[GTK] imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args.html crash in in bmalloc::Heap::allocateLarge

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Charlie Turner]

Created attachment 325430 [details]
Crash log

The following seems to have taken us from always failing to occasionally failing and occasionally crashing.

commit f4fd10564f49868d19feb708112cd373b514fa7d
Author: [e-mail] <[e-mail]@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Sun Oct 29 10:06:35 2017 +0000

    createImageBitmap with HTMLCanvasElement
    https://bugs.webkit.org/show_bug.cgi?id=178984
    <rdar://problem/35238440>

Crash log attached.

[Ms2ger (he/him; ⌚ UTC+1/+2)]

Created attachment 325558 [details]
Patch

[Build Bot]

Comment on attachment 325558 [details]
Patch

Attachment 325558 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: http://webkit-queues.webkit.org/results/5061481

New failing tests:
imported/w3c/web-platform-tests/service-workers/cache-storage/serviceworker/cache-match.https.html

[Build Bot]

Created attachment 325561 [details]
Archive of layout-test-results from ews124 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews124  Port: ios-simulator-wk2  Platform: Mac OS X 10.12.6

[Michael Catanzaro]

Comment on attachment 325558 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=325558&action=review

> Source/WebCore/ChangeLog:3
> +        [GTK] Use fallible allocation in ImageBuffer::ImageBuffer().

Why?

I think Zan or Miguel would be a good reviewer to ask for this.

[Ms2ger (he/him; ⌚ UTC+1/+2)]

(In reply to Michael Catanzaro from comment #4)
> Comment on attachment 325558 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=325558&action=review
> 
> > Source/WebCore/ChangeLog:3
> > +        [GTK] Use fallible allocation in ImageBuffer::ImageBuffer().
> 
> Why?
> 
> I think Zan or Miguel would be a good reviewer to ask for this.

Because of the crash this bug is filed for; web pages can easily control the size of the buffer we try to allocate here. The mac port also uses fallible allocation.

[Fujii Hironori]

WinCairo EWS is red. tryFastZeroedMalloc should be marked as WTF_EXPORT_PRIVATE.

[Ms2ger (he/him; ⌚ UTC+1/+2)]

Created attachment 326569 [details]
Patch

[Michael Catanzaro]

(In reply to Ms2ger from comment #5)
> Because of the crash this bug is filed for; web pages can easily control the
> size of the buffer we try to allocate here. The mac port also uses fallible
> allocation.

OK, makes sense.

[WebKit Commit Bot]

Comment on attachment 326569 [details]
Patch

Clearing flags on attachment: 326569

Committed r224681: <https://trac.webkit.org/changeset/224681>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Ms2ger (he/him; ⌚ UTC+1/+2)]

*** Bug 179477 has been marked as a duplicate of this bug. ***