[Webkit-unassigned] [Bug 162020] New: [Coordinated Graphics] Scrolling through 01.org/dleyna crashes WebKitWebProcess

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=162020

            Bug ID: 162020
           Summary: [Coordinated Graphics] Scrolling through 01.org/dleyna
                    crashes WebKitWebProcess
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Keywords: Gtk
          Severity: Normal
          Priority: P2
         Component: Platform
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: cgarcia at igalia.com
                CC: bugs-noreply at webkitgtk.org

Bug forwarded from GNOME bugzilla:

"Scrolling through https://01.org/dleyna/ once it has finished loading crashes WebKitWebProcess. Unfortunately, coredumpctl is unable to show the backtrace.

I have:
epiphany-3.20.3-1.fc24.x86_64
gtk3-3.20.9-1.fc24.x86_64
webkitgtk4-2.12.4-1.fc24.x86_64"

The problem is that we are trying to clone a ReferenceFilterOperation:

PassRefPtr<FilterOperation> clone() const override
{
    // Reference filters cannot be cloned.                                                                                                                                                
    ASSERT_NOT_REACHED();
    return nullptr;
}

That's from FilterAnimationValue copy constructor, and FilterOperations are never expected to be nullptr, so we end up crashing.

Thread 1 (Thread 0x7fc129322a80 (LWP 6125)):
#0  0x00007fc127c8e74a in WebCore::FilterAnimationValue::clone() const () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#1  0x00007fc127fd118e in WebCore::TextureMapperAnimation::TextureMapperAnimation(WebCore::TextureMapperAnimation const&) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#2  0x00007fc127fd217a in WebCore::TextureMapperAnimations::add(WebCore::TextureMapperAnimation const&) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#3  0x00007fc127fe4d83 in WebCore::CoordinatedGraphicsLayer::addAnimation(WebCore::KeyframeValueList const&, WebCore::FloatSize const&, WebCore::Animation const*, WTF::String const&, double) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#4  0x00007fc127c87e5a in WebCore::RenderLayerBacking::startTransition(double, WebCore::CSSPropertyID, WebCore::RenderStyle const*, WebCore::RenderStyle const*) ()
   from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#5  0x00007fc1279c657c in WebCore::AnimationBase::updateStateMachine(WebCore::AnimationBase::AnimationStateInput, double) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#6  0x00007fc1279c90ed in WebCore::AnimationControllerPrivate::styleAvailable() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#7  0x00007fc1279c92c5 in WebCore::AnimationControllerPrivate::endAnimationUpdate() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#8  0x00007fc1274cc130 in WebCore::Document::recalcStyle(WebCore::Style::Change) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#9  0x00007fc1274cb359 in WebCore::Document::updateLayout() () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fc1274cdf12 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#11 0x00007fc127942d42 in WebCore::DOMWindow::scrollY() const () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#12 0x00007fc128335fe4 in WebCore::jsDOMWindowPageYOffset(JSC::ExecState*, long, JSC::PropertyName) () from /home/cgarcia/gnome/lib/libwebkit2gtk-4.0.so.37
#13 0x00007fc1258b43e7 in JSC::PropertySlot::customGetter(JSC::ExecState*, JSC::PropertyName) const () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18
#14 0x00007fc125617f41 in llint_slow_path_get_by_val () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18
#15 0x00007fc125626b08 in llint_entry () from /home/cgarcia/gnome/lib/libjavascriptcoregtk-4.0.so.18

We just need to validate the filters before setting then and before creating a TextureMapperAnimation for them.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160915/36d3e197/attachment.html>