196340 2019-03-27 22:19:45 -0700 [Cairo] out-of-bounds read in ShareableBitmap::paint if a fractional device scale factor is used 2019-09-24 18:35:05 -0700 1 1 1 Unclassified WebKit Platform WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 201361 196339 1 fujii fujii bfulgham don.olmstead ross.kirsling webkit-bug-importer oldest_to_newest 1522003 0 fujii 2019-03-27 22:19:45 -0700 [Cairo] Segmentation fault in Cairo::drawPatternToCairoContext with 1.5x device scale factor high DPI display I'm working on WinCairo WK2 High DPI support in Bug 196339. It's easy to cause segmentation faults in Cairo::drawPatternToCairoContext. I'm using 1.5x device scale factor high DPI. It's no problem if I tweaks deviceScaleFactor to 2x. > cairo.dll!_pixman_implementation_create_sse2() C > cairo.dll!_pixman_gradient_walker_pixel() C > cairo.dll!pixman_image_composite32() C > cairo.dll!_inplace_src_spans(void * abstract_renderer, int y, int h, const _cairo_half_open_span * spans, unsigned int num_spans) Line 2716 C > cairo.dll!generate_row(_cairo_span_renderer * renderer, const _rectangle * r, int y, int h, unsigned short coverage) Line 626 C > cairo.dll!_cairo_rectangular_scan_converter_generate(void * converter, _cairo_span_renderer * renderer) Line 673 C > cairo.dll!composite_boxes(const cairo_spans_compositor * compositor, _cairo_composite_rectangles * extents, _cairo_boxes_t * boxes) Line 741 C > cairo.dll!clip_and_composite_boxes(const cairo_spans_compositor * compositor, _cairo_composite_rectangles * extents, _cairo_boxes_t * boxes) Line 888 C > cairo.dll!_cairo_spans_compositor_mask(const cairo_compositor * _compositor, _cairo_composite_rectangles * extents) Line 1000 C > cairo.dll!_cairo_compositor_paint(const cairo_compositor * compositor, _cairo_surface * surface, _cairo_operator op, const _cairo_pattern * source, const _cairo_clip * clip) Line 67 C > cairo.dll!_cairo_image_surface_paint(void * abstract_surface, _cairo_operator op, const _cairo_pattern * source, const _cairo_clip * clip) Line 931 C > cairo.dll!_cairo_surface_paint(_cairo_surface * surface, _cairo_operator op, const _cairo_pattern * source, const _cairo_clip * clip) Line 2199 C > cairo.dll!_cairo_gstate_paint(_cairo_gstate * gstate) Line 1061 C > cairo.dll!_cairo_default_context_paint_with_alpha(void * abstract_cr, double alpha) Line 971 C > cairo.dll!cairo_paint_with_alpha(_cairo * cr, double alpha) Line 2248 C > WebKit2.dll!WebCore::Cairo::drawPatternToCairoContext(_cairo * cr, _cairo_pattern * pattern, const WebCore::FloatRect & destRect, float alpha) Line 156 C++ > WebKit2.dll!WebCore::Cairo::drawSurface(WebCore::PlatformContextCairo & platformContext, _cairo_surface * surface, const WebCore::FloatRect & destRect, const WebCore::FloatRect & originalSrcRect, WebCore::InterpolationQuality imageInterpolationQuality, float globalAlpha, const WebCore::Cairo::ShadowState & shadowState) Line 944 C++ > WebKit2.dll!WebKit::ShareableBitmap::paint(WebCore::GraphicsContext & context, float scaleFactor, const WebCore::IntPoint & dstPoint, const WebCore::IntRect & srcRect) Line 80 C++ > WebKit2.dll!WebKit::BackingStore::incorporateUpdate(WebKit::ShareableBitmap * bitmap, const WebKit::UpdateInfo & updateInfo) Line 93 C++ > WebKit2.dll!WebKit::BackingStore::incorporateUpdate(const WebKit::UpdateInfo & updateInfo) Line 62 C++ > WebKit2.dll!WebKit::DrawingAreaProxyCoordinatedGraphics::incorporateUpdate(const WebKit::UpdateInfo & updateInfo) Line 255 C++ > WebKit2.dll!WebKit::DrawingAreaProxyCoordinatedGraphics::update(unsigned __int64 backingStoreStateID, const WebKit::UpdateInfo & updateInfo) Line 157 C++ > WebKit2.dll!IPC::callMemberFunctionImpl<WebKit::DrawingAreaProxy,void (WebKit::DrawingAreaProxy::*)(unsigned long long, const WebKit::UpdateInfo &),std::tuple<unsigned long long,WebKit::UpdateInfo>,0,1>(WebKit::DrawingAreaProxy * object, void(WebKit::DrawingAreaProxy::*)(unsigned __int64, const WebKit::UpdateInfo &) function, std::tuple<unsigned long long,WebKit::UpdateInfo> && args, std::integer_sequence<unsigned long long,0,1>) Line 42 C++ > WebKit2.dll!IPC::callMemberFunction<WebKit::DrawingAreaProxy,void (WebKit::DrawingAreaProxy::*)(unsigned long long, const WebKit::UpdateInfo &),std::tuple<unsigned long long,WebKit::UpdateInfo>,std::integer_sequence<unsigned long long,0,1> >(std::tuple<unsigned long long,WebKit::UpdateInfo> && args, WebKit::DrawingAreaProxy * object, void(WebKit::DrawingAreaProxy::*)(unsigned __int64, const WebKit::UpdateInfo &) function) Line 47 C++ > WebKit2.dll!IPC::handleMessage<Messages::DrawingAreaProxy::Update,WebKit::DrawingAreaProxy,void (WebKit::DrawingAreaProxy::*)(unsigned long long, const WebKit::UpdateInfo &)>(IPC::Decoder & decoder, WebKit::DrawingAreaProxy * object, void(WebKit::DrawingAreaProxy::*)(unsigned __int64, const WebKit::UpdateInfo &) function) Line 121 C++ > WebKit2.dll!WebKit::DrawingAreaProxy::didReceiveMessage(IPC::Connection & connection, IPC::Decoder & decoder) Line 50 C++ > WebKit2.dll!IPC::MessageReceiverMap::dispatchMessage(IPC::Connection & connection, IPC::Decoder & decoder) Line 124 C++ > WebKit2.dll!WebKit::AuxiliaryProcessProxy::dispatchMessage(IPC::Connection & connection, IPC::Decoder & decoder) Line 155 C++ > WebKit2.dll!WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection & connection, IPC::Decoder & decoder) Line 619 C++ > WebKit2.dll!IPC::Connection::dispatchMessage(IPC::Decoder & decoder) Line 984 C++ > WebKit2.dll!IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder,std::default_delete<IPC::Decoder> > message) Line 1012 C++ > WebKit2.dll!IPC::Connection::dispatchIncomingMessages() Line 1116 C++ > WebKit2.dll!IPC::Connection::enqueueIncomingMessage::<unnamed-tag>::operator()() Line 959 C++ > WebKit2.dll!WTF::Function<void ()>::CallableWrapper<`lambda at ..\..\Source\WebKit\Platform\IPC\Connection.cpp:957:30'>::call() Line 102 C++ > WTF.dll!WTF::Function<void ()>::operator()() Line 57 C++ > WTF.dll!WTF::RunLoop::performWork() Line 107 C++ > WTF.dll!WTF::RunLoop::wndProc(HWND__ * hWnd, unsigned int message, unsigned __int64 wParam, __int64 lParam) Line 57 C++ > WTF.dll!WTF::RunLoop::RunLoopWndProc(HWND__ * hWnd, unsigned int message, unsigned __int64 wParam, __int64 lParam) Line 39 C++ > [External Code] > WebKit.dll!WebKitMessageLoop::run(HACCEL__ * hAccelTable) Line 94 C++ > MiniBrowserLib.dll!wWinMain(HINSTANCE__ * hInstance, HINSTANCE__ * hPrevInstance, wchar_t * lpstrCmdLine, int nCmdShow) Line 97 C++ > MiniBrowserLib.dll!dllLauncherEntryPoint(HINSTANCE__ * hInstance, HINSTANCE__ * hPrevInstance, wchar_t * lpstrCmdLine, int nCmdShow) Line 115 C++ > MiniBrowser.exe!wWinMain(HINSTANCE__ * hInstance, HINSTANCE__ * hPrevInstance, wchar_t * lpstrCmdLine, int nCmdShow) Line 232 C++ > [External Code] 1522007 1 366154 fujii 2019-03-27 23:19:32 -0700 Created attachment 366154 WIP patch 1567108 2 377837 fujii 2019-09-01 21:23:25 -0700 Created attachment 377837 Patch 1567122 3 377837 bfulgham 2019-09-01 22:43:38 -0700 Comment on attachment 377837 Patch This looks correct to me, and seems to satisfy the CI system. 1567126 4 377837 fujii 2019-09-01 23:03:37 -0700 Comment on attachment 377837 Patch Clearing flags on attachment: 377837 Committed r249375: <https://trac.webkit.org/changeset/249375> 1567127 5 fujii 2019-09-01 23:03:40 -0700 All reviewed patches have been landed. Closing bug. 366154 2019-03-27 23:19:32 -0700 2019-09-01 21:23:15 -0700 WIP patch a.diff text/plain 1256 fujii ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvU2hhcmVkL2NhaXJvL1NoYXJlYWJsZUJpdG1hcENh aXJvLmNwcCBiL1NvdXJjZS9XZWJLaXQvU2hhcmVkL2NhaXJvL1NoYXJlYWJsZUJpdG1hcENhaXJv LmNwcAppbmRleCBjNzM0N2M3OWU2Ni4uOGY3NDBkNGE4MTAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJLaXQvU2hhcmVkL2NhaXJvL1NoYXJlYWJsZUJpdG1hcENhaXJvLmNwcAorKysgYi9Tb3VyY2Uv V2ViS2l0L1NoYXJlZC9jYWlyby9TaGFyZWFibGVCaXRtYXBDYWlyby5jcHAKQEAgLTcxLDEzICs3 MSwxMiBAQCB2b2lkIFNoYXJlYWJsZUJpdG1hcDo6cGFpbnQoR3JhcGhpY3NDb250ZXh0JiBjb250 ZXh0LCBjb25zdCBJbnRQb2ludCYgZHN0UG9pbnQsCiB2b2lkIFNoYXJlYWJsZUJpdG1hcDo6cGFp bnQoR3JhcGhpY3NDb250ZXh0JiBjb250ZXh0LCBmbG9hdCBzY2FsZUZhY3RvciwgY29uc3QgSW50 UG9pbnQmIGRzdFBvaW50LCBjb25zdCBJbnRSZWN0JiBzcmNSZWN0KQogewogICAgIFJlZlB0cjxj YWlyb19zdXJmYWNlX3Q+IHN1cmZhY2UgPSBjcmVhdGVTdXJmYWNlRnJvbURhdGEoZGF0YSgpLCBt X3NpemUpOworICAgIGNhaXJvU3VyZmFjZVNldERldmljZVNjYWxlKHN1cmZhY2UuZ2V0KCksIHNj YWxlRmFjdG9yLCBzY2FsZUZhY3Rvcik7CiAgICAgRmxvYXRSZWN0IGRlc3RSZWN0KGRzdFBvaW50 LCBzcmNSZWN0LnNpemUoKSk7Ci0gICAgRmxvYXRSZWN0IHNyY1JlY3RTY2FsZWQoc3JjUmVjdCk7 Ci0gICAgc3JjUmVjdFNjYWxlZC5zY2FsZShzY2FsZUZhY3Rvcik7CiAKICAgICBBU1NFUlQoY29u dGV4dC5oYXNQbGF0Zm9ybUNvbnRleHQoKSk7CiAgICAgYXV0byYgc3RhdGUgPSBjb250ZXh0LnN0 YXRlKCk7Ci0gICAgQ2Fpcm86OmRyYXdTdXJmYWNlKCpjb250ZXh0LnBsYXRmb3JtQ29udGV4dCgp LCBzdXJmYWNlLmdldCgpLCBkZXN0UmVjdCwgc3JjUmVjdFNjYWxlZCwgc3RhdGUuaW1hZ2VJbnRl cnBvbGF0aW9uUXVhbGl0eSwgc3RhdGUuYWxwaGEsIENhaXJvOjpTaGFkb3dTdGF0ZShzdGF0ZSkp OworICAgIENhaXJvOjpkcmF3U3VyZmFjZSgqY29udGV4dC5wbGF0Zm9ybUNvbnRleHQoKSwgc3Vy ZmFjZS5nZXQoKSwgZGVzdFJlY3QsIHNyY1JlY3QsIHN0YXRlLmltYWdlSW50ZXJwb2xhdGlvblF1 YWxpdHksIHN0YXRlLmFscGhhLCBDYWlybzo6U2hhZG93U3RhdGUoc3RhdGUpKTsKIH0KIAogUmVm UHRyPGNhaXJvX3N1cmZhY2VfdD4gU2hhcmVhYmxlQml0bWFwOjpjcmVhdGVDYWlyb1N1cmZhY2Uo KQo= 377837 2019-09-01 21:23:25 -0700 2019-09-01 23:03:37 -0700 Patch bug-196340-20190902132324.patch text/plain 2326 fujii U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ5MzcyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDJlYjQwNzE2M2E4MjI1YzM3 MjVmYzljYzhlYzJiOGM0YmZiY2Q1OTMuLjk4NjNmZjI0NDI4ZWU4NjkxYzdmZDM2NDg5YTI3YTY5 YTkwOGQzZjggMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMTktMDktMDEgIEZ1amlpIEhp cm9ub3JpICA8SGlyb25vcmkuRnVqaWlAc29ueS5jb20+CisKKyAgICAgICAgW0NhaXJvXSBvdXQt b2YtYm91bmRzIHJlYWQgaW4gU2hhcmVhYmxlQml0bWFwOjpwYWludCBpZiBhIGZyYWN0aW9uYWwg ZGV2aWNlIHNjYWxlIGZhY3RvciBpcyB1c2VkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0xOTYzNDAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBJbiBTaGFyZWFibGVCaXRtYXA6OnBhaW50LCBzcmNSZWN0U2Nh bGVkIGNhbiBiZSBvdXQtb2YtYm91bmRzIG9mCisgICAgICAgIHRoZSBzdXJmYWNlIGlmIGEgZnJh Y3Rpb25hbCBkZXZpY2Ugc2NhbGUgZmFjdG9yIGlzIHVzZWQuCisKKyAgICAgICAgKiBTaGFyZWQv Y2Fpcm8vU2hhcmVhYmxlQml0bWFwQ2Fpcm8uY3BwOgorICAgICAgICAoV2ViS2l0OjpTaGFyZWFi bGVCaXRtYXA6OnBhaW50KTogVXNlIGNhaXJvU3VyZmFjZVNldERldmljZVNjYWxlCisgICAgICAg IHRvIHNldCBhIGRldmljZSBzY2FsZSBmYWN0b3IgdG8gdGhlIHN1cmZhY2UgaW5zdGVhZCBvZiBt dWx0aXBseWluZworICAgICAgICBzcmNSZWN0IHdpdGggYSBkZXZpY2Ugc2NhbGUgZmFjdG9yLgor CiAyMDE5LTA5LTAxICBGdWppaSBIaXJvbm9yaSAgPEhpcm9ub3JpLkZ1amlpQHNvbnkuY29tPgog CiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxpbmcgb3V0IHIyNDkzNjYuCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViS2l0L1NoYXJlZC9jYWlyby9TaGFyZWFibGVCaXRtYXBDYWlyby5jcHAgYi9Tb3Vy Y2UvV2ViS2l0L1NoYXJlZC9jYWlyby9TaGFyZWFibGVCaXRtYXBDYWlyby5jcHAKaW5kZXggYjJj ZDQ4NDY2NzdjZTk3ZGZhYzI4NTg0OTBjMWVhNDM0Zjk2MjkzMy4uODQyY2JmYWU4YzU1ZjlhYjJk OWRkMTk4MTNkMTE3MGEzYTFhMTY1MiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9TaGFyZWQv Y2Fpcm8vU2hhcmVhYmxlQml0bWFwQ2Fpcm8uY3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvU2hhcmVk L2NhaXJvL1NoYXJlYWJsZUJpdG1hcENhaXJvLmNwcApAQCAtNzEsMTMgKzcxLDEyIEBAIHZvaWQg U2hhcmVhYmxlQml0bWFwOjpwYWludChHcmFwaGljc0NvbnRleHQmIGNvbnRleHQsIGNvbnN0IElu dFBvaW50JiBkc3RQb2ludCwKIHZvaWQgU2hhcmVhYmxlQml0bWFwOjpwYWludChHcmFwaGljc0Nv bnRleHQmIGNvbnRleHQsIGZsb2F0IHNjYWxlRmFjdG9yLCBjb25zdCBJbnRQb2ludCYgZHN0UG9p bnQsIGNvbnN0IEludFJlY3QmIHNyY1JlY3QpCiB7CiAgICAgUmVmUHRyPGNhaXJvX3N1cmZhY2Vf dD4gc3VyZmFjZSA9IGNyZWF0ZVN1cmZhY2VGcm9tRGF0YShkYXRhKCksIG1fc2l6ZSk7CisgICAg Y2Fpcm9TdXJmYWNlU2V0RGV2aWNlU2NhbGUoc3VyZmFjZS5nZXQoKSwgc2NhbGVGYWN0b3IsIHNj YWxlRmFjdG9yKTsKICAgICBGbG9hdFJlY3QgZGVzdFJlY3QoZHN0UG9pbnQsIHNyY1JlY3Quc2l6 ZSgpKTsKLSAgICBGbG9hdFJlY3Qgc3JjUmVjdFNjYWxlZChzcmNSZWN0KTsKLSAgICBzcmNSZWN0 U2NhbGVkLnNjYWxlKHNjYWxlRmFjdG9yKTsKIAogICAgIEFTU0VSVChjb250ZXh0Lmhhc1BsYXRm b3JtQ29udGV4dCgpKTsKICAgICBhdXRvJiBzdGF0ZSA9IGNvbnRleHQuc3RhdGUoKTsKLSAgICBD YWlybzo6ZHJhd1N1cmZhY2UoKmNvbnRleHQucGxhdGZvcm1Db250ZXh0KCksIHN1cmZhY2UuZ2V0 KCksIGRlc3RSZWN0LCBzcmNSZWN0U2NhbGVkLCBzdGF0ZS5pbWFnZUludGVycG9sYXRpb25RdWFs aXR5LCBzdGF0ZS5hbHBoYSwgQ2Fpcm86OlNoYWRvd1N0YXRlKHN0YXRlKSk7CisgICAgQ2Fpcm86 OmRyYXdTdXJmYWNlKCpjb250ZXh0LnBsYXRmb3JtQ29udGV4dCgpLCBzdXJmYWNlLmdldCgpLCBk ZXN0UmVjdCwgc3JjUmVjdCwgc3RhdGUuaW1hZ2VJbnRlcnBvbGF0aW9uUXVhbGl0eSwgc3RhdGUu YWxwaGEsIENhaXJvOjpTaGFkb3dTdGF0ZShzdGF0ZSkpOwogfQogCiBSZWZQdHI8Y2Fpcm9fc3Vy ZmFjZV90PiBTaGFyZWFibGVCaXRtYXA6OmNyZWF0ZUNhaXJvU3VyZmFjZSgpCg==