrSG9sZGVyIGxvY2tI b2xkZXIobV9tdXRleCk7CiAgICAgaWYgKG1fZnJhbWVCdWZmZXJDYWNoZS5zaXplKCkgPD0gaW5k ZXgpCiAgICAgICAgIHJldHVybiAwOwogICAgIC8vIEZJWE1FOiBVc2UgdGhlIGRpbWVuc2lvbiBv ZiB0aGUgcmVxdWVzdGVkIGZyYW1lLgpAQCAtMTk1LDYgKzE5OCw3IEBAIHVuc2lnbmVkIEltYWdl RGVjb2Rlcjo6ZnJhbWVCeXRlc0F0SW5kZXgoc2l6ZV90IGluZGV4KSBjb25zdAogCiBmbG9hdCBJ bWFnZURlY29kZXI6OmZyYW1lRHVyYXRpb25BdEluZGV4KHNpemVfdCBpbmRleCkKIHsKKyAgICBM b2NrSG9sZGVyIGxvY2tIb2xkZXIobV9tdXRleCk7CiAgICAgSW1hZ2VGcmFtZSogYnVmZmVyID0g ZnJhbWVCdWZmZXJBdEluZGV4KGluZGV4KTsKICAgICBpZiAoIWJ1ZmZlciB8fCBidWZmZXItPmlz SW52YWxpZCgpKQogICAgICAgICByZXR1cm4gMDsKQEAgLTIxMSw2ICsyMTUsNyBAQCBmbG9hdCBJ bWFnZURlY29kZXI6OmZyYW1lRHVyYXRpb25BdEluZGV4KHNpemVfdCBpbmRleCkKIAogTmF0aXZl SW1hZ2VQdHIgSW1hZ2VEZWNvZGVyOjpjcmVhdGVGcmFtZUltYWdlQXRJbmRleChzaXplX3QgaW5k ZXgsIFN1YnNhbXBsaW5nTGV2ZWwsIGNvbnN0IERlY29kaW5nT3B0aW9ucyYpCiB7CisgICAgTG9j a0hvbGRlciBsb2NrSG9sZGVyKG1fbXV0ZXgpOwogICAgIC8vIFplcm8taGVpZ2h0IGltYWdlcyBj YW4gY2F1c2UgcHJvYmxlbXMgZm9yIHNvbWUgcG9ydHMuIElmIHdlIGhhdmUgYW4gZW1wdHkgaW1h Z2UgZGltZW5zaW9uLCBqdXN0IGJhaWwuCiAgICAgaWYgKHNpemUoKS5pc0VtcHR5KCkpCiAgICAg ICAgIHJldHVybiBudWxscHRyOwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0v aW1hZ2UtZGVjb2RlcnMvSW1hZ2VEZWNvZGVyLmggYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9p bWFnZS1kZWNvZGVycy9JbWFnZURlY29kZXIuaAppbmRleCAxNjQzNzJlNDg0NDBjMjBiM2U5MGY0 OWYzMDM4M2I3MGIxZTI1NTJiLi5kMDhlYThkNDZhZTMwMjZmZTE5ODFlNTc5YWY4OWE2OThmYjEw MjliIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9pbWFnZS1kZWNvZGVycy9J bWFnZURlY29kZXIuaAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9pbWFnZS1kZWNvZGVy cy9JbWFnZURlY29kZXIuaApAQCAtMzMsNiArMzMsNyBAQAogI2luY2x1ZGUgIkludFNpemUuaCIK ICNpbmNsdWRlICJTaGFyZWRCdWZmZXIuaCIKICNpbmNsdWRlIDx3dGYvQXNzZXJ0aW9ucy5oPgor I2luY2x1ZGUgPHd0Zi9Mb2NrLmg+CiAjaW5jbHVkZSA8d3RmL09wdGlvbmFsLmg+CiAjaW5jbHVk ZSA8d3RmL1JlZlB0ci5oPgogI2luY2x1ZGUgPHd0Zi9WZWN0b3IuaD4KQEAgLTc1LDYgKzc2LDcg QEAgcHVibGljOgogCiAgICAgdmlydHVhbCB2b2lkIHNldERhdGEoU2hhcmVkQnVmZmVyJiBkYXRh LCBib29sIGFsbERhdGFSZWNlaXZlZCkKICAgICB7CisgICAgICAgIExvY2tIb2xkZXIgbG9ja0hv bGRlcihtX211dGV4KTsKICAgICAgICAgaWYgKG1fZW5jb2RlZERhdGFTdGF0dXMgPT0gRW5jb2Rl ZERhdGFTdGF0dXM6OkVycm9yKQogICAgICAgICAgICAgcmV0dXJuOwogCkBAIC0yMDgsNiArMjEw LDcgQEAgcHJvdGVjdGVkOgogCiAgICAgUmVmUHRyPFNoYXJlZEJ1ZmZlcj4gbV9kYXRhOyAvLyBU aGUgZW5jb2RlZCBkYXRhLgogICAgIFZlY3RvcjxJbWFnZUZyYW1lLCAxPiBtX2ZyYW1lQnVmZmVy Q2FjaGU7CisgICAgbXV0YWJsZSBMb2NrIG1fbXV0ZXg7CiAgICAgYm9vbCBtX3NjYWxlZCB7IGZh bHNlIH07CiAgICAgVmVjdG9yPGludD4gbV9zY2FsZWRDb2x1bW5zOwogICAgIFZlY3RvcjxpbnQ+ IG1fc2NhbGVkUm93czsK