Title: [216394] releases/WebKitGTK/webkit-2.16
Revision
216394
Author
carlo...@webkit.org
Date
2017-05-08 05:40:43 -0700 (Mon, 08 May 2017)

Log Message

Merge r215957 - App crashing: Dispatch queue: com.apple.root.user-interactive-qos / vBoxConvolve / WebCore::FEGaussianBlur::platformApplySoftware()
https://bugs.webkit.org/show_bug.cgi?id=171461
<rdar://problem/30534722>

Reviewed by Eric Carlson.

Source/WebCore:

We're getting reports of crashes in this function, caused by null or empty data being
passed to vImage. Guard against this, in a way that will ASSERT in debug builds if
anyone comes across it.

Test: css3/filters/blur-various-radii.html

* platform/graphics/filters/FEGaussianBlur.cpp:
(WebCore::accelerateBoxBlur): Return early if things don't look good.

LayoutTests:

Test a bunch of blurs a frame at a time.

* css3/filters/blur-various-radii-expected.html: Added.
* css3/filters/blur-various-radii.html: Added.

Modified Paths

Added Paths

Diff

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog (216393 => 216394)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog	2017-05-08 12:38:29 UTC (rev 216393)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog	2017-05-08 12:40:43 UTC (rev 216394)
@@ -1,3 +1,16 @@
+2017-04-28  Dean Jackson  <d...@apple.com>
+
+        App crashing: Dispatch queue: com.apple.root.user-interactive-qos / vBoxConvolve / WebCore::FEGaussianBlur::platformApplySoftware()
+        https://bugs.webkit.org/show_bug.cgi?id=171461
+        <rdar://problem/30534722>
+
+        Reviewed by Eric Carlson.
+
+        Test a bunch of blurs a frame at a time.
+
+        * css3/filters/blur-various-radii-expected.html: Added.
+        * css3/filters/blur-various-radii.html: Added.
+
 2017-04-27  Antti Koivisto  <an...@apple.com>
 
         Repeated layouts in Mail due to viewport units being used with auto-sizing

Added: releases/WebKitGTK/webkit-2.16/LayoutTests/css3/filters/blur-various-radii-expected.html (0 => 216394)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/css3/filters/blur-various-radii-expected.html	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/css3/filters/blur-various-radii-expected.html	2017-05-08 12:40:43 UTC (rev 216394)
@@ -0,0 +1,64 @@
+<style>
+    .target1 {
+        background-color: rgba(0,0,0,0.25);
+    }
+    .target2 {
+        width: 0;
+        height: 0;
+    }
+    .target3 {
+        width: 80px;
+        height: 0;
+    }
+    .target4 {
+        width: 0;
+        height: 3px;
+    }
+    .target5 {
+        width: 1px;
+        height: 1px;
+    }
+</style>
+<script>
+    if (window.testRunner)
+        window.testRunner.waitUntilDone();
+
+    window.addEventListener("load", run, false);
+
+    const MAX_VALUE = 20;
+    const INCREMENT = 0.45;
+    let blurValue = -0.9;
+    let results;
+
+    function run() {
+        results = document.getElementById("results");
+
+        requestAnimationFrame(blur);
+    }
+
+    function blur() {
+        results.innerHTML += `Blurring ${blurValue}px<br>`;
+
+        blurValue += INCREMENT;
+        if (blurValue < MAX_VALUE)
+            requestAnimationFrame(blur);
+        else
+            requestAnimationFrame(finish);
+    }
+
+    function finish() {
+        if (window.testRunner)
+            window.testRunner.notifyDone();
+
+    }
+</script>
+<p class="target target1">
+    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut
  labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
+    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut
  labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
+</p>
+<p class="target target2"></p>
+<p class="target target3"></p>
+<p class="target target4"></p>
+<p class="target target5"></p>
+<div id="results">
+</div>

Added: releases/WebKitGTK/webkit-2.16/LayoutTests/css3/filters/blur-various-radii.html (0 => 216394)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/css3/filters/blur-various-radii.html	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/css3/filters/blur-various-radii.html	2017-05-08 12:40:43 UTC (rev 216394)
@@ -0,0 +1,69 @@
+<style>
+    .target1 {
+        background-color: rgba(0,0,0,0.25);
+    }
+    .target2 {
+        width: 0;
+        height: 0;
+    }
+    .target3 {
+        width: 80px;
+        height: 0;
+    }
+    .target4 {
+        width: 0;
+        height: 3px;
+    }
+    .target5 {
+        width: 1px;
+        height: 1px;
+    }
+</style>
+<script>
+    if (window.testRunner)
+        window.testRunner.waitUntilDone();
+
+    window.addEventListener("load", run, false);
+
+    const MAX_VALUE = 20;
+    const INCREMENT = 0.45;
+    let blurValue = -0.9;
+    let targets;
+    let results;
+
+    function run() {
+        targets = document.querySelectorAll(".target");
+        results = document.getElementById("results");
+
+        requestAnimationFrame(blur);
+    }
+
+    function blur() {
+        targets.forEach(obj => { obj.style.filter = `blur(${blurValue}px)` });
+        results.innerHTML += `Blurring ${blurValue}px<br>`;
+
+        blurValue += INCREMENT;
+        if (blurValue < MAX_VALUE)
+            requestAnimationFrame(blur);
+        else
+            requestAnimationFrame(finish);
+    }
+
+    function finish() {
+        targets.forEach(obj => { obj.style.filter = "none" });
+
+        if (window.testRunner)
+            window.testRunner.notifyDone();
+
+    }
+</script>
+<p class="target target1">
+    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut
  labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
+    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut
  labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
+</p>
+<p class="target target2"></p>
+<p class="target target3"></p>
+<p class="target target4"></p>
+<p class="target target5"></p>
+<div id="results">
+</div>

Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog (216393 => 216394)


--- releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog	2017-05-08 12:38:29 UTC (rev 216393)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog	2017-05-08 12:40:43 UTC (rev 216394)
@@ -1,3 +1,20 @@
+2017-04-28  Dean Jackson  <d...@apple.com>
+
+        App crashing: Dispatch queue: com.apple.root.user-interactive-qos / vBoxConvolve / WebCore::FEGaussianBlur::platformApplySoftware()
+        https://bugs.webkit.org/show_bug.cgi?id=171461
+        <rdar://problem/30534722>
+
+        Reviewed by Eric Carlson.
+
+        We're getting reports of crashes in this function, caused by null or empty data being
+        passed to vImage. Guard against this, in a way that will ASSERT in debug builds if
+        anyone comes across it.
+
+        Test: css3/filters/blur-various-radii.html
+
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::accelerateBoxBlur): Return early if things don't look good.
+
 2017-04-28  Chris Dumez  <cdu...@apple.com>
 
         URLSearchParams should be reflective

Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp (216393 => 216394)


--- releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp	2017-05-08 12:38:29 UTC (rev 216393)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp	2017-05-08 12:40:43 UTC (rev 216394)
@@ -298,6 +298,16 @@
 #if USE(ACCELERATE)
 inline void accelerateBoxBlur(const Uint8ClampedArray* src, Uint8ClampedArray* dst, unsigned kernelSize, int stride, int effectWidth, int effectHeight)
 {
+    if (!src || !src->data() || !dst || !dst->data()) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    if (effectWidth <= 0 || effectHeight <= 0 || stride <= 0) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
     // We must always use an odd radius.
     if (kernelSize % 2 != 1)
         kernelSize += 1;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to