Bug 71932 – [GTK] svg/as-image/svg-image-change-content-size.xhtml crashes

• Component: SVG
• Status: RESOLVED FIXED

[Philippe Normand]

http://webkit-bots.igalia.com/amd64/svn_99724.core-when_1320861570-_-who_DumpRenderTree-_-why_11.trace.html
Happens in the 64-bits Debug bot at least.

#0  0x00002b0fa96aea6d in WTF::OwnPtr<WebCore::Page>::operator-> (this=0x47dacf80) at ../../Source/JavaScriptCore/wtf/OwnPtr.h:63
63	        PtrType operator->() const { ASSERT(m_ptr); return m_ptr; }

Thread 1 (Thread 0x2b0fb6abe8e0 (LWP 17874)):
#0  0x00002b0fa96aea6d in WTF::OwnPtr<WebCore::Page>::operator-> (this=0x47dacf80) at ../../Source/JavaScriptCore/wtf/OwnPtr.h:63
#1  0x00002b0fa96ab027 in WebCore::SVGImage::drawSVGToImageBuffer (this=0x47dacf40, buffer=0x47c84190, size=..., zoom=1, shouldClear=WebCore::SVGImage::DontClearImageBuffer) at ../../Source/WebCore/svg/graphics/SVGImage.cpp:161
#2  0x00002b0fa96a5cb2 in WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer (this=0x47ec4e50, renderer=0x47ec6f98) at ../../Source/WebCore/svg/graphics/SVGImageCache.cpp:140
#3  0x00002b0fa91c3d0d in WebCore::CachedImage::lookupOrCreateImageForRenderer (this=0x47e94b00, renderer=0x47ec6f98) at ../../Source/WebCore/loader/cache/CachedImage.cpp:150
#4  0x00002b0fa91c29ac in WebCore::CachedImage::imageForRenderer (this=0x47e94b00, renderer=0x47ec6f98) at ../../Source/WebCore/loader/cache/CachedImage.cpp:191
#5  0x00002b0fa950e31c in WebCore::RenderImageResource::image (this=0x47e7e290) at ../../Source/WebCore/rendering/RenderImageResource.h:57
#6  0x00002b0fa950c4df in WebCore::RenderImage::paintReplaced (this=0x47ec6f98, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderImage.cpp:326
#7  0x00002b0fa95594d6 in WebCore::RenderReplaced::paint (this=0x47ec6f98, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderReplaced.cpp:152
#8  0x00002b0fa950c61d in WebCore::RenderImage::paint (this=0x47ec6f98, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderImage.cpp:344
#9  0x00002b0fa94466cb in WebCore::InlineBox::paint (this=0x48140b18, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/InlineBox.cpp:231
#10 0x00002b0fa944b852 in WebCore::InlineFlowBox::paint (this=0x47ea5498, paintInfo=..., paintOffset=..., lineTop=1, lineBottom=425) at ../../Source/WebCore/rendering/InlineFlowBox.cpp:1061
#11 0x00002b0fa95ac37e in WebCore::RootInlineBox::paint (this=0x47ea5498, paintInfo=..., paintOffset=..., lineTop=1, lineBottom=425) at ../../Source/WebCore/rendering/RootInlineBox.cpp:195
#12 0x00002b0fa9531acb in WebCore::RenderLineBoxList::paint (this=0x47e7f7c8, renderer=0x47e7f728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderLineBoxList.cpp:262
#13 0x00002b0fa946c826 in WebCore::RenderBlock::paintContents (this=0x47e7f728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2507
#14 0x00002b0fa946d0a6 in WebCore::RenderBlock::paintObject (this=0x47e7f728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2617
#15 0x00002b0fa946b909 in WebCore::RenderBlock::paint (this=0x47e7f728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2362
#16 0x00002b0fa946cb85 in WebCore::RenderBlock::paintChildren (this=0x47e7e728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2551
#17 0x00002b0fa946c83f in WebCore::RenderBlock::paintContents (this=0x47e7e728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2509
#18 0x00002b0fa946d0a6 in WebCore::RenderBlock::paintObject (this=0x47e7e728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2617
#19 0x00002b0fa946b909 in WebCore::RenderBlock::paint (this=0x47e7e728, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2362
#20 0x00002b0fa946cb85 in WebCore::RenderBlock::paintChildren (this=0x47eab3b8, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2551
#21 0x00002b0fa946c83f in WebCore::RenderBlock::paintContents (this=0x47eab3b8, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2509
#22 0x00002b0fa946d0a6 in WebCore::RenderBlock::paintObject (this=0x47eab3b8, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2617
#23 0x00002b0fa946b909 in WebCore::RenderBlock::paint (this=0x47eab3b8, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:2362
#24 0x00002b0fa95235f3 in WebCore::RenderLayer::paintLayer (this=0x47ea0bc8, rootLayer=0x47e8ef68, p=0x7fffc9a09780, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, overlapTestRequests=0x7fffc9a09480, paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:2806
#25 0x00002b0fa9523b57 in WebCore::RenderLayer::paintList (this=0x47e8ef68, list=0x47ea51d0, rootLayer=0x47e8ef68, p=0x7fffc9a09780, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, overlapTestRequests=0x7fffc9a09480, paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:2865
#26 0x00002b0fa9523851 in WebCore::RenderLayer::paintLayer (this=0x47e8ef68, rootLayer=0x47e8ef68, p=0x7fffc9a09780, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, overlapTestRequests=0x7fffc9a09480, paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:2827
#27 0x00002b0fa9522468 in WebCore::RenderLayer::paint (this=0x47e8ef68, p=0x7fffc9a09780, damageRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:2549
#28 0x00002b0fa92cb9d6 in WebCore::FrameView::paintContents (this=0x47dadb40, p=0x7fffc9a09780, rect=...) at ../../Source/WebCore/page/FrameView.cpp:2772
#29 0x00002b0fa93eb341 in WebCore::ScrollView::paint (this=0x47dadb40, context=0x7fffc9a09780, rect=...) at ../../Source/WebCore/platform/ScrollView.cpp:1049
#30 0x00002b0fa8afe7c4 in WebKit::paintWebView (webView=0x1156050, frame=0x1184380, dirtyRegion=...) at ../../Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:515
#31 0x00002b0fa8afeb54 in WebKit::ChromeClient::paint (this=0x1152fa0) at ../../Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:560
#32 0x00002b0fa8afdcdd in WebKit::repaintEverythingSoonTimeout (client=0x1152fa0) at ../../Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:387
#33 0x00002b0faddb1ddb in g_timeout_dispatch (source=0x47ed2c50, callback=<optimized out>, user_data=<optimized out>) at /tmp/buildd/glib2.0-2.28.6/./glib/gmain.c:3882
#34 0x00002b0faddb04a3 in g_main_dispatch (context=0x10dfe60) at /tmp/buildd/glib2.0-2.28.6/./glib/gmain.c:2440
#35 g_main_context_dispatch (context=0x10dfe60) at /tmp/buildd/glib2.0-2.28.6/./glib/gmain.c:3013
#36 0x00002b0faddb0c80 in g_main_context_iterate (context=0x10dfe60, block=1, dispatch=1, self=<optimized out>) at /tmp/buildd/glib2.0-2.28.6/./glib/gmain.c:3091
#37 0x00002b0faddb12f2 in g_main_loop_run (loop=0x47b091b0) at /tmp/buildd/glib2.0-2.28.6/./glib/gmain.c:3299
#38 0x00002b0fabb5e4cd in gtk_main () from /usr/lib/libgtk-3.so.0
#39 0x000000000042f805 in runTest (testPathOrURL=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:708
#40 0x000000000042ee3d in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:500
#41 0x000000000043117d in main (argc=2, argv=0x7fffc9a0a538) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1206

[Nikolas Zimmermann]

Created attachment 114497 [details]
Patch

Obvious fix needed, thanks for noticing!

[Philippe Normand]

Comment on attachment 114497 [details]
Patch

LGTM, bonus point if you unskip the test in GTK when landing the patch!

[Nikolas Zimmermann]

Thanks, landed in r99856.