98456 2012-10-04 15:17:20 -0700 [chromium] Crash in WebCore::GraphicsLayerChromium::setContentsToImage 2012-10-12 14:05:36 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) All Unspecified RESOLVED FIXED http://code.google.com/p/chromium/issues/detail?id=138677 P2 Normal --- 99207 1 nick webkit-unassigned hclam inferno jamesr nick senorblanco simon.fraser webkit.review.bot oldest_to_newest 735061 0 nick 2012-10-04 15:17:20 -0700 GraphicsLayerChromium::setContentsToImage does not handle a null return from nativeImageForCurrentFrame(). This can happen if there is an error early in the decoding of an image. I have a layout test that demonstrates the crash, and a proposed fix. 735070 1 167188 nick 2012-10-04 15:30:19 -0700 Created attachment 167188 Patch 736021 2 167188 jamesr 2012-10-05 15:14:53 -0700 Comment on attachment 167188 Patch R=me. Thanks for tracking this down! 736024 3 inferno 2012-10-05 15:18:18 -0700 Note that null ptr crashes are not security bugs. Please don't use the security template for such bugs in the future. 736027 4 nick 2012-10-05 15:20:53 -0700 @inferno -- that's what I thought, but I figured I'd rather be wrong in this direction than in the other direction. 736030 5 inferno 2012-10-05 15:22:23 -0700 (In reply to comment #4) > @inferno -- that's what I thought, but I figured I'd rather be wrong in this direction than in the other direction. Feel free to poke us anytime on chat :) 736033 6 167188 webkit.review.bot 2012-10-05 15:25:48 -0700 Comment on attachment 167188 Patch Rejecting attachment 167188 from commit-queue. nick@chromium.org does not have committer permissions according to http://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/committers.py. - If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags. - If you have committer rights please correct the error in Tools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed). The commit-queue restarts itself every 2 hours. After restart the commit-queue will correctly respect your committer rights. 736066 7 167188 webkit.review.bot 2012-10-05 15:57:13 -0700 Comment on attachment 167188 Patch Rejecting attachment 167188 from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2 Last 500 characters of output: Auto-merging Source/WebCore/ChangeLog CONFLICT (content): Merge conflict in Source/WebCore/ChangeLog Failed to merge in the changes. Patch failed at 0001 Try to fix the build. When you have resolved this problem run "git rebase --continue". If you would prefer to skip this patch, instead run "git rebase --skip". To restore the original branch and stop rebasing run "git rebase --abort". rebase refs/remotes/origin/master: command returned error: 1 Died at Tools/Scripts/update-webkit line 164. Full output: http://queues.webkit.org/results/14183550 736435 8 167188 webkit.review.bot 2012-10-07 15:13:55 -0700 Comment on attachment 167188 Patch Clearing flags on attachment: 167188 Committed r130610: <http://trac.webkit.org/changeset/130610> 736436 9 webkit.review.bot 2012-10-07 15:13:58 -0700 All reviewed patches have been landed. Closing bug. 736809 10 simon.fraser 2012-10-08 11:03:15 -0700 The ref test is failing on Mac. 736915 11 jamesr 2012-10-08 12:12:01 -0700 What does the failure look like? 736934 12 simon.fraser 2012-10-08 12:36:51 -0700 The partial image is black. This is probably an OS-level thing. 736935 13 simon.fraser 2012-10-08 12:37:11 -0700 http://build.webkit.org/results/Apple%20Lion%20Debug%20WK1%20(Tests)/r130656%20(3475)/results.html 738164 14 nick 2012-10-09 13:58:55 -0700 The reftest is based on the assumption that a broken image will render the same regardless of whether or not it has an identity transform applied (in this case, a z-transform of zero). If that assumption is invalid for the Mac port, we can change this test so that it's not a reftest -- all I really needed was a "doesn't crash" expectation; making it a reftest was gravy. Please let me know if you'd like me to relax the test in that way. 738243 15 simon.fraser 2012-10-09 15:16:34 -0700 Yes, you should change the test. A 'do not crash' test should never be a ref test anyway, because those are more expensive to run. The new test can use internals.layerTreeAsText() to verify that the image is going into a compositing layer. 738244 16 simon.fraser 2012-10-09 15:16:55 -0700 Oh, and we should have a separate bug on the fact that the image is black on Mac. 739588 17 simon.fraser 2012-10-10 21:23:45 -0700 It's bad to leave the test failing for so long. I'm gonna make it an ImageOnlyFailure in Mac TestExpectations. 739590 18 simon.fraser 2012-10-10 21:26:05 -0700 http://trac.webkit.org/changeset/131010 167188 2012-10-04 15:30:19 -0700 2012-10-07 15:13:55 -0700 Patch bug-98456-20121004152929.patch text/plain 4895 nick U3VidmVyc2lvbiBSZXZpc2lvbjogMTI5NzA4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNjI5YjJlMmNhMTk0ODhk YmMxNzgxNzczMzY0OGVhNTBhNDYyZTIxNi4uZmMzZDQyMzkzNzM3NDI4ZWNkODNhOTY3MWYyZGM3 ZWIwMmE3NTMyOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEyLTEwLTA0ICBOaWNr IENhcnRlciAgPG5pY2tAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFtjaHJvbWl1bV0gQ3Jhc2gg aW4gV2ViQ29yZTo6R3JhcGhpY3NMYXllckNocm9taXVtOjpzZXRDb250ZW50c1RvSW1hZ2UKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTk4NDU2CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSGFuZGxlIG51bGwg cmV0dXJuIG9mIG5hdGl2ZUltYWdlRm9yQ3VycmVudEZyYW1lLgorCisgICAgICAgIFRlc3Q6IGNv bXBvc2l0aW5nL2ltYWdlcy90cnVuY2F0ZWQtZGlyZWN0LXBuZy1pbWFnZS5odG1sCisKKyAgICAg ICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9HcmFwaGljc0xheWVyQ2hyb21pdW0uY3Bw OgorICAgICAgICAoV2ViQ29yZTo6R3JhcGhpY3NMYXllckNocm9taXVtOjpzZXRDb250ZW50c1Rv SW1hZ2UpOgorCiAyMDEyLTA5LTI2ICBTaW1vbiBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUu Y29tPgogCiAgICAgICAgIFJlbmFtZSBQYWdlOjpmcmFtZUNvdW50KCkgdG8gc3ViZnJhbWVDb3Vu dCgpLCBhbmQgcmVsYXRlZApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3Jh cGhpY3MvY2hyb21pdW0vR3JhcGhpY3NMYXllckNocm9taXVtLmNwcCBiL1NvdXJjZS9XZWJDb3Jl L3BsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0dyYXBoaWNzTGF5ZXJDaHJvbWl1bS5jcHAKaW5k ZXggNDdjMDNjYmU5MGY5MTdlM2I4MTMwNzdmMGNhMmEzNjVjMjIxMTEwMC4uM2Q3MDNkYjM3OWJm MDMwZjkyMGFiNGQyZDdlMWNhZGI1MWU2YzZjNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUv cGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vR3JhcGhpY3NMYXllckNocm9taXVtLmNwcAorKysg Yi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9HcmFwaGljc0xheWVy Q2hyb21pdW0uY3BwCkBAIC00NTksNyArNDU5LDggQEAgdm9pZCBHcmFwaGljc0xheWVyQ2hyb21p dW06OnNldENvbnRlbnRzUmVjdChjb25zdCBJbnRSZWN0JiByZWN0KQogdm9pZCBHcmFwaGljc0xh eWVyQ2hyb21pdW06OnNldENvbnRlbnRzVG9JbWFnZShJbWFnZSogaW1hZ2UpCiB7CiAgICAgYm9v bCBjaGlsZHJlbkNoYW5nZWQgPSBmYWxzZTsKLSAgICBpZiAoaW1hZ2UpIHsKKyAgICBOYXRpdmVJ bWFnZVNraWEqIG5hdGl2ZUltYWdlID0gaW1hZ2UgPyBpbWFnZS0+bmF0aXZlSW1hZ2VGb3JDdXJy ZW50RnJhbWUoKSA6IDA7CisgICAgaWYgKG5hdGl2ZUltYWdlKSB7CiAgICAgICAgIGlmIChtX2Nv bnRlbnRzTGF5ZXJQdXJwb3NlICE9IENvbnRlbnRzTGF5ZXJGb3JJbWFnZSkgewogICAgICAgICAg ICAgbV9pbWFnZUxheWVyID0gYWRvcHRQdHIoUGxhdGZvcm06OmN1cnJlbnQoKS0+Y29tcG9zaXRv clN1cHBvcnQoKS0+Y3JlYXRlSW1hZ2VMYXllcigpKTsKICAgICAgICAgICAgIHJlZ2lzdGVyQ29u dGVudHNMYXllcihtX2ltYWdlTGF5ZXItPmxheWVyKCkpOwpAQCAtNDY4LDcgKzQ2OSw2IEBAIHZv aWQgR3JhcGhpY3NMYXllckNocm9taXVtOjpzZXRDb250ZW50c1RvSW1hZ2UoSW1hZ2UqIGltYWdl KQogICAgICAgICAgICAgbV9jb250ZW50c0xheWVyUHVycG9zZSA9IENvbnRlbnRzTGF5ZXJGb3JJ bWFnZTsKICAgICAgICAgICAgIGNoaWxkcmVuQ2hhbmdlZCA9IHRydWU7CiAgICAgICAgIH0KLSAg ICAgICAgTmF0aXZlSW1hZ2VTa2lhKiBuYXRpdmVJbWFnZSA9IGltYWdlLT5uYXRpdmVJbWFnZUZv ckN1cnJlbnRGcmFtZSgpOwogICAgICAgICBtX2ltYWdlTGF5ZXItPnNldEJpdG1hcChuYXRpdmVJ bWFnZS0+Yml0bWFwKCkpOwogICAgICAgICBtX2ltYWdlTGF5ZXItPmxheWVyKCktPnNldE9wYXF1 ZShpbWFnZS0+aXNCaXRtYXBJbWFnZSgpICYmICFpbWFnZS0+Y3VycmVudEZyYW1lSGFzQWxwaGEo KSk7CiAgICAgICAgIHVwZGF0ZUNvbnRlbnRzUmVjdCgpOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz dHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDZhZDZjNTllNzQwODJk MzIwMDc4ZTc1YTg2N2UwNTBhZmNmYWEzMmYuLjAwZDQ4OWQ3ZDA2NWY0OTJiYzJlMTQyZDZlYjg4 YTM2N2JmMmU2YTggMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAxMi0xMC0wNCAgTmljayBDYXJ0 ZXIgIDxuaWNrQGNocm9taXVtLm9yZz4KKworICAgICAgICBbY2hyb21pdW1dIENyYXNoIGluIFdl YkNvcmU6OkdyYXBoaWNzTGF5ZXJDaHJvbWl1bTo6c2V0Q29udGVudHNUb0ltYWdlCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05ODQ1NgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE5ldyB0ZXN0cyBleGVyY2lz aW5nIGEgYnJva2VuIGltYWdlIG9uIGl0cyBvd24gbGF5ZXIuCisKKyAgICAgICAgKiBjb21wb3Np dGluZy9pbWFnZXMvdHJ1bmNhdGVkLWRpcmVjdC1wbmctaW1hZ2UtZXhwZWN0ZWQuaHRtbDogQWRk ZWQuCisgICAgICAgICogY29tcG9zaXRpbmcvaW1hZ2VzL3RydW5jYXRlZC1kaXJlY3QtcG5nLWlt YWdlLmh0bWw6IEFkZGVkLgorCiAyMDEyLTA5LTI2ICBNaWtlIFJlZWQgIDxyZWVkQGdvb2dsZS5j b20+CiAKICAgICAgICAgdXBkYXRlIGV4cGVjdGF0aW9ucyBmb3IgZmVUaWxlLnN2ZwpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvY29tcG9zaXRpbmcvaW1hZ2VzL3RydW5jYXRlZC1kaXJlY3QtcG5n LWltYWdlLWV4cGVjdGVkLmh0bWwgYi9MYXlvdXRUZXN0cy9jb21wb3NpdGluZy9pbWFnZXMvdHJ1 bmNhdGVkLWRpcmVjdC1wbmctaW1hZ2UtZXhwZWN0ZWQuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi42NTM5MDU3 NzczYmM0YzdlYjQxZjE0MjA4NWMyYzE2YjQ3NTMwMjllCi0tLSAvZGV2L251bGwKKysrIGIvTGF5 b3V0VGVzdHMvY29tcG9zaXRpbmcvaW1hZ2VzL3RydW5jYXRlZC1kaXJlY3QtcG5nLWltYWdlLWV4 cGVjdGVkLmh0bWwKQEAgLTAsMCArMSwxNyBAQAorPGh0bWw+Cis8aGVhZD4KKzxzdHlsZSB0eXBl PSJ0ZXh0L2NzcyI+CisjaW1hZ2UgeworLyogbm8gei10cmFuc2Zvcm0gaW4gdGhlIGV4cGVjdGF0 aW9uICovCit9CisKK2JvZHkgeworICAgIGJhY2tncm91bmQtY29sb3I6IHllbGxvdzsKK30KKzwv c3R5bGU+Cis8L2hlYWQ+Cis8Ym9keT4KKzxwPlRoaXMgaXMgYSBicm9rZW4gaW1hZ2Ugb24gaXRz IG93biBsYXllcjogYSA1MDB4MzM0IFBORyBpbWFnZSB0cnVuY2F0ZWQgYXQgdGhlIDEwMCBieXRl IG1hcmsuIFRoZSB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCB0cmlnZ2VyIGFuIGFzc2VydGlv biBvciBjcmFzaC48L3A+Cis8aW1nIGlkPSJpbWFnZSIgc3JjPSJkYXRhOmFwcGxpY2F0aW9uL29j dGV0LXN0cmVhbTtiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQWZRQUFBRk9DQUlBQUFE JTJGNVhqT0FBQUFDWEJJV1hNQUFBc1RBQUFMRXdFQW1wd1lBQUFnQUVsRVFWUjRBYnpkQ2JDbHlW VVk2SHZmdmUlMkIlMkIlMkIlMkZaWHI5YnVxbDZxRjNWTGFyV1dsbHBTSXlTaHdRJTNEJTNEIj4K KzwvYm9keT4KKzwvaHRtbD4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2NvbXBvc2l0aW5nL2lt YWdlcy90cnVuY2F0ZWQtZGlyZWN0LXBuZy1pbWFnZS5odG1sIGIvTGF5b3V0VGVzdHMvY29tcG9z aXRpbmcvaW1hZ2VzL3RydW5jYXRlZC1kaXJlY3QtcG5nLWltYWdlLmh0bWwKbmV3IGZpbGUgbW9k ZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4u Y2RkMzhjN2FjOTEyNzM3NzA2ZTM3ZDAwMjQ0MmU2YWY2NmJjZDQ0ZgotLS0gL2Rldi9udWxsCisr KyBiL0xheW91dFRlc3RzL2NvbXBvc2l0aW5nL2ltYWdlcy90cnVuY2F0ZWQtZGlyZWN0LXBuZy1p bWFnZS5odG1sCkBAIC0wLDAgKzEsMTggQEAKKzxodG1sPgorPGhlYWQ+Cis8c3R5bGUgdHlwZT0i dGV4dC9jc3MiPgorI2ltYWdlIHsKKyAgICAtd2Via2l0LXRyYW5zZm9ybTogdHJhbnNsYXRlWigw KTsKKyAgICAtd2Via2l0LXRyYW5zZm9ybS1vcmlnaW46IDAgMDsKK30KKworYm9keSB7CisgICAg YmFja2dyb3VuZC1jb2xvcjogeWVsbG93OworfQorPC9zdHlsZT4KKzwvaGVhZD4KKzxib2R5Pgor PHA+VGhpcyBpcyBhIGJyb2tlbiBpbWFnZSBvbiBpdHMgb3duIGxheWVyOiBhIDUwMHgzMzQgUE5H IGltYWdlIHRydW5jYXRlZCBhdCB0aGUgMTAwIGJ5dGUgbWFyay4gVGhlIHRlc3QgcGFzc2VzIGlm IGl0IGRvZXMgbm90IHRyaWdnZXIgYW4gYXNzZXJ0aW9uIG9yIGNyYXNoLjwvcD4KKzxpbWcgaWQ9 ImltYWdlIiBzcmM9ImRhdGE6YXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtO2Jhc2U2NCxpVkJPUncw S0dnb0FBQUFOU1VoRVVnQUFBZlFBQUFGT0NBSUFBQUQlMkY1WGpPQUFBQUNYQklXWE1BQUFzVEFB QUxFd0VBbXB3WUFBQWdBRWxFUVZSNEFiemRDYkNseVZVWTZIdmZ2ZSUyQiUyQiUyQiUyRlpYcjli dXFsNnFGM1ZMYXJXV2xscFNJeVNod1ElM0QlM0QiPgorPC9ib2R5PgorPC9odG1sPgo=