This is http://code.google.com/p/chromium/issues/detail?id=111027 and possibly http://code.google.com/p/chromium/issues/detail?id=114517. This continues the discussion from '027. To repro: - Load http://maps.google.com/ but do not mouse over the page. - When the page is done loading, set a breakpoint on the last line of CachedImage::imageForRenderer, where Image::nullImage() is returned. - Mouse over the page, continue over the breakpoint until it is called from EventHandler::selectCursor Inside of EventHandler::selectCursor, it looks to see if the CSS style has a cursor set: if (style && style->cursors()) { const CursorList* cursors = style->cursors(); for (unsigned i = 0; i < cursors->size(); ++i) { CachedImage* cimage = 0; StyleImage* image = (*cursors)[i].image(); if (image && image->isCachedImage()) cimage = static_cast<StyleCachedImage*>(image)->cachedImage(); if (!cimage) continue; IntPoint hotSpot = (*cursors)[i].hotSpot(); // Limit the size of cursors so that they cannot be used to cover UI elements in chrome. IntSize size = cimage->imageForRenderer(renderer)->size(); // ***1*** if (size.width() > 128 || size.height() > 128) continue; if (!cimage->errorOccurred()) // ***2*** return Cursor(cimage->imageForRenderer(renderer), hotSpot); // ***3*** } } In my repro case, there is one item in the |cursors| list. Indeed, the type is a CachedImage. Inside of CachedImage, errorOccurred() returns false, but there is no m_image. So Image::nullImage() is returned from CachedImage::imageForRenderer (line 1) Its size is 0x0, so it passes the tests, and since no error occurred (line 2), a bogus cursor is created (line 3). What is going on here? Why are the cached images not loading?
BTW, along the lines of blaming caching, another repro is: http://www.w3schools.com/cssref/playit.asp?filename=playcss_cursor&preval=url(smiley.gif),url(myBall.cur),auto Watch it work. Let it sit for twenty minutes. The cursor no longer works.
Do any of you know what set of states that corresponds to in CachedImage?
(In reply to comment #2) > Do any of you know what set of states that corresponds to in CachedImage? I think this is the same root cause as https://bugs.webkit.org/show_bug.cgi?id=73760
(In reply to comment #3) > (In reply to comment #2) > > Do any of you know what set of states that corresponds to in CachedImage? > > I think this is the same root cause as https://bugs.webkit.org/show_bug.cgi?id=73760 It's possibly related, but the patch you posted didn't change this.
Created attachment 127615 [details] patch
Comment on attachment 127615 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=127615&action=review This change looks very reasonable. I wish he had a test for the change. I talked with Nate, and he's been working on trying to reduce the bug into a test for a while without success. If anyone thoughts on how to write a test, please let us know. > Source/WebCore/rendering/style/StyleCachedImage.h:59 > + StyleCachedImage(CachedImage*); explicit
The problem with getting a reduced testcase is that the bug is that images get evicted under cache pressure. If there's a way to force the cache to clean itself out that might help.
http://trac.webkit.org/changeset/108100
Maybe layoutTestController.setCacheModel would help?
*** Bug 73760 has been marked as a duplicate of this bug. ***