116715 2013-05-24 02:41:06 -0700 ASSERTION FAILED: type() == Percent in WebCore::Length::percent 2013-08-13 03:44:10 -0700 1 1 1 Unclassified WebKit Tables 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 116980 1 rhodovan.u-szeged zan ap jchaffraix ojan zan oldest_to_newest 893245 0 202795 rhodovan.u-szeged 2013-05-24 02:41:06 -0700 Created attachment 202795 Test case The attached test throws an ASSERTION FAILURE in debug webkit. The parser accepts the style definition: style="width: -webkit-calc(100% + -100px);" what probably should not do. #0 0x00007ffff5758c3d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339 #1 0x00007ffff409c4d3 in WebCore::Length::percent (this=0x7fffffffaf60) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/Length.h:139 #2 0x00007ffff484dfa9 in WebCore::AutoTableLayout::calcEffectiveLogicalWidth (this=0x8d3f90) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/AutoTableLayout.cpp:345 #3 0x00007ffff484d68e in WebCore::AutoTableLayout::computeIntrinsicLogicalWidths (this=0x8d3f90, minWidth=..., maxWidth=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/AutoTableLayout.cpp:217 #4 0x00007ffff4a15149 in WebCore::RenderTable::computeIntrinsicLogicalWidths (this=0x8d2d18, minWidth=..., maxWidth=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:740 #5 0x00007ffff4a151bd in WebCore::RenderTable::computePreferredLogicalWidths (this=0x8d2d18) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:749 #6 0x00007ffff4900517 in WebCore::RenderBox::maxPreferredLogicalWidth (this=0x8d2d18) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:861 #7 0x00007ffff4a11fde in WebCore::RenderTable::updateLogicalWidth (this=0x8d2d18) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:273 #8 0x00007ffff4a12f6a in WebCore::RenderTable::layout (this=0x8d2d18) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:414 #9 0x00007ffff48a3b1c in WebCore::RenderBlock::layoutBlockChild (this=0x88d4b8, child=0x8d2d18, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2621 905273 1 zan 2013-07-02 00:01:49 -0700 Length::isPercent returns true if the Length object has type of either Percent or Calculated. Length::percent asserts that the type must be Percent. Should the assert in Length::percent (where the current crash occurs) allow the Calculated type as well? 905276 2 zan 2013-07-02 00:12:27 -0700 Bug #79621 introduced the Calculated type and started treating Length objects of that type as if having a percent value. http://trac.webkit.org/changeset/110148 916305 3 208546 zan 2013-08-12 09:27:27 -0700 Created attachment 208546 Patch 916320 4 208546 darin 2013-08-12 09:59:09 -0700 Comment on attachment 208546 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208546&action=review > Source/WebCore/platform/Length.h:139 > + ASSERT(type() == Percent || type() == Calculated); I think it would be clearer to do: ASSERT(isPercent()); 916645 5 zan 2013-08-13 03:44:10 -0700 Landed in r153981. http://trac.webkit.org/changeset/153981 202795 2013-05-24 02:41:06 -0700 2013-05-24 02:41:06 -0700 Test case current_AppleWebKit_537_43.html text/html 146 rhodovan.u-szeged PGh0bWw+Cjxib2R5PgoJPHRhYmxlPgoJCTx0cj4KCQkJPHRkIHNjb3BlPSJjb2wiIGNvbHNwYW49 IjUiIHN0eWxlPSJ3aWR0aDogLXdlYmtpdC1jYWxjKDEwMCUgKyAgIC0xMDBweCk7Ij48L3RkPgoJ CTwvdHI+Cgk8L3RhYmxlPgo8L2JvZHk+CjwvaHRtbD4= 208546 2013-08-12 09:27:27 -0700 2013-08-12 09:59:09 -0700 Patch bug-116715-20130812092727.patch text/plain 3829 zan U3VidmVyc2lvbiBSZXZpc2lvbjogMTUzOTQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZWIwZmY0YTg5OWIxNTIy ZjFlYTcyMDExYmU3ZjUzZTMxNWRjOWQ4ZC4uMWEyOTI2NGQ5N2ZmODgyZTEyM2UxOGQ4YmY4MTYw YjY4NGI0ZTBjNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDEzLTA4LTEyICBaYW4g RG9iZXJzZWsgIDx6ZG9iZXJzZWtAaWdhbGlhLmNvbT4KKworICAgICAgICBBU1NFUlRJT04gRkFJ TEVEOiB0eXBlKCkgPT0gUGVyY2VudCBpbiBXZWJDb3JlOjpMZW5ndGg6OnBlcmNlbnQKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExNjcxNQorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFsbG93IHRoZSBDYWxj dWxhdGVkIHR5cGUgaW4gdGhlIExlbmd0aDo6cGVyY2VudCBtZXRob2QgdGhhdCByZXR1cm5zIHRo ZSBMZW5ndGgncworICAgICAgICBmbG9hdCB2YWx1ZS4gVGhpcyByZWZsZWN0cyB0aGUgY2hhbmdl cyBpbiByMTEwMTQ4IHRoYXQgYWRqdXN0ZWQgdGhlIExlbmd0aDo6aXNQZXJjZW50CisgICAgICAg IG1ldGhvZCB0byByZXR1cm4gdHJ1ZSBmb3IgTGVuZ3RoIG9iamVjdHMgb2YgZWl0aGVyIFBlcmNl bnQgb3IgQ2FsY3VsYXRlZCB0eXBlLgorCisgICAgICAgIFRlc3Q6IGZhc3QvY3NzL2NhbGN1bGF0 ZWQtbGVuZ3RoLWFzLXBlcmNlbnQtY3Jhc2guaHRtbAorCisgICAgICAgICogcGxhdGZvcm0vTGVu Z3RoLmg6CisgICAgICAgIChXZWJDb3JlOjpMZW5ndGg6OnBlcmNlbnQpOgorCiAyMDEzLTA4LTEy ICBBbGxhbiBTYW5kZmVsZCBKZW5zZW4gIDxhbGxhbi5qZW5zZW5AZGlnaWEuY29tPgogCiAgICAg ICAgIFtRdF0gQWRkIFN1cHBvcnQgZm9yIGNhbnZhcyBibGVuZCBtb2RlcwpkaWZmIC0tZ2l0IGEv U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vTGVuZ3RoLmggYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9y bS9MZW5ndGguaAppbmRleCAyZjkxNTUwZGE4NzNiYmYwODI2NDU0ODEzNzhiMDgwZmIzNWY0N2Y2 Li5kM2IzMmQ1ZjA1OTliODg5NmYyMTRmODIwZmE0NDM5Nzk2OGY1NDY2IDEwMDY0NAotLS0gYS9T b3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9MZW5ndGguaAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0 Zm9ybS9MZW5ndGguaApAQCAtMTM2LDcgKzEzNiw3IEBAIHB1YmxpYzoKIAogICAgIGZsb2F0IHBl cmNlbnQoKSBjb25zdAogICAgIHsKLSAgICAgICAgQVNTRVJUKHR5cGUoKSA9PSBQZXJjZW50KTsK KyAgICAgICAgQVNTRVJUKHR5cGUoKSA9PSBQZXJjZW50IHx8IHR5cGUoKSA9PSBDYWxjdWxhdGVk KTsKICAgICAgICAgcmV0dXJuIGdldEZsb2F0VmFsdWUoKTsKICAgICB9CiAKZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCA0NTU4 NWJjNjM1MzBhZmQzODJlMzNhNDI2ZDM2YzliMzMwN2Q2OThhLi43YTk5NzNmZWZmNDA4YzM3NjBh MzNhZDQwZjU2NTU1NTk1ZjVkODRhIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cK KysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMTMtMDgtMTIg IFphbiBEb2JlcnNlayAgPHpkb2JlcnNla0BpZ2FsaWEuY29tPgorCisgICAgICAgIEFTU0VSVElP TiBGQUlMRUQ6IHR5cGUoKSA9PSBQZXJjZW50IGluIFdlYkNvcmU6Okxlbmd0aDo6cGVyY2VudAor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTE2NzE1CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkIHRoZSB0 ZXN0IGNhc2UsIGFzIHByb2R1Y2VkIGJ5IHRoZSBGdXp6aW5hdG9yLCB0aGF0IHdhcyBjYXVzaW5n IGFzc2VydGlvbnMKKyAgICAgICAgaW4gTGVuZ3RoOjpwZXJjZW50IGR1ZSB0byBMZW5ndGggb2Jq ZWN0cyBvZiB0aGUgQ2FsY3VsYXRlZCB0eXBlIG5vdCBiZWluZyB0cmVhdGVkCisgICAgICAgIGFz IGhvbGRpbmcgYSBwcm9wZXIgcGVyY2VudCB2YWx1ZSBpbiB0aGF0IG1ldGhvZCwgZGVzcGl0ZSBM ZW5ndGg6OmlzUGVyY2VudAorICAgICAgICByZXR1cm5pbmcgdHJ1ZSBmb3IgTGVuZ3RoIG9iamVj dHMgb2YgZWl0aGVyIFBlcmNlbnQgb3IgdGhlIENhbGN1bGF0ZWQgdHlwZS4KKworICAgICAgICAq IGZhc3QvY3NzL2NhbGN1bGF0ZWQtbGVuZ3RoLWFzLXBlcmNlbnQtY3Jhc2gtZXhwZWN0ZWQudHh0 OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2Nzcy9jYWxjdWxhdGVkLWxlbmd0aC1hcy1wZXJjZW50 LWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDEzLTA4LTEyICBBbGxhbiBTYW5kZmVsZCBKZW5zZW4g IDxhbGxhbi5qZW5zZW5AZGlnaWEuY29tPgogCiAgICAgICAgIFtRdF0gQWRkIFN1cHBvcnQgZm9y IGNhbnZhcyBibGVuZCBtb2RlcwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9jc3MvY2Fs Y3VsYXRlZC1sZW5ndGgtYXMtcGVyY2VudC1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0 cy9mYXN0L2Nzcy9jYWxjdWxhdGVkLWxlbmd0aC1hcy1wZXJjZW50LWNyYXNoLWV4cGVjdGVkLnR4 dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwLi5iOTY2NWFlYTk5MjA5MmQ2ZDQ5MTMwYjM0Y2ZhMTA4YWQ2MjVlYzc3Ci0t LSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9jc3MvY2FsY3VsYXRlZC1sZW5ndGgt YXMtcGVyY2VudC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwzIEBACitUZXN0IGZvciBi dWcgIzExNjcxNTogQVNTRVJUSU9OIEZBSUxFRDogdHlwZSgpID09IFBlcmNlbnQgaW4gV2ViQ29y ZTo6TGVuZ3RoOjpwZXJjZW50CitUaGlzIHRlc3QgcGFzc2VzIGlmIHRoZXJlJ3Mgbm8gY3Jhc2gu CisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvY3NzL2NhbGN1bGF0ZWQtbGVuZ3RoLWFz LXBlcmNlbnQtY3Jhc2guaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvY3NzL2NhbGN1bGF0ZWQtbGVu Z3RoLWFzLXBlcmNlbnQtY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5iMDZmOGRjZjI1ODJjMjI4ODY2 NmFjY2I2YjkxNWU1MGVlNGJlNTdhCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFz dC9jc3MvY2FsY3VsYXRlZC1sZW5ndGgtYXMtcGVyY2VudC1jcmFzaC5odG1sCkBAIC0wLDAgKzEs MTkgQEAKKzwhRE9DVFlQRSBodG1sPgorPGhlYWQ+Cis8c2NyaXB0PgorICAgIGlmICh3aW5kb3cu dGVzdFJ1bm5lcikKKyAgICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4K KzwvaGVhZD4KKzxib2R5PgorPGRpdj4KK1Rlc3QgZm9yIDxhIGhyZWY9Imh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTY3MTUiPmJ1ZyAjMTE2NzE1PC9hPjogQVNTRVJU SU9OIEZBSUxFRDogdHlwZSgpID09IFBlcmNlbnQgaW4gV2ViQ29yZTo6TGVuZ3RoOjpwZXJjZW50 PGJyPgorVGhpcyB0ZXN0IHBhc3NlcyBpZiB0aGVyZSdzIG5vIGNyYXNoLgorPC9kaXY+Cis8dGFi bGU+Cis8dHI+Cis8dGQgc2NvcGU9ImNvbCIgY29sc3Bhbj0iNSIgc3R5bGU9IndpZHRoOiAtd2Vi a2l0LWNhbGMoMTAwJSArIC0xMDBweCk7Ij48L3RkPgorPC90cj4KKzwvdGFibGU+Cis8L2JvZHk+ Cis8L2h0bWw+Cg==