Bug 139289
| Summary: | Crash when setting '-webkit-box-shadow' CSS property to 'calc(50px + 1em) calc(50px + 1em) calc(50px + 1em)' | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Chris Dumez <cdumez> |
| Component: | CSS | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED CONFIGURATION CHANGED | ||
| Severity: | Normal | CC: | ahmad.saleem792, ntim |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | |||
| Bug Blocks: | 138778 | ||
Chris Dumez
Crash when setting '-webkit-box-shadow' CSS property to 'calc(50px + 1em) calc(50px + 1em) calc(50px + 1em)'.
Backtrace:
ASSERTION FAILED: !m_parsedCalculation
0 com.apple.JavaScriptCore 0x000000010df4534a WTFCrash + 42
1 com.apple.WebCore 0x000000010f884feb WebCore::CSSParser::parseCalculation(WebCore::CSSParserValue&, WebCore::CalculationPermittedValueRange) + 235 (CSSParser.cpp:9989)
2 com.apple.WebCore 0x000000010f884c49 WebCore::CSSParser::validCalculationUnit(WebCore::CSSParserValue&, WebCore::CSSParser::Units, WebCore::CSSParser::ReleaseParsedCalcValueCondition) + 105 (CSSParser.cpp:1588)
3 com.apple.WebCore 0x000000010f8850de WebCore::CSSParser::validUnit(WebCore::CSSParserValue&, WebCore::CSSParser::Units, WebCore::CSSParserMode, WebCore::CSSParser::ReleaseParsedCalcValueCondition) + 78 (CSSParser.cpp:1640)
4 com.apple.WebCore 0x000000010f895b78 WebCore::CSSParser::parseShadow(WebCore::CSSParserValueList&, WebCore::CSSPropertyID) + 408 (CSSParser.cpp:7259)
5 com.apple.WebCore 0x000000010f88883a WebCore::CSSParser::parseValue(WebCore::CSSPropertyID, bool) + 12394 (CSSParser.cpp:2407)
6 com.apple.WebCore 0x000000010f851363 cssyyparse(WebCore::CSSParser*) + 2771 (.CSSGrammar.y:389)
7 com.apple.WebCore 0x000000010f882a5e WebCore::CSSParser::parseValue(WebCore::MutableStyleProperties*, WebCore::CSSPropertyID, WTF::String const&, bool, WebCore::StyleSheetContents*) + 110 (CSSParser.cpp:1314)
8 com.apple.WebCore 0x000000010f881c97 WebCore::CSSParser::parseValue(WebCore::MutableStyleProperties*, WebCore::CSSPropertyID, WTF::String const&, bool, WebCore::CSSParserMode, WebCore::StyleSheetContents*) + 471 (CSSParser.cpp:1302)
9 com.apple.WebCore 0x0000000111131d6f WebCore::MutableStyleProperties::setProperty(WebCore::CSSPropertyID, WTF::String const&, bool, WebCore::StyleSheetContents*) + 159 (StyleProperties.cpp:682)
10 com.apple.WebCore 0x0000000110b1055b WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal(WebCore::CSSPropertyID, WTF::String const&, bool, int&) + 171 (PropertySetCSSStyleDeclaration.cpp:265)
11 com.apple.WebCore 0x0000000110305038 WebCore::JSCSSStyleDeclaration::putDelegate(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 392 (JSCSSStyleDeclarationCustom.cpp:343)
12 com.apple.WebCore 0x00000001103001e9 WebCore::JSCSSStyleDeclaration::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 329 (JSCSSStyleDeclaration.cpp:284)
13 com.apple.JavaScriptCore 0x000000010d90dd12 JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 210
14 com.apple.JavaScriptCore 0x000000010d8e2026 void JSC::DFG::operationPutByValInternal<false, false>(JSC::ExecState*, long long, long long, long long) + 678
15 com.apple.JavaScriptCore 0x000000010d8e1d6b operationPutByValNonStrict + 75
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Ahmad Saleem
This seems like this commit - https://chromium.googlesource.com/chromium/blink/+/f72bda0163c886943084d4caa01a19a18ab63b1c
and it seems that we already have imported related test case, I think this might have already been fixed and it does not have because else it would've been triggered by the test case, we imported from Blink?
Tim Nguyen (:ntim)
Seems fixed.