23212 2009-01-09 13:03:07 -0800 Crash in HTMLCanvasElement 2009-04-07 06:39:09 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC All RESOLVED FIXED P1 Critical --- 1 mbelshe mbelshe darin eric oldest_to_newest 105045 0 mbelshe 2009-01-09 13:03:07 -0800 Attached is a simple web page which can crash webkit. The problem is a null-dereference problem when we can't create the ImageBuffer. On Chromium, this is fairly easy to reproduce. 105046 1 26571 mbelshe 2009-01-09 13:04:06 -0800 Created attachment 26571 The test page which can crash Crashing is somewhat platform dependent, as it requires a case where the ImageBuffer::create() call fails. 105048 2 26572 mbelshe 2009-01-09 13:13:44 -0800 Created attachment 26572 Patch 105050 3 26572 eric 2009-01-09 13:17:10 -0800 Comment on attachment 26572 Patch The change looks great. Is there a way to make a LayoutTest for this for run-webkit-tests? 105053 4 26572 darin 2009-01-09 13:27:24 -0800 Comment on attachment 26572 Patch Code change looks good. How did you discover this bug? Can you write a regression test? Normally we require a regression test for every bug fix unless there's a reason that's impractical. 105135 5 26572 darin 2009-01-10 14:36:27 -0800 Comment on attachment 26572 Patch For now, review- because of the lack of a regression test. If it's not possible to make one, please explain why in the change log and put a new patch up for review. 105397 6 jon 2009-01-12 14:44:59 -0800 Filed in Chromium as http://code.google.com/p/chromium/issues/detail?id=5452 109504 7 mbelshe 2009-02-12 10:36:54 -0800 Sorry for not having had time to get the regression test yet; the attached page reproduces the problem. I'll get to this eventually; I think the fix is simple enough it could go as-is. If someone else wants to take a shot at the layout test in the interim, please do. 111552 8 eric 2009-02-27 14:27:11 -0800 *** Bug 24209 has been marked as a duplicate of this bug. *** 116589 9 26572 eric 2009-04-06 01:22:57 -0700 Comment on attachment 26572 Patch I recommend we land this w/o test case. I just attempted to make one and found bug 25055. The test case I've attached to bug 25055 could possibly catch this on some platforms. This exact crash is sorta protected against by IntSize HTMLCanvasElement::convertLogicalToDevice(const FloatSize& logicalSize) const which makes sure that logicalSize is < MaxCanvasSize. however testing max canvas size (as I did in bug 25055) reveals that we fail in other parts of the code (making it difficult to test for a crash here on platforms that might fail earlier than CG does. Mike, since I can never remember if you have commit-bit or not, I'll land this, with additional information in the ChangeLog about why a test case could not be created. 116757 10 eric 2009-04-07 06:39:09 -0700 http://trac.webkit.org/changeset/42236 26571 2009-01-09 13:04:06 -0800 2009-01-09 13:04:06 -0800 The test page which can crash reduction.html text/html 958 mbelshe PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjEvL0VOIiAiaHR0cDov L3d3dy53My5vcmcvVFIveGh0bWwxMS9EVEQveGh0bWwxMS5kdGQiPg0KPGh0bWwgeG1sbnM9Imh0 dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJD b250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIgLz4NCjxzY3Jp cHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4NCjwhLS0NCgl2YXIgY291bnQgPSAwOw0KCXZhciBp bWc7DQoJdmFyIGNhbnZhc2VzID0gbmV3IEFycmF5KDApOw0KCXZhciBjdHhlcyA9IG5ldyBBcnJh eSgwKTsNCglmdW5jdGlvbiBsb2FkZWQoKXsNCgkJaW1nID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5 SWQoJ2ltZzEnKTsNCgkJdGVzdCgpOw0KCX0NCg0KCWZ1bmN0aW9uIHRlc3QoKXsNCgkJaWYod2lu ZG93LmNvbnNvbGUmJndpbmRvdy5jb25zb2xlLmxvZykgd2luZG93LmNvbnNvbGUubG9nKCsrY291 bnQpOwkNCgkJdmFyIHNpemUgPSAxMDAwOw0KCQlmb3IodmFyIGkgPSAwOyBpIDwgc2l6ZTsgKytp KXsNCgkJCXZhciBjID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnY2FudmFzJyk7DQoJCQljLndp ZHRoID0gODA7DQoJCQljLmhlaWdodCA9IDgwOw0KCQkJdmFyIGN0eCA9IGMuZ2V0Q29udGV4dCgn MmQnKTsNCgkJCWN0eC5kcmF3SW1hZ2UoaW1nLDAsMCw0MCw0MCwwLDAsNDAsNDApOw0KCQl9DQoJ CXNldFRpbWVvdXQodGVzdCwxMDAwKTsNCgl9DQoNCi8vLS0+DQo8L3NjcmlwdD4NCjx0aXRsZT5U ZXN0PC90aXRsZT4NCjwvaGVhZD4NCg0KPGJvZHkgb25sb2FkPSJsb2FkZWQoKTsiPg0KPGltZyBz cmM9Imh0dHA6Ly95YWxwZWRvYy5nb29nbGVwYWdlcy5jb20vMS5qcGciIGFsdD0iaW1hZ2UgMSIg aWQ9ImltZzEiLz4NCjxici8+PGJyIC8+DQoNCjwvYm9keT4NCjwvaHRtbD4NCg== 26572 2009-01-09 13:13:44 -0800 2009-04-06 01:22:57 -0700 Patch patch text/plain 1452 mbelshe SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAzOTc1NykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTYgQEAKKzIwMDktMDEtMDkgIE1pa2UgQmVsc2hlIDxtaWtlQGJlbHNoZS5jb20+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzIxMgorICAgICAg ICBIVE1MQ2FudmFzRWxlbWVudCBjcmFzaCB3aGVuIEltYWdlQnVmZmVyIGNyZWF0aW9uIGZhaWxz LgorICAgICAgICAKKyAgICAgICAgQ2hlY2sgZm9yIG51bGwgYmVmb3JlIHVzaW5nIHRoZSBidWZm ZXIuCisgICAgICAgIAorICAgICAgICAqIGh0bWwvSFRNTENhbnZhc0VsZW1lbnQuY3BwOgorICAg ICAgICAoV2ViQ29yZTo6SFRNTENhbnZhc0VsZW1lbnQ6OmNyZWF0ZUltYWdlQnVmZmVyKToKKwog MjAwOS0wMS0wOSAgUGV0ZXIgS2FzdGluZyAgPHBrYXN0aW5nQGdvb2dsZS5jb20+CgogICAgICAg ICBSZXZpZXdlZCBieSBEYXZpZCBIeWF0dC4KCkluZGV4OiBXZWJDb3JlL2h0bWwvSFRNTENhbnZh c0VsZW1lbnQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIGh0bWwvSFRNTENhbnZhc0VsZW1lbnQuY3BwCShy ZXZpc2lvbiA3Nzk1KQorKysgaHRtbC9IVE1MQ2FudmFzRWxlbWVudC5jcHAJKHdvcmtpbmcgY29w eSkKQEAgLTI1Nyw4ICsyNTcsMTAgQEAKICAgICAgICAgcmV0dXJuOwogCiAgICAgbV9pbWFnZUJ1 ZmZlci5zZXQoSW1hZ2VCdWZmZXI6OmNyZWF0ZShzaXplLCBmYWxzZSkucmVsZWFzZSgpKTsKLSAg ICBtX2ltYWdlQnVmZmVyLT5jb250ZXh0KCktPnNjYWxlKEZsb2F0U2l6ZShzaXplLndpZHRoKCkg LyB1bnNjYWxlZFNpemUud2lkdGgoKSwgc2l6ZS5oZWlnaHQoKSAvIHVuc2NhbGVkU2l6ZS5oZWln aHQoKSkpOwotICAgIG1faW1hZ2VCdWZmZXItPmNvbnRleHQoKS0+c2V0U2hhZG93c0lnbm9yZVRy YW5zZm9ybXModHJ1ZSk7CisgICAgaWYgKG1faW1hZ2VCdWZmZXIpIHsKKyAgICAgICAgbV9pbWFn ZUJ1ZmZlci0+Y29udGV4dCgpLT5zY2FsZShGbG9hdFNpemUoc2l6ZS53aWR0aCgpIC8gdW5zY2Fs ZWRTaXplLndpZHRoKCksIHNpemUuaGVpZ2h0KCkgLyB1bnNjYWxlZFNpemUuaGVpZ2h0KCkpKTsK KyAgICAgICAgbV9pbWFnZUJ1ZmZlci0+Y29udGV4dCgpLT5zZXRTaGFkb3dzSWdub3JlVHJhbnNm b3Jtcyh0cnVlKTsKKyAgICB9CiB9CiAKIEdyYXBoaWNzQ29udGV4dCogSFRNTENhbnZhc0VsZW1l bnQ6OmRyYXdpbmdDb250ZXh0KCkgY29uc3QK