[Webkit-unassigned] [Bug 235586] New: UI process crash in WebCore::ScalableImageDecoderFrame::operator=
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Jan 25 07:40:17 PST 2022
https://bugs.webkit.org/show_bug.cgi?id=235586
Bug ID: 235586
Summary: UI process crash in
WebCore::ScalableImageDecoderFrame::operator=
Product: WebKit
Version: WebKit Nightly Build
Hardware: PC
OS: Linux
Status: NEW
Severity: Normal
Priority: P2
Component: WebKitGTK
Assignee: webkit-unassigned at lists.webkit.org
Reporter: mcatanzaro at gnome.org
CC: bugs-noreply at webkitgtk.org
Moving from https://gitlab.gnome.org/GNOME/epiphany/-/issues/1684. Reproducer: replace your Epiphany's session_state.xml with:
<?xml version="1.0"?>
<session>
<window x="0" y="0" width="1024" height="768" is-maximized="1" is-fullscreen="0" active-tab="19">
<embed url="https://lupyuen.github.io/pinetime-rust-mynewt/articles/wayland" title="Wayland and LVGL on PinePhone with Ubuntu Touch" loading="true" history="AgAAAAAAAAAI"/>
</window>
</session>
Then Epiphany will crash on startup in ScalableImageDecoder. The backtrace is pretty short, so I'm going to paste it inline instead of attaching it:
#0 WebCore::ScalableImageDecoderFrame::operator=(WebCore::ScalableImageDecoderFrame const&) [clone .isra.0]
(this=0x7f0884426280, other=...)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/image-decoders/ScalableImageDecoderFrame.cpp:46
#1 0x00007f089a2959e3 in WebCore::ICOImageDecoder::decodeAtIndex(unsigned long) (index=0, this=0x7f0884492000)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:216
dirEntry =
@0x7f08844dac00: {m_size = {m_width = 196, m_height = 196}, m_bitCount = 32, m_hotSpot = {m_x = 0, m_y = 0}, m_imageOffset = 70}
imageType = WebCore::ICOImageDecoder::PNG
#2 WebCore::ICOImageDecoder::decode(unsigned long, bool, bool)
(this=0x7f0884492000, index=0, onlySize=<optimized out>, allDataReceived=<optimized out>)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:158
#3 0x00007f089a2963f1 in WebCore::ICOImageDecoder::decode(unsigned long, bool, bool)
(allDataReceived=<optimized out>, onlySize=false, index=0, this=0x7f0884492000)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/image-decoders/ScalableImageDecoder.h:70
buffer = 0x7f0884426280
#4 WebCore::ICOImageDecoder::frameBufferAtIndex(unsigned long) (this=0x7f0884492000, index=0)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:101
buffer = 0x7f0884426280
#5 0x00007f089a286f75 in WebCore::ScalableImageDecoder::createFrameImageAtIndex(unsigned long, WebCore::SubsamplingLevel, WebCore::DecodingOptions const&) (this=0x7f0884492000, index=0)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/image-decoders/ScalableImageDecoder.cpp:229
buffer = <optimized out>
#6 0x00007f0899dd3a78 in WebCore::ImageSource::frameAtIndexCacheIfNeeded(unsigned long, WebCore::ImageFrame::Caching, std::optional<WebCore::SubsamplingLevel> const&)
(this=0x7f08844316c0, index=0, caching=(unknown: 0x5e3331c8), subsamplingLevel=std::optional<WebCore::SubsamplingLevel> = {...}) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/graphics/ImageSource.cpp:462
platformImage = {m_ptr = 0x7f0899dcbf86 <WebCore::ImageSource::growFrames()+294>}
frame =
@0x7f0884469a00: {m_decodingStatus = WebCore::DecodingStatus::Invalid, m_size = {m_width = 0, m_height = 0}, m_nativeImage = {m_ptr = 0x0}, m_subsamplingLevel = WebCore::SubsamplingLevel::First, m_decodingOptions = {m_decodingModeOrSize = {<WTF::__variant_base<WTF::Variant<WebCore::DecodingMode, std::optional<WebCore::IntSize> >, true>> = {<No data fields>}, __storage = {__head = {__val = WebCore::DecodingMode::Auto, __dummy = {<No data fields>}}, __rest = {__val = std::optional<WebCore::IntSize> [no contained value], __dummy = {<No data fields>}}}, __index = 0 '\000'}}, m_orientation = {static EXIFFirst = WebCore::ImageOrientation::OriginTopLeft, static EXIFLast = WebCore::ImageOrientation::OriginLeftBottom, static First = WebCore::ImageOrientation::FromImage, static Last = WebCore::ImageOrientation::OriginLeftBottom, m_orientation = WebCore::ImageOrientation::OriginTopLeft}, m_densityCorrectedSize = std::optional<WebCore::IntSize> [no contained value], m_duration = {m_value = 0}, m_hasAlpha = true}
subsamplingLevelValue = WebCore::SubsamplingLevel::First
#7 0x00007f089a526735 in WebCore::ImageSource::frameAtIndexCacheIfNeeded(unsigned long, WebCore::ImageFrame::Caching, std::optional<WebCore::SubsamplingLevel> const&)
(subsamplingLevel=std::optional<WebCore::SubsamplingLevel> = {...}, caching=WebCore::ImageFrame::Caching::MetadataAndImage, index=0, this=<optimized out>)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/graphics/ImageSource.cpp:440
#8 WebCore::ImageSource::frameImageAtIndexCacheIfNeeded(unsigned long, WebCore::SubsamplingLevel)
(subsamplingLevel=WebCore::SubsamplingLevel::First, index=0, this=<optimized out>)
at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/graphics/ImageSource.cpp:718
#9 WebCore::BitmapImage::frameImageAtIndexCacheIfNeeded(unsigned long, WebCore::SubsamplingLevel, WebCore::GraphicsCon--Type <RET> for more, q to quit, c to continue without paging--c
text const*) [clone .constprop.0] (this=<optimized out>, index=0, subsamplingLevel=subsamplingLevel at entry=WebCore::SubsamplingLevel::First, targetContext=<optimized out>) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/graphics/BitmapImage.cpp:142
#10 0x00007f0898e5bcd4 in WebCore::BitmapImage::nativeImageForCurrentFrame(WebCore::GraphicsContext const*) (targetContext=0x0, this=<optimized out>) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebCore/platform/graphics/BitmapImage.cpp:152
image = {m_ptr = 0x7f088441c000}
nativeImage = {m_ptr = 0x0}
addResult = {iterator = {<std::iterator<std::forward_iterator_tag, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >, long, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >*, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >&>> = {<No data fields>}, m_iterator = {<std::iterator<std::forward_iterator_tag, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >, long, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> > const*, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> > const&>> = {<No data fields>}, m_position = 0x7f08844bc0f8, m_endPosition = <optimized out>}}, isNewEntry = <optimized out>}
icon = {m_ptr = 0x0}
#11 operator() (__closure=<optimized out>) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebKit/UIProcess/API/glib/IconDatabase.cpp:585
image = {m_ptr = 0x7f088441c000}
nativeImage = {m_ptr = 0x0}
addResult = {iterator = {<std::iterator<std::forward_iterator_tag, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >, long, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >*, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >&>> = {<No data fields>}, m_iterator = {<std::iterator<std::forward_iterator_tag, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> >, long, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> > const*, WTF::KeyValuePair<WTF::String, std::pair<WTF::RefPtr<_cairo_surface, WTF::RawPtrTraits<_cairo_surface>, WTF::DefaultRefDerefTraits<_cairo_surface> >, WTF::MonotonicTime> > const&>> = {<No data fields>}, m_position = 0x7f08844bc0f8, m_endPosition = <optimized out>}}, isNewEntry = <optimized out>}
icon = {m_ptr = 0x0}
#12 operator() (__closure=<optimized out>) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WebKit/UIProcess/API/glib/IconDatabase.cpp:595
icon = {m_ptr = 0x0}
#13 WTF::Detail::CallableWrapper<WebKit::IconDatabase::loadIconForPageURL(const WTF::String&, WebKit::IconDatabase::AllowDatabaseWrite, WTF::CompletionHandler<void(WTF::RefPtr<_cairo_surface>&&)>&&)::<lambda()> mutable::<lambda()>, void>::call(void) (this=0x7f088447a348) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/redhat-linux-build/WTF/Headers/wtf/Function.h:53
#14 0x00007f0898085bfd in WTF::Function<void ()>::operator()() const (this=<synthetic pointer>) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WTF/wtf/Function.h:79
didSuspendFunctions = false
#15 WTF::RunLoop::performWork() (this=0x7f08844f9000) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WTF/wtf/RunLoop.cpp:133
didSuspendFunctions = false
#16 0x00007f08980d4edd in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WTF/wtf/glib/RunLoopGLib.cpp:80
#17 0x00007f08980cf913 in operator() (__closure=0x0, userData=0x7f08844f9000, callback=0x7f08980d4ed0 <WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*)>, source=0x5562955ccea0) at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WTF/wtf/glib/RunLoopGLib.cpp:53
name = 0x556295640de0 "[WebKit] RunLoop work"
runLoopSource = @0x5562955ccea0: {source = {callback_data = 0x556295684bd0, callback_funcs = 0x7f089bbea3e0 <g_source_callback_funcs>, source_funcs = 0x7f089857e4e0 <WTF::RunLoop::s_runLoopSourceFunctions>, ref_count = 3, context = 0x556295477f80, priority = 100, flags = 35, source_id = 7, poll_fds = 0x0, prev = 0x0, next = 0x0, name = 0x556295640de0 "[WebKit] RunLoop work", priv = 0x55629551d400}, runLoop = 0x7f08844f9000}
returnValue = <optimized out>
#18 _FUN(GSource*, GSourceFunc, gpointer) () at /usr/src/debug/webkit2gtk3-2.34.1-2.fc35.x86_64/Source/WTF/wtf/glib/RunLoopGLib.cpp:56
#19 0x00007f089bb06130 in g_main_dispatch (context=0x556295477f80) at ../glib/gmain.c:3381
dispatch = 0x7f08980cf8c0 <_FUN(GSource*, GSourceFunc, gpointer)>
prev_source = 0x0
begin_time_nsec = 24845183386370
was_in_call = <optimized out>
user_data = 0x7f08844f9000
callback = 0x7f08980d4ed0 <WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*)>
cb_funcs = 0x7f089bbea3e0 <g_source_callback_funcs>
cb_data = 0x556295684bd0
need_destroy = <optimized out>
source = 0x5562955ccea0
current = 0x55629547a7e0
i = 0
#20 g_main_context_dispatch (context=0x556295477f80) at ../glib/gmain.c:4099
#21 0x00007f089bb5b208 in g_main_context_iterate.constprop.0 (context=context at entry=0x556295477f80, block=block at entry=1, dispatch=dispatch at entry=1, self=<optimized out>) at ../glib/gmain.c:4175
max_priority = 2147483647
timeout = 168
some_ready = 1
nfds = 5
allocated_nfds = 5
fds = <optimized out>
begin_time_nsec = 24845180922660
#22 0x00007f089bb03933 in g_main_context_iteration (context=context at entry=0x556295477f80, may_block=may_block at entry=1) at ../glib/gmain.c:4240
retval = <optimized out>
#23 0x00007f089bd273d5 in g_application_run (application=0x5562954706a0, argc=<optimized out>, argv=<optimized out>) at ../gio/gapplication.c:2569
arguments = 0x55629552b9e0
status = 0
context = 0x556295477f80
acquired_context = <optimized out>
__func__ = "g_application_run"
#24 0x000055629456b08b in main (argc=<optimized out>, argv=<optimized out>) at ../src/ephy-main.c:431
option_context = <optimized out>
option_group = <optimized out>
error = 0x0
user_time = 24841570
arbitrary_url = <optimized out>
ctx = <optimized out>
mode = <optimized out>
status = <optimized out>
flags = <optimized out>
desktop_info = <optimized out>
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220125/7cb08f1b/attachment-0001.htm>
More information about the webkit-unassigned
mailing list