Bug 98456 – [chromium] Crash in WebCore::GraphicsLayerChromium::setContentsToImage

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Nick Carter]

GraphicsLayerChromium::setContentsToImage does not handle a null return from nativeImageForCurrentFrame().

This can happen if there is an error early in the decoding of an image. I have a layout test that demonstrates the crash, and a proposed fix.

[Nick Carter]

Created attachment 167188 [details]
Patch

[James Robinson]

Comment on attachment 167188 [details]
Patch

R=me. Thanks for tracking this down!

[Abhishek Arya]

Note that null ptr crashes are not security bugs. Please don't use the security template for such bugs in the future.

[Nick Carter]

@inferno -- that's what I thought, but I figured I'd rather be wrong in this direction than in the other direction.

[Abhishek Arya]

(In reply to comment #4)
> @inferno -- that's what I thought, but I figured I'd rather be wrong in this direction than in the other direction.

Feel free to poke us anytime on chat :)

[WebKit Review Bot]

Comment on attachment 167188 [details]
Patch

Rejecting attachment 167188 [details] from commit-queue.

[e-mail] does not have committer permissions according to http://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/committers.py.

- If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags.

- If you have committer rights please correct the error in Tools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed).  The commit-queue restarts itself every 2 hours.  After restart the commit-queue will correctly respect your committer rights.

[WebKit Review Bot]

Comment on attachment 167188 [details]
Patch

Rejecting attachment 167188 [details] from commit-queue.

Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2

Last 500 characters of output:

Auto-merging Source/WebCore/ChangeLog
CONFLICT (content): Merge conflict in Source/WebCore/ChangeLog
Failed to merge in the changes.
Patch failed at 0001 Try to fix the build.

When you have resolved this problem run "git rebase --continue".
If you would prefer to skip this patch, instead run "git rebase --skip".
To restore the original branch and stop rebasing run "git rebase --abort".

rebase refs/remotes/origin/master: command returned error: 1

Died at Tools/Scripts/update-webkit line 164.

Full output: http://queues.webkit.org/results/14183550

[WebKit Review Bot]

Comment on attachment 167188 [details]
Patch

Clearing flags on attachment: 167188

Committed r130610: <http://trac.webkit.org/changeset/130610>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Simon Fraser (smfr)]

The ref test is failing on Mac.

[James Robinson]

What does the failure look like?

[Simon Fraser (smfr)]

The partial image is black. This is probably an OS-level thing.

[Simon Fraser (smfr)]

http://build.webkit.org/results/Apple%20Lion%20Debug%20WK1%20(Tests)/r130656%20(3475)/results.html

[Nick Carter]

The reftest is based on the assumption that a broken image will render the same regardless of whether or not it has an identity transform applied (in this case, a z-transform of zero). If that assumption is invalid for the Mac port, we can change this test so that it's not a reftest -- all I really needed was a "doesn't crash" expectation; making it a reftest was gravy.

Please let me know if you'd like me to relax the test in that way.

[Simon Fraser (smfr)]

Yes, you should change the test. A 'do not crash' test should never be a ref test anyway, because those are more expensive to run.

The new test can use internals.layerTreeAsText() to verify that the image is going into a compositing layer.

[Simon Fraser (smfr)]

Oh, and we should have a separate bug on the fact that the image is black on Mac.

[Simon Fraser (smfr)]

It's bad to leave the test failing for so long. I'm gonna make it an ImageOnlyFailure in Mac TestExpectations.

[Simon Fraser (smfr)]

http://trac.webkit.org/changeset/131010