Bug 149316 – Null dereference loading Blink layout test svg/filters/feImage-failed-load-crash.html

• Status: RESOLVED
• Resolution: FIXED
• Component: SVG

[Jon Honeycutt]

Created attachment 261454 [details]
crashing test

Null dereference loading Blink layout test svg/filters/feImage-failed-load-crash.html.

Stack trace:

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000014
Exception Note:        EXC_CORPSE_NOTIFY

VM Regions Near 0x14:
--> 
    __TEXT                 00000001065fe000-0000000106600000 [    8K] r-x/rwx SM=COW  /Users/USER/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development

Application Specific Information:
CRASHING TEST: temp-tests/svg/filters/feImage-failed-load-crash.html

Global Trace Buffer (reverse chronological seconds):
18446743971.992725 CFNetwork                 	0x00007fff88d43b97 Explicitly setting CF cookie storage singleton
18446743971.993103 CFNetwork                 	0x00007fff88d8f211 Explicitly setting cookie storage singleton

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000010f16e585 non-virtual thunk to WebCore::SVGFEImageElement::notifyFinished(WebCore::CachedResource*) + 37 (Node.h:638)
1   com.apple.WebCore             	0x000000010e3b8179 WebCore::CachedResource::checkNotify() + 153 (CachedResourceClientWalker.h:51)
2   com.apple.WebCore             	0x000000010e3b2a91 WebCore::CachedImage::error(WebCore::CachedResource::Status) + 113 (CachedImage.cpp:443)
3   com.apple.WebCore             	0x000000010f12f807 WebCore::SubresourceLoader::didFail(WebCore::ResourceError const&) + 375 (SubresourceLoader.cpp:401)
4   com.apple.WebKit              	0x000000010cc75d35 void IPC::handleMessage<Messages::WebResourceLoader::DidFailResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::ResourceError const&)>(IPC::MessageDecoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::ResourceError const&)) + 100 (StdLibExtras.h:366)
5   com.apple.WebKit              	0x000000010ca4f1f1 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 (memory:2636)
6   com.apple.WebKit              	0x000000010ca51b4a IPC::Connection::dispatchOneMessage() + 126 (memory:2656)
7   com.apple.JavaScriptCore      	0x000000010de93985 WTF::RunLoop::performWork() + 437 (functional:1742)
8   com.apple.JavaScriptCore      	0x000000010de93d32 WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39)
9   com.apple.CoreFoundation      	0x00007fff949e2c01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
10  com.apple.CoreFoundation      	0x00007fff949d4b1c __CFRunLoopDoSources0 + 556
11  com.apple.CoreFoundation      	0x00007fff949d403f __CFRunLoopRun + 927
12  com.apple.CoreFoundation      	0x00007fff949d3a38 CFRunLoopRunSpecific + 296
13  com.apple.HIToolbox           	0x00007fff88e673bd RunCurrentEventLoopInMode + 235
14  com.apple.HIToolbox           	0x00007fff88e67153 ReceiveNextEventCommon + 432
15  com.apple.HIToolbox           	0x00007fff88e66f93 _BlockUntilNextEventMatchingListInModeWithFilter + 71
16  com.apple.AppKit              	0x00007fff870b81e7 _DPSNextEvent + 1076
17  com.apple.AppKit              	0x00007fff8748490d -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454
18  com.apple.AppKit              	0x00007fff870ae0b8 -[NSApplication run] + 682
19  com.apple.AppKit              	0x00007fff87030396 NSApplicationMain + 1176
20  libxpc.dylib                  	0x00007fff8c70ff70 _xpc_objc_main + 793
21  libxpc.dylib                  	0x00007fff8c7116bf xpc_main + 494
22  com.apple.WebKit.WebContent.Development	0x00000001065ff424 main + 409 (XPCServiceMain.Development.mm:187)
23  libdyld.dylib                 	0x00007fff93aa15ad start + 1

[Radar WebKit Bug Importer]

<rdar://problem/22749532>

[Dean Jackson]

Created attachment 261559 [details]
Patch

[Dean Jackson]

Committed r190013: <http://trac.webkit.org/changeset/190013>