Crash in WebCore::ImageBuffer::context

[renatahodovan]

The crashing test is attached. I haven't pasted it here, since it contains a lot whitespaces, what are necessary to reproduce the bug (its probably related to the size of the test).

The backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffa66a9700 (LWP 7221)]
0x00007ffff3fd98ae in WTF::OwnPtr<WebCore::GraphicsContext>::get (this=0xa0) at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/OwnPtr.h:65
65          PtrType get() const { return m_ptr; }
(gdb) bt
#0  0x00007ffff3fd98ae in WTF::OwnPtr<WebCore::GraphicsContext>::get (this=0xa0) at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/OwnPtr.h:65
#1  0x00007ffff3fd83b2 in WebCore::ImageBuffer::context (this=0x0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp:123
#2  0x00007ffff359bd62 in WebCore::ShadowBlur::beginShadowLayer (this=0x70cc20, context=0x6f4d60, layerArea=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/ShadowBlur.cpp:900
#3  0x00007ffff3fd6592 in WebCore::GraphicsContext::drawLineForText (this=0x6f4d60, origin=..., width=66936)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp:630
#4  0x00007ffff36c0589 in WebCore::InlineTextBox::paintDecoration (this=0x731748, context=0x6f4d60, boxOrigin=..., deco=WebCore::TextDecorationUnderline, 
    decorationStyle=WebCore::TextDecorationStyleSolid, shadow=0x0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/InlineTextBox.cpp:1226
#5  0x00007ffff36be512 in WebCore::InlineTextBox::paint (this=0x731748, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/InlineTextBox.cpp:802
#6  0x00007ffff36b0dfd in WebCore::InlineFlowBox::paint (this=0x688a18, paintInfo=..., paintOffset=..., lineTop=<incomplete type>, 
    lineBottom=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/InlineFlowBox.cpp:1170
#7  0x00007ffff38a54d2 in WebCore::RootInlineBox::paint (this=0x688a18, paintInfo=..., paintOffset=..., lineTop=<incomplete type>, 
    lineBottom=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RootInlineBox.cpp:218
#8  0x00007ffff380dc5b in WebCore::RenderLineBoxList::paint (this=0x711e90, renderer=0x711df8, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLineBoxList.cpp:262
#9  0x00007ffff36d611d in WebCore::RenderBlock::paintContents (this=0x711df8, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3209
#10 0x00007ffff36d6c3c in WebCore::RenderBlock::paintObject (this=0x711df8, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3327
#11 0x00007ffff36d48ed in WebCore::RenderBlock::paint (this=0x711df8, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3022
#12 0x00007ffff36d65fb in WebCore::RenderBlock::paintChild (this=0x6b13f8, child=0x711df8, paintInfo=..., paintOffset=..., paintInfoForChild=..., 
    usePrintRect=false) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3260
#13 0x00007ffff36d625b in WebCore::RenderBlock::paintChildren (this=0x6b13f8, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3229
#14 0x00007ffff36d61ff in WebCore::RenderBlock::paintContents (this=0x6b13f8, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3222
#15 0x00007ffff36d6c3c in WebCore::RenderBlock::paintObject (this=0x6b13f8, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3327
#16 0x00007ffff36d48ed in WebCore::RenderBlock::paint (this=0x6b13f8, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3022
#17 0x00007ffff36d65fb in WebCore::RenderBlock::paintChild (this=0x714228, child=0x6b13f8, paintInfo=..., paintOffset=..., paintInfoForChild=..., 
    usePrintRect=false) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3260
#18 0x00007ffff36d625b in WebCore::RenderBlock::paintChildren (this=0x714228, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3229
#19 0x00007ffff36d61ff in WebCore::RenderBlock::paintContents (this=0x714228, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3222
#20 0x00007ffff36d6c3c in WebCore::RenderBlock::paintObject (this=0x714228, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3327
#21 0x00007ffff36d48ed in WebCore::RenderBlock::paint (this=0x714228, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3022
#22 0x00007ffff36d65fb in WebCore::RenderBlock::paintChild (this=0x714158, child=0x714228, paintInfo=..., paintOffset=..., paintInfoForChild=..., 
    usePrintRect=false) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3260
#23 0x00007ffff36d625b in WebCore::RenderBlock::paintChildren (this=0x714158, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3229
#24 0x00007ffff36d61ff in WebCore::RenderBlock::paintContents (this=0x714158, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3222
#25 0x00007ffff36d6c3c in WebCore::RenderBlock::paintObject (this=0x714158, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3327
#26 0x00007ffff36d48ed in WebCore::RenderBlock::paint (this=0x714158, paintInfo=..., paintOffset=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderBlock.cpp:3022
#27 0x00007ffff37d8705 in WebCore::RenderLayer::paintForegroundForFragmentsWithPhase (this=0x714838, phase=WebCore::PaintPhaseForeground, layerFragments=..., 
---Type <return> to continue, or q <return> to quit---
    context=0x6f4d60, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayer.cpp:4235
#28 0x00007ffff37d840a in WebCore::RenderLayer::paintForegroundForFragments (this=0x714838, layerFragments=..., context=0x6f4d60, 
    transparencyLayerContext=0x6f4d60, transparencyPaintDirtyRect=..., haveTransparency=false, localPaintingInfo=..., paintBehavior=0, 
    subtreePaintRootForRenderer=0x0, selectionOnly=false, forceBlackText=false)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayer.cpp:4211
#29 0x00007ffff37d6d3e in WebCore::RenderLayer::paintLayerContents (this=0x714838, context=0x6f4d60, paintingInfo=..., paintFlags=224)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayer.cpp:3942
#30 0x00007ffff37d5bd0 in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x714838, context=0x6f4d60, paintingInfo=..., paintFlags=224)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayer.cpp:3702
#31 0x00007ffff37d5ac5 in WebCore::RenderLayer::paintLayer (this=0x714838, context=0x6f4d60, paintingInfo=..., paintFlags=224)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayer.cpp:3684
#32 0x00007ffff37d73cd in WebCore::RenderLayer::paintList (this=0x713b98, list=0x89a430, context=0x6f4d60, paintingInfo=..., paintFlags=224)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayer.cpp:4028
#33 0x00007ffff37d6dfd in WebCore::RenderLayer::paintLayerContents (this=0x713b98, context=0x6f4d60, paintingInfo=..., paintFlags=224)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayer.cpp:3953
#34 0x00007ffff37f6586 in WebCore::RenderLayerBacking::paintIntoLayer (this=0x7150e0, graphicsLayer=0x7f62d0, context=0x6f4d60, paintDirtyRect=..., 
    paintBehavior=0, paintingPhase=7) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayerBacking.cpp:1997
#35 0x00007ffff37f68dc in WebCore::RenderLayerBacking::paintContents (this=0x7150e0, graphicsLayer=0x7f62d0, context=..., paintingPhase=7, clip=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLayerBacking.cpp:2042
#36 0x00007ffff35823bb in WebCore::GraphicsLayer::paintGraphicsLayerContents (this=0x7f62d0, context=..., clip=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/GraphicsLayer.cpp:324
#37 0x00007ffff35ea625 in WebCore::CoordinatedGraphicsLayer::tiledBackingStorePaint (this=0x7f62d0, context=0x6f4d60, rect=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:906
#38 0x00007ffff360715b in WebCore::CoordinatedTile::paintToSurfaceContext (this=0x8fbd00, context=0x6f4d60)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedTile.cpp:104
#39 0x00007ffff3607ba8 in WebCore::UpdateAtlasSurfaceClient::paintToSurfaceContext (this=0x7fffffffd1b0, context=0x6f4d60)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/UpdateAtlas.cpp:50
#40 0x00007ffff4537ca3 in WebKit::WebCoordinatedSurface::paintToSurface (this=0x809c70, rect=..., client=0x7fffffffd1b0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebKit2/Shared/CoordinatedGraphics/WebCoordinatedSurface.cpp:189
#41 0x00007ffff3607a30 in WebCore::UpdateAtlas::paintOnAvailableBuffer (this=0x7d8da0, size=..., atlasID=@0x7fffffffd304: 1, offset=..., client=0x8fbd10)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/UpdateAtlas.cpp:110
#42 0x00007ffff35d801f in WebCore::CompositingCoordinator::paintToSurface (this=0x80f530, size=..., flags=0, atlasID=@0x7fffffffd304: 1, offset=..., 
    client=0x8fbd10) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:388
#43 0x00007ffff35ead42 in WebCore::CoordinatedGraphicsLayer::paintToSurface (this=0x7f62d0, size=..., atlas=@0x7fffffffd304: 1, offset=..., client=0x8fbd10)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:967
#44 0x00007ffff3606eb0 in WebCore::CoordinatedTile::updateBackBuffer (this=0x8fbd00)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedTile.cpp:77
#45 0x00007ffff35a07e7 in WebCore::TiledBackingStore::updateTileBuffers (this=0x8a6680)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/TiledBackingStore.cpp:132
#46 0x00007ffff35a177a in WebCore::TiledBackingStore::createTiles (this=0x8a6680)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/TiledBackingStore.cpp:329
#47 0x00007ffff35a030e in WebCore::TiledBackingStore::coverWithTilesIfNeeded (this=0x8a6680)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/TiledBackingStore.cpp:78
#48 0x00007ffff35a0d8c in WebCore::TiledBackingStore::commitScaleChange (this=0x8a6680)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/TiledBackingStore.cpp:193
#49 0x00007ffff35a0d3b in WebCore::TiledBackingStore::setContentsScale (this=0x8a6680, scale=0.015296367)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/TiledBackingStore.cpp:185
#50 0x00007ffff35ea5e1 in WebCore::CoordinatedGraphicsLayer::createBackingStore (this=0x7f62d0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:899
#51 0x00007ffff35eb180 in WebCore::CoordinatedGraphicsLayer::updateContentBuffers (this=0x7f62d0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:1032
#52 0x00007ffff35eb086 in WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers (this=0x7f62d0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:1010
---Type <return> to continue, or q <return> to quit---
#53 0x00007ffff35eb0be in WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers (this=0x8090a0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:1013
#54 0x00007ffff35eb0be in WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers (this=0x80f790)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:1013
#55 0x00007ffff35d6e54 in WebCore::CompositingCoordinator::flushPendingLayerChanges (this=0x80f530)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:104
#56 0x00007ffff46a7215 in WebKit::CoordinatedLayerTreeHost::performScheduledLayerFlush (this=0x80f420)
    at /home/reni/Data/REPOS/webkitnix/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:314
#57 0x00007ffff46a72c2 in WebKit::CoordinatedLayerTreeHost::layerFlushTimerFired (this=0x80f420)
    at /home/reni/Data/REPOS/webkitnix/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:329
#58 0x00007ffff46aa7dd in WebCore::Timer<WebKit::CoordinatedLayerTreeHost>::fired (this=0x80f498)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/Timer.h:114
#59 0x00007ffff351179a in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x835ab0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/ThreadTimers.cpp:129
#60 0x00007ffff3511687 in WebCore::ThreadTimers::sharedTimerFired () at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/ThreadTimers.cpp:105
#61 0x00007ffff3fd1373 in WebCore::timeoutCallback () at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/nix/SharedTimerNix.cpp:49
#62 0x00007ffff06bd8eb in g_timeout_dispatch (source=source@entry=0x89aa50, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4413
#63 0x00007ffff06bccd5 in g_main_dispatch (context=0x6106f0) at gmain.c:3054
#64 g_main_context_dispatch (context=context@entry=0x6106f0) at gmain.c:3630
#65 0x00007ffff06bd018 in g_main_context_iterate (context=0x6106f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3701
#66 0x00007ffff06bd48a in g_main_loop_run (loop=0x610850) at gmain.c:3895
#67 0x00007ffff3fcfc2a in WebCore::RunLoop::run () at /home/reni/Data/REPOS/webkitnix/Source/WebCore/platform/nix/RunLoopNix.cpp:60
#68 0x00007ffff46bd712 in WebKit::WebProcessMainNix (argc=2, argv=0x7fffffffdae8)
    at /home/reni/Data/REPOS/webkitnix/Source/WebKit2/WebProcess/nix/WebProcessMainNix.cpp:84
#69 0x000000000040084a in main (argc=2, argv=0x7fffffffdae8) at /home/reni/Data/REPOS/webkitnix/Source/WebKit2/nix/MainNix.cpp:30

[renatahodovan]

Hmm... it seems I can attach only image files. This way the test is uploaded to gist and you can reach it from here:

https://gist.github.com/renatahodovan/fff9bf6c3d868f5a7b0c

[hugopl]

I can reproduce that.

[hugopl]

The problem here is that WebCore tell ImageBufferCairo do create a cairo_surface of 33472x32, so cairo fails to create a surface of such size and the result is a crash... if I add a protection against those ImageBuffer creation failures the result will be a blank page, also unacceptable.

I need to investigate what other ports (not based on cairo) do, if they create a surface this big of if somehow they tell WebCore about this limitation and WebCore split the contents in more ImageBuffers.