Bug 136945

Summary: ASSERTION FAILED: columnCount in WebCore::CSSParser::parseGridTemplateAreasRow
Product: WebKit Reporter: Renata Hodovan <rhodovan.u-szeged>
Component: CSSAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, commit-queue, darin, jfernandez, rego, svillar
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 60731, 116980    
Attachments:
Description Flags
Test case
none
Patch
none
Patch
none
Patch none

Description Renata Hodovan 2014-09-19 01:57:40 PDT 
Created attachment 238360 [details]
Test case

The failing test case:

<style>
* {
    -webkit-grid-template-areas: " ";
}
</style>

It's probably the same issue as http://crbug.com/412715.


The backtrace:

ASSERTION FAILED: columnCount
../../Source/WebCore/css/CSSParser.cpp(5579) : bool WebCore::CSSParser::parseGridTemplateAreasRow(WebCore::NamedGridAreaMap&, unsigned int, unsigned int&)

0x00007fffedbf3127 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329
329	    *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007fffedbf3127 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329
#1  0x00007ffff2ebdce4 in WebCore::CSSParser::parseGridTemplateAreasRow (this=0x7fffffffbb70, gridAreaMap=..., rowCount=0x0, columnCount=@0x7fffffff9008: 0x0) at ../../Source/WebCore/css/CSSParser.cpp:5579
#2  0x00007ffff2ebe120 in WebCore::CSSParser::parseGridTemplateAreas (this=0x7fffffffbb70) at ../../Source/WebCore/css/CSSParser.cpp:5634
#3  0x00007ffff2eaca55 in WebCore::CSSParser::parseValue (this=0x7fffffffbb70, propId=WebCore::CSSPropertyWebkitGridTemplateAreas, important=0x0) at ../../Source/WebCore/css/CSSParser.cpp:2653
#4  0x00007ffff3f60ac9 in cssyyparse (parser=0x7fffffffbb70) at /home/reni/data/REPOS/webkit/WebKitBuild/Debug/DerivedSources/WebCore/CSSGrammar.y:1207
#5  0x00007ffff2ea5104 in WebCore::CSSParser::parseSheet (this=0x7fffffffbb70, sheet=0x9b9cb0, string=..., startLineNumber=0x0, ruleSourceDataResult=0x0, logErrors=0x1) at ../../Source/WebCore/css/CSSParser.cpp:441
#6  0x00007ffff2ff330d in WebCore::StyleSheetContents::parseStringAtLine (this=0x9b9cb0, sheetText=..., startLineNumber=0x0, createdByParser=0x1) at ../../Source/WebCore/css/StyleSheetContents.cpp:326
#7  0x00007ffff30eadcc in WebCore::InlineStyleSheetOwner::createSheet (this=0x85bb88, element=..., text=...) at ../../Source/WebCore/dom/InlineStyleSheetOwner.cpp:147
#8  0x00007ffff30ea811 in WebCore::InlineStyleSheetOwner::createSheetFromTextContents (this=0x85bb88, element=...) at ../../Source/WebCore/dom/InlineStyleSheetOwner.cpp:97
#9  0x00007ffff30ea7cd in WebCore::InlineStyleSheetOwner::finishParsingChildren (this=0x85bb88, element=...) at ../../Source/WebCore/dom/InlineStyleSheetOwner.cpp:91
#10 0x00007ffff3320101 in WebCore::HTMLStyleElement::finishParsingChildren (this=0x85bb20) at ../../Source/WebCore/html/HTMLStyleElement.cpp:90
#11 0x00007ffff33cddde in WebCore::HTMLElementStack::popCommon (this=0x8a9758) at ../../Source/WebCore/html/parser/HTMLElementStack.cpp:578
#12 0x00007ffff33cc652 in WebCore::HTMLElementStack::pop (this=0x8a9758) at ../../Source/WebCore/html/parser/HTMLElementStack.cpp:214
#13 0x00007ffff33f7e2f in WebCore::HTMLTreeBuilder::processEndTag (this=0x8a9720, token=0x7fffffffd030) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2179
#14 0x00007ffff33ede12 in WebCore::HTMLTreeBuilder::processToken (this=0x8a9720, token=0x7fffffffd030) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:386
#15 0x00007ffff33edc24 in WebCore::HTMLTreeBuilder::constructTree (this=0x8a9720, token=0x7fffffffd030) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:354
#16 0x00007ffff33c59e5 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken (this=0x8a9000, rawToken=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:352
#17 0x00007ffff33c561b in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x8a9000, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:309
#18 0x00007ffff33c4db3 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x8a9000, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:189
#19 0x00007ffff33c5f7b in WebCore::HTMLDocumentParser::append (this=0x8a9000, inputSource=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:428
#20 0x00007ffff305463b in WebCore::DecodedDataDocumentParser::flush (this=0x8a9000, writer=...) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60
#21 0x00007ffff3532297 in WebCore::DocumentWriter::end (this=0x949730) at ../../Source/WebCore/loader/DocumentWriter.cpp:243
#22 0x00007ffff351d9ad in WebCore::DocumentLoader::finishedLoading (this=0x949690, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441
#23 0x00007ffff351d716 in WebCore::DocumentLoader::notifyFinished (this=0x949690, resource=0x8a68e0) at ../../Source/WebCore/loader/DocumentLoader.cpp:375
#24 0x00007ffff35d47c4 in WebCore::CachedResource::checkNotify (this=0x8a68e0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:347
#25 0x00007ffff35d48ce in WebCore::CachedResource::finishLoading (this=0x8a68e0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:363
#26 0x00007ffff35d11f4 in WebCore::CachedRawResource::finishLoading (this=0x8a68e0, data=0x8ac090) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:101
#27 0x00007ffff3580a50 in WebCore::SubresourceLoader::didFinishLoading (this=0x8a6e50, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:309
#28 0x00007ffff357c73b in WebCore::ResourceLoader::didFinishLoading (this=0x8a6e50, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:512
#29 0x00007ffff3eecb0f in WebCore::readCallback (asyncResult=0x8a89a0, data=0x8a74c0) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302
#30 0x00007fffebac72ea in async_ready_callback_wrapper (source_object=0xa3bb30, res=0x8a89a0, user_data=0x8a74c0) at ginputstream.c:519
#31 0x00007fffebae6ceb in g_task_return_now (task=0x8a89a0) at gtask.c:1108
#32 0x00007fffebae6d09 in complete_in_idle_cb (task=0x8a89a0) at gtask.c:1117
#33 0x00007fffead3d2e6 in g_main_dispatch (context=0x677bb0) at gmain.c:3065
#34 g_main_context_dispatch (context=context@entry=0x677bb0) at gmain.c:3641
#35 0x00007fffead3d638 in g_main_context_iterate (context=0x677bb0, block=block@entry=0x1, dispatch=dispatch@entry=0x1, self=<optimized out>) at gmain.c:3712
#36 0x00007fffead3da3a in g_main_loop_run (loop=0xafe450) at gmain.c:3906
#37 0x00007ffff45e062e in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59
#38 0x00007ffff2b1c1e2 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=0x2, argv=0x7fffffffd938) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#39 0x00007ffff2b1c047 in WebKit::WebProcessMainUnix (argc=0x2, argv=0x7fffffffd938) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73
#40 0x000000000040080d in main (argc=0x2, argv=0x7fffffffd938) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32
Comment 1 Javier Fernandez 2014-09-25 02:15:43 PDT 
Created attachment 238652 [details]
Patch
Comment 2 Sergio Villar Senin 2014-09-25 04:04:48 PDT 
Comment on attachment 238652 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=238652&action=review

> Source/WebCore/css/CSSParser.cpp:5571
> +    if (gridRowNames.isEmpty() || gridRowNames.containsOnlyWhitespace())

Does this cover also multiple whitespaces?

> LayoutTests/fast/css-grid-layout/grid-template-areas-empty-string-crash-expected.txt:1
> +crbug.com/412715 - ASSERTION FAILED: columnCount in blink::CSSPropertyParser::parseGridTemplateAreasRow

Do not mention external bugs. Also remove the blink:: thing

> LayoutTests/fast/css-grid-layout/grid-template-areas-empty-string-crash.html:27
> +<p>crbug.com/412715 - ASSERTION FAILED: columnCount in blink::CSSPropertyParser::parseGridTemplateAreasRow</p>

Ditto.
Comment 3 Javier Fernandez 2014-09-25 07:03:10 PDT 
Created attachment 238657 [details]
Patch
Comment 4 Javier Fernandez 2014-09-25 07:06:35 PDT 
Created attachment 238658 [details]
Patch
Comment 5 WebKit Commit Bot 2014-09-25 07:50:18 PDT 
Comment on attachment 238658 [details]
Patch

Clearing flags on attachment: 238658

Committed r173965: <http://trac.webkit.org/changeset/173965>
Comment 6 WebKit Commit Bot 2014-09-25 07:50:21 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 7 Darin Adler 2014-09-25 22:05:04 PDT 
Comment on attachment 238658 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=238658&action=review

> Source/WebCore/css/CSSParser.cpp:5571
> +    if (gridRowNames.isEmpty() || gridRowNames.containsOnlyWhitespace())

The isEmpty check here is now redundant. The containsOnlyWhitespace function returns true for empty strings.
Comment 8 Javier Fernandez 2014-09-26 06:47:02 PDT 
(In reply to comment #7)
> (From update of attachment 238658 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=238658&action=review
> 
> > Source/WebCore/css/CSSParser.cpp:5571
> > +    if (gridRowNames.isEmpty() || gridRowNames.containsOnlyWhitespace())
> 
> The isEmpty check here is now redundant. The containsOnlyWhitespace function returns true for empty strings.

This will be address in bug #137146.