Bug 116715 – ASSERTION FAILED: type() == Percent in WebCore::Length::percent

• Component: Tables
• Status: RESOLVED FIXED

[Renata Hodovan]

Created attachment 202795 [details]
Test case

The attached test throws an ASSERTION FAILURE in debug webkit.

The parser accepts the style definition: style="width: -webkit-calc(100% +   -100px);" what probably should not do.

#0  0x00007ffff5758c3d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
#1  0x00007ffff409c4d3 in WebCore::Length::percent (this=0x7fffffffaf60) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/Length.h:139
#2  0x00007ffff484dfa9 in WebCore::AutoTableLayout::calcEffectiveLogicalWidth (this=0x8d3f90)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/AutoTableLayout.cpp:345
#3  0x00007ffff484d68e in WebCore::AutoTableLayout::computeIntrinsicLogicalWidths (this=0x8d3f90, minWidth=..., maxWidth=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/AutoTableLayout.cpp:217
#4  0x00007ffff4a15149 in WebCore::RenderTable::computeIntrinsicLogicalWidths (this=0x8d2d18, minWidth=..., maxWidth=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:740
#5  0x00007ffff4a151bd in WebCore::RenderTable::computePreferredLogicalWidths (this=0x8d2d18)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:749
#6  0x00007ffff4900517 in WebCore::RenderBox::maxPreferredLogicalWidth (this=0x8d2d18)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:861
#7  0x00007ffff4a11fde in WebCore::RenderTable::updateLogicalWidth (this=0x8d2d18)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:273
#8  0x00007ffff4a12f6a in WebCore::RenderTable::layout (this=0x8d2d18) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:414
#9  0x00007ffff48a3b1c in WebCore::RenderBlock::layoutBlockChild (this=0x88d4b8, child=0x8d2d18, marginInfo=..., previousFloatLogicalBottom=..., 
    maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2621

[Zan Dobersek]

Length::isPercent returns true if the Length object has type of either Percent or Calculated. Length::percent asserts that the type must be Percent.

Should the assert in Length::percent (where the current crash occurs) allow the Calculated type as well?

[Zan Dobersek]

Bug #79621 introduced the Calculated type and started treating Length objects of that type as if having a percent value.
http://trac.webkit.org/changeset/110148

[Zan Dobersek]

Created attachment 208546 [details]
Patch

[Darin Adler]

Comment on attachment 208546 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208546&action=review

> Source/WebCore/platform/Length.h:139
> +        ASSERT(type() == Percent || type() == Calculated);

I think it would be clearer to do:

    ASSERT(isPercent());

[Zan Dobersek]

Landed in r153981.
http://trac.webkit.org/changeset/153981