[Webkit-unassigned] [Bug 65637] New: Crash beneath PlatformCALayerWinInternal::updateTiles when zooming on Google Map

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=65637

           Summary: Crash beneath PlatformCALayerWinInternal::updateTiles
                    when zooming on Google Map
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
               URL: http://maps.google.com/
        OS/Version: Windows XP
            Status: NEW
          Keywords: PlatformOnly
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: aroben at apple.com
                CC: cmarrin at apple.com


To reproduce:

1. Go to Google Maps
2. Select Satellite view
3. Zoom in and out using the scroll wheel

Eventually, you'll crash beneath PlatformCALayerWinInternal::updateTiles due to a null CFArrayRef being passed to CFArrayGetValueAtIndex. Here's the backtrace:


     CoreFoundation.dll!CF_IS_OBJC()    C++
     CoreFoundation.dll!CFArrayGetValueAtIndex() + 0xe bytes    C++
     WebKit.dll!WebCore::PlatformCALayerWinInternal::updateTiles()  Line 444 + 0x17 bytes    C++
     WebKit.dll!WebCore::PlatformCALayerWinInternal::setBounds(const WebCore::FloatRect & rect={...})  Line 329    C++
     WebKit.dll!WebCore::PlatformCALayer::setBounds(const WebCore::FloatRect & value={...})  Line 364    C++
>	WebKit.dll!WebCore::GraphicsLayerCA::updateGeometry(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...})  Line 1058	C++
     WebKit.dll!WebCore::GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer=true, float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...})  Line 2087    C++
     WebKit.dll!WebCore::GraphicsLayerCA::updateGeometry(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...})  Line 1018    C++
     WebKit.dll!WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...})  Line 894    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=true)  Line 842    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=true)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=true)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=true)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=true)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=true)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=false)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=false)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=false)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::recursiveCommitChanges(float pageScaleFactor=1.0000000, const WebCore::FloatPoint & positionRelativeToBase={...}, bool affectedByPageScale=false)  Line 850    C++
     WebKit.dll!WebCore::GraphicsLayerCA::syncCompositingState()  Line 816    C++
     WebKit.dll!WebCore::RenderLayerCompositor::flushPendingLayerChanges(bool isFlushRoot=true)  Line 207 + 0x12 bytes    C++
     WebKit.dll!WebCore::FrameView::syncCompositingStateForThisFrame(WebCore::Frame * rootFrameForSync=0x03d7b580)  Line 700    C++
     WebKit.dll!WebCore::FrameView::syncCompositingStateIncludingSubframes()  Line 787 + 0x17 bytes    C++
     WebKit.dll!WebKit::LayerTreeHostCA::flushPendingLayerChanges()  Line 247    C++
     WebKit.dll!WebKit::LayerTreeHostCA::performScheduledLayerFlush()  Line 224 + 0x8 bytes    C++
     WebKit.dll!WebKit::LayerTreeHostCAWin::flushPendingLayerChangesNow()  Line 240    C++
     WebKit.dll!WebCore::LayerChangesFlusher::hookFired(int code=0, unsigned int wParam=1, long lParam=1244088)  Line 89 + 0x20 bytes    C++
     WebKit.dll!WebCore::LayerChangesFlusher::hookCallback(int code=0, unsigned int wParam=1, long lParam=1244088)  Line 75    C++
     user32.dll!_DispatchHookW at 16()  + 0x31 bytes    
     user32.dll!_CallHookWithSEH at 16()  + 0x21 bytes    
     user32.dll!___fnHkINLPMSG at 4()  + 0x25 bytes    
     ntdll.dll!_KiUserCallbackDispatcher at 12()  + 0x13 bytes    
     user32.dll!_NtUserGetMessage at 16()  + 0xc bytes    
     WebKit.dll!RunLoop::run()  Line 74 + 0x12 bytes    C++
     WebKit.dll!WebKit::WebProcessMain(const WebKit::CommandLine & commandLine={...})  Line 82    C++
     WebKit.dll!WebKitMain(const WebKit::CommandLine & commandLine={...})  Line 50 + 0x9 bytes    C++
     WebKit.dll!WebKitMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x00021118, int nCmdShow=10)  Line 187 + 0x9 bytes    C++
     WebKit2WebProcess.exe!wWinMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x00021118, int nCmdShow=10)  Line 66 + 0x18 bytes    C++
     WebKit2WebProcess.exe!__tmainCRTStartup()  Line 589 + 0x1c bytes    C
     kernel32.dll!_BaseProcessStart at 4()  + 0x23 bytes

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.