95002 2012-08-25 05:19:41 -0700 Crash when same SVG used as a CSS background AND drawn on canvas 2012-08-29 03:17:31 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Mac (Intel) OS X 10.7 RESOLVED FIXED http://lea.verou.me/tests/svg-background.html P2 Critical --- 1 lea pdr krit pdr simon.fraser tabatkins thorton webkit.review.bot zimmermann oldest_to_newest 704685 0 lea 2012-08-25 05:19:41 -0700 After reducing this bug for a painfully long time, I narrowed it down to the linked testcase, which should be sufficiently simple: If the same SVG file is drawn on a canvas AND used as a CSS background, the browser (or tab, in Canary) crashes. The testcase crashes both Chrome Canary and WebKit nightlies. The bug first appeared around 2±1 updates ago. Things that do NOT seem to be relevant to the bug: - The element where the SVG is applied - The way to CSS is applied (JavaScript, inline style, linked etc) - Whether the canvas is generated or pre-existing in the page - The element that contains the canvas - The dimensions of the canvas or SVG - The SVG itself (tried with multiple) - Other CSS properties that also accept <image> do not seem to trigger this (I tried content, border-image, cursor, list-style-image). 705336 1 pdr 2012-08-27 09:51:28 -0700 Thanks for filing this detailed test report and minimized testcase! I'm already playing in this space so let me pick this up. 705364 2 160741 pdr 2012-08-27 10:15:04 -0700 Created attachment 160741 Minimized testcase (1 of 2) Just attaching the testcase 705367 3 160743 pdr 2012-08-27 10:15:44 -0700 Created attachment 160743 Minimized testcase (2 of 2) Just attaching the testcase 705373 4 pdr 2012-08-27 10:25:13 -0700 I think I see what's going on: we're detached and don't have a renderer (aka client) so we crash when trying to get the size for the CSS background. And the backtrace/assert from a debug build: ASSERTION FAILED: client /Users/progers7/Desktop/webkit/Source/WebCore/svg/graphics/SVGImageCache.cpp(79) : SVGImageCache::SizeAndScales WebCore::SVGImageCache::requestedSizeAndScales(const WebCore::CachedImageClient *) const 1 0x105c998ad WebCore::SVGImageCache::requestedSizeAndScales(WebCore::CachedImageClient const*) const 2 0x1046e42f4 WebCore::CachedImage::imageSizeForRenderer(WebCore::RenderObject const*, float) 3 0x104710f84 _ZN7WebCoreL4sizeEPNS_16HTMLImageElementE 4 0x10471101d WebCore::CanvasRenderingContext2D::drawImage(WebCore::HTMLImageElement*, float, float, float, float, int&) 5 0x10506e761 _ZN7WebCoreL53jsCanvasRenderingContext2DPrototypeFunctionDrawImage2EPN3JSC9ExecStateE 6 0x10506db62 WebCore::jsCanvasRenderingContext2DPrototypeFunctionDrawImage(JSC::ExecState*) 7 0x10a62e265 8 0x10399fe84 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 9 0x10399cc5c JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 10 0x10384fbc8 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 11 0x10505ca92 WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 12 0x10518dc71 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) 13 0x104bd9f17 WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul>&) 14 0x104bd9d7b WebCore::EventTarget::fireEventListeners(WebCore::Event*) 15 0x10565cb0b WebCore::Node::handleLocalEvents(WebCore::Event*) 16 0x104baaae4 WebCore::EventContext::handleLocalEvents(WebCore::Event*) const 17 0x104bad629 WebCore::EventDispatcher::dispatchEventAtTarget(WTF::PassRefPtr<WebCore::Event>) 18 0x104bac57d WebCore::EventDispatcher::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) 19 0x104bb2264 WebCore::EventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const 20 0x104bab4cc WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::EventDispatchMediator>) 21 0x10565cbfa WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) 22 0x104dd6c2c WebCore::HTMLImageLoader::dispatchLoadEvent() 23 0x104ead511 WebCore::ImageLoader::dispatchPendingLoadEvent() 24 0x104ead448 WebCore::ImageLoader::dispatchPendingEvent(WebCore::EventSender<WebCore::ImageLoader>*) 25 0x104eadb1c WebCore::EventSender<WebCore::ImageLoader>::dispatchPendingEvents() 26 0x104ead621 WebCore::ImageLoader::dispatchPendingLoadEvents() 27 0x10497f6d2 WebCore::Document::implicitClose() 28 0x104c83b0b WebCore::FrameLoader::checkCallImplicitClose() 29 0x104c83803 WebCore::FrameLoader::checkCompleted() 30 0x104c83975 WebCore::FrameLoader::loadDone() 31 0x1046fb0d2 WebCore::CachedResourceLoader::loadDone() 705794 5 160830 pdr 2012-08-27 15:43:22 -0700 Created attachment 160830 Use SVGImage instead of cached image when drawing without a render tree. Requesting a review from Nikolas on this one... I'm just getting into this code and this patch relies on a codepath that you removed from your haromize patch: inline Image* CachedImage::lookupOrCreateImageForRenderer(const RenderObject* renderer) { ... Image* useImage = m_svgImageCache->lookupOrCreateBitmapImageForRenderer(renderer); if (useImage == Image::nullImage()) return m_image.get(); ... My understanding is that we should fall back to using SVGImage (aka m_image.get()) when we aren't in the render tree (and don't have a cached image). This means, to draw we just rely on SVGImage::draw(). 707250 6 160830 zimmermann 2012-08-29 02:54:43 -0700 Comment on attachment 160830 Use SVGImage instead of cached image when drawing without a render tree. This still seems fine, as-is. r=me. 707263 7 160830 webkit.review.bot 2012-08-29 03:17:28 -0700 Comment on attachment 160830 Use SVGImage instead of cached image when drawing without a render tree. Clearing flags on attachment: 160830 Committed r126977: <http://trac.webkit.org/changeset/126977> 707264 8 webkit.review.bot 2012-08-29 03:17:31 -0700 All reviewed patches have been landed. Closing bug. 160741 2012-08-27 10:15:04 -0700 2012-08-27 10:15:04 -0700 Minimized testcase (1 of 2) svgcrash.html text/html 357 pdr PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+Cjxib2R5IHN0eWxlPSJiYWNr Z3JvdW5kOiB1cmwodGVzdC5zdmcpOyI+CjxjYW52YXMgaWQ9ImNhbnZhcyI+PC9jYW52YXM+Cjxz Y3JpcHQ+CiAgICB2YXIgc3ZnID0gbmV3IEltYWdlKCk7CiAgICBzdmcuc3JjID0gJ3Rlc3Quc3Zn JzsKCiAgICBzdmcub25sb2FkID0gZnVuY3Rpb24oKSB7CiAgICAgICAgdmFyIGNhbnZhcyA9IGRv Y3VtZW50LmdldEVsZW1lbnRCeUlkKCdjYW52YXMnKTsKICAgICAgICBjYW52YXMuZ2V0Q29udGV4 dCgnMmQnKS5kcmF3SW1hZ2Uoc3ZnLCAwLCAwLCAzMDAsIDE1MCk7CiAgICB9Owo8L3NjcmlwdD4K PC9ib2R5Pgo8L2h0bWw+ 160743 2012-08-27 10:15:44 -0700 2012-08-27 10:15:44 -0700 Minimized testcase (2 of 2) test.svg image/svg+xml 191 pdr PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxz dmcgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRo PSIxMDAiIGhlaWdodD0iMTAwIj4KPGNpcmNsZSBjeD0iNTAiIGN5PSI1MCIgcj0iNTAiIGZpbGw9 ImdyZWVuIiAvPgrigIs8L3N2Zz4= 160830 2012-08-27 15:43:22 -0700 2012-08-29 03:17:28 -0700 Use SVGImage instead of cached image when drawing without a render tree. 95002.1.patch text/plain 4266 pdr SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDEyNjgwNikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDEyLTA4LTI3ICBQaGlsaXAg Um9nZXJzICA8cGRyQGdvb2dsZS5jb20+CisKKyAgICAgICAgVXNlIFNWR0ltYWdlIGluc3RlYWQg b2YgY2FjaGVkIGltYWdlIHdoZW4gZHJhd2luZyB3aXRob3V0IGEgcmVuZGVyIHRyZWUuCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NTAwMgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFByZXZpb3VzbHkgaWYg d2UgdHJpZWQgdG8gdXNlIGNhbnZhcy5jb250ZXh0MmQuZHJhd0ltYWdlKCkgd2l0aCBhbiBTVkcg aW1hZ2UKKyAgICAgICAgdGhhdCB3YXMgbm90IGluIHRoZSByZW5kZXIgdHJlZSwgd2Ugd291bGQg Y3Jhc2guIFRoaXMgcGF0Y2ggY2hhbmdlcyB0aGlzIGJlaGF2aW9yCisgICAgICAgIHNvIHRoYXQg d2UgdXNlIFNWR0ltYWdlOjpkcmF3KCkgdG8gZHJhdyBpbWFnZXMgdGhhdCBhcmUgbm90IGluIHRo ZSByZW5kZXIgdHJlZS4KKworICAgICAgICBUZXN0OiBzdmcvYXMtaW1hZ2Uvc3ZnLWNhbnZhcy1k cmF3LWltYWdlLWRldGFjaGVkLmh0bWwKKworICAgICAgICAqIHN2Zy9ncmFwaGljcy9TVkdJbWFn ZUNhY2hlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNWR0ltYWdlQ2FjaGU6OnJlcXVlc3RlZFNp emVBbmRTY2FsZXMpOgorICAgICAgICAoV2ViQ29yZTo6U1ZHSW1hZ2VDYWNoZTo6bG9va3VwT3JD cmVhdGVCaXRtYXBJbWFnZUZvclJlbmRlcmVyKToKKwogMjAxMi0wOC0yNyAgUm9nZXIgRm9uZyAg PHJvZ2VyX2ZvbmdAYXBwbGUuY29tPgogCiAgICAgICAgIEhvb2sgcHJvY2VkdXJlIHNob3VsZCBj aGVjayB0byBzZWUgaWYgaG9vayBoYXMgYWxyZWFkeSBiZWVuIHJlbW92ZWQgYmVmb3JlIGF0dGVt cHRpbmcgcmVtb3ZhbC4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3N2Zy9ncmFwaGljcy9TVkdJbWFn ZUNhY2hlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9zdmcvZ3JhcGhpY3MvU1ZH SW1hZ2VDYWNoZS5jcHAJKHJldmlzaW9uIDEyNjc3MCkKKysrIFNvdXJjZS9XZWJDb3JlL3N2Zy9n cmFwaGljcy9TVkdJbWFnZUNhY2hlLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNzYsNyArNzYsOCBA QCB2b2lkIFNWR0ltYWdlQ2FjaGU6OnNldFJlcXVlc3RlZFNpemVBbmRTCiAKIFNWR0ltYWdlQ2Fj aGU6OlNpemVBbmRTY2FsZXMgU1ZHSW1hZ2VDYWNoZTo6cmVxdWVzdGVkU2l6ZUFuZFNjYWxlcyhj b25zdCBDYWNoZWRJbWFnZUNsaWVudCogY2xpZW50KSBjb25zdAogewotICAgIEFTU0VSVChjbGll bnQpOworICAgIGlmICghY2xpZW50KQorICAgICAgICByZXR1cm4gU2l6ZUFuZFNjYWxlcygpOwog ICAgIFNpemVBbmRTY2FsZXNNYXA6OmNvbnN0X2l0ZXJhdG9yIGl0ID0gbV9zaXplQW5kU2NhbGVz TWFwLmZpbmQoY2xpZW50KTsKICAgICBpZiAoaXQgPT0gbV9zaXplQW5kU2NhbGVzTWFwLmVuZCgp KQogICAgICAgICByZXR1cm4gU2l6ZUFuZFNjYWxlcygpOwpAQCAtMTMxLDcgKzEzMiw5IEBAIHZv aWQgU1ZHSW1hZ2VDYWNoZTo6cmVkcmF3VGltZXJGaXJlZChUaW0KIAogSW1hZ2UqIFNWR0ltYWdl Q2FjaGU6Omxvb2t1cE9yQ3JlYXRlQml0bWFwSW1hZ2VGb3JSZW5kZXJlcihjb25zdCBSZW5kZXJP YmplY3QqIHJlbmRlcmVyKQogewotICAgIEFTU0VSVChyZW5kZXJlcik7CisgICAgaWYgKCFyZW5k ZXJlcikKKyAgICAgICAgcmV0dXJuIEltYWdlOjpudWxsSW1hZ2UoKTsKKwogICAgIGNvbnN0IENh Y2hlZEltYWdlQ2xpZW50KiBjbGllbnQgPSByZW5kZXJlcjsKIAogICAgIC8vIFRoZSBjYWNoZSBu ZWVkcyB0byBrbm93IHRoZSBzaXplIG9mIHRoZSByZW5kZXJlciBiZWZvcmUgcXVlcnlpbmcgYW4g aW1hZ2UgZm9yIGl0LgpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTI2ODA2KQorKysgTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTItMDgtMjcgIFBo aWxpcCBSb2dlcnMgIDxwZHJAZ29vZ2xlLmNvbT4KKworICAgICAgICBVc2UgU1ZHSW1hZ2UgaW5z dGVhZCBvZiBjYWNoZWQgaW1hZ2Ugd2hlbiBkcmF3aW5nIHdpdGhvdXQgYSByZW5kZXIgdHJlZS4K KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTk1MDAyCisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdmcvYXMt aW1hZ2Uvc3ZnLWNhbnZhcy1kcmF3LWltYWdlLWRldGFjaGVkLWV4cGVjdGVkLnR4dDogQWRkZWQu CisgICAgICAgICogc3ZnL2FzLWltYWdlL3N2Zy1jYW52YXMtZHJhdy1pbWFnZS1kZXRhY2hlZC5o dG1sOiBBZGRlZC4KKwogMjAxMi0wOC0yNyAgSnVsaWVuIENoYWZmcmFpeCAgPGpjaGFmZnJhaXhA d2Via2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkIGdhcmRlbmluZy4KSW5kZXg6IExheW91 dFRlc3RzL3N2Zy9hcy1pbWFnZS9zdmctY2FudmFzLWRyYXctaW1hZ2UtZGV0YWNoZWQtZXhwZWN0 ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL3N2Zy9hcy1pbWFnZS9zdmctY2FudmFz LWRyYXctaW1hZ2UtZGV0YWNoZWQtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0 VGVzdHMvc3ZnL2FzLWltYWdlL3N2Zy1jYW52YXMtZHJhdy1pbWFnZS1kZXRhY2hlZC1leHBlY3Rl ZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMyBAQAorVGhpcyB0ZXN0IHBhc3NlcyBpZiB0 aGVyZSBhcmUgdHdvIGdyZWVuIGJveGVzIGFuZCBubyBjcmFzaC4KKworCkluZGV4OiBMYXlvdXRU ZXN0cy9zdmcvYXMtaW1hZ2Uvc3ZnLWNhbnZhcy1kcmF3LWltYWdlLWRldGFjaGVkLmh0bWwKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gTGF5b3V0VGVzdHMvc3ZnL2FzLWltYWdlL3N2Zy1jYW52YXMtZHJhdy1pbWFn ZS1kZXRhY2hlZC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvc3ZnL2FzLWltYWdl L3N2Zy1jYW52YXMtZHJhdy1pbWFnZS1kZXRhY2hlZC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCww ICsxLDI2IEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGJvZHk+CisgICAgVGhpcyB0ZXN0 IHBhc3NlcyBpZiB0aGVyZSBhcmUgdHdvIGdyZWVuIGJveGVzIGFuZCBubyBjcmFzaC4KKyAgICA8 ZGl2IHN0eWxlPSJ3aWR0aDogMTAwcHg7IGhlaWdodDogMTAwcHg7IGJhY2tncm91bmQ6IHVybChy ZXNvdXJjZXMvMTAwcHgtZ3JlZW4tcmVjdC5zdmcpOyI+PC9kaXY+CisgICAgPGJyLz4KKyAgICA8 Y2FudmFzIGlkPSJjYW52YXMiIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIj48L2NhbnZhcz4KKyAg ICA8c2NyaXB0PgorICAgICAgICBpZiAod2luZG93LnRlc3RSdW5uZXIpIHsKKyAgICAgICAgICAg IHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworICAgICAgICAgICAgdGVzdFJ1bm5lci53YWl0VW50 aWxEb25lKCk7CisgICAgICAgIH0KKworICAgICAgICB2YXIgc3ZnID0gbmV3IEltYWdlKCk7Cisg ICAgICAgIHN2Zy5zcmMgPSAncmVzb3VyY2VzLzEwMHB4LWdyZWVuLXJlY3Quc3ZnJzsKKworICAg ICAgICBzdmcub25sb2FkID0gZnVuY3Rpb24oKSB7CisgICAgICAgICAgICB2YXIgY2FudmFzID0g ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2NhbnZhcycpOworICAgICAgICAgICAgY2FudmFzLmdl dENvbnRleHQoJzJkJykuZHJhd0ltYWdlKHN2ZywgMCwgMCk7CisKKyAgICAgICAgICAgIGlmICh3 aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgICAgICAgICAgICB0ZXN0UnVubmVyLm5vdGlmeURvbmUo KTsKKyAgICAgICAgfTsKKyAgICA8L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4K