Bug 159367

Summary: Null cached image for certain uses of -webkit-image-set
Product: WebKit Reporter: Brent Fulgham <bfulgham>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: NEW    
Severity: Normal CC: bfulgham, dino, hyatt, simon.fraser, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=159288
https://bugs.webkit.org/show_bug.cgi?id=159373
Attachments:
Description Flags
Test case showing the null image none

Brent Fulgham
Reported 2016-07-01 13:31:37 PDT
Created attachment 282572 [details] Test case showing the null image Certain web content results in the 'cachedImage' member of the HTMLImageElement's Renderer being set to nullptr. The attached test case illustrates this problem. It seems to be related to the specific use of "-webkit-image-set". There might be some relationship between the size of the containing div and the native size of the images used in this test case.
Attachments
Test case showing the null image (6.14 KB, application/zip)
2016-07-01 13:31 PDT, Brent Fulgham 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2016-07-01 13:48:31 PDT
<rdar://problem/27138301>
Brent Fulgham
Comment 2 2016-07-01 13:51:38 PDT
This markup shows the problem: <div style="width: 572px; height: 572px"> <img id="target" src="resources/test_image.jpg" style="content: -webkit-image-set(url(resources/test_image_1x.jpg) 1x); width: 100%; height: 100%;"> </div>
Brent Fulgham
Comment 3 2016-07-01 14:11:13 PDT
(In reply to comment #2) > This markup shows the problem: > > <div style="width: 572px; height: 572px"> > <img id="target" src="resources/test_image.jpg" style="content: > -webkit-image-set(url(resources/test_image_1x.jpg) 1x); width: 100%; height: > 100%;"> > </div> The scaling is not needed. This is sufficient to trigger the bug: <!DOCTYPE html> <html> <body> <img src="resources/test_image.jpg" style="content: -webkit-image-set(url(resources/test_image_1x.jpg) 1x); width: 100%; height: 100%;"> </body> </html>
Brent Fulgham
Comment 4 2016-07-01 17:06:33 PDT
I think this might only happen when you have an "image-set" that only contains a 1x image, and you attempt to do the copy on a retina system.
Simon Fraser (smfr)
Comment 5 2016-07-02 17:25:44 PDT
Is this actually a crash?
Brent Fulgham
Comment 6 2016-07-05 08:43:59 PDT
(In reply to comment #5) > Is this actually a crash? Yes, although I fixed the specific crash that caused me to notice this problem in Bug 159288. Now we do not crash, but attempts to copy the image result in a blank pasteboard buffer.
Note You need to log in before you can comment on or make changes to this bug.