search

movableink / webkit

Unofficial mirror of the WebKit SVN repository
http://www.webkit.org/
59 stars 11 forks source link

Wonderwall segfault #37

Open username227 opened 2 months ago

username227 commented 2 months ago

Hi, I was attempting to start Wonderwall (from the aur) with the qt5-webkit-movableink-git instead of the normal qt5-webkit. I did this by installing the prebuilt package uploaded onto Sourceforge several days ago, and then altering the wonderwall pkgbuild to reflect this dependency instead of qt5-webkit. It did not start, and I got a segfault. The information, including a backtrace, is printed below:

backtrace.txt

The program works with qt5-webkit.

whitslack commented 2 months ago

I get the same segfault when attempting to view an email in Trojitá using this QtWebkit implementation.

#0  QPainterPath::QPainterPath (this=this@entry=0x7fffffff83f8, other=...)
    at ../../../qtbase-everywhere-src-5.15.13/src/gui/painting/qpainterpath.cpp:561
#1  0x00007ffff17f0727 in WebCore::GraphicsContextQt::fillPath (this=0x7fffffffa8c0, path=...)
    at ../qtwebkit-5.212.9999/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp:648
#2  0x00007ffff30357ab in WebCore::BorderPainter::paintSides (this=this@entry=0x7fffffff89e0, sides=...)
    at ../qtwebkit-5.212.9999/Source/WebCore/rendering/BorderPainter.cpp:455
⋮

The crash occurs because WebCore::Path::platformPath() returns a dangling reference to a temporary QPainterPath object returned by WebCore::PathQt::platformPath().

https://github.com/movableink/webkit/blob/2d2b3794dd79e0379f9dba7b653b80e4f8cbde04/Source/WebCore/platform/graphics/PlatformPath.h#L32

https://github.com/movableink/webkit/blob/2d2b3794dd79e0379f9dba7b653b80e4f8cbde04/Source/WebCore/platform/graphics/PlatformPath.h#L41-L42

https://github.com/movableink/webkit/blob/2d2b3794dd79e0379f9dba7b653b80e4f8cbde04/Source/WebCore/platform/graphics/Path.cpp#L412-L415

https://github.com/movableink/webkit/blob/2d2b3794dd79e0379f9dba7b653b80e4f8cbde04/Source/WebCore/platform/graphics/qt/PathQt.cpp#L113-L116

The offending commit was 71a469fd7c413c796b6a769e07c9bd14d2915371. WebCore::PathQt::platformPath() was mistakenly declared as returning a QPainterPath. As a point of reference: WebCore::PathCG::platformPath() returns a PlatformPathPtr (typedef'd as struct CGPath*). WebCore::Path::platformPath() expects to be able to return the return value of WebCore::PlatformPathImpl::platformPath() as a PlatformPathPtr without potentially creating a dangling reference. If we redefine WebCore::PathQt::platformPath() as returning a PlatformPathPtr (typedef'd as const QPainterPath&), then we will avoid creating a temporary QPainterPath object, and thus WebCore::Path::platformPath() will not return a dangling reference. When I make this change, I no longer suffer the crash. I will open a PR.