Bug 191817 – Dragging image with a border-image larger than the image element crashes

• Component: Platform
• Status: RESOLVED FIXED

[Ralph T]

Dragging the image in the attached sample causes the renderer to crash.

[Ralph T]

Created attachment 355214 [details]
Page that crashes when image is dragged.

[Simon Fraser (smfr)]

Thanks for the report.

[Simon Fraser (smfr)]

    frame #0: 0x00007fff59b456f0 libobjc.A.dylib`objc_exception_throw
  * frame #1: 0x00007fff2dc2926f CoreFoundation`+[NSException raise:format:] + 201
    frame #2: 0x00007fff2b1ec6d1 AppKit`-[NSImage _lockFocusOnRepresentation:rect:context:hints:flipped:] + 316
    frame #3: 0x00007fff2b1ec58c AppKit`__51-[NSImage lockFocusWithRect:context:hints:flipped:]_block_invoke + 68
    frame #4: 0x00007fff2b17c538 AppKit`-[NSImage _usingBestRepresentationForRect:context:hints:body:] + 156
    frame #5: 0x00007fff2b1ec53e AppKit`-[NSImage lockFocusWithRect:context:hints:flipped:] + 141
    frame #6: 0x00007fff2b2f134b AppKit`-[NSImage lockFocusFlipped:] + 111
    frame #7: 0x00000005f899f931 WebCore`WebCore::dissolveDragImageToFraction(image=(m_ptr = 0x00007fee8173fe30), delta=0.75) at DragImageMac.mm:88
    frame #8: 0x00000005fab4b292 WebCore`WebCore::DragController::doImageDrag(this=0x000000060fcd85a0, element=0x0000000613600138, dragOrigin={ x = 127, y = 37 }, layoutRect={ x = 33, y = 58, width = 150, height = 0 }, frame={ origin = https://bug-191817-attachments.webkit.org, url = https://bug-191817-attachments.webkit.org/attachment.cgi?id=355214, isMainFrame = 1, pageCacheState = NotInPageCache }, dragImageOffset={ x = 0, y = 0 }, state=0x00000005fd33ac50, attachmentInfo=0x00007ffee10d4078) at DragController.cpp:1212
    frame #9: 0x00000005fab4835e WebCore`WebCore::DragController::startDrag(this=0x000000060fcd85a0, src={ origin = https://bug-191817-attachments.webkit.org, url = https://bug-191817-attachments.webkit.org/attachment.cgi?id=355214, isMainFrame = 1, pageCacheState = NotInPageCache }, state=0x00000005fd33ac50, srcOp=DragOperationEvery, dragEvent=0x00007ffee10d4f50, dragOrigin={ x = 127, y = 37 }, hasData=No) at DragController.cpp:1052

[Simon Fraser (smfr)]

Image size is 0x0

[Radar WebKit Bug Importer]

<rdar://problem/46159222>

[Wenson Hsieh]

Created attachment 355253 [details]
Patch

[EWS Watchlist]

Comment on attachment 355253 [details]
Patch

Attachment 355253 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: https://webkit-queues.webkit.org/results/10074900

New failing tests:
media/no-fullscreen-when-hidden.html

[EWS Watchlist]

Created attachment 355257 [details]
Archive of layout-test-results from ews126 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews126  Port: ios-simulator-wk2  Platform: Mac OS X 10.13.6

[WebKit Commit Bot]

Comment on attachment 355253 [details]
Patch

Clearing flags on attachment: 355253

Committed r238375: <https://trac.webkit.org/changeset/238375>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.