Bug 113768 – Web Inspector: crash in WebCore::InspectorLayerTreeAgent::buildObjectForLayer if a layer is created for an anonymous RenderObject (:first-letter)

• Component: Web Inspector (Deprecated)
• Status: RESOLVED FIXED

[Antoine Quint]

Steps to reproduce:

1. Load <http://sahilparikh.com/post/46741689726/building-a-saas-business-2007-vs-2013#> in a WebKit nightly
2. Open the Safari Web Inspector
3. Click on the layers pane
4. *crash*

The issue here is that a CSS rule using the :first-letter pseudo-element creates a composited layer (due to "backface-visilibity: hidden") and the InspectorLayerTreeAgent doesn't know how to handle such "special" RenderObjects. As a result, we get a null Node and when we ask for its nodeId, we eventually crash. We should be both more protective of unknown nodes and handle anonymous RenderObjects specifically.

[Radar WebKit Bug Importer]

<rdar://problem/13555463>

[Antoine Quint]

Created attachment 196169 [details]
Patch

[David Kilzer (:ddkilzer)]

Comment on attachment 196169 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=196169&action=review

> Source/WebCore/inspector/InspectorLayerTreeAgent.cpp:206
> +        RenderStyle* style = renderer->style();
> +        if (style) {

FWIW, this can be simplified to:

    if (RenderStyle* style = renderer->style()) {

[Simon Fraser (smfr)]

Comment on attachment 196169 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=196169&action=review

> Source/WebCore/inspector/InspectorLayerTreeAgent.cpp:175
> +    else if (isReflection || isAnonymous)
>          node = renderer->parent()->node();

Does this always work? What about a :first-letter inside a :first-line?

[Antoine Quint]

<rdar://problem/13555463>

[Antoine Quint]

(In reply to comment #4)
> (From update of attachment 196169 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=196169&action=review
> 
> > Source/WebCore/inspector/InspectorLayerTreeAgent.cpp:175
> > +    else if (isReflection || isAnonymous)
> >          node = renderer->parent()->node();
> 
> Does this always work? What about a :first-letter inside a :first-line?

Per my testing, that works too. I haven't found a way to have a ::first-letter be composited though, animations don't apply, neither do transforms, etc.

[Antoine Quint]

Created attachment 196313 [details]
Patch for landing

[Antoine Quint]

<rdar://problem/13544596>

[WebKit Review Bot]

Comment on attachment 196313 [details]
Patch for landing

Clearing flags on attachment: 196313

Committed r147538: <http://trac.webkit.org/changeset/147538>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.