87964 2012-05-31 06:06:46 -0700 Lonely stop crashes 2013-08-26 15:27:44 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 86941 1 pdr schenney commit-queue darin d-r esprehn+autocc fmalita glenn kondapallykalyan rwlbuis schenney zimmermann oldest_to_newest 638302 0 145071 pdr 2012-05-31 06:06:46 -0700 Created attachment 145071 Repro case The following will crash: <svg xmlns="http://www.w3.org/2000/svg"> <stop/> </svg> Stacktrace: Program received signal SIGSEGV, Segmentation fault. 0x00007fa9362a101a in WebCore::RenderObject::nodeAtFloatPoint (this=0x7fa9313e0cd8) at ../../third_party/WebKit/Source/WebCore/rendering/RenderObject.cpp:2966 2966 ASSERT_NOT_REACHED(); (gdb) bt #0 0x00007fa9362a101a in WebCore::RenderObject::nodeAtFloatPoint (this=0x7fa9313e0cd8) at ../../third_party/WebKit/Source/WebCore/rendering/RenderObject.cpp:2966 #1 0x00007fa9348799cc in WebCore::RenderSVGRoot::nodeAtPoint (this=0x7fa92463c198, request=..., result=..., pointInContainer=..., accumulatedOffset=..., hitTestAction= WebCore::HitTestForeground) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGRoot.cpp:429 #2 0x00007fa93629f471 in WebCore::RenderObject::hitTest (this=0x7fa92463c198, request=..., result=..., pointInContainer=..., accumulatedOffset=..., hitTestFilter= WebCore::HitTestDescendants) at ../../third_party/WebKit/Source/WebCore/rendering/RenderObject.cpp:2465 #3 0x00007fa9362526a8 in WebCore::RenderLayer::hitTestContents (this=0x7fa92462f018, request=..., result=..., layerBounds=..., hitTestPoint=..., hitTestFilter= WebCore::HitTestDescendants) at ../../third_party/WebKit/Source/WebCore/rendering/RenderLayer.cpp:3596 #4 0x00007fa93625225c in WebCore::RenderLayer::hitTestLayer (this=0x7fa92462f018, rootLayer=0x7fa92462fb58, containerLayer=0x7fa92462fb58, request=..., result=..., hitTestRect=..., hitTestPoint=..., appliedTransform=false, transformState=0x0, zOffset=0x0) at ../../third_party/WebKit/Source/WebCore/rendering/RenderLayer.cpp:3551 #5 0x00007fa93625297d in WebCore::RenderLayer::hitTestList (this=0x7fa92462fb58, list=0x7fa92463ede0, rootLayer=0x7fa92462fb58, request=..., result=..., hitTestRect=..., hitTestPoint=..., transformState=0x0, zOffsetForDescendants=0x0, zOffset=0x0, unflattenedTransformState=0x0, depthSortDescendants=false) at ../../third_party/WebKit/Source/WebCore/rendering/RenderLayer.cpp:3639 #6 0x00007fa9362520bd in WebCore::RenderLayer::hitTestLayer (this=0x7fa92462fb58, rootLayer=0x7fa92462fb58, containerLayer=0x0, request=..., result=..., hitTestRect=..., hitTestPoint=..., appliedTransform=false, transformState=0x0, zOffset=0x0) at ../../third_party/WebKit/Source/WebCore/rendering/RenderLayer.cpp:3531 #7 0x00007fa936251382 in WebCore::RenderLayer::hitTest (this=0x7fa92462fb58, request=..., result=...) at ../../third_party/WebKit/Source/WebCore/rendering/RenderLayer.cpp:3313 #8 0x00007fa9362fc397 in WebCore::RenderView::hitTest (this=0x7fa931329498, request=..., result=...) at ../../third_party/WebKit/Source/WebCore/rendering/RenderView.cpp:83 #9 0x00007fa9349e12e1 in WebCore::Document::prepareMouseEvent (this=0x7fa924611000, request=..., documentPoint=..., event=...) at ../../third_party/WebKit/Source/WebCore/dom/Document.cpp:3081 #10 0x00007fa9345e77ac in WebCore::EventHandler::prepareMouseEvent (this=0x7fa92457ea88, request=..., mev=...) at ../../third_party/WebKit/Source/WebCore/page/EventHandler.cpp:2090 #11 0x00007fa9345e5f29 in WebCore::EventHandler::handleMouseMoveEvent (this=0x7fa92457ea88, mouseEvent=..., hoveredNode=0x7fff3f091cf0, onlyUpdateScrollbars=false) at ../../third_party/WebKit/Source/WebCore/page/EventHandler.cpp:1769 #12 0x00007fa9345e5a8c in WebCore::EventHandler::mouseMoved (this=0x7fa92457ea88, event=...) at ../../third_party/WebKit/Source/WebCore/page/EventHandler.cpp:1691 #13 0x00007fa93368c465 in WebKit::PageWidgetEventHandler::handleMouseMove (this=0x7fa93130ee38, mainFrame=..., event=...) at ../../third_party/WebKit/Source/WebKit/chromium/src/PageWidgetDelegate.cpp:193 #14 0x00007fa93368c1cd in WebKit::PageWidgetDelegate::handleInputEvent (page=0x7fa931397200, handler=..., event=...) at ../../third_party/WebKit/Source/WebKit/chromium/src/PageWidgetDelegate.cpp:116 #15 0x00007fa933643c85 in WebKit::WebViewImpl::handleInputEvent (this=0x7fa93130ee00, inputEvent=...) 638435 1 rwlbuis 2012-05-31 08:17:12 -0700 Hi Philip, Have you tried with Niko's change to not create a renderer for stops? 638442 2 pdr 2012-05-31 08:27:26 -0700 (In reply to comment #1) > Hi Philip, > > Have you tried with Niko's change to not create a renderer for stops? I have now and it does fix it. I'll mark this as depending on wkbug.com/86941 665063 3 schenney 2012-07-09 12:26:23 -0700 This is also a top crasher in Chrome, on pages containing the Meebo bar, that has the following stack. The only real potential cause is a null renderer or null style. I will post a fix in an effort to get this crash addressed, while waiting for Bug 86941 and 87373 to be fixed. Thread 0 *CRASHED* ( EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE @ 0x00000004 ) 0x7b6bc17c [Google Chrome Framework] - ../../WTF/wtf/RefPtr.h:58] WebCore::SVGStopElement::stopColorIncludingOpacity 0x7b6831ac [Google Chrome Framework] - SVGGradientElement.cpp:150 WebCore::SVGGradientElement::buildStops 0x7b68cedd [Google Chrome Framework] - SVGLinearGradientElement.cpp:150 WebCore::SVGLinearGradientElement::collectGradientAttributes 0x7b6066c6 [Google Chrome Framework] - RenderSVGResourceLinearGradient.cpp:45 WebCore::RenderSVGResourceLinearGradient::collectGradientAttributes 0x7b6059ad [Google Chrome Framework] - RenderSVGResourceGradient.cpp:131 WebCore::RenderSVGResourceGradient::applyResource 0x7b605db0 [Google Chrome Framework] + 0x01e78db0] non-virtual thunk to WebCore::RenderSVGResourceGradient::applyResource(WebCore::RenderObject*, WebCore::RenderStyle*, WebCore::GraphicsContext*&, unsigned short) 0x7b60e27b [Google Chrome Framework] - RenderSVGShape.cpp:254 WebCore::RenderSVGShape::fillShape 0x7b60e4a0 [Google Chrome Framework] - RenderSVGShape.cpp:291 WebCore::RenderSVGShape::fillAndStrokePath 0x7b60e857 [Google Chrome Framework] - RenderSVGShape.cpp:339 WebCore::RenderSVGShape::paint 665086 4 schenney 2012-07-09 12:44:04 -0700 Argh, this is an entirely different issue to the Chrome crasher. So forget I ever mentioned it. It's worth pointing out that a <stop/> inside an SVG like this is illegal according to the SVG content model. 921154 5 209678 rwlbuis 2013-08-26 14:10:33 -0700 Created attachment 209678 Patch 921159 6 pdr 2013-08-26 14:28:53 -0700 (In reply to comment #5) > Created an attachment (id=209678) [details] > Patch I think this fix is too local and may hide real security bugs in the future. RenderSVGGradientStop is one of the few SVG renderers to inherit from RenderObject instead of RenderBlock or RenderSVGBoxModelObject, and it's missing the overrides we have in those "normal" base classes. As an example, we don't appear to do the proper SVGResourcesCache::clientDestroyed call in willBeDestroyed(). Niko tried and failed to remove RenderSVGGradientStop. Reviving that fix is one solution; making RenderSVGGradientStop inherit from RenderSVGBoxModelObject is another. 921160 7 209678 darin 2013-08-26 14:29:31 -0700 Comment on attachment 209678 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=209678&action=review > Source/WebCore/rendering/svg/RenderSVGGradientStop.h:50 > + virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint&, HitTestAction) OVERRIDE FINAL { return false; } No need for FINAL on the function when it’s in a FINAL class. 921161 8 darin 2013-08-26 14:30:17 -0700 Seems fine to revert this and do other testing to find the “real fix” too, but seems no harm to doing this. 921167 9 rwlbuis 2013-08-26 14:39:31 -0700 (In reply to comment #8) > Seems fine to revert this and do other testing to find the “real fix” too, but seems no harm to doing this. I talked with Philip on IRC. As was noted this fixes the problem, though long-term the current situation is not ideal. Removing RenderSVGGradientStop sounds like the ideal solution, but it is AFAIK still blocked by problems with interaction with CSS transitions. We'll probably have to decide between removal of RenderSVGGradientStop or inheriting from RenderSVGBoxModelObject (adds some bloat though) soon, for now I'll commit this and close the bug so whatever we choose this problem is already fixed and we have the regression test to check that it remains fixed. 921173 10 rwlbuis 2013-08-26 14:48:45 -0700 (In reply to comment #6) > (In reply to comment #5) > > Created an attachment (id=209678) [details] [details] > > Patch > > I think this fix is too local and may hide real security bugs in the future. RenderSVGGradientStop is one of the few SVG renderers to inherit from RenderObject instead of RenderBlock or RenderSVGBoxModelObject, and it's missing the overrides we have in those "normal" base classes. As an example, we don't appear to do the proper SVGResourcesCache::clientDestroyed call in willBeDestroyed(). That may be the wrong example ; AFAIK stops are not added to SVGResourcesCache, so there is no need to call SVGResourcesCache::clientDestroyed for them. 921194 11 rwlbuis 2013-08-26 15:27:44 -0700 Committed r154644: <http://trac.webkit.org/changeset/154644> 145071 2012-05-31 06:06:46 -0700 2012-05-31 06:06:46 -0700 Repro case crash.svg image/svg+xml 57 pdr PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgogIDxzdG9wLz4KPC9zdmc+ 209678 2013-08-26 14:10:33 -0700 2013-08-26 14:29:31 -0700 Patch bug-87964-20130826171017.patch text/plain 3374 rwlbuis U3VidmVyc2lvbiBSZXZpc2lvbjogMTU0NTgyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMjhhZjgzNTYyM2ZhZTE1 YzY4ZGVlYzlhNzFlNzZlOTc3MzRmNzhiYi4uOWE0ODQ1NjFiMDhiYmEwODhhMTk4MmIxOTMxYjY3 OWFiZDBjMzVjZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDEzLTA4LTI2ICBSb2Ig QnVpcyAgPHJ3bGJ1aXNAd2Via2l0Lm9yZz4KKworICAgICAgICBMb25lbHkgc3RvcCBjcmFzaGVz CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04Nzk2NAor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFByb3ZpZGUg YSBub2RlQXRGbG9hdFBvaW50IGltcGxlbWVudGF0aW9uIGZvciBSZW5kZXJTVkdHcmFkaWVudFN0 b3AgdG8gYXZvaWQgaGl0dGluZyB0aGUgYXNzZXJ0IGluIFJlbmRlck9iamVjdDo6bm9kZUF0Rmxv YXRQb2ludC4KKworICAgICAgICBUZXN0OiBzdmcvY3VzdG9tL3N0b3AtY3Jhc2gtaGl0dGVzdC5z dmcKKworICAgICAgICAqIHJlbmRlcmluZy9zdmcvUmVuZGVyU1ZHR3JhZGllbnRTdG9wLmg6CisK IDIwMTMtMDgtMjUgIFJvYiBCdWlzICA8cndsYnVpc0B3ZWJraXQub3JnPgogCiAgICAgICAgIENv bXB1dGVkIHN0eWxlIG9mIGZpbGwvc3Ryb2tlIHByb3BlcnRpZXMgaW5jb3JyZWN0IG9uIHJlZmVy ZW5jZXMKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9zdmcvUmVuZGVyU1ZH R3JhZGllbnRTdG9wLmggYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvc3ZnL1JlbmRlclNWR0dy YWRpZW50U3RvcC5oCmluZGV4IDdlZDBjYTM5OWQyNzA5OGY5ODU4Mzk1YmZmYTNmMWUxYjMwNzIz OGUuLjE3ODc2MTFkYWJhYzVmZDkwNTk0N2ZhODhlYmU3M2Y4MzU4NmYwNWYgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9zdmcvUmVuZGVyU1ZHR3JhZGllbnRTdG9wLmgKKysr IGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9SZW5kZXJTVkdHcmFkaWVudFN0b3AuaApA QCAtNDcsNiArNDcsNyBAQCBwdWJsaWM6CiAgICAgdmlydHVhbCBGbG9hdFJlY3Qgb2JqZWN0Qm91 bmRpbmdCb3goKSBjb25zdCB7IHJldHVybiBGbG9hdFJlY3QoKTsgfQogICAgIHZpcnR1YWwgRmxv YXRSZWN0IHN0cm9rZUJvdW5kaW5nQm94KCkgY29uc3QgeyByZXR1cm4gRmxvYXRSZWN0KCk7IH0K ICAgICB2aXJ0dWFsIEZsb2F0UmVjdCByZXBhaW50UmVjdEluTG9jYWxDb29yZGluYXRlcygpIGNv bnN0IHsgcmV0dXJuIEZsb2F0UmVjdCgpOyB9CisgICAgdmlydHVhbCBib29sIG5vZGVBdEZsb2F0 UG9pbnQoY29uc3QgSGl0VGVzdFJlcXVlc3QmLCBIaXRUZXN0UmVzdWx0JiwgY29uc3QgRmxvYXRQ b2ludCYsIEhpdFRlc3RBY3Rpb24pIE9WRVJSSURFIEZJTkFMIHsgcmV0dXJuIGZhbHNlOyB9CiAK IHByb3RlY3RlZDoKICAgICB2aXJ0dWFsIHZvaWQgc3R5bGVEaWRDaGFuZ2UoU3R5bGVEaWZmZXJl bmNlLCBjb25zdCBSZW5kZXJTdHlsZSogb2xkU3R5bGUpOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz dHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDA0MmIzOWFiMTFiZjkx YzE0MDQ3NjIxMzc3M2YxNDRjOWJkYTkxNGEuLjI5MzljOGM4ZDg2N2VhMGU4NGQwNWYzYzIyYjE4 NTk4NjExMzdhYzMgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAxMy0wOC0yNiAgUm9iIEJ1aXMg IDxyd2xidWlzQHdlYmtpdC5vcmc+CisKKyAgICAgICAgTG9uZWx5IHN0b3AgY3Jhc2hlcworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODc5NjQKKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgdGVzdGNhc2Ug YnkgdGFraW5nIHN0b3AtY3Jhc2guc3ZnIGFuZCBhZGRpbmcgaGl0dGVzdCBpbnN0cnVjdGlvbnMu CisKKyAgICAgICAgKiBzdmcvY3VzdG9tL3N0b3AtY3Jhc2gtaGl0dGVzdC1leHBlY3RlZC50eHQ6 IEFkZGVkLgorICAgICAgICAqIHN2Zy9jdXN0b20vc3RvcC1jcmFzaC1oaXR0ZXN0LnN2ZzogQWRk ZWQuCisKIDIwMTMtMDgtMjUgIFJvYiBCdWlzICA8cndsYnVpc0B3ZWJraXQub3JnPgogCiAgICAg ICAgIENvbXB1dGVkIHN0eWxlIG9mIGZpbGwvc3Ryb2tlIHByb3BlcnRpZXMgaW5jb3JyZWN0IG9u IHJlZmVyZW5jZXMKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3N2Zy9jdXN0b20vc3RvcC1jcmFz aC1oaXR0ZXN0LWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL3N2Zy9jdXN0b20vc3RvcC1jcmFz aC1oaXR0ZXN0LWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi41YmY0NjA3YzkzM2E3ODRhMDFjNjEw MDc2NmQ0ODYwYzBlYTQ4ZDlkCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvc3ZnL2N1 c3RvbS9zdG9wLWNyYXNoLWhpdHRlc3QtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEgQEAKK1BBU1Mg LS0gaWYgdGhpcyB0ZXN0IGRvZXNuJ3QgY3Jhc2ggaXQgcGFzc2VzLgpkaWZmIC0tZ2l0IGEvTGF5 b3V0VGVzdHMvc3ZnL2N1c3RvbS9zdG9wLWNyYXNoLWhpdHRlc3Quc3ZnIGIvTGF5b3V0VGVzdHMv c3ZnL2N1c3RvbS9zdG9wLWNyYXNoLWhpdHRlc3Quc3ZnCm5ldyBmaWxlIG1vZGUgMTAwNjQ0Cmlu ZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmZmOTNiNmY3MmI5 Y2RhODYyMmUxZjMyM2Y5NDFkM2Y4MzE1N2UxYTMKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRU ZXN0cy9zdmcvY3VzdG9tL3N0b3AtY3Jhc2gtaGl0dGVzdC5zdmcKQEAgLTAsMCArMSwxMyBAQAor PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgorICA8c3RvcC8+CisgIDxz Y3JpcHQ+CisgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgdGVzdFJ1bm5lci5kdW1wQXNU ZXh0KCk7CisgIGlmICh3aW5kb3cuZXZlbnRTZW5kZXIpIHsKKyAgICAgZXZlbnRTZW5kZXIubW91 c2VNb3ZlVG8oMjAwLCAyMDApOworICAgICBldmVudFNlbmRlci5tb3VzZURvd24oKTsKKyAgICAg ZXZlbnRTZW5kZXIubW91c2VVcCgpOworICB9CisgIDwvc2NyaXB0PgorICA8dGV4dCB4PSIxMCIg eT0iMjUiPlBBU1MgLS0gaWYgdGhpcyB0ZXN0IGRvZXNuJ3QgY3Jhc2ggaXQgcGFzc2VzLjwvdGV4 dD4KKzwvc3ZnPgo=