Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

QWebFrame::render SIGSEGV with HiDPI + filter CSS #461

Closed
jkozera opened this issue Mar 3, 2017 · 10 comments
Closed

QWebFrame::render SIGSEGV with HiDPI + filter CSS #461

jkozera opened this issue Mar 3, 2017 · 10 comments
Labels
bug regression
Milestone
v5.212.0-alpha

Comments

@jkozera
Copy link

jkozera commented Mar 3, 2017

I've encountered a crash in the TP5 QWebView with a HiDPI display by trying to add a filter: invert(); CSS.

The full backtrace of an example app is available at http://pastebin.com/4QFFD2nR and the example app is available at http://pastebin.com/cNwjAgZU

It doesn't happen if AA_EnableHighDpiScaling is not enabled.

Excerpt from the traceback:

#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:242
#1  0x00007ffff6101a96 in WebCore::FilterEffect::copyUnmultipliedImage(JSC::GenericTypedArrayView<JSC::Uint8ClampedAdaptor>*, WebCore::IntRect const&) () from /home/jkozera/Qt/5.8/gcc_64/lib/libQt5WebKit.so.5
#2  0x00007ffff60fd3d1 in WebCore::FEComponentTransfer::platformApplySoftware() () from /home/jkozera/Qt/5.8/gcc_64/lib/libQt5WebKit.so.5
#3  0x00007ffff61014df in WebCore::FilterEffect::apply() () from /home/jkozera/Qt/5.8/gcc_64/lib/libQt5WebKit.so.5
(...)
#13 0x00007ffff4f24cef in QWebFrameAdapter::renderRelativeCoords(QPainter*, int, QRegion const&) ()
   from /home/jkozera/Qt/5.8/gcc_64/lib/libQt5WebKit.so.5
#14 0x00007ffff7fce82e in QWebFrame::render(QPainter*, QFlags<QWebFrame::RenderLayer>, QRegion const&) ()
(...)
#37 0x00007fffee801b0c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#38 0x00007ffff3a3dcbf in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /home/jkozera/Qt/5.8/gcc_64/lib/libQt5Core.so.5
#39 0x00007ffff39eb9ca in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /home/jkozera/Qt/5.8/gcc_64/lib/libQt5Core.so.5
#40 0x00007ffff39f39f4 in QCoreApplication::exec() () from /home/jkozera/Qt/5.8/gcc_64/lib/libQt5Core.so.5
@annulen
Copy link
Member

annulen commented Mar 3, 2017

Try applying patches https://bugs.webkit.org/show_bug.cgi?id=159495 and https://webkit.org/b/163762

@trollixx trollixx mentioned this issue Mar 30, 2017
Closed
@jkozera
Copy link
Author

jkozera commented Mar 30, 2017

@annulen sadly it didn't help.

@annulen
Copy link
Member

annulen commented Mar 30, 2017

Does crash happen with old QtWebKit released with Qt?

@jkozera
Copy link
Author

jkozera commented Mar 30, 2017

I have just built the one from http://download.qt.io/community_releases/5.8/5.8.0-final/ and checked - the crash doesn't happen there.

@annulen
Copy link
Member

annulen commented Mar 30, 2017

Reproduced

@auscompgeek auscompgeek mentioned this issue Apr 17, 2017
Closed
@annulen annulen added this to the Alpha milestone Apr 24, 2017
@annulen
Copy link
Member

annulen commented Apr 24, 2017

Valgrind: https://0x0.st/3Xl.txt

@annulen
Copy link
Member

annulen commented Apr 24, 2017

Somehow we have identical sizes of scaledRect and scaledPaintSize (and therefore equal destinationScanline and sourceScanline), but destination->length() is 4 times larger than source->length() when QT_SCALE_FACTOR=2. Hence invalid read after source ended but destination wants more

@annulen
Copy link
Member

annulen commented Apr 24, 2017 •
edited

I guess it means that earlier in execution flow scale factor was mistakenly applied to destination, or mistakenly was not applied to source.

jkozera added a commit to jkozera/webkit that referenced this issue Apr 24, 2017
@jkozera
Attempt to fix ImageBufferQt scaling seemingly wrong for HiDPI enviro…
00b1e47 
…nments

As per qtwebkit#461 - the scale may be wrongly not applied to the source,
resulting in the filter attempting to copy from unallocated memory.

This adds similar implementation of scaling to the one from the ImageBufferCG
changes in https://trac.webkit.org/changeset/168577/webkit
("-webkit-filter prevents rendering at retina scale")
@annulen annulen mentioned this issue Apr 26, 2017
Merged
jkozera added a commit to jkozera/webkit that referenced this issue May 5, 2017
@jkozera
Finish fixing qtwebkit#461 by attaching proper scale to images
1ba9f7c 
Also scale FloatRects correctly, as per the review.
jkozera added a commit to jkozera/webkit that referenced this issue May 5, 2017
@jkozera
Fix ImageBufferQt scaling wrong for HiDPI environments
9d8257b 
As per qtwebkit#461 - the scale was not applied to the source,
resulting in the filter attempting to copy from unallocated memory.

This adds similar implementation of scaling to the one from the
ImageBufferCG changes in https://trac.webkit.org/changeset/168577/webkit
("-webkit-filter prevents rendering at retina scale")

Also fixes putByteArray creating too small image, and adds proper
scale to images.
@jkozera jkozera mentioned this issue May 5, 2017
Closed
@annulen
Copy link
Member

annulen commented May 9, 2017

Related: #201

annulen pushed a commit that referenced this issue May 19, 2017
@jkozera @annulen
Fix ImageBufferQt scaling wrong for HiDPI environments
70d9f8a 
As per #461 - the scale was not applied to the source,
resulting in the filter attempting to copy from unallocated memory.

This adds similar implementation of scaling to the one from the
ImageBufferCG changes in https://trac.webkit.org/changeset/168577/webkit
("-webkit-filter prevents rendering at retina scale")

Also fixes putByteArray creating too small image, and adds proper
scale to images.

Change-Id: I39a38097ce017e9688db789478c292f37038abe3
annulen pushed a commit that referenced this issue May 27, 2017
@jkozera @annulen
Fix ImageBufferQt scaling wrong for HiDPI environments
7259518 
As per #461 - the scale was not applied to the source,
resulting in the filter attempting to copy from unallocated memory.

This adds similar implementation of scaling to the one from the
ImageBufferCG changes in https://trac.webkit.org/changeset/168577/webkit
("-webkit-filter prevents rendering at retina scale")

Also fixes putByteArray creating too small image, and adds proper
scale to images.

Change-Id: I39a38097ce017e9688db789478c292f37038abe3
@annulen
Copy link
Member

annulen commented May 30, 2017

Fixed

@annulen annulen closed this as completed May 30, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug regression
Projects
None yet
Milestone
v5.212.0-alpha
Development

No branches or pull requests
2 participants
@annulen @jkozera