Bug 153333 – WebKitCSSMatrix transformList with calculated relative length crashes Safari.

• Component: CSS
• Status: REOPENED

[William Chen]

Created attachment 269516 [details]
Test case

See attachment.

[Alexey Proskuryakov]

<rdar://problem/17198383> 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00007fff96e86464 WebCore::RenderStyle::fontDescription() const + 4
1   com.apple.WebCore             	0x00007fff9720ce85 WebCore::CSSPrimitiveValue::computeNonCalcLengthDouble(WebCore::CSSToLengthConversionData const&, unsigned short, double) + 85
2   com.apple.WebCore             	0x00007fff971ceb13 WebCore::CSSCalcValue::computeLengthPx(WebCore::CSSToLengthConversionData const&) const + 19
3   com.apple.WebCore             	0x00007fff97b77a27 WebCore::Length WebCore::CSSPrimitiveValue::convertToLength<26>(WebCore::CSSToLengthConversionData const&) const + 87
4   com.apple.WebCore             	0x00007fff97c6661e WebCore::transformsForValue(WebCore::CSSValue&, WebCore::CSSToLengthConversionData const&, WebCore::TransformOperations&) + 3742
5   com.apple.WebCore             	0x00007fff9701c77e WebCore::WebKitCSSMatrix::setMatrixValue(WTF::String const&, int&) + 270
6   com.apple.WebCore             	0x00007fff9701c4d0 WebCore::JSWebKitCSSMatrixConstructor::constructJSWebKitCSSMatrix(JSC::ExecState*) + 208

[Mike Taylor]

Edge throws a Syntax Error and that's what Gecko is planning on doing too, for caclated values in a transformList.

[Myles C. Maxfield]

Spec says "If parsing is not successful or any <transform-function> has <length> values without absolute length units, throw a SyntaxError exception." https://drafts.fxtf.org/geometry/#dom-dommatrix-dommatrix-transformlist

[Dean Jackson]

Created attachment 271609 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 271609 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=271609&action=review

> Source/WebCore/ChangeLog:10
> +        using absolute length.

lengths.

> Source/WebCore/css/StyleBuilderConverter.h:358
> +    transformsForValue(value, styleResolver.state().cssToLengthConversionData(), false, operations);

boolean trap!

> Source/WebCore/css/WebKitCSSMatrix.cpp:70
> +        if (!transformsForValue(*value, CSSToLengthConversionData(), true, operations)) {

Ick. I think i want an enum here.

[Dean Jackson]

Committed r196738: <http://trac.webkit.org/changeset/196738>

[WebKit Commit Bot]

Re-opened since this is blocked by bug 154380

[Ahmad Saleem]

Safari 16 does not crash on the test case but show following warning in console:

[Error] SyntaxError: The string did not match the expected pattern.
	DOMMatrix (attachment.cgi:5)
	Global Code (attachment.cgi:5)

While Chrome Canary 108 show following in console:

attachment.cgi?id=269516:5 Uncaught DOMException: Failed to construct 'DOMMatrix': Lengths must be absolute, not relative
    at https://bug-153333-attachments.webkit.org/attachment.cgi?id=269516:5:9

In Firefox Nightly 107, we get following:

Uncaught DOMException: An invalid or illegal string was specified

______

From Comment 01, it seems that it is expected rather than crash. Should we mark this as "RESOLVED CONFIGURATION CHANGED" since now we are doing right thing? Thanks!