Bug 162020 – [TextureMapper] Scrolling through 01.org/dleyna crashes WebKitWebProcess

• Component: Platform
• Status: RESOLVED FIXED

[Carlos Garcia Campos]

Bug forwarded from GNOME bugzilla:

"Scrolling through https://01.org/dleyna/ once it has finished loading crashes WebKitWebProcess. Unfortunately, coredumpctl is unable to show the backtrace.

I have:
epiphany-3.20.3-1.fc24.x86_64
gtk3-3.20.9-1.fc24.x86_64
webkitgtk4-2.12.4-1.fc24.x86_64"

The problem is that we are trying to clone a ReferenceFilterOperation:

PassRefPtr<FilterOperation> clone() const override
{
    // Reference filters cannot be cloned.                                                                                                                                                
    ASSERT_NOT_REACHED();
    return nullptr;
}

That's from FilterAnimationValue copy constructor, and FilterOperations are never expected to be nullptr, so we end up crashing.

Thread 1 (Thread 0x7fc129322a80 (LWP 6125)):
#0  0x00007fc127c8e74a in WebCore::FilterAnimationValue::clone() const () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#1  0x00007fc127fd118e in WebCore::TextureMapperAnimation::TextureMapperAnimation(WebCore::TextureMapperAnimation const&) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#2  0x00007fc127fd217a in WebCore::TextureMapperAnimations::add(WebCore::TextureMapperAnimation const&) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#3  0x00007fc127fe4d83 in WebCore::CoordinatedGraphicsLayer::addAnimation(WebCore::KeyframeValueList const&, WebCore::FloatSize const&, WebCore::Animation const*, WTF::String const&, double) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#4  0x00007fc127c87e5a in WebCore::RenderLayerBacking::startTransition(double, WebCore::CSSPropertyID, WebCore::RenderStyle const*, WebCore::RenderStyle const*) ()
   from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#5  0x00007fc1279c657c in WebCore::AnimationBase::updateStateMachine(WebCore::AnimationBase::AnimationStateInput, double) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#6  0x00007fc1279c90ed in WebCore::AnimationControllerPrivate::styleAvailable() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#7  0x00007fc1279c92c5 in WebCore::AnimationControllerPrivate::endAnimationUpdate() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#8  0x00007fc1274cc130 in WebCore::Document::recalcStyle(WebCore::Style::Change) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#9  0x00007fc1274cb359 in WebCore::Document::updateLayout() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fc1274cdf12 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#11 0x00007fc127942d42 in WebCore::DOMWindow::scrollY() const () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#12 0x00007fc128335fe4 in WebCore::jsDOMWindowPageYOffset(JSC::ExecState*, long, JSC::PropertyName) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#13 0x00007fc1258b43e7 in JSC::PropertySlot::customGetter(JSC::ExecState*, JSC::PropertyName) const () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18
#14 0x00007fc125617f41 in llint_slow_path_get_by_val () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18
#15 0x00007fc125626b08 in llint_entry () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18

We just need to validate the filters before setting then and before creating a TextureMapperAnimation for them.

[Carlos Garcia Campos]

Created attachment 288957 [details]
Patch

[Carlos Garcia Campos]

This is for CoordinatedGraphicsLayer only, but I guess we need to do the same in GraphicsLayerTextureMapper

[Carlos Garcia Campos]

Created attachment 288965 [details]
Updated patch

Same changes in GraphicsLayerTextureMapper (untested I would need to recompile without threaded compositor). It really sucks there's so much code duplicated in GraphicsLayerTextureMapper and CoordinatedGraphicsLayer

[Carlos Garcia Campos]

Committed r206019: <http://trac.webkit.org/changeset/206019>