<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>66686</bug_id>
          
          <creation_ts>2011-08-22 11:04:07 -0700</creation_ts>
          <short_desc>Crash with -webkit-radial-gradient(top) gradient</short_desc>
          <delta_ts>2011-08-31 12:11:43 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>CSS</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Major</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Rafał Chłodnicki">rchl2k</reporter>
          <assigned_to name="Simon Fraser (smfr)">simon.fraser</assigned_to>
          <cc>cachobot</cc>
    
    <cc>simon.fraser</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>454702</commentid>
    <comment_count>0</comment_count>
    <who name="Rafał Chłodnicki">rchl2k</who>
    <bug_when>2011-08-22 11:04:07 -0700</bug_when>
    <thetext>-webkit-radial-gradient(top) crashes browser. Possibly at CSS parsing stage but could be rendering instead.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>454712</commentid>
    <comment_count>1</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-08-22 11:09:51 -0700</bug_when>
    <thetext>Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00007fff94013212 WebCore::CSSParser::parseRadialGradient(WTF::RefPtr&lt;WebCore::CSSValue&gt;&amp;, WebCore::CSSGradientRepeat) + 430
1   com.apple.WebCore             	0x00007fff93ab846e WebCore::CSSParser::parseGeneratedImage(WTF::RefPtr&lt;WebCore::CSSValue&gt;&amp;) + 400
2   com.apple.WebCore             	0x00007fff93ab58d6 WebCore::CSSParser::parseFillImage(WTF::RefPtr&lt;WebCore::CSSValue&gt;&amp;) + 462
3   com.apple.WebCore             	0x00007fff93ab4fb8 WebCore::CSSParser::parseFillProperty(int, int&amp;, int&amp;, WTF::RefPtr&lt;WebCore::CSSValue&gt;&amp;, WTF::RefPtr&lt;WebCore::CSSValue&gt;&amp;) + 682
4   com.apple.WebCore             	0x00007fff93a22d5f WebCore::CSSParser::parseValue(int, bool) + 4473
5</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>454713</commentid>
    <comment_count>2</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-08-22 11:10:45 -0700</bug_when>
    <thetext>&lt;rdar://problem/9718053&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>459673</commentid>
    <comment_count>3</comment_count>
      <attachid>105782</attachid>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-08-31 09:35:40 -0700</bug_when>
    <thetext>Created attachment 105782
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>459710</commentid>
    <comment_count>4</comment_count>
      <attachid>105782</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2011-08-31 10:33:42 -0700</bug_when>
    <thetext>Comment on attachment 105782
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=105782&amp;action=review

&gt; LayoutTests/fast/gradients/css3-radial-gradient-crash-expected.txt:1
&gt; +

Usually better to put some output like “this passes if it does not crash” into the document.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>459819</commentid>
    <comment_count>5</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2011-08-31 12:11:43 -0700</bug_when>
    <thetext>http://trac.webkit.org/changeset/94215</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>105782</attachid>
            <date>2011-08-31 09:35:40 -0700</date>
            <delta_ts>2011-08-31 10:33:42 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-66686-20110831093538.patch</filename>
            <type>text/plain</type>
            <size>3251</size>
            <attacher name="Simon Fraser (smfr)">simon.fraser</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogOTM4NDkKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n
ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBiYzJiNDU1NmE4N2E4ZTA3MzM4NDI2
Yjc0NzVlYzI5Mjc3N2I2ZjRlLi40ZjU1YTBjY2RmYzI1ZmFkNWYxZTgzY2E3NmZkZWRiOWNjZjg0
NjA3IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv
Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTEtMDgtMzEgIFNpbW9uIEZyYXNlciAgPHNp
bW9uLmZyYXNlckBhcHBsZS5jb20+CisKKyAgICAgICAgQ3Jhc2ggd2l0aCAtd2Via2l0LXJhZGlh
bC1ncmFkaWVudCh0b3ApIGdyYWRpZW50CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn
L3Nob3dfYnVnLmNnaT9pZD02NjY4NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q
UyEpLgorICAgICAgICAKKyAgICAgICAgVGVzdCBjYXNlIHdpdGggZGVnZW5lcmF0ZSBhcmd1bWVu
dHMgaW4gYSByYWRpYWwgZ3JhZGllbnQuCisKKyAgICAgICAgKiBmYXN0L2dyYWRpZW50cy9jc3Mz
LXJhZGlhbC1ncmFkaWVudC1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZh
c3QvZ3JhZGllbnRzL2NzczMtcmFkaWFsLWdyYWRpZW50LWNyYXNoLmh0bWw6IEFkZGVkLgorCiAy
MDExLTA4LTI1ICBNYXJ0aW4gUm9iaW5zb24gIDxtcm9iaW5zb25AaWdhbGlhLmNvbT4KIAogICAg
ICAgICBTa2lwIHNvbWUgdGVzdHMgb24gR1RLKyB0aGF0IGFyZSBtaXNzaW5nIERSVCBmdW5jdGlv
bmFsaXR5LiBBbHNvCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2dyYWRpZW50cy9jc3Mz
LXJhZGlhbC1ncmFkaWVudC1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L2dy
YWRpZW50cy9jc3MzLXJhZGlhbC1ncmFkaWVudC1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUg
bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MC4uOGIxMzc4OTE3OTFmZTk2OTI3YWQ3OGU2NGIwYWFkN2JkZWQwOGJkYwotLS0gL2Rldi9udWxs
CisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZ3JhZGllbnRzL2NzczMtcmFkaWFsLWdyYWRpZW50LWNy
YXNoLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxIEBACisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz
L2Zhc3QvZ3JhZGllbnRzL2NzczMtcmFkaWFsLWdyYWRpZW50LWNyYXNoLmh0bWwgYi9MYXlvdXRU
ZXN0cy9mYXN0L2dyYWRpZW50cy9jc3MzLXJhZGlhbC1ncmFkaWVudC1jcmFzaC5odG1sCm5ldyBm
aWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAuLjRiYjE3NmU0NzQzY2I3MDAwMjI4NWIwZGI4M2JhOTc1NmM5ZDRhZWYKLS0tIC9kZXYv
bnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2dyYWRpZW50cy9jc3MzLXJhZGlhbC1ncmFkaWVu
dC1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMTEgQEAKKzxoZWFkPgorPHNjcmlwdD4KK2lmICh3aW5k
b3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgIHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlci5k
dW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5PgorPCEtLSBUaGlzIHRlc3Qg
c2hvdWxkIG5vdCBjcmFzaCAtLT4KKzxkaXYgc3R5bGU9ImhlaWdodDogMTBweDsgd2lkdGg6IDEw
cHg7IGJhY2tncm91bmQtaW1hZ2U6IC13ZWJraXQtcmFkaWFsLWdyYWRpZW50KHRvcCkiPjwvZGl2
PgorPC9ib2R5PgorCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3Vy
Y2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOTNiMWMwOTIwMjE1MGZiYTA4Y2M1MDE2MzU1Mjky
ZGQ1OGI5Zjg2Mi4uYzM5ZjIxMWZjZDc5YmU3MzZkYjQ4NDgzZTFlNDI2NDM4MzhjNmNhYyAxMDA2
NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0No
YW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDExLTA4LTMxICBTaW1vbiBGcmFzZXIgIDxzaW1v
bi5mcmFzZXJAYXBwbGUuY29tPgorCisgICAgICAgIENyYXNoIHdpdGggLXdlYmtpdC1yYWRpYWwt
Z3JhZGllbnQodG9wKSBncmFkaWVudAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z
aG93X2J1Zy5jZ2k/aWQ9NjY2ODYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh
KS4KKyAgICAgICAgCisgICAgICAgIE51bGwtY2hlY2sgdGhlIGN1cnJlbnQgdmFsdWUgYWZ0ZXIg
Y2FsbGluZyBwYXJzZUZpbGxQb3NpdGlvbigpLAorICAgICAgICBzaW5jZSBpdCBtYXkgYmUgbnVs
bCBmb3IgZ3JhZGllbnRzIHdpdGggZGVnZW5lcmF0ZSBhcmd1bWVudHMuCisKKyAgICAgICAgVGVz
dDogZmFzdC9ncmFkaWVudHMvY3NzMy1yYWRpYWwtZ3JhZGllbnQtY3Jhc2guaHRtbAorCisgICAg
ICAgICogY3NzL0NTU1BhcnNlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpDU1NQYXJzZXI6OnBh
cnNlUmFkaWFsR3JhZGllbnQpOgorCiAyMDExLTA4LTI1ICBMdWtlIE1hY3BoZXJzb24gICA8bWFj
cGhlcnNvbkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgSW1wbGVtZW50IGFuaW1hdGlvbiBhbmQg
dHJhbnNpdGlvbiBwcm9wZXJ0aWVzIGluIENTU1N0eWxlQXBwbHlQcm9wZXJ0eS4KZGlmZiAtLWdp
dCBhL1NvdXJjZS9XZWJDb3JlL2Nzcy9DU1NQYXJzZXIuY3BwIGIvU291cmNlL1dlYkNvcmUvY3Nz
L0NTU1BhcnNlci5jcHAKaW5kZXggZDZmNDI3N2Y0YmQ5NjJkMTRkN2RjMzRiZWZkZjBhYTdmMzBm
Yjk3Ny4uYzBhOTgyOTU1M2UzY2Q1ZjQxOGMzOTE1NTAyNjRiMTY0MGM1MWVjMCAxMDA2NDQKLS0t
IGEvU291cmNlL1dlYkNvcmUvY3NzL0NTU1BhcnNlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUv
Y3NzL0NTU1BhcnNlci5jcHAKQEAgLTU3NDEsNiArNTc0MSw4IEBAIGJvb2wgQ1NTUGFyc2VyOjpw
YXJzZVJhZGlhbEdyYWRpZW50KFJlZlB0cjxDU1NWYWx1ZT4mIGdyYWRpZW50LCBDU1NHcmFkaWVu
dFJlcGVhCiAgICAgLy8gcGFyc2VGaWxsUG9zaXRpb24gYWR2YW5jZXMgdGhlIGFyZ3MgbmV4dCBw
b2ludGVyLgogICAgIHBhcnNlRmlsbFBvc2l0aW9uKGFyZ3MsIGNlbnRlclgsIGNlbnRlclkpOwog
ICAgIGEgPSBhcmdzLT5jdXJyZW50KCk7CisgICAgaWYgKCFhKQorICAgICAgICByZXR1cm4gZmFs
c2U7CiAgICAgCiAgICAgaWYgKGNlbnRlclggfHwgY2VudGVyWSkgewogICAgICAgICAvLyBDb21t
YQo=
</data>
<flag name="review"
          id="102030"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>