<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>52225</bug_id>
          
          <creation_ts>2011-01-11 10:52:51 -0800</creation_ts>
          <short_desc>Webkit crashes when a gradient is applied using the first-line pseudo element</short_desc>
          <delta_ts>2011-01-11 21:30:58 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac (Intel)</rep_platform>
          <op_sys>OS X 10.6</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://matiasventura.com/test.htm</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Matias">mtiasv</reporter>
          <assigned_to name="Simon Fraser (smfr)">simon.fraser</assigned_to>
          <cc>hyatt</cc>
    
    <cc>mitz</cc>
    
    <cc>simon.fraser</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>332451</commentid>
    <comment_count>0</comment_count>
    <who name="Matias">mtiasv</who>
    <bug_when>2011-01-11 10:52:51 -0800</bug_when>
    <thetext>The following code crashes with Webkit for me (can be tested on the url above):

&lt;!DOCTYPE html&gt;
&lt;html lang=&quot;en&quot;&gt;
&lt;head&gt;
	&lt;meta charset=&quot;utf-8&quot;&gt;
	&lt;title&gt;Test&lt;/title&gt;

&lt;style&gt;
body {
	background: #eee;
	font-family: &apos;Helvetica Neue&apos;, Helvetica, Arial, sans-serif;
	font-weight: 200;
}

#wrapper {
	margin: 150px auto;
	width: 700px;
}

.sleeve_main {
	background: #fff;
	margin: 0;
	padding: 100px 40px;
	border-radius: 8px;
}

h2:first-line {
	background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(#EED200), to(#EDBE00));
}
&lt;/style&gt;

&lt;/head&gt;
&lt;body&gt;

&lt;div id=&quot;wrapper&quot;&gt;
	
&lt;div class=&quot;sleeve_main&quot;&gt;

	&lt;h2&gt;Quisque facilisis erat a dui. Nam malesuada ornare dolor.&lt;/h2&gt;
	
&lt;/div&gt;
&lt;/div&gt;
&lt;/body&gt;
&lt;/html&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>332478</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2011-01-11 11:26:17 -0800</bug_when>
    <thetext>&lt;rdar://problem/8045778&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>332894</commentid>
    <comment_count>2</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-01-11 20:56:36 -0800</bug_when>
    <thetext>The problem here is that we don&apos;t go through the normal updateFillImages() code for the :first-line style (which might be a cached pseudostyle), so the image has no reference to its clients, and the CSSValue fails to cache the Image in its hash table, so nothing keeps the Image alive.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>332896</commentid>
    <comment_count>3</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-01-11 21:04:51 -0800</bug_when>
    <thetext>The fact that the RenderObject isn&apos;t registered as a client of the image in the pseudostyle is also evident in the fact that animated background-images used in :first-line fail to repaint their renderer.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>332898</commentid>
    <comment_count>4</comment_count>
      <attachid>78648</attachid>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-01-11 21:13:49 -0800</bug_when>
    <thetext>Created attachment 78648
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>332901</commentid>
    <comment_count>5</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-01-11 21:30:58 -0800</bug_when>
    <thetext>http://trac.webkit.org/changeset/75585</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>78648</attachid>
            <date>2011-01-11 21:13:49 -0800</date>
            <delta_ts>2011-01-11 21:20:15 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-52225-20110111211347.patch</filename>
            <type>text/plain</type>
            <size>3604</size>
            <attacher name="Simon Fraser (smfr)">simon.fraser</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCA3OGM1NTMxMGQ0OGRkNzczYjc1ZDMwYmQ4YzkxZTk5YjM1ZGI0ZWU5Li5kZDZkY2Rj
YTc3ZTFiNjIxZTMwZDg2MzdhZjRhZDI0ZGNkMGZkMDhkIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0
cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAK
KzIwMTEtMDEtMTEgIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CisKKyAg
ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2Via2l0IGNyYXNo
ZXMgd2hlbiBhIGdyYWRpZW50IGlzIGFwcGxpZWQgdXNpbmcgdGhlIGZpcnN0LWxpbmUgcHNldWRv
IGVsZW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk
PTUyMjI1CisgICAgICAgIAorICAgICAgICBUZXN0Y2FzZS4KKworICAgICAgICAqIGZhc3QvZ3Jh
ZGllbnRzL2dyYWRpZW50LW9uLXBzZXVkb2VsZW1lbnQtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRl
ZC4KKyAgICAgICAgKiBmYXN0L2dyYWRpZW50cy9ncmFkaWVudC1vbi1wc2V1ZG9lbGVtZW50LWNy
YXNoLmh0bWw6IEFkZGVkLgorCiAyMDExLTAxLTExICBKdXN0aW4gU2NodWggIDxqc2NodWhAY2hy
b21pdW0ub3JnPgogCiAgICAgICAgIFVucmV2aWV3ZWQgY2hyb21pdW0gZXhwZWN0YXRpb25zIHVw
ZGF0ZS4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvZ3JhZGllbnRzL2dyYWRpZW50LW9u
LXBzZXVkb2VsZW1lbnQtY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9ncmFk
aWVudHMvZ3JhZGllbnQtb24tcHNldWRvZWxlbWVudC1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZp
bGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMC4uZmMwNjYwY2Y3YTE5OWJkYzg4NTY5OTNkZDU3NzZjMmRlZGExMzU2ZAotLS0gL2Rldi9u
dWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZ3JhZGllbnRzL2dyYWRpZW50LW9uLXBzZXVkb2Vs
ZW1lbnQtY3Jhc2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEgQEAKK1RoaXMgdGVzdCBzaG91bGQg
bm90IGNyYXNoLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9ncmFkaWVudHMvZ3JhZGll
bnQtb24tcHNldWRvZWxlbWVudC1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9ncmFkaWVu
dHMvZ3JhZGllbnQtb24tcHNldWRvZWxlbWVudC1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAw
NjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmZhYmYx
ZmFlMDU4M2VkZjhjMTJmOGZmMzZiNGRmZjkwNmE3ODA5ZTkKLS0tIC9kZXYvbnVsbAorKysgYi9M
YXlvdXRUZXN0cy9mYXN0L2dyYWRpZW50cy9ncmFkaWVudC1vbi1wc2V1ZG9lbGVtZW50LWNyYXNo
Lmh0bWwKQEAgLTAsMCArMSwxNyBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxoZWFkPgor
PHN0eWxlPgorYm9keTpmaXJzdC1saW5lIHsKKyAgICBiYWNrZ3JvdW5kLWltYWdlOiAtd2Via2l0
LWdyYWRpZW50KGxpbmVhciwgMCUgMCUsIDAlIDEwMCUsIGZyb20oYmx1ZSksIHRvKGdyZWVuKSk7
Cit9Cis8L3N0eWxlPgorPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIGNoYXJzZXQ9InV0
Zi04Ij4KKyAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICBsYXlvdXRUZXN0
Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5PgorVGhp
cyB0ZXN0IHNob3VsZCBub3QgY3Jhc2guCis8L2JvZHk+Cis8L2h0bWw+CmRpZmYgLS1naXQgYS9T
b3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg
ZTQ4YjAyNDU2ZmUwOGE1MTBiYzI0NThkMWYxMzI3NGIzOTdjYzRkYS4uZTRkYzljN2UwMTI2OTli
YzA2MGNjOGZmOWRkYzc1NTI2NDcxZDEyYiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hh
bmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisy
MDExLTAxLTExICBTaW1vbiBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29tPgorCisgICAg
ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFdlYmtpdCBjcmFzaGVz
IHdoZW4gYSBncmFkaWVudCBpcyBhcHBsaWVkIHVzaW5nIHRoZSBmaXJzdC1saW5lIHBzZXVkbyBl
bGVtZW50CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01
MjIyNQorICAgICAgICAKKyAgICAgICAgV2hlbiBhIHBzZXVkb3N0eWxlIHJlZmVyZW5jZXMgaW1h
Z2VzLCB3ZSBmYWlsIHRvIHJlZ2lzdGVyL3VucmVnaXN0ZXIKKyAgICAgICAgdGhlIHJlbGV2YW50
IFJlbmRlck9iamVjdHMgYXMgY2xpZW50cyBvZiB0aGUgaW1hZ2UgaW4gdGhlIHN0eWxlLgorICAg
ICAgICBGb3IgZ3JhZGllbnRzLCB0aGlzIGNhdXNlZCBhIGNyYXNoLgorICAgICAgICAKKyAgICAg
ICAgVGhpcyBwYXRjaCBmaXhlcyB0aGUgY3Jhc2ggYnkgcmV0dXJuaW5nIGEgbnVsbCBncmFkaWVu
dCBpbWFnZSBpbiB0aGlzCisgICAgICAgIHNpdHVhdGlvbi4KKworICAgICAgICBUZXN0OiBmYXN0
L2dyYWRpZW50cy9ncmFkaWVudC1vbi1wc2V1ZG9lbGVtZW50LWNyYXNoLmh0bWwKKworICAgICAg
ICAqIGNzcy9DU1NHcmFkaWVudFZhbHVlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNTU0dyYWRp
ZW50VmFsdWU6OmltYWdlKToKKwogMjAxMS0wMS0xMSAgQW5keSBFc3RlcyAgPGFlc3Rlc0BhcHBs
ZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIuCmRpZmYgLS1naXQgYS9T
b3VyY2UvV2ViQ29yZS9jc3MvQ1NTR3JhZGllbnRWYWx1ZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9j
c3MvQ1NTR3JhZGllbnRWYWx1ZS5jcHAKaW5kZXggODA0MGM2Y2VmZTNlMjI5ODA4NDc1N2IwMDcy
ZTZkY2NlNDQ3OTk3MS4uZmRlNGE0ZTM0ZmE4M2JjZDU3NzljZjU4ODk0NTQ4ODRkNDg4NmUwMSAx
MDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvY3NzL0NTU0dyYWRpZW50VmFsdWUuY3BwCisrKyBi
L1NvdXJjZS9XZWJDb3JlL2Nzcy9DU1NHcmFkaWVudFZhbHVlLmNwcApAQCAtNDMsNyArNDMsOCBA
QCBuYW1lc3BhY2UgV2ViQ29yZSB7CiAKIEltYWdlKiBDU1NHcmFkaWVudFZhbHVlOjppbWFnZShS
ZW5kZXJPYmplY3QqIHJlbmRlcmVyLCBjb25zdCBJbnRTaXplJiBzaXplKQogewotICAgIEFTU0VS
VChtX2NsaWVudHMuY29udGFpbnMocmVuZGVyZXIpKTsKKyAgICBpZiAoIW1fY2xpZW50cy5jb250
YWlucyhyZW5kZXJlcikpCisgICAgICAgIHJldHVybiAwOwogCiAgICAgLy8gTmVlZCB0byBsb29r
IHVwIG91ciBzaXplLiAgQ3JlYXRlIGEgc3RyaW5nIG9mIHdpZHRoKmhlaWdodCB0byB1c2UgYXMg
YSBoYXNoIGtleS4KICAgICAvLyBGSVhNRTogaGFzaGluZyBiYXNlZCBvbmx5IG9uIHNpemUgaXMg
bm90IHN1ZmZpY2llbnQuIENvbG9yIHN0b3BzIG1heSB1c2UgY29udGV4dC1zZW5zaXRpdmUgdW5p
dHMgKGxpa2UgZW0pCg==
</data>
<flag name="review"
          id="70002"
          type_id="1"
          status="+"
          setter="mitz"
    />
          </attachment>
      

    </bug>

</bugzilla>