Hi, When loading WebKit LayoutTest/fast/text/text-shadow-extreme-value.html, GtkLauncher crashes. The same LayoutTest crashes WinCairo build too. Here is the stack trace, caught in gdb: ASSERTION FAILED: m_ptr (../../JavaScriptCore/wtf/OwnPtr.h:66 typename WTF::RemovePointer<T>::Type* WTF::OwnPtr<T>::operator->() const [with T = WebCore::ImageBuffer]) Program received signal SIGSEGV, Segmentation fault. #0 0x005fc9a6 in WTF::OwnPtr<WebCore::ImageBuffer>::operator-> (this=0x8587de4) at ../../JavaScriptCore/wtf/OwnPtr.h:66 #1 0x00a66d00 in WebCore::FilterEffect::getEffectContext (this=0x8587d98) at ../../WebCore/platform/graphics/filters/FilterEffect.cpp:77 #2 0x00a66060 in WebCore::FEGaussianBlur::apply (this=0x8587d98, filter=0x856ce68) at ../../WebCore/platform/graphics/filters/FEGaussianBlur.cpp:108 #3 0x00b8f4b9 in WebCore::GraphicsContext::createPlatformShadow (this=0xbfffeb18, buffer=..., shadowColor=..., shadowRect=..., kernelSize=1000) at ../../WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp:912 #4 0x00b8bd26 in WebCore::Font::drawGlyphs (this=0x85777f8, context=0xbfffeb18, font=0x8592c28, glyphBuffer=..., from=0, numGlyphs=49, point=...) at ../../WebCore/platform/graphics/cairo/FontCairo.cpp:116 #5 0x00807afa in WebCore::Font::drawGlyphBuffer (this=0x85777f8, context=0xbfffeb18, glyphBuffer=..., point=...) at ../../WebCore/platform/graphics/FontFastPath.cpp:241 #6 0x00807931 in WebCore::Font::drawSimpleText (this=0x85777f8, context=0xbfffeb18, run=..., point=..., from=0, to=49) at ../../WebCore/platform/graphics/FontFastPath.cpp:214 #7 0x007f995d in WebCore::Font::drawText (this=0x85777f8, context=0xbfffeb18, run=..., point=..., from=0, to=49) at ../../WebCore/platform/graphics/Font.cpp:153 #8 0x00812ee1 in WebCore::GraphicsContext::drawText (this=0xbfffeb18, font=..., run=..., point=..., from=0, to=49) at ../../WebCore/platform/graphics/GraphicsContext.cpp:337 #9 0x00882af2 in paintTextWithShadows (context=0xbfffeb18, font=..., textRun=..., startOffset=0, endOffset=49, truncationPoint=49, textOrigin=..., x=8, y=8, w=405, h=19, shadow=0x85902e0, stroked=false) at ../../WebCore/rendering/InlineTextBox.cpp:338 #10 0x008839cc in WebCore::InlineTextBox::paint (this=0x8529bcc, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/InlineTextBox.cpp:528 #11 0x0087b96b in WebCore::InlineFlowBox::paint (this=0x855c63c, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/InlineFlowBox.cpp:695 #12 0x0096e252 in WebCore::RootInlineBox::paint (this=0x855c63c, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RootInlineBox.cpp:166 #13 0x00910862 in WebCore::RenderLineBoxList::paint (this=0x81dee50, renderer=0x81dede4, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RenderLineBoxList.cpp:219 #14 0x00891e03 in WebCore::RenderBlock::paintContents (this=0x81dede4, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RenderBlock.cpp:2089 #15 0x0089258d in WebCore::RenderBlock::paintObject (this=0x81dede4, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RenderBlock.cpp:2184 #16 0x008916af in WebCore::RenderBlock::paint (this=0x81dede4, paintInfo=..., tx=8, ty=8) ---Type <return> to continue, or q <return> to quit--- at ../../WebCore/rendering/RenderBlock.cpp:1980 #17 0x008920db in WebCore::RenderBlock::paintChildren (this=0x8543974, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RenderBlock.cpp:2117 #18 0x00891e25 in WebCore::RenderBlock::paintContents (this=0x8543974, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RenderBlock.cpp:2091 #19 0x0089258d in WebCore::RenderBlock::paintObject (this=0x8543974, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RenderBlock.cpp:2184 #20 0x008916af in WebCore::RenderBlock::paint (this=0x8543974, paintInfo=..., tx=8, ty=8) at ../../WebCore/rendering/RenderBlock.cpp:1980 #21 0x008920db in WebCore::RenderBlock::paintChildren (this=0x854466c, paintInfo=..., tx=0, ty=0) at ../../WebCore/rendering/RenderBlock.cpp:2117 #22 0x00891e25 in WebCore::RenderBlock::paintContents (this=0x854466c, paintInfo=..., tx=0, ty=0) at ../../WebCore/rendering/RenderBlock.cpp:2091 #23 0x0089258d in WebCore::RenderBlock::paintObject (this=0x854466c, paintInfo=..., tx=0, ty=0) at ../../WebCore/rendering/RenderBlock.cpp:2184 #24 0x008916af in WebCore::RenderBlock::paint (this=0x854466c, paintInfo=..., tx=0, ty=0) at ../../WebCore/rendering/RenderBlock.cpp:1980 #25 0x0090499e in WebCore::RenderLayer::paintLayer (this=0x81da53c, rootLayer=0x81fb6f4, p=0xbfffeb18, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, overlapTestRequests=0xbfffe95c, paintFlags=0) at ../../WebCore/rendering/RenderLayer.cpp:2446 #26 0x00904d4d in WebCore::RenderLayer::paintList (this=0x81fb6f4, list=0x80c51d0, rootLayer=0x81fb6f4, p=0xbfffeb18, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, overlapTestRequests=0xbfffe95c, paintFlags=0) at ../../WebCore/rendering/RenderLayer.cpp:2499 #27 0x00904b5e in WebCore::RenderLayer::paintLayer (this=0x81fb6f4, rootLayer=0x81fb6f4, p=0xbfffeb18, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, overlapTestRequests=0xbfffe95c, paintFlags=0) at ../../WebCore/rendering/RenderLayer.cpp:2467 #28 0x00903e92 in WebCore::RenderLayer::paint (this=0x81fb6f4, p=0xbfffeb18, damageRect=..., paintBehavior=0, paintingRoot=0x0) at ../../WebCore/rendering/RenderLayer.cpp:2252 #29 0x0077e001 in WebCore::FrameView::paintContents (this=0x8178a00, p=0xbfffeb18, rect=...) at ../../WebCore/page/FrameView.cpp:1941 #30 0x007e78f4 in WebCore::ScrollView::paint (this=0x8178a00, context=0xbfffeb18, rect=...) at ../../WebCore/platform/ScrollView.cpp:797 #31 0x00c0d162 in webkit_web_view_expose_event (widget=0x812d808, event=0xbfffef88) at ../../WebKit/gtk/webkit/webkitwebview.cpp:539 #32 0x01fc62f4 in ?? () from /usr/lib/libgtk-x11-2.0.so.0 #33 0x025928b9 in ?? () from /usr/lib/libgobject-2.0.so.0 ---Type <return> to continue, or q <return> to quit--- #34 0x02594252 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0 #35 0x025a85e6 in ?? () from /usr/lib/libgobject-2.0.so.0 #36 0x025a9c33 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0 #37 0x025aa256 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0 #38 0x020f3306 in ?? () from /usr/lib/libgtk-x11-2.0.so.0 #39 0x01fbffeb in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0 #40 0x0229980b in ?? () from /usr/lib/libgdk-x11-2.0.so.0 #41 0x022997ba in ?? () from /usr/lib/libgdk-x11-2.0.so.0 #42 0x022c2964 in ?? () from /usr/lib/libgdk-x11-2.0.so.0 #43 0x02295f63 in ?? () from /usr/lib/libgdk-x11-2.0.so.0 #44 0x02297f7f in gdk_window_process_all_updates () from /usr/lib/libgdk-x11-2.0.so.0 #45 0x01f356df in ?? () from /usr/lib/libgtk-x11-2.0.so.0 #46 0x02274318 in ?? () from /usr/lib/libgdk-x11-2.0.so.0 #47 0x02610661 in ?? () from /lib/libglib-2.0.so.0 #48 0x026125e5 in g_main_context_dispatch () from /lib/libglib-2.0.so.0 #49 0x026162d8 in ?? () from /lib/libglib-2.0.so.0 #50 0x02616817 in g_main_loop_run () from /lib/libglib-2.0.so.0 #51 0x01fc0299 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #52 0x0804a093 in main (argc=1, argv=0xbffff494) at ../../WebKitTools/GtkLauncher/main.c:224 Regards, Mihnea
Debugging a little, i have found that the allocation of m_effectBuffer in FilterEffect::getEffectContext() fails. In the first place, i have thought that the fix for the problem is to add a null check in this function, but then i have realized that the problem appears because in function GraphicsContext::calculateShadowBufferDimensions the kernel size is not limitted at all. The LayoutTest uses a blurRadius = 38005685px, which gives a very bug kernel that is not limitted to 1000 as in GraphicsContext::createPlatformShadow (both from GraphicsContextCairo.cpp). * I think the fix should be to limit the kernel size in calculateShadowBufferDimensions the same way it is done in createPlatformShadow * Taking a look at GraphicsContext::setPlatformShadow() from GraphicsContextCG.cpp, i can see that the blurRadius is clamped to 1000, not the kernel, which in the case of Cairo port (Win/Gtk) is computed to be sqrt(2*blurRadius). Am i missing something here? Regards, Mihnea Ovidenie
Soon the blur radius will be limited to 128, similar to other ports. See this bug: https://bugs.webkit.org/show_bug.cgi?id=45599
The shadows code has changed completely, I've tested it and it does not crash anymore. Feel free to reopen if I missed something.