Summary: | Making -webkit-image-set() the first value of background property causes crash. | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Simon Fraser (smfr) <simon.fraser> | ||||||||
Component: | CSS | Assignee: | Takashi Sakamoto <tasak> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | bdakin, cmarcelo, detmud, eoconnor, macpherson, menard, ojan.autocc, simon.fraser, tasak, webkit-bug-importer, webkit.review.bot | ||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||
Version: | 528+ (Nightly build) | ||||||||||
Hardware: | Unspecified | ||||||||||
OS: | Unspecified | ||||||||||
Attachments: |
|
Found by Detmund_ on #webkit s/Detmund_/DETMUD Debug build hits: ASSERTION FAILED: imageValue->isImageValue() /Volumes/SSData/Development/OSX/webkit/OpenSource/Source/WebCore/css/CSSImageSetValue.cpp(65) : void WebCore::CSSImageSetValue::fillImageSet() 1 0x103872c95 WebCore::CSSImageSetValue::fillImageSet() 2 0x10387304b WebCore::CSSImageSetValue::cachedImageSet(WebCore::CachedResourceLoader*) 3 0x104e993c0 WebCore::StyleResolver::loadPendingImage(WebCore::StylePendingImage*) 4 0x104e99713 WebCore::StyleResolver::loadPendingImages() 5 0x104e90fe9 WebCore::StyleResolver::loadPendingResources() 6 0x104e8a362 WebCore::StyleResolver::applyMatchedProperties(WebCore::StyleResolver::MatchResult const&, WebCore::Element const*) 7 0x104e84570 WebCore::StyleResolver::styleForElement(WebCore::Element*, WebCore::RenderStyle*, WebCore::StyleSharingBehavior, WebCore::RuleMatchingBehavior, WebCore::RenderRegion*) Its not just the -webkit-image-set() in the body, its the layering of -webkit-image-set() and -webkit-gradient() in the body. Detmud_ #webkit Created attachment 185678 [details]
Patch
Comment on attachment 185678 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=185678&action=review > Source/WebCore/ChangeLog:3 > + -webkit-image-set() on the body causes crash The crash is not related to the image-set being used on the body. Please amend the bug title and Changelog. > LayoutTests/fast/css/image-set-value-crash-in-fillImageSet.html:17 > + -webkit-image-set( > + url(images/noise.png) 1x, > + url(images/noise@2x.png) 2x), > + -webkit-gradient( > + linear, left top, left bottom, > + from(#eaeaea), > + to(#d2d2d2) > + );"> Please remove the tabs, and unwrap the lines. Created attachment 185684 [details]
Patch
Comment on attachment 185678 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=185678&action=review Thank you for reviewing. >> Source/WebCore/ChangeLog:3 >> + -webkit-image-set() on the body causes crash > > The crash is not related to the image-set being used on the body. Please amend the bug title and Changelog. Sure. Done. >> LayoutTests/fast/css/image-set-value-crash-in-fillImageSet.html:17 >> + );"> > > Please remove the tabs, and unwrap the lines. Done. I also moved the inline style to a style element in document.head. Comment on attachment 185684 [details] Patch Clearing flags on attachment: 185684 Committed r141701: <http://trac.webkit.org/changeset/141701> All reviewed patches have been landed. Closing bug. |
Created attachment 185633 [details] Testcase (crashes!) Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000001035517a9 WebCore::CSSPrimitiveValue::getDoubleValue() const + 9 1 com.apple.WebCore 0x0000000103521933 WebCore::CSSImageSetValue::fillImageSet() + 99 2 com.apple.WebCore 0x0000000103521b01 WebCore::CSSImageSetValue::cachedImageSet(WebCore::CachedResourceLoader*) + 97 3 com.apple.WebCore 0x0000000103c74a21 WebCore::StyleResolver::loadPendingImage(WebCore::StylePendingImage*) + 241 4 com.apple.WebCore 0x0000000103c74d47 WebCore::StyleResolver::loadPendingImages() + 759 5 com.apple.WebCore 0x0000000103c67a23 WebCore::StyleResolver::applyMatchedProperties(WebCore::StyleResolver::MatchResult const&, WebCore::Element const*) + 1091 6 com.apple.WebCore 0x0000000103c6366c WebCore::StyleResolver::styleForElement(WebCore::Element*, WebCore::RenderStyle*, WebCore::StyleSharingBehavior, WebCore::RuleMatchingBehavior, WebCore::RenderRegion*) + 4236 7 com.apple.WebCore 0x000000010368581e WebCore::Element::styleForRenderer() + 126 8 com.apple.WebCore 0x0000000103a9bb14 WebCore::NodeRenderingContext::createRendererForElementIfNeeded() + 52 9 com.apple.WebCore 0x000000010301994a WebCore::Element::attach() + 58 10 com.apple.WebCore 0x0000000103718afc WebCore::executeTask(WebCore::HTMLConstructionSiteTask&) + 172