Summary: | WebKitCSSMatrix transformList with calculated relative length crashes Safari. | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | William Chen <wchen> | ||||||
Component: | CSS | Assignee: | Dean Jackson <dino> | ||||||
Status: | REOPENED --- | ||||||||
Severity: | Normal | CC: | ahmad.saleem792, bdakin, commit-queue, dino, mathias, mmaxfield, simon.fraser, webkit-bug-importer, zalan | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | Safari 9 | ||||||||
Hardware: | Mac | ||||||||
OS: | OS X 10.11 | ||||||||
Bug Depends on: | 154380 | ||||||||
Bug Blocks: | |||||||||
Attachments: |
|
<rdar://problem/17198383> Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff96e86464 WebCore::RenderStyle::fontDescription() const + 4 1 com.apple.WebCore 0x00007fff9720ce85 WebCore::CSSPrimitiveValue::computeNonCalcLengthDouble(WebCore::CSSToLengthConversionData const&, unsigned short, double) + 85 2 com.apple.WebCore 0x00007fff971ceb13 WebCore::CSSCalcValue::computeLengthPx(WebCore::CSSToLengthConversionData const&) const + 19 3 com.apple.WebCore 0x00007fff97b77a27 WebCore::Length WebCore::CSSPrimitiveValue::convertToLength<26>(WebCore::CSSToLengthConversionData const&) const + 87 4 com.apple.WebCore 0x00007fff97c6661e WebCore::transformsForValue(WebCore::CSSValue&, WebCore::CSSToLengthConversionData const&, WebCore::TransformOperations&) + 3742 5 com.apple.WebCore 0x00007fff9701c77e WebCore::WebKitCSSMatrix::setMatrixValue(WTF::String const&, int&) + 270 6 com.apple.WebCore 0x00007fff9701c4d0 WebCore::JSWebKitCSSMatrixConstructor::constructJSWebKitCSSMatrix(JSC::ExecState*) + 208 Edge throws a Syntax Error and that's what Gecko is planning on doing too, for caclated values in a transformList. Spec says "If parsing is not successful or any <transform-function> has <length> values without absolute length units, throw a SyntaxError exception." https://drafts.fxtf.org/geometry/#dom-dommatrix-dommatrix-transformlist Created attachment 271609 [details]
Patch
Comment on attachment 271609 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=271609&action=review > Source/WebCore/ChangeLog:10 > + using absolute length. lengths. > Source/WebCore/css/StyleBuilderConverter.h:358 > + transformsForValue(value, styleResolver.state().cssToLengthConversionData(), false, operations); boolean trap! > Source/WebCore/css/WebKitCSSMatrix.cpp:70 > + if (!transformsForValue(*value, CSSToLengthConversionData(), true, operations)) { Ick. I think i want an enum here. Committed r196738: <http://trac.webkit.org/changeset/196738> Re-opened since this is blocked by bug 154380 Safari 16 does not crash on the test case but show following warning in console: [Error] SyntaxError: The string did not match the expected pattern. DOMMatrix (attachment.cgi:5) Global Code (attachment.cgi:5) While Chrome Canary 108 show following in console: attachment.cgi?id=269516:5 Uncaught DOMException: Failed to construct 'DOMMatrix': Lengths must be absolute, not relative at https://bug-153333-attachments.webkit.org/attachment.cgi?id=269516:5:9 In Firefox Nightly 107, we get following: Uncaught DOMException: An invalid or illegal string was specified ______ From Comment 01, it seems that it is expected rather than crash. Should we mark this as "RESOLVED CONFIGURATION CHANGED" since now we are doing right thing? Thanks! |
Created attachment 269516 [details] Test case See attachment.