[TextureMapper] Crashed in TextureMapperLayer::paintUsingOverlapRegions 1. Start GTK MiniBrowser 2. Go to http://www.satine.org/research/webkit/snowleopard/snowstack.html 3. Press right arrow key to scroll 4. Crash Thread 1 (Thread 0x7f1cdffff700 (LWP 61)): #0 0x00007f1d4ea5f218 in WTFCrash() () at ../../Source/WTF/wtf/Assertions.cpp:295 #1 0x00007f1d5ce7f061 in WTF::CrashOnOverflow::crash() () at DerivedSources/ForwardingHeaders/wtf/CheckedArithmetic.h:127 #2 0x00007f1d5ce7f058 in WTF::CrashOnOverflow::overflowed() () at DerivedSources/ForwardingHeaders/wtf/CheckedArithmetic.h:120 #3 0x00007f1d5dffcfac in WTF::Checked<unsigned int, WTF::CrashOnOverflow>::Checked(WTF::ResultOverflowedTag) (this=0x7f1cdfffa8f0) at DerivedSources/ForwardingHeaders/wtf/CheckedArithmetic.h:658 #4 0x00007f1d5dff9bad in WTF::operator*<unsigned int, int, WTF::CrashOnOverflow>(WTF::Checked<unsigned int, WTF::CrashOnOverflow>, WTF::Checked<int, WTF::CrashOnOverflow>) (lhs=..., rhs=...) at DerivedSources/ForwardingHeaders/wtf/CheckedArithmetic.h:975 #5 0x00007f1d5dff3246 in WTF::operator*<unsigned int, int, WTF::CrashOnOverflow>(WTF::Checked<unsigned int, WTF::CrashOnOverflow>, int) (lhs=..., rhs=156276) at DerivedSources/ForwardingHeaders/wtf/CheckedArithmetic.h:1003 #6 0x00007f1d5dfeec2a in WebCore::IntSize::area<WTF::CrashOnOverflow>() const (this=0x7f1cdfffa940) at DerivedSources/ForwardingHeaders/WebCore/IntSize.h:136 #7 0x00007f1d5e5dbc8d in WebCore::TextureMapperLayer::paintUsingOverlapRegions(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04265100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:370 #8 0x00007f1d5e5dcd89 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04265100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:485 #9 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04264b80, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #10 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04264b80, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #11 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04264b80, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #12 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042ae000, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #13 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042ae000, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #14 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042ae000, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #15 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b3680, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #16 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b3680, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #17 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b3680, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #18 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b3100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #19 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b3100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #20 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b3100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #21 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b0100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #22 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b0100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #23 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b0100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #24 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04274680, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #25 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04274680, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #26 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04274680, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #27 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2b80, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #28 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2b80, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #29 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2b80, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #30 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2600, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #31 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2600, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #32 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2600, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #33 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042ae580, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #34 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042ae580, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #35 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042ae580, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #36 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2080, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #37 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2080, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #38 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b2080, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #39 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1b00, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #40 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1b00, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #41 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1b00, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #42 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1580, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #43 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1580, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #44 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1580, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #45 0x00007f1d5e5dac1f in WebCore::TextureMapperLayer::paintSelfAndChildren(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1000, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:241 #46 0x00007f1d5e5daf86 in WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1000, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:281 #47 0x00007f1d5e5dcd69 in WebCore::TextureMapperLayer::paintRecursive(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d042b1000, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:481 #48 0x00007f1d5e5d9eaf in WebCore::TextureMapperLayer::paint() (this=0x7f1d042b1000) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:137 #49 0x00007f1d5da03623 in WebKit::CoordinatedGraphicsScene::paintToCurrentGLContext(WebCore::TransformationMatrix const&, WebCore::FloatRect const&, unsigned int) (this=0x7f1cfc27e000, matrix=..., clipRect=..., PaintFlags=0) at ../../Source/WebKit/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:79 #50 0x00007f1d5da077ea in WebKit::ThreadedCompositor::renderLayerTree() (this=0x7f1cfc283280) at ../../Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:220 #51 0x00007f1d5da068a7 in WebKit::ThreadedCompositor::<lambda()>::operator()(void) const (__closure=0x7f1cfc293848) at ../../Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:56 #52 0x00007f1d5da0e9b8 in WTF::Detail::CallableWrapper<WebKit::ThreadedCompositor::ThreadedCompositor(WebKit::ThreadedCompositor::Client&, WebKit::ThreadedDisplayRefreshMonitor::Client&, WebCore::PlatformDisplayID, const WebCore::IntSize&, float, WebCore::TextureMapper::PaintFlags)::<lambda()>, void>::call(void) (this=0x7f1cfc293840) at DerivedSources/ForwardingHeaders/wtf/Function.h:52 #53 0x00007f1d5ce82513 in WTF::Function<void ()>::operator()() const (this=0x7f1d4522cc48) at DerivedSources/ForwardingHeaders/wtf/Function.h:83 #54 0x00007f1d5da067d7 in WebKit::CompositingRunLoop::updateTimerFired() (this=0x7f1d4522cc00) at ../../Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/CompositingRunLoop.cpp:188 #55 0x00007f1d5da249d2 in WTF::RunLoop::Timer<WebKit::CompositingRunLoop>::fired() (this=0x7f1d4522cc08) at DerivedSources/ForwardingHeaders/wtf/RunLoop.h:173 #56 0x00007f1d4eb1a88b in WTF::RunLoop::TimerBase::<lambda(gpointer)>::operator()(gpointer) const (__closure=0x0, userData=0x7f1d4522cc08) at ../../Source/WTF/wtf/glib/RunLoopGLib.cpp:146 #57 0x00007f1d4eb1a8cb in WTF::RunLoop::TimerBase::<lambda(gpointer)>::_FUN(gpointer) () at ../../Source/WTF/wtf/glib/RunLoopGLib.cpp:150 #58 0x00007f1d4eb1a0ba in WTF::<lambda(GSource*, GSourceFunc, gpointer)>::operator()(GSource *, GSourceFunc, gpointer) const (__closure=0x0, source=0x55ede51ca170, callback=0x7f1d4eb1a8ae <WTF::RunLoop::TimerBase::<lambda(gpointer)>::_FUN(gpointer)>, userData=0x7f1d4522cc08) at ../../Source/WTF/wtf/glib/RunLoopGLib.cpp:45 #59 0x00007f1d4eb1a0ea in WTF::<lambda(GSource*, GSourceFunc, gpointer)>::_FUN(GSource *, GSourceFunc, gpointer) () at ../../Source/WTF/wtf/glib/RunLoopGLib.cpp:46 #60 0x00007f1d47e00c3e in g_main_dispatch (context=0x7f1cd4000b60) at ../glib/gmain.c:3309 #61 0x00007f1d47e00c3e in g_main_context_dispatch (context=context@entry=0x7f1cd4000b60) at ../glib/gmain.c:3974 #62 0x00007f1d47e00ff0 in g_main_context_iterate (context=0x7f1cd4000b60, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4047 #63 0x00007f1d47e012e3 in g_main_loop_run (loop=0x7f1cd4001480) at ../glib/gmain.c:4241 #64 0x00007f1d4eb1a66a in WTF::RunLoop::run() () at ../../Source/WTF/wtf/glib/RunLoopGLib.cpp:96 #65 0x00007f1d5da05f17 in WebKit::<lambda()>::operator()(void) const (__closure=0x7f1cfc2872a8) at ../../Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/CompositingRunLoop.cpp:49 #66 0x00007f1d5da0eaa8 in WTF::Detail::CallableWrapper<WebKit::createRunLoop()::<lambda()>, void>::call(void) (this=0x7f1cfc2872a0) at DerivedSources/ForwardingHeaders/wtf/Function.h:52 #67 0x00007f1d5ce82513 in WTF::Function<void ()>::operator()() const (this=0x7f1cdfffec30) at DerivedSources/ForwardingHeaders/wtf/Function.h:83 #68 0x00007f1d4ea98925 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) (newThreadContext=0x7f1cfc2862d0) at ../../Source/WTF/wtf/Threading.cpp:167 #69 0x00007f1d4eb21195 in WTF::wtfThreadEntryPoint(void*) (context=0x7f1cfc2862d0) at ../../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:197 #70 0x00007f1d48e815e2 in start_thread (arg=<optimized out>) at pthread_create.c:479 #71 0x00007f1d46b0a473 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
> #7 0x00007f1d5e5dbc8d in WebCore::TextureMapperLayer::paintUsingOverlapRegions(WebCore::TextureMapperPaintOptions const&) (this=0x7f1d04265100, options=...) at ../../Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:370 368 // Having both overlap and non-overlap regions carries some overhead. Avoid it if the overlap area 369 // is big anyway. 370 if (overlapRegion.bounds().size().area() > nonOverlapRegion.bounds().size().area()) { 371 overlapRegion.unite(nonOverlapRegion); 372 nonOverlapRegion = Region(); 373 } This code was added by r149369 (Bug 115226).
Created attachment 405335 [details] WIP patch
TextureMapperLayer::computeOverlapRegions has the following code: > boundingRect = m_layerTransforms.combined.mapRect(boundingRect); This code calculates a tranformed bounding rect. The original bounding rect was the the img size of thumbnail. It was 187x132. Then, it was transformed into 650749x156033. Why does it apply 3d transform to calculate a overlap region?
<rdar://problem/66489090>
Created attachment 411196 [details] test case
Created attachment 411496 [details] WIP patch
Created attachment 411525 [details] Patch
Comment on attachment 411525 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=411525&action=review Jut a minor comment, I'll leave the actual review to Miguel > Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:326 > +void TextureMapperLayer::computeOverlapRegions(Region& overlapRegion, Region& nonOverlapRegion, ResolveSelfOverlapMode mode, IntRect clipBounds) const IntRect& clipBounds? or even IntRect&& if clipbounds is not used by the caller after this.
Created attachment 411641 [details] Patch
Thank you for the review, KaL. Addressed the point. This patch makes compositing/clipping/border-radius-stacking-context-clip.html pass unexpectedly. This seems regression, not progression. I will check it.
(In reply to Fujii Hironori from comment #10) > This patch makes > compositing/clipping/border-radius-stacking-context-clip.html > pass unexpectedly. > > This seems regression, not progression. I will check it. I'm going to fix it in Bug 214868.
Created attachment 412499 [details] Patch
Oops. This patch make compositing/clipping/border-radius-stacking-context-clip.html fail again. I'll check it.
(In reply to Fujii Hironori from comment #13) > Oops. This patch make > compositing/clipping/border-radius-stacking-context-clip.html fail again. > I'll check it. r269204 fixed the issue.
Created attachment 412804 [details] Patch
Created attachment 412853 [details] Patch
Created attachment 412854 [details] Patch
Created attachment 412867 [details] Patch
Review?
Comment on attachment 412867 [details] Patch Clearing flags on attachment: 412867 Committed r269328: <https://trac.webkit.org/changeset/269328>
All reviewed patches have been landed. Closing bug.