63305 2011-06-23 18:05:50 -0700 [chromium] Divide by zero in TilingData 2011-06-29 11:30:20 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 enne enne enne jamesr vangelis oldest_to_newest 426673 0 enne 2011-06-23 18:05:50 -0700 There's a divide by zero showing up in Chromium crash reports: http://code.google.com/p/chromium/issues/detail?id=87153 This can only happen when there are no tiles because the layer size is zero. I can see what could trigger this in code, but don't understand what state of events could cause this. I'll upload a patch to prevent this crash, because we probably need that safety check anyway. Callstack: Thread 0 *CRASHED* ( EXCEPTION_INT_DIVIDE_BY_ZERO @ 0x610241a9 ) 0x610241a9 [chrome.dll - tilingdata.cpp:99] WebCore::TilingData::tileBounds(int) 0x6102420c [chrome.dll - tilingdata.cpp:112] WebCore::TilingData::tileBoundsWithBorder(int) 0x61032f95 [chrome.dll - layertilerchromium.cpp:185] WebCore::LayerTilerChromium::tileLayerRect(WebCore::LayerTilerChromium::Tile const *) 0x61032cc7 [chrome.dll - layertilerchromium.cpp:117] WebCore::LayerTilerChromium::createTile(int,int) 0x6103318e [chrome.dll - layertilerchromium.cpp:247] WebCore::LayerTilerChromium::prepareToUpdate(WebCore::IntRect const &) 0x619dd6f3 [chrome.dll - contentlayerchromium.cpp:115] WebCore::ContentLayerChromium::paintContentsIfDirty(WebCore::IntRect const &) 0x61029b4b [chrome.dll - layerrendererchromium.cpp:430] WebCore::LayerRendererChromium::paintLayerContents(WTF::Vector<WTF::RefPtr<WebCore::CCLayerImpl>,0> const &) 0x610298ff [chrome.dll - layerrendererchromium.cpp:328] WebCore::LayerRendererChromium::updateLayers(WTF::Vector<WTF::RefPtr<WebCore::CCLayerImpl>,0> &) 0x61029650 [chrome.dll - layerrendererchromium.cpp:239] WebCore::LayerRendererChromium::updateAndDrawLayers() 0x611a04e2 [chrome.dll - webviewimpl.cpp:2547] WebKit::WebViewImpl::doComposite() 0x6119e02c [chrome.dll - webviewimpl.cpp:1148] WebKit::WebViewImpl::composite(bool) 426683 1 98449 enne 2011-06-23 18:22:33 -0700 Created attachment 98449 Patch 427792 2 98449 morrita 2011-06-27 02:00:23 -0700 Comment on attachment 98449 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=98449&action=review > Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp:277 > + if (!m_tilingData.totalSizeX() || !m_tilingData.totalSizeY() || m_updateRect.isEmpty() || !numTiles()) It looks numTiles() check is redundant because m_updateRect is empty. Is that right? r+ anyway because being careful is no bad... 427987 3 enne 2011-06-27 09:03:25 -0700 (In reply to comment #2) > (From update of attachment 98449 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=98449&action=review > > > Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp:277 > > + if (!m_tilingData.totalSizeX() || !m_tilingData.totalSizeY() || m_updateRect.isEmpty() || !numTiles()) > > It looks numTiles() check is redundant because m_updateRect is empty. Is that right? > r+ anyway because being careful is no bad... You're quite right. I just figured that an extra sanity check wouldn't hurt while I was making a similar change. 429718 4 99113 enne 2011-06-29 10:51:58 -0700 Created attachment 99113 Patch 429723 5 enne 2011-06-29 10:56:45 -0700 (In reply to comment #4) > Created an attachment (id=99113) [details] > Patch I'm uploading another patch, but this should be a quick review. I took a look at a potential repro case for this issue from a bug that was duped into the linked Chromium bug. However, I couldn't repro it locally. It looked a lot like an issue I'd seen before, where doing a WebKit paint operation turned off compositing. This bug could be triggered because the updateRect wasn't being cleared in reset. I would like to leave the other safety checks in place, however, as they are still relevant even if the reset fix might remove the current root cause. 429739 6 99113 jamesr 2011-06-29 11:21:03 -0700 Comment on attachment 99113 Patch OK 429742 7 enne 2011-06-29 11:30:20 -0700 Committed r90029: <http://trac.webkit.org/changeset/90029> 98449 2011-06-23 18:22:33 -0700 2011-06-29 10:51:55 -0700 Patch bug-63305-20110623182232.patch text/plain 2142 enne U3VidmVyc2lvbiBSZXZpc2lvbjogODk2NDcKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA5NjhiZmVmZjA0YTRmZDk2 YzBmMjI4ZDBmYzM5YmI5N2ZhYzRjMzUxLi41MDBjYmJjMWU2YzJmMTk3ZjlmN2I2OTlkMzAwM2Ix OGQ4NWRkM2Y4IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDYtMjMgIEFkcmll bm5lIFdhbGtlciAgPGVubmVAZ29vZ2xlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBbY2hyb21pdW1dIERpdmlkZSBieSB6ZXJvIGluIFRpbGlu Z0RhdGEKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTYz MzA1CisKKyAgICAgICAgQWRkIHNhZmV0eSBjaGVja3MgZm9yIGVtcHR5IGxheWVycy4KKworICAg ICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0xheWVyVGlsZXJDaHJvbWl1bS5jcHA6 CisgICAgICAgIChXZWJDb3JlOjpMYXllclRpbGVyQ2hyb21pdW06OnByZXBhcmVUb1VwZGF0ZSk6 CisgICAgICAgIChXZWJDb3JlOjpMYXllclRpbGVyQ2hyb21pdW06OnVwZGF0ZVJlY3QpOgorCiAy MDExLTA1LTI1ICBKYW1lcyBSb2JpbnNvbiAgPGphbWVzckBjaHJvbWl1bS5vcmc+CiAKICAgICAg ICAgUmV2aWV3ZWQgYnkgS2VubmV0aCBSdXNzZWxsLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNv cmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vTGF5ZXJUaWxlckNocm9taXVtLmNwcCBiL1Nv dXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0xheWVyVGlsZXJDaHJvbWl1 bS5jcHAKaW5kZXggYjkwMjQxNmJhMzdjNGI5MWI1MTNkMmZiMjQwMjM2ZmEwNzJiMmMxYy4uNWFk NDY3MjcwYTEwZDExZGYwMTJiNGNkN2U4MWE0NzMzMzRmOWNiYiAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vTGF5ZXJUaWxlckNocm9taXVtLmNw cAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclRp bGVyQ2hyb21pdW0uY3BwCkBAIC0yMzYsNiArMjM2LDExIEBAIHZvaWQgTGF5ZXJUaWxlckNocm9t aXVtOjpwcmVwYXJlVG9VcGRhdGUoY29uc3QgSW50UmVjdCYgY29udGVudFJlY3QsIExheWVyVGV4 dHVyCiAgICAgaW52YWxpZGF0ZVRpbGVzKGNvbnRlbnRSZWN0KTsKICAgICBncm93TGF5ZXJUb0Nv bnRhaW4oY29udGVudFJlY3QpOwogCisgICAgaWYgKCFudW1UaWxlcygpKSB7CisgICAgICAgIG1f dXBkYXRlUmVjdCA9IEludFJlY3QoKTsKKyAgICAgICAgcmV0dXJuOworICAgIH0KKwogICAgIC8v IENyZWF0ZSB0aWxlcyBhcyBuZWVkZWQsIGV4cGFuZGluZyBhIGRpcnR5IHJlY3QgdG8gY29udGFp biBhbGwKICAgICAvLyB0aGUgZGlydHkgcmVnaW9ucyBjdXJyZW50bHkgYmVpbmcgZHJhd24uCiAg ICAgSW50UmVjdCBkaXJ0eUxheWVyUmVjdDsKQEAgLTI2OSw3ICsyNzQsNyBAQCB2b2lkIExheWVy VGlsZXJDaHJvbWl1bTo6cHJlcGFyZVRvVXBkYXRlKGNvbnN0IEludFJlY3QmIGNvbnRlbnRSZWN0 LCBMYXllclRleHR1cgogdm9pZCBMYXllclRpbGVyQ2hyb21pdW06OnVwZGF0ZVJlY3QoTGF5ZXJU ZXh0dXJlVXBkYXRlciogdGV4dHVyZVVwZGF0ZXIpCiB7CiAgICAgLy8gUGFpbnRpbmcgY291bGQg Y2F1c2UgY29tcG9zaXRpbmcgdG8gZ2V0IHR1cm5lZCBvZmYsIHdoaWNoIG1heSBjYXVzZSB0aGUg dGlsZXIgdG8gYmVjb21lIGludmFsaWRhdGVkIG1pZC11cGRhdGUuCi0gICAgaWYgKCFtX3RpbGlu Z0RhdGEudG90YWxTaXplWCgpIHx8ICFtX3RpbGluZ0RhdGEudG90YWxTaXplWSgpIHx8IG1fdXBk YXRlUmVjdC5pc0VtcHR5KCkpCisgICAgaWYgKCFtX3RpbGluZ0RhdGEudG90YWxTaXplWCgpIHx8 ICFtX3RpbGluZ0RhdGEudG90YWxTaXplWSgpIHx8IG1fdXBkYXRlUmVjdC5pc0VtcHR5KCkgfHwg IW51bVRpbGVzKCkpCiAgICAgICAgIHJldHVybjsKIAogICAgIEdyYXBoaWNzQ29udGV4dDNEKiBj b250ZXh0ID0gbGF5ZXJSZW5kZXJlckNvbnRleHQoKTsK 99113 2011-06-29 10:51:58 -0700 2011-06-29 11:21:03 -0700 Patch bug-63305-20110629105157.patch text/plain 2465 enne U3VidmVyc2lvbiBSZXZpc2lvbjogOTAwMjIKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCBjMGU2M2YzMTgwZmZiMzU2 NjJkMWNkMjgxZDdkZjc1ODhkMDUzNTU0Li5iMjQ4NjdmODIwYTczOTQzNDUyNzdiNjUwMzI3ZTMx NWE0MDdkOWM4IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTEtMDYtMjkgIEFkcmll bm5lIFdhbGtlciAgPGVubmVAZ29vZ2xlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBbY2hyb21pdW1dIERpdmlkZSBieSB6ZXJvIGluIFRpbGlu Z0RhdGEKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTYz MzA1CisKKyAgICAgICAgQWRkIHNhZmV0eSBjaGVja3MgZm9yIGVtcHR5IGxheWVycy4KKworICAg ICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0xheWVyVGlsZXJDaHJvbWl1bS5jcHA6 CisgICAgICAgIChXZWJDb3JlOjpMYXllclRpbGVyQ2hyb21pdW06OnByZXBhcmVUb1VwZGF0ZSk6 CisgICAgICAgIChXZWJDb3JlOjpMYXllclRpbGVyQ2hyb21pdW06OnJlc2V0KToKKyAgICAgICAg KFdlYkNvcmU6OkxheWVyVGlsZXJDaHJvbWl1bTo6dXBkYXRlUmVjdCk6CisKIDIwMTEtMDYtMjkg IFZzZXZvbG9kIFZsYXNvdiAgPHZzZXZpa0BjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3 ZWQgYnkgUGF2ZWwgRmVsZG1hbi4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3Jt L2dyYXBoaWNzL2Nocm9taXVtL0xheWVyVGlsZXJDaHJvbWl1bS5jcHAgYi9Tb3VyY2UvV2ViQ29y ZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclRpbGVyQ2hyb21pdW0uY3BwCmluZGV4 IGI5MDI0MTZiYTM3YzRiOTFiNTEzZDJmYjI0MDIzNmZhMDcyYjJjMWMuLjBlN2MyMzk0NmM3MzZh Yjg0NDA5NjAzMGE1ZDRhZjE5MjIyNzA2MjggMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3Bs YXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0xheWVyVGlsZXJDaHJvbWl1bS5jcHAKKysrIGIvU291 cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vTGF5ZXJUaWxlckNocm9taXVt LmNwcApAQCAtOTYsNiArOTYsOCBAQCB2b2lkIExheWVyVGlsZXJDaHJvbWl1bTo6cmVzZXQoKQog ICAgIG1fdGlsZXMuY2xlYXIoKTsKICAgICBtX3VudXNlZFRpbGVzLmNsZWFyKCk7CiAgICAgbV90 aWxpbmdEYXRhLnNldFRvdGFsU2l6ZSgwLCAwKTsKKyAgICBtX3BhaW50UmVjdCA9IEludFJlY3Qo KTsKKyAgICBtX3VwZGF0ZVJlY3QgPSBJbnRSZWN0KCk7CiB9CiAKIExheWVyVGlsZXJDaHJvbWl1 bTo6VGlsZSogTGF5ZXJUaWxlckNocm9taXVtOjpjcmVhdGVUaWxlKGludCBpLCBpbnQgaikKQEAg LTIzNiw2ICsyMzgsMTEgQEAgdm9pZCBMYXllclRpbGVyQ2hyb21pdW06OnByZXBhcmVUb1VwZGF0 ZShjb25zdCBJbnRSZWN0JiBjb250ZW50UmVjdCwgTGF5ZXJUZXh0dXIKICAgICBpbnZhbGlkYXRl VGlsZXMoY29udGVudFJlY3QpOwogICAgIGdyb3dMYXllclRvQ29udGFpbihjb250ZW50UmVjdCk7 CiAKKyAgICBpZiAoIW51bVRpbGVzKCkpIHsKKyAgICAgICAgbV91cGRhdGVSZWN0ID0gSW50UmVj dCgpOworICAgICAgICByZXR1cm47CisgICAgfQorCiAgICAgLy8gQ3JlYXRlIHRpbGVzIGFzIG5l ZWRlZCwgZXhwYW5kaW5nIGEgZGlydHkgcmVjdCB0byBjb250YWluIGFsbAogICAgIC8vIHRoZSBk aXJ0eSByZWdpb25zIGN1cnJlbnRseSBiZWluZyBkcmF3bi4KICAgICBJbnRSZWN0IGRpcnR5TGF5 ZXJSZWN0OwpAQCAtMjY5LDcgKzI3Niw3IEBAIHZvaWQgTGF5ZXJUaWxlckNocm9taXVtOjpwcmVw YXJlVG9VcGRhdGUoY29uc3QgSW50UmVjdCYgY29udGVudFJlY3QsIExheWVyVGV4dHVyCiB2b2lk IExheWVyVGlsZXJDaHJvbWl1bTo6dXBkYXRlUmVjdChMYXllclRleHR1cmVVcGRhdGVyKiB0ZXh0 dXJlVXBkYXRlcikKIHsKICAgICAvLyBQYWludGluZyBjb3VsZCBjYXVzZSBjb21wb3NpdGluZyB0 byBnZXQgdHVybmVkIG9mZiwgd2hpY2ggbWF5IGNhdXNlIHRoZSB0aWxlciB0byBiZWNvbWUgaW52 YWxpZGF0ZWQgbWlkLXVwZGF0ZS4KLSAgICBpZiAoIW1fdGlsaW5nRGF0YS50b3RhbFNpemVYKCkg fHwgIW1fdGlsaW5nRGF0YS50b3RhbFNpemVZKCkgfHwgbV91cGRhdGVSZWN0LmlzRW1wdHkoKSkK KyAgICBpZiAoIW1fdGlsaW5nRGF0YS50b3RhbFNpemVYKCkgfHwgIW1fdGlsaW5nRGF0YS50b3Rh bFNpemVZKCkgfHwgbV91cGRhdGVSZWN0LmlzRW1wdHkoKSB8fCAhbnVtVGlsZXMoKSkKICAgICAg ICAgcmV0dXJuOwogCiAgICAgR3JhcGhpY3NDb250ZXh0M0QqIGNvbnRleHQgPSBsYXllclJlbmRl cmVyQ29udGV4dCgpOwo=