Bug 162020 - [TextureMapper] Scrolling through 01.org/dleyna crashes WebKitWebProcess
Summary: [TextureMapper] Scrolling through 01.org/dleyna crashes WebKitWebProcess
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Platform (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: Gtk
Depends on:
Blocks:
 
Reported: 2016-09-15 09:38 PDT by Carlos Garcia Campos
Modified: 2016-09-16 03:02 PDT (History)
7 users (show)

See Also:


Attachments
Patch (4.56 KB, patch)
2016-09-15 09:43 PDT, Carlos Garcia Campos
no flags Details | Formatted Diff | Diff
Updated patch (8.50 KB, patch)
2016-09-15 10:01 PDT, Carlos Garcia Campos
zan: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos Garcia Campos 2016-09-15 09:38:27 PDT
Bug forwarded from GNOME bugzilla:

"Scrolling through https://01.org/dleyna/ once it has finished loading crashes WebKitWebProcess. Unfortunately, coredumpctl is unable to show the backtrace.

I have:
epiphany-3.20.3-1.fc24.x86_64
gtk3-3.20.9-1.fc24.x86_64
webkitgtk4-2.12.4-1.fc24.x86_64"

The problem is that we are trying to clone a ReferenceFilterOperation:

PassRefPtr<FilterOperation> clone() const override
{
    // Reference filters cannot be cloned.                                                                                                                                                
    ASSERT_NOT_REACHED();
    return nullptr;
}

That's from FilterAnimationValue copy constructor, and FilterOperations are never expected to be nullptr, so we end up crashing.

Thread 1 (Thread 0x7fc129322a80 (LWP 6125)):
#0  0x00007fc127c8e74a in WebCore::FilterAnimationValue::clone() const () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#1  0x00007fc127fd118e in WebCore::TextureMapperAnimation::TextureMapperAnimation(WebCore::TextureMapperAnimation const&) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#2  0x00007fc127fd217a in WebCore::TextureMapperAnimations::add(WebCore::TextureMapperAnimation const&) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#3  0x00007fc127fe4d83 in WebCore::CoordinatedGraphicsLayer::addAnimation(WebCore::KeyframeValueList const&, WebCore::FloatSize const&, WebCore::Animation const*, WTF::String const&, double) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#4  0x00007fc127c87e5a in WebCore::RenderLayerBacking::startTransition(double, WebCore::CSSPropertyID, WebCore::RenderStyle const*, WebCore::RenderStyle const*) ()
   from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#5  0x00007fc1279c657c in WebCore::AnimationBase::updateStateMachine(WebCore::AnimationBase::AnimationStateInput, double) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#6  0x00007fc1279c90ed in WebCore::AnimationControllerPrivate::styleAvailable() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#7  0x00007fc1279c92c5 in WebCore::AnimationControllerPrivate::endAnimationUpdate() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#8  0x00007fc1274cc130 in WebCore::Document::recalcStyle(WebCore::Style::Change) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#9  0x00007fc1274cb359 in WebCore::Document::updateLayout() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fc1274cdf12 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#11 0x00007fc127942d42 in WebCore::DOMWindow::scrollY() const () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#12 0x00007fc128335fe4 in WebCore::jsDOMWindowPageYOffset(JSC::ExecState*, long, JSC::PropertyName) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#13 0x00007fc1258b43e7 in JSC::PropertySlot::customGetter(JSC::ExecState*, JSC::PropertyName) const () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18
#14 0x00007fc125617f41 in llint_slow_path_get_by_val () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18
#15 0x00007fc125626b08 in llint_entry () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18

We just need to validate the filters before setting then and before creating a TextureMapperAnimation for them.
Comment 1 Carlos Garcia Campos 2016-09-15 09:43:41 PDT
Created attachment 288957 [details]
Patch
Comment 2 Carlos Garcia Campos 2016-09-15 09:46:09 PDT
This is for CoordinatedGraphicsLayer only, but I guess we need to do the same in GraphicsLayerTextureMapper
Comment 3 Carlos Garcia Campos 2016-09-15 10:01:19 PDT
Created attachment 288965 [details]
Updated patch

Same changes in GraphicsLayerTextureMapper (untested I would need to recompile without threaded compositor). It really sucks there's so much code duplicated in GraphicsLayerTextureMapper and CoordinatedGraphicsLayer
Comment 4 Carlos Garcia Campos 2016-09-16 03:02:11 PDT
Committed r206019: <http://trac.webkit.org/changeset/206019>