[Webkit-unassigned] [Bug 221789] New: SIGSEGV in TextureMapperLayer::paintSelf()

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Thu Feb 11 17:24:46 PST 2021 

https://bugs.webkit.org/show_bug.cgi?id=221789

            Bug ID: 221789
           Summary: SIGSEGV in TextureMapperLayer::paintSelf()
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: gavriliuk at gmail.com

It seems the pointer m_contentsLayer becomes invalid but is not set to NULL

Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp : 165

void TextureMapperLayer::paintSelf(const TextureMapperPaintOptions& options)
{
    if (!m_state.visible || !m_state.contentsVisible)
        return;
...
    if (!m_contentsLayer)
        return;

    if (!m_state.contentsTileSize.isEmpty()) {
        options.textureMapper.setWrapMode(TextureMapper::RepeatWrap);

        auto patternTransform = TransformationMatrix::rectToRect({ { }, m_state.contentsTileSize }, { { }, m_state.contentsRect.size() })
            .translate(m_state.contentsTilePhase.width() / m_state.contentsRect.width(), m_state.contentsTilePhase.height() / m_state.contentsRect.height());
        options.textureMapper.setPatternTransform(patternTransform);
    }

    ASSERT(!layerRect().isEmpty());
/// SIGSEGV on the following line:
    m_contentsLayer->paintToTextureMapper(options.textureMapper, m_state.contentsRect, transform, options.opacity);
    if (m_state.showDebugBorders)
        m_contentsLayer->drawBorder(options.textureMapper, m_state.debugBorderColor, m_state.debugBorderWidth, m_state.contentsRect, transform);
}

Callstack

| 1|paintSelf‎                      |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:165
| 2|paintSelfAndChildren‎           |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:180
| 3|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
| 4|paintRecursive                 ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
| 5|paintSelfAndChildren‎           |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:203
| 6|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
| 7|paintRecursive                 ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
| 8|paintSelfAndChildren           ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:203
| 9|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
|10|paintRecursive‎                 |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
|11|paintSelfAndChildren           ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:203
|12|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
|13|paintRecursive                 ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
|14|paintSelfAndChildren           ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:203
|15|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
|16|paintRecursive‎                 |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
|17|paintSelfAndChildren‎           |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:203
|18|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
|19|paintRecursive‎                 |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
|20|paintSelfAndChildren           ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:203
|21|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
|22|paintRecursive‎                 |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
|23|paintSelfAndChildren‎           |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:203
|24|paintSelfAndChildrenWithReplica‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:242
|25|paintRecursive‎                 |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:446
|26|paint‎                          |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:110
|27|paintToCurrentGLContext        ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebKit/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:97
|28|renderLayerTree‎                |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:302
|29|updateTimerFired‎               |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/build/DerivedSources/ForwardingHeaders/wtf/Function.h:56
|30|_FUN‎                           |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WTF/wtf/glib/RunLoopGLib.cpp:170
|31|g_main_context_dispatch‎        |/usr/src/debug/glib-2.0/1_2.48.2-r0/glib-2.48.2/glib/gmain.c:3154
|32|g_main_context_iterate         ‎|/usr/src/debug/glib-2.0/1_2.48.2-r0/glib-2.48.2/glib/gmain.c:3844
|33|g_main_loop_run                ‎|/usr/src/debug/glib-2.0/1_2.48.2-r0/glib-2.48.2/glib/gmain.c:4038
|34|run‎                            |/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WTF/wtf/glib/RunLoopGLib.cpp:96
|35|entryPoint                     ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WTF/wtf/Function.h:56
|36|wtfThreadEntryPoint            ‎|/usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/WTF/wtf/ThreadingPthreads.cpp:215
|37|start_thread                   ‎|/usr/src/debug/glibc/2.24-r0/git/nptl/pthread_create.c:458
|38|clone                          ‎|/lib/libc-2.24.so

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210212/e5cb2b94/attachment.htm>

More information about the webkit-unassigned mailing list