Bug 118613 – [CoordinatedGraphics] Crash at CoordinatedGraphicsScene::updateImageBacking

• Component: WebKit Qt
• Status: RESOLVED INVALID

[Luciano Wolf]

If you run this demo: http://dev.sencha.com/deploy/touch/examples/production/kitchensink/#demo/touchevents and click on "Console" button, it produces a segmentation fault:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6491d85 in WebCore::CoordinatedGraphicsScene::updateImageBacking(unsigned long, WTF::PassRefPtr<WebCore::CoordinatedSurface>) ()

It was tested with Nix (MiniBrowser --ipad) and with Qt (MiniBrowser --user-agent "Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10")


I was able to fix the problem but I'm not sure if it's the right fix. Inside CoordinatedGraphicsScene::syncImageBackings(const CoordinatedGraphicsState& state) function there are some iterations to deal with images that must be created, removed, updated and cleared. The thing is that it tries to create/remove/update the very same ID thus generating a segfault - as it tries to updated an ID that was killed. I can "fix" the problem just changing the order of these operations: execute the removals prior any other operation.

I'm not considering this as a proper fix because it's weird to have the same ID scheduled for all operations. What do you guys think?

[Luciano Wolf]

Created attachment 206572 [details]
Proposed fix

[Luciano Wolf]

Created attachment 206669 [details]
Proposed fix.

[Noam Rosenthal]

Comment on attachment 206669 [details]
Proposed fix.

View in context: https://bugs.webkit.org/attachment.cgi?id=206669&action=review

> Source/WebCore/ChangeLog:9
> +        operation - solves the issue.
> +

You should mention why :)
It works because when an image is replaced the old one is deleted before the new one is created, and IDs are not unique in cairo (they're based on the image pointer)

[Luciano Wolf]

Created attachment 206673 [details]
Proposed fix.

[WebKit Commit Bot]

Comment on attachment 206673 [details]
Proposed fix.

Clearing flags on attachment: 206673

Committed r152647: <http://trac.webkit.org/changeset/152647>

[Noam Rosenthal]

This crash still appears, the patch makes it more rare but doesn't fix it.
The right fix for this is to stop using the Cairo pointer as an image ID, but rather have a map in the WebProcess between a referenced cairo surface and an image ID.

[Noam Rosenthal]

See previous comment.

[Alexey Proskuryakov]

The Qt port has been removed from WebKit, resolving this bug.