56209 2011-03-11 11:19:52 -0800 [chromium] Avoid updating a composited layer's contents if the layer has nonpositive dimensions 2011-03-11 11:59:29 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Other OS X 10.5 RESOLVED FIXED P2 Normal --- 1 jamesr jamesr kbr mihaip tonyg vangelis oldest_to_newest 366146 0 jamesr 2011-03-11 11:19:52 -0800 [chromium] Avoid updating a composited layer's contents if the layer has nonpositive dimensions 366151 1 85500 jamesr 2011-03-11 11:22:10 -0800 Created attachment 85500 Patch 366171 2 85500 kbr 2011-03-11 11:42:29 -0800 Comment on attachment 85500 Patch In the comment: "the prior to" -> "the behavior prior to". 366172 3 jamesr 2011-03-11 11:42:44 -0800 Notes for posterity: The intent of this patch is to mitigate the crash on nytimes.com/chrome (http://code.google.com/p/chromium/issues/detail?id=75563). The issue is that a composited layer has a negative width due to bug 56153, which is still a mystery but does not seem to be recent. If updateContents() is called on a ContentLayerChromium with a negative width, it attempts to allocate a PlatformCanvas with a negative width which crashes on Mac and Windows but seems to work fine on Linux. Such a layer is never actually rendered because the draw() call is guarded by a bounds().isEmpty() check, which returns true (empty) if either width or height are non-positive. The code prior to r80482 did the update and draw calls at the same time, and so both were guarded by a bounds().isEmpty() check. 366195 4 jamesr 2011-03-11 11:59:29 -0800 Committed r80869: <http://trac.webkit.org/changeset/80869> 85500 2011-03-11 11:22:10 -0800 2011-03-11 11:42:29 -0800 Patch bug-56209-20110311112209.patch text/plain 1749 jamesr U3VidmVyc2lvbiBSZXZpc2lvbjogODA2NjUKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCAyZWQ0NTMxMzQ4MzMwYWJi ZDA2NzA1YmFmMmE3NThhM2UzZjBjZGExLi5hODlkMmVlOWRlOGIyOTJhZGY3NmEwMmU2NWNkYjlj Y2FhNjA4ODA1IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTEtMDMtMTEgIEphbWVz IFJvYmluc29uICA8amFtZXNyQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBbY2hyb21pdW1dIEF2b2lkIHVwZGF0aW5nIGEgY29t cG9zaXRlZCBsYXllciZhcG9zO3MgY29udGVudHMgaWYgdGhlIGxheWVyIGhhcyBub25wb3NpdGl2 ZSBkaW1lbnNpb25zCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD01NjIwOQorCisgICAgICAgIFRoaXMgbWF0Y2hlcyB0aGUgcHJpb3IgdG8gcjgwNDgyLiAg Tm8gdGVzdCBzaW5jZSB0aGUgb25seSBjaGFuZ2VzIGluCisgICAgICAgIGJlaGF2aW9yIGFyZSBh dm9pZGluZyB3b3JrIG9uIGludmlzaWJsZSBsYXllcnMsIHdoaWNoIGlzIHVub2JzZXJ2YWJsZSwK KyAgICAgICAgYW5kIGZpeGluZyBhIGNyYXNoIGR1ZSB0byBidWcgNTYxNTMuCisKKyAgICAgICAg KiBwbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclJlbmRlcmVyQ2hyb21pdW0uY3BwOgor ICAgICAgICAoV2ViQ29yZTo6TGF5ZXJSZW5kZXJlckNocm9taXVtOjp1cGRhdGVDb250ZW50c1Jl Y3Vyc2l2ZSk6CisKIDIwMTEtMDMtMDkgIEphbWVzIFJvYmluc29uICA8amFtZXNyQGNocm9taXVt Lm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBLZW5uZXRoIFJ1c3NlbGwuCmRpZmYgLS1naXQg YS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclJlbmRlcmVy Q2hyb21pdW0uY3BwIGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0v TGF5ZXJSZW5kZXJlckNocm9taXVtLmNwcAppbmRleCBhYzRjZmFkNWY0Mzk5NjM0ZWI1MTE4YzE2 M2I1YTIxNDM5YjgzNTZiLi5iZjFlOTE0N2E1ZjI1ZjQxMzFlYThjOWM2YWIzNzZmOTY1MWZmYzc4 IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9M YXllclJlbmRlcmVyQ2hyb21pdW0uY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dy YXBoaWNzL2Nocm9taXVtL0xheWVyUmVuZGVyZXJDaHJvbWl1bS5jcHAKQEAgLTcwOCw2ICs3MDgs OSBAQCB2b2lkIExheWVyUmVuZGVyZXJDaHJvbWl1bTo6dXBkYXRlQ29udGVudHNSZWN1cnNpdmUo TGF5ZXJDaHJvbWl1bSogbGF5ZXIpCiAgICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPCBzdWJsYXll cnMuc2l6ZSgpOyArK2kpCiAgICAgICAgIHVwZGF0ZUNvbnRlbnRzUmVjdXJzaXZlKHN1YmxheWVy c1tpXS5nZXQoKSk7CiAKKyAgICBpZiAobGF5ZXItPmJvdW5kcygpLmlzRW1wdHkoKSkKKyAgICAg ICAgcmV0dXJuOworCiAgICAgaWYgKGxheWVyLT5kcmF3c0NvbnRlbnQoKSkKICAgICAgICAgbGF5 ZXItPnVwZGF0ZUNvbnRlbnRzSWZEaXJ0eSgpOwogICAgIGlmIChsYXllci0+bWFza0xheWVyKCkg JiYgbGF5ZXItPm1hc2tMYXllcigpLT5kcmF3c0NvbnRlbnQoKSkK