139391 2014-12-08 04:46:32 -0800 Should never reach failure in WebCore::CSSPrimitiveValue::computeLengthDouble 2021-09-22 03:55:05 -0700 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham cdumez giles_joplin krit rbuis sam webkit-bug-importer oldest_to_newest 1053357 0 242803 rhodovan.u-szeged 2014-12-08 04:46:32 -0800 Created attachment 242803 Test case Load this test: <style> * { -webkit-border-image: radial-gradient(circle closest-side at right bottom 8187%, InactiveBorder,transparent 50%); } </style> Backtrace: SHOULD NEVER BE REACHED ../../Source/WebCore/css/CSSPrimitiveValue.cpp(658) : double WebCore::CSSPrimitiveValue::computeLengthDouble(const WebCore::CSSToLengthConversionData&) const Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff98927700 (LWP 24923)] 0x00007fffedbca36f in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007fffedbca36f in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff2f2e26a in WebCore::CSSPrimitiveValue::computeLengthDouble (this=0x7d0830, conversionData=...) at ../../Source/WebCore/css/CSSPrimitiveValue.cpp:658 #2 0x00007ffff2f2ddbf in WebCore::CSSPrimitiveValue::computeLength<float> (this=0x7d0830, conversionData=...) at ../../Source/WebCore/css/CSSPrimitiveValue.cpp:581 #3 0x00007ffff2eb9155 in WebCore::positionFromValue (value=..., conversionData=..., size=..., isHorizontal=true) at ../../Source/WebCore/css/CSSGradientValue.cpp:528 #4 0x00007ffff2eb91e8 in WebCore::CSSGradientValue::computeEndPoint (this=0x6590a0, horizontal=0x7d0830, vertical=0x7d0880, conversionData=..., size=...) at ../../Source/WebCore/css/CSSGradientValue.cpp:536 #5 0x00007ffff2ebcf56 in WebCore::CSSRadialGradientValue::createGradient (this=0x6590a0, renderer=..., size=...) at ../../Source/WebCore/css/CSSGradientValue.cpp:1094 #6 0x00007ffff2eb6953 in WebCore::CSSGradientValue::image (this=0x6590a0, renderer=0x7ceeb0, size=...) at ../../Source/WebCore/css/CSSGradientValue.cpp:66 #7 0x00007ffff2ec808e in WebCore::CSSImageGeneratorValue::image (this=0x6590a0, renderer=0x7ceeb0, size=...) at ../../Source/WebCore/css/CSSImageGeneratorValue.cpp:120 #8 0x00007ffff3bb00bb in WebCore::StyleGeneratedImage::image (this=0x693110, renderer=0x7ceeb0, size=...) at ../../Source/WebCore/rendering/style/StyleGeneratedImage.cpp:90 #9 0x00007ffff39b78c6 in WebCore::RenderBoxModelObject::paintNinePieceImage (this=0x7ceeb0, graphicsContext=0x65a170, rect=..., style=..., ninePieceImage=..., op=WebCore::CompositeSourceOver) at ../../Source/WebCore/rendering/RenderBoxModelObject.cpp:1318 #10 0x00007ffff39bb1cb in WebCore::RenderBoxModelObject::paintBorder (this=0x7ceeb0, info=..., rect=..., style=..., bleedAvoidance=WebCore::BackgroundBleedNone, includeLogicalLeftEdge=true, includeLogicalRightEdge=true) at ../../Source/WebCore/rendering/RenderBoxModelObject.cpp:1740 #11 0x00007ffff3992c79 in WebCore::RenderBox::paintBoxDecorations (this=0x7ceeb0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBox.cpp:1297 #12 0x00007ffff3937551 in WebCore::RenderBlock::paintObject (this=0x7ceeb0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1563 #13 0x00007ffff39368ac in WebCore::RenderBlock::paint (this=0x7ceeb0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1434 #14 0x00007ffff3a4ad6f in WebCore::RenderLayer::paintBackgroundForFragments (this=0x7cf340, layerFragments=..., context=0x65a170, transparencyLayerContext=0x65a170, transparencyPaintDirtyRect=..., haveTransparency=false, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0) at ../../Source/WebCore/rendering/RenderLayer.cpp:4488 #15 0x00007ffff3a492ab in WebCore::RenderLayer::paintLayerContents (this=0x7cf340, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4148 #16 0x00007ffff3a47f8c in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x7cf340, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:3848 #17 0x00007ffff3a47e6b in WebCore::RenderLayer::paintLayer (this=0x7cf340, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:3830 #18 0x00007ffff3a49b34 in WebCore::RenderLayer::paintList (this=0x73ff50, list=0x4f5210, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4252 #19 0x00007ffff3a4944a in WebCore::RenderLayer::paintLayerContents (this=0x73ff50, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4169 #20 0x00007ffff3a47f8c in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x73ff50, context=0x65a170, paintingInfo=..., paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3848 #21 0x00007ffff3a47e6b in WebCore::RenderLayer::paintLayer (this=0x73ff50, context=0x65a170, paintingInfo=..., paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3830 #22 0x00007ffff3a46edf in WebCore::RenderLayer::paint (this=0x73ff50, context=0x65a170, damageRect=..., subpixelAccumulation=..., paintBehavior=0, subtreePaintRoot=0x0, paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3633 #23 0x00007ffff36a5433 in WebCore::FrameView::paintContents (this=0x7cd720, context=0x65a170, dirtyRect=...) at ../../Source/WebCore/page/FrameView.cpp:3846 #24 0x00007ffff3769da7 in WebCore::ScrollView::paint (this=0x7cd720, context=0x65a170, rect=...) at ../../Source/WebCore/platform/ScrollView.cpp:1203 #25 0x00007ffff2a40c7d in WebKit::WebPage::drawRect (this=0x849ed0, graphicsContext=..., rect=...) at ../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:1330 #26 0x00007ffff2b360c4 in WebKit::DrawingAreaImpl::display (this=0x6e2410, updateInfo=...) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:634 #27 0x00007ffff2b35954 in WebKit::DrawingAreaImpl::display (this=0x6e2410) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:550 #28 0x00007ffff2b35812 in WebKit::DrawingAreaImpl::displayTimerFired (this=0x6e2410) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:529 #29 0x00007ffff2b37cd1 in WTF::RunLoop::Timer<WebKit::DrawingAreaImpl>::fired (this=0x6e2608) at ../../Source/WTF/wtf/RunLoop.h:121 #30 0x00007ffff45dfee9 in WTF::RunLoop::TimerBase::__lambda1::operator() (__closure=0x7cf2d0) at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:121 #31 0x00007ffff45e038f in std::_Function_handler<bool(), WTF::RunLoop::TimerBase::start(double, bool)::__lambda1>::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/4.8/functional:2057 #32 0x00007ffff45df570 in std::function<bool ()>::operator()() const (this=0x7fffffffd5d8) at /usr/include/c++/4.8/functional:2464 #33 0x00007fffedc140b6 in WTF::GMainLoopSource::boolCallback (this=0x6e2618) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:405 #34 0x00007fffedc1452b in WTF::GMainLoopSource::boolSourceCallback (source=0x6e2618, source@entry=<error reading variable: value has been optimized out>) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:462 #35 0x00007fffeaa11443 in g_timeout_dispatch (source=0x693890, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4472 #36 0x00007fffeaa10a1d in g_main_dispatch (context=0x478020) at gmain.c:3064 #37 g_main_context_dispatch (context=context@entry=0x478020) at gmain.c:3663 #38 0x00007fffeaa10d88 in g_main_context_iterate (context=0x478020, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734 #39 0x00007fffeaa1104a in g_main_loop_run (loop=0x8eb810) at gmain.c:3928 #40 0x00007ffff45df9dc in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #41 0x00007ffff2b44f82 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #42 0x00007ffff2b44de7 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #43 0x0000000000400891 in main (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44 1217481 1 bfulgham 2016-08-04 10:57:32 -0700 This issue reproduces in r204037. 1217482 2 webkit-bug-importer 2016-08-04 10:57:51 -0700 <rdar://problem/27702894> 1217484 3 bfulgham 2016-08-04 10:58:54 -0700 Primitive Type is CSS_PAIR, which is not expected. 1796005 4 rbuis 2021-09-22 03:55:05 -0700 Can't reproduce anymore, likely fixed by https://bugs.webkit.org/show_bug.cgi?id=189142. 242803 2014-12-08 04:46:32 -0800 2014-12-08 04:46:32 -0800 Test case crash.html text/html 136 rhodovan.u-szeged PHN0eWxlPgoqIHsKLXdlYmtpdC1ib3JkZXItaW1hZ2U6IHJhZGlhbC1ncmFkaWVudChjaXJjbGUg Y2xvc2VzdC1zaWRlIGF0IHJpZ2h0IGJvdHRvbSA4MTg3JSwgSW5hY3RpdmVCb3JkZXIsdHJhbnNw YXJlbnQgNTAlKTsKfQo8L3N0eWxlPg==