Bug 18465 – wxWebit crash in BitmapImage::draw on particular site

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit wx

[Alexander Vassilev]

Opening the site 'dir.bg' in wxBrowser, after it is completely loaded (tha statusbar says 'Load complete', then starting to resize increasing the size of the window - at one point the application crashes with access violation. I am in the process of investigating hte bug, but seems gdb provides some misleading information about the point of the crash, or I have not figured out something yet.

[Alexander Vassilev]

Created attachment 20510 [details]
patch

The problem is that the source and destination areas are not always the same sizes, and without a check the underlying wx Blit code crashes. This is why I jsut added a simple check and if the sizes dont match hte function quits. This is just to prevent a crash, I am not sure how is it specified in the call how exactly to handle stretching or tiling of the image to fit the destination rect.

[Dave Hyatt]

Comment on attachment 20510 [details]
patch

I think you probably just need to add a null check for your underlying platform image (like Mac has).

I recently removed the cross-platform null checks from draw and drawTiled, so it's up to the platforms to null-check now.

[Kevin Ollivier]

@Hyatt, we do check for a NULL image when we call frameAtIndex, so we shouldn't be hitting this point in the code without a valid image.

@Alexander, I'll prepare some code to resize images as we need that anyway, but we've never hit a crash before just because the src and dest rect were different, and I have so far been unable to reproduce your crash. Since I don't have MinGW setup, I would really appreciate if you could attach the stack traces for these crashes (this and the mouse one too) so I can look at the code paths that lead to these crashes.

[Alexander Vassilev]

Created attachment 20528 [details]
patch to ImageWx.cpp

This patch adds support for image rescaling in the draw method, as well as filling with solid color when source is 1x1 pixel

[Alexander Vassilev]

@Hyatt: Yes, the images are checked and they aren't null, we have valid images when the crash happens.
@Kevin: The crash with the 'dir.bg' site occurred also with msvc, in exactly the same way. I have dug deeply in wxWidgets to find the cause - it was because of the Blit code trying to read the source image past its end - wxWidgets assumes that the source and destination are of the same size and does not perform any checks on this. As for the image resize, I just committed a patch and then read your reply that you are going to do the same - I'm not sure my variant of rescaling is very efficient, but this seems to be the only way to rescale image - by converting to wxImage and then back to wxBitmap, the doc says the only other way is to blit between wxMemoryDC-s but i didn't find out any resizing support special for wxMemoryDC, so I used the canonical way via wxImage.

Since I have changed the original files, and now the crashes don't occur, I will do a build on the original source tree and send you the traces

[Alexander Vassilev]

Kevin, here are the stack traces for both crashes:


Image crash:
Program received signal SIGSEGV, Segmentation fault.
AlphaBlt (hdcDst=0xfc0132de, x=707, y=51, width=42, height=18, srcX=0, srcY=0, 
    hdcSrc=0x0, bmp=@0x22d650) at ../include/wx/rawbmp.h:588
588                 ChannelType& Alpha() { return m_ptr[PixelFormat::ALPHA]; }
Current language:  auto; currently c++
(gdb) bt
#0  AlphaBlt (hdcDst=0xfc0132de, x=707, y=51, width=42, height=18, srcX=0, 
    srcY=0, hdcSrc=0x0, bmp=@0x22d650) at ../include/wx/rawbmp.h:588
#1  0x6289a5f0 in wxDC::DoBlit (this=0x22e5f4, xdest=707, ydest=51, width=42, 
    height=18, source=0x22d574, xsrc=0, ysrc=0, rop=5, useMask=true, 
    xsrcMask=-1, ysrcMask=-1) at ../include/wx/msw/dc.h:107
#2  0x00cbb187 in wxDCBase::Blit (this=0x22e5f4, xdest=707, ydest=51, 
    width=42, height=18, source=0x22d574, xsrc=0, ysrc=0, rop=5, useMask=true, 
    xsrcMask=-1, ysrcMask=-1) at /devel/wxWidgets-2.8.7/include/wx/dc.h:306
#3  0x006fb732 in WebCore::BitmapImage::draw (this=0xfcc8b68, ctxt=0x10474bd8, 
    dst=@0x22d704, src=@0x22d724, op=CompositeSourceOver)
    at platform/graphics/wx/ImageWx.cpp:112
#4  0x0054b745 in WebCore::GraphicsContext::drawImage (this=0x10474bd8, 
    image=0xfcc8b68, dest=@0x22d784, src=@0x22d794, op=CompositeSourceOver, 
    useLowQualityScale=false) at platform/graphics/GraphicsContext.cpp:358
#5  0x0054ad20 in WebCore::GraphicsContext::drawImage (this=0x10474bd8, 
    image=0xfcc8b68, dest=@0x22d914, srcRect=@0x22d7e4, 
    op=CompositeSourceOver, useLowQualityScale=false)
    at platform/graphics/GraphicsContext.cpp:227
#6  0x0054ac5c in WebCore::GraphicsContext::drawImage (this=0x10474bd8, 
    image=0xfcc8b68, r=@0x22d914, op=CompositeSourceOver, 
    useLowQualityScale=false) at platform/graphics/GraphicsContext.cpp:217
#7  0x007449fe in WebCore::RenderImage::paintReplaced (this=0x103d904c, 
    paintInfo=@0x22d9f4, tx=707, ty=51) at rendering/RenderImage.cpp:258
#8  0x007301ab in WebCore::RenderReplaced::paint (this=0x103d904c, 
    paintInfo=@0x22d9f4, tx=707, ty=51) at rendering/RenderReplaced.cpp:129
#9  0x006fa66a in WebCore::InlineBox::paint (this=0xfc58a2c, 
    paintInfo=@0x22da74, tx=707, ty=51) at rendering/InlineBox.cpp:154
#10 0x00712470 in WebCore::InlineFlowBox::paint (this=0x10385114, 
    paintInfo=@0x22db04, tx=707, ty=51) at rendering/InlineFlowBox.cpp:640
---Type <return> to continue, or q <return> to quit---
#11 0x00712470 in WebCore::InlineFlowBox::paint (this=0x10385184, 
    paintInfo=@0x22dc84, tx=707, ty=51) at rendering/InlineFlowBox.cpp:640
#12 0x00707f14 in WebCore::RootInlineBox::paint (this=0x10385184, 
    paintInfo=@0x22dc84, tx=707, ty=51) at rendering/RootInlineBox.cpp:179
#13 0x00717b44 in WebCore::RenderFlow::paintLines (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderFlow.cpp:433
#14 0x006718e7 in WebCore::RenderBlock::paintContents (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderBlock.cpp:1502
#15 0x00672020 in WebCore::RenderBlock::paintObject (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderBlock.cpp:1586
#16 0x00671357 in WebCore::RenderBlock::paint (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderBlock.cpp:1416
#17 0x00672653 in WebCore::RenderBlock::paintFloats (this=0x1049fd9c, 
    paintInfo=@0x22df54, tx=0, ty=39, preservePhase=false)
    at rendering/RenderBlock.cpp:1650
#18 0x00672107 in WebCore::RenderBlock::paintObject (this=0x1049fd9c, 
    paintInfo=@0x22df54, tx=0, ty=39) at rendering/RenderBlock.cpp:1600
#19 0x00671357 in WebCore::RenderBlock::paint (this=0x1049fd9c, 
    paintInfo=@0x22df54, tx=0, ty=39) at rendering/RenderBlock.cpp:1416
#20 0x00671b14 in WebCore::RenderBlock::paintChildren (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1528
#21 0x00671909 in WebCore::RenderBlock::paintContents (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1504
#22 0x00672020 in WebCore::RenderBlock::paintObject (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1586
#23 0x00671357 in WebCore::RenderBlock::paint (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1416
#24 0x00671b14 in WebCore::RenderBlock::paintChildren (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1528
---Type <return> to continue, or q <return> to quit---
#25 0x00671909 in WebCore::RenderBlock::paintContents (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1504
#26 0x00672020 in WebCore::RenderBlock::paintObject (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1586
#27 0x00671357 in WebCore::RenderBlock::paint (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1416
#28 0x00671b14 in WebCore::RenderBlock::paintChildren (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1528
#29 0x00671909 in WebCore::RenderBlock::paintContents (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1504
#30 0x00672020 in WebCore::RenderBlock::paintObject (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1586
#31 0x00671357 in WebCore::RenderBlock::paint (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1416
#32 0x0050437b in WebCore::RenderLayer::paintLayer (this=0xfc95cd4, 
    rootLayer=0xfc3222c, p=0x10474bd8, paintDirtyRect=@0x22e5c4, 
    haveTransparency=false, paintRestriction=PaintRestrictionNone, 
    paintingRoot=0x0, appliedTransform=false) at rendering/RenderLayer.cpp:1599
#33 0x005045c7 in WebCore::RenderLayer::paintLayer (this=0xfc3222c, 
    rootLayer=0xfc3222c, p=0x10474bd8, paintDirtyRect=@0x22e5c4, 
    haveTransparency=false, paintRestriction=PaintRestrictionNone, 
    paintingRoot=0x0, appliedTransform=false) at rendering/RenderLayer.cpp:1626
#34 0x00503bc0 in WebCore::RenderLayer::paint (this=0xfc3222c, p=0x10474bd8, 
    damageRect=@0x22e5c4, paintRestriction=PaintRestrictionNone, 
    paintingRoot=0x0) at rendering/RenderLayer.cpp:1451
#35 0x0042ddc8 in WebCore::Frame::paint (this=0xfc3d188, p=0x10474bd8, 
    rect=@0x22e5c4) at page/Frame.cpp:1346
#36 0x0040c928 in wxWebView::OnPaint (this=0xfc3c638, event=@0x22e934)
    at WebView.cpp:442
---Type <return> to continue, or q <return> to quit---
#37 0x6cec7285 in wxEvtHandler::ProcessEventIfMatches (entry=@0x10852e0, 
    handler=0xfc3c638, event=@0x22e934) at ../include/wx/app.h:287
#38 0x6cec75dc in wxEventHashTable::HandleEvent (this=0x1, event=@0x22e934, 
    self=0xfc3c638) at ../include/wx/event.h:2319
#39 0x6cec85d9 in wxEvtHandler::ProcessEvent (this=0xfc3c638, event=@0x22e934)
    at ../src/common/event.cpp:1287
#40 0x628d4e34 in wxWindow::HandlePaint (this=0xfc3c638)
    at ../include/wx/window.h:612
#41 0x628da5e2 in wxWindow::MSWWindowProc (this=0xfc3c638, message=15, 
    wParam=0, lParam=0) at ../src/msw/window.cpp:2723
#42 0x628d1830 in wxWndProc (hWnd=0xa60bca, message=15, wParam=0, lParam=0)
    at ../src/msw/window.cpp:2594
#43 0x7e418734 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#44 0x00a60bca in xmlSchemaXPathProcessHistory ()
#45 0x7e418816 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#46 0x628d1780 in wxWindowCreationHook::~wxWindowCreationHook ()
    at ../src/msw/window.cpp:2566
#47 0x7e41b4c0 in USER32!DefWindowProcW ()
   from /cygdrive/c/WINDOWS/system32/user32.dll
#48 0x00000000 in ?? ()
(gdb) 





Mouse event crash:

Program received signal SIGSEGV, Segmentation fault.
0x0050c42e in WebCore::EventTargetNode::dispatchMouseEvent (this=0xfc56f30, 
    event=@0x22f57c, eventType=@0x1086dcc, detail=1, relatedTarget=0x0)
    at dom/EventTargetNode.cpp:195
195         ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
Current language:  auto; currently c++
(gdb) bt
#0  0x0050c42e in WebCore::EventTargetNode::dispatchMouseEvent (
    this=0xfc56f30, event=@0x22f57c, eventType=@0x1086dcc, detail=1, 
    relatedTarget=0x0) at dom/EventTargetNode.cpp:195
#1  0x0043b602 in WebCore::EventHandler::dispatchMouseEvent (this=0xfc3de70, 
    eventType=@0x1086dcc, targetNode=0xfc56f30, cancelable=true, clickCount=1, 
    mouseEvent=@0x22f57c, setUnder=false) at page/EventHandler.cpp:1262
#2  0x0043a4df in WebCore::EventHandler::handleMouseReleaseEvent (
    this=0xfc3de70, mouseEvent=@0x22f57c) at page/EventHandler.cpp:1079
#3  0x0040cbf7 in wxWebView::OnMouseEvents (this=0xfc3c638, event=@0x22f6bc)
    at WebView.cpp:483
#4  0x6cec7285 in wxEvtHandler::ProcessEventIfMatches (entry=@0x1085328, 
    handler=0xfc3c638, event=@0x22f6bc) at ../include/wx/app.h:287
#5  0x6cec75dc in wxEventHashTable::HandleEvent (this=0x1, event=@0x22f6bc, 
    self=0xfc3c638) at ../include/wx/event.h:2319
#6  0x6cec85d9 in wxEvtHandler::ProcessEvent (this=0xfc3c638, event=@0x22f6bc)
    at ../src/common/event.cpp:1287
#7  0x628d6996 in wxWindow::HandleMouseEvent (this=0xfc3c638, msg=167, x=167, 
    y=167, flags=167) at ../include/wx/window.h:612
#8  0x628d95c1 in wxWindow::MSWWindowProc (this=0xfc3c638, message=514, 
    wParam=0, lParam=9109751) at ../src/msw/window.cpp:2860
#9  0x628d1830 in wxWndProc (hWnd=0x7a0b20, message=514, wParam=0, 
    lParam=9109751) at ../src/msw/window.cpp:2594
#10 0x7e418734 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#11 0x007a0b20 in WebCore::HTMLTokenizer::HTMLTokenizer (this=0x628d1780, 
    doc=0x7a0b20, reportErrors=220) at html/HTMLTokenizer.cpp:169
#12 0x7e418816 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#13 0x628d1780 in wxWindowCreationHook::~wxWindowCreationHook ()
    at ../src/msw/window.cpp:2566
#14 0x7e4189cd in USER32!GetWindowLongW ()
---Type <return> to continue, or q <return> to quit---
   from /cygdrive/c/WINDOWS/system32/user32.dll
#15 0x00000000 in ?? ()
(gdb) 

[Kevin Ollivier]

If you want to submit a patch for review, you should flag it with a '?' rather than a '+'. A WebKit reviewer needs to be the one to give it a '+', which means it's ready to land in the trunk. (All WebKit patches must be reviewed by someone other than the submitter.) Thanks!

[Alexander Vassilev]

Ups, sorry, Kevin, as you can see I am not yet familiar with bugzilla :) Sorry for the confusion

[Kevin Ollivier]

Landed in r34178, thanks!