Bug 223366

Summary:

Zero division in RenderBox::blockSizeFromAspectRatio via WebCore::RenderBox::computeLogicalHeight

Product:

WebKit

Reporter:

Ryosuke Niwa <rniwa>

Component:

Layout and Rendering

Assignee:

Rob Buis <rbuis>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bfulgham, cgarcia, ews-feeder, fred.wang, gpoo, product-security, rbuis, simon.fraser, svillar, webkit-bug-importer, zalan

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Test	none
Patch	none
Patch	none
Patch	ews-feeder: commit-queue-

Description Ryosuke Niwa 2021-03-17 01:24:05 PDT

Created attachment 423452 [details]
Test

e.g.

    #0 0x1b31b032e in WebCore::operator/(WebCore::LayoutUnit const&, WebCore::LayoutUnit const&)+0xce (WebCore.framework/Versions/A/WebCore:x86_64+0x2f3632e)
    #1 0x1b57da446 in WebCore::RenderBox::blockSizeFromAspectRatio(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::BoxSizing, WebCore::LayoutUnit)+0x186 (WebCore.framework/Versions/A/WebCore:x86_64+0x5560446)
    #2 0x1b58770ce in WebCore::RenderBox::computeLogicalHeight(WebCore::LayoutUnit, WebCore::LayoutUnit) const+0xa0e (WebCore.framework/Versions/A/WebCore:x86_64+0x55fd0ce)
    #3 0x1b5876257 in WebCore::RenderBox::updateLogicalHeight()+0x127 (WebCore.framework/Versions/A/WebCore:x86_64+0x55fc257)
    #4 0x1b57f1ee8 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x798 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577ee8)
    #5 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #6 0x1b57f7074 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0x5b4 (WebCore.framework/Versions/A/WebCore:x86_64+0x557d074)
    #7 0x1b57f3a9d in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x2cd (WebCore.framework/Versions/A/WebCore:x86_64+0x5579a9d)
    #8 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #9 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #10 0x1b57f7074 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0x5b4 (WebCore.framework/Versions/A/WebCore:x86_64+0x557d074)
    #11 0x1b57f3a9d in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x2cd (WebCore.framework/Versions/A/WebCore:x86_64+0x5579a9d)
    #12 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #13 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #14 0x1b5920026 in WebCore::RenderFragmentedFlow::layout()+0x116 (WebCore.framework/Versions/A/WebCore:x86_64+0x56a6026)
    #15 0x1b5a82910 in WebCore::RenderMultiColumnFlow::layout()+0xb0 (WebCore.framework/Versions/A/WebCore:x86_64+0x5808910)
    #16 0x1b58187c3 in WebCore::RenderBlockFlow::layoutExcludedChildren(bool)+0xc3 (WebCore.framework/Versions/A/WebCore:x86_64+0x559e7c3)
    #17 0x1b57f39a2 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x1d2 (WebCore.framework/Versions/A/WebCore:x86_64+0x55799a2)
    #18 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #19 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #20 0x1b57f7074 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0x5b4 (WebCore.framework/Versions/A/WebCore:x86_64+0x557d074)
    #21 0x1b57f3a9d in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x2cd (WebCore.framework/Versions/A/WebCore:x86_64+0x5579a9d)
    #22 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #23 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #24 0x1b57f7074 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0x5b4 (WebCore.framework/Versions/A/WebCore:x86_64+0x557d074)
    #25 0x1b57f3a9d in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x2cd (WebCore.framework/Versions/A/WebCore:x86_64+0x5579a9d)
    #26 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #27 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #28 0x1b57f7074 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0x5b4 (WebCore.framework/Versions/A/WebCore:x86_64+0x557d074)
    #29 0x1b57f3a9d in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x2cd (WebCore.framework/Versions/A/WebCore:x86_64+0x5579a9d)
    #30 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #31 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #32 0x1b57f7074 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0x5b4 (WebCore.framework/Versions/A/WebCore:x86_64+0x557d074)
    #33 0x1b57f3a9d in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x2cd (WebCore.framework/Versions/A/WebCore:x86_64+0x5579a9d)
    #34 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #35 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #36 0x1b57f7074 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0x5b4 (WebCore.framework/Versions/A/WebCore:x86_64+0x557d074)
    #37 0x1b57f3a9d in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0x2cd (WebCore.framework/Versions/A/WebCore:x86_64+0x5579a9d)
    #38 0x1b57f1c27 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0x4d7 (WebCore.framework/Versions/A/WebCore:x86_64+0x5577c27)
    #39 0x1b57c1524 in WebCore::RenderBlock::layout()+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x5547524)
    #40 0x1b5b69d36 in WebCore::RenderView::layout()+0x5c6 (WebCore.framework/Versions/A/WebCore:x86_64+0x58efd36)
    #41 0x1b4ce2829 in WebCore::FrameViewLayoutContext::layout()+0x549 (WebCore.framework/Versions/A/WebCore:x86_64+0x4a68829)
    #42 0x1b3b0ff22 in WebCore::Document::updateLayout()+0x212 (WebCore.framework/Versions/A/WebCore:x86_64+0x3895f22)
    #43 0x1b3b12462 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks)+0x92 (WebCore.framework/Versions/A/WebCore:x86_64+0x3898462)
    #44 0x1b36b6142 in WebCore::ComputedStyleExtractor::propertyValue(WebCore::CSSPropertyID, WebCore::EUpdateLayout)+0x2a2 (WebCore.framework/Versions/A/WebCore:x86_64+0x343c142)
    #45 0x1b36b5e04 in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue(WebCore::CSSPropertyID, WebCore::EUpdateLayout) const+0x114 (WebCore.framework/Versions/A/WebCore:x86_64+0x343be04)
    #46 0x1b36e1522 in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValueInternal(WebCore::CSSPropertyID)+0x12 (WebCore.framework/Versions/A/WebCore:x86_64+0x3467522)
    #47 0x1b37deaa5 in WebCore::CSSStyleDeclaration::namedItem(WTF::AtomString const&)+0x175 (WebCore.framework/Versions/A/WebCore:x86_64+0x3564aa5)
    #48 0x1b09d119e in WTF::Optional<WTF::Variant<WTF::String, double> > WebCore::JSCSSStyleDeclaration::getOwnPropertySlot(JSC::JSObject*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&)::$_8::operator()<WebCore::JSCSSStyleDeclaration, JSC::PropertyName>(WebCore::JSCSSStyleDeclaration&, JSC::PropertyName) const+0x10e (WebCore.framework/Versions/A/WebCore:x86_64+0x75719e)
    #49 0x1b09248e4 in decltype(fp2(fp0, fp1)) WebCore::accessVisibleNamedProperty<(WebCore::LegacyOverrideBuiltIns)0, WebCore::JSCSSStyleDeclaration, WebCore::JSCSSStyleDeclaration::getOwnPropertySlot(JSC::JSObject*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&)::$_8&>(JSC::JSGlobalObject&, WebCore::JSCSSStyleDeclaration&, JSC::PropertyName, WebCore::JSCSSStyleDeclaration::getOwnPropertySlot(JSC::JSObject*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&)::$_8&)+0x224 (WebCore.framework/Versions/A/WebCore:x86_64+0x6aa8e4)
    #50 0x1b092149b in WebCore::JSCSSStyleDeclaration::getOwnPropertySlot(JSC::JSObject*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&)+0x88b (WebCore.framework/Versions/A/WebCore:x86_64+0x6a749b)
    #51 0x1d166d66e in JSC::LLInt::performLLIntGetByID(JSC::Instruction const*, JSC::CodeBlock*, JSC::JSGlobalObject*, JSC::JSValue, JSC::Identifier const&, JSC::GetByIdModeMetadata&)+0x1c7e (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x277b66e)
    #52 0x1d166b7a1 in llint_slow_path_get_by_id+0x211 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x27797a1)
    #53 0x1cfb374f4 in llint_entry+0x952c (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc454f4)
    #54 0x1cfb48db0 in llint_entry+0x1ade8 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc56db0)
    #55 0x1cfb48db0 in llint_entry+0x1ade8 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc56db0)
    #56 0x1cfb49a9b in llint_entry+0x1bad3 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc57a9b)
    #57 0x1cfb2ddc8 in vmEntryToJavaScript+0xd7 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc3bdc8)
    #58 0x1d13767d1 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)+0x611 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x24847d1)
    #59 0x1d1a5fd14 in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)+0x64 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x2b6dd14)
    #60 0x1b420dd23 in WebCore::HTMLMediaElement::didAddUserAgentShadowRoot(WebCore::ShadowRoot&)::$_41::operator()(WebCore::JSDOMGlobalObject&, JSC::JSGlobalObject&, WebCore::ScriptController&, WebCore::DOMWrapperWorld&) const+0x473 (WebCore.framework/Versions/A/WebCore:x86_64+0x3f93d23)
    #61 0x1b420d861 in WTF::Detail::CallableWrapper<WebCore::HTMLMediaElement::didAddUserAgentShadowRoot(WebCore::ShadowRoot&)::$_41, bool, WebCore::JSDOMGlobalObject&, JSC::JSGlobalObject&, WebCore::ScriptController&, WebCore::DOMWrapperWorld&>::call(WebCore::JSDOMGlobalObject&, JSC::JSGlobalObject&, WebCore::ScriptController&, WebCore::DOMWrapperWorld&)+0x51 (WebCore.framework/Versions/A/WebCore:x86_64+0x3f93861)
    #62 0x1b41aed5d in WTF::Function<bool (WebCore::JSDOMGlobalObject&, JSC::JSGlobalObject&, WebCore::ScriptController&, WebCore::DOMWrapperWorld&)>::operator()(WebCore::JSDOMGlobalObject&, JSC::JSGlobalObject&, WebCore::ScriptController&, WebCore::DOMWrapperWorld&) const+0x8d (WebCore.framework/Versions/A/WebCore:x86_64+0x3f34d5d)
    #63 0x1b41ae9a2 in WebCore::HTMLMediaElement::setupAndCallJS(WTF::Function<bool (WebCore::JSDOMGlobalObject&, JSC::JSGlobalObject&, WebCore::ScriptController&, WebCore::DOMWrapperWorld&)> const&)+0x172 (WebCore.framework/Versions/A/WebCore:x86_64+0x3f349a2)
    #64 0x1b41c1682 in WebCore::HTMLMediaElement::didAddUserAgentShadowRoot(WebCore::ShadowRoot&)+0x1a2 (WebCore.framework/Versions/A/WebCore:x86_64+0x3f47682)
    #65 0x1b3c1d476 in WebCore::Element::addShadowRoot(WTF::Ref<WebCore::ShadowRoot, WTF::RawPtrTraits<WebCore::ShadowRoot> >&&)+0x2f6 (WebCore.framework/Versions/A/WebCore:x86_64+0x39a3476)
    #66 0x1b3c1e0b0 in WebCore::Element::ensureUserAgentShadowRoot()+0x1c0 (WebCore.framework/Versions/A/WebCore:x86_64+0x39a40b0)
    #67 0x1b41ae74f in WebCore::HTMLMediaElement::ensureMediaControlsShadowRoot()+0x9f (WebCore.framework/Versions/A/WebCore:x86_64+0x3f3474f)
    #68 0x1b418838f in WebCore::HTMLMediaElement::configureMediaControls()+0xef (WebCore.framework/Versions/A/WebCore:x86_64+0x3f0e38f)
    #69 0x1b418988b in WebCore::HTMLMediaElement::didFinishInsertingNode()+0x2cb (WebCore.framework/Versions/A/WebCore:x86_64+0x3f0f88b)
    #70 0x1b3aa38d2 in WebCore::ContainerNode::parserAppendChild(WebCore::Node&)+0x412 (WebCore.framework/Versions/A/WebCore:x86_64+0x38298d2)
    #71 0x1b44b7a96 in WebCore::insert(WebCore::HTMLConstructionSiteTask&)+0xb6 (WebCore.framework/Versions/A/WebCore:x86_64+0x423da96)
    #72 0x1b44b702c in WebCore::executeInsertTask(WebCore::HTMLConstructionSiteTask&)+0x1c (WebCore.framework/Versions/A/WebCore:x86_64+0x423d02c)
    #73 0x1b44a7dca in WebCore::executeTask(WebCore::HTMLConstructionSiteTask&)+0x3a (WebCore.framework/Versions/A/WebCore:x86_64+0x422ddca)
    #74 0x1b44a7c57 in WebCore::HTMLConstructionSite::executeQueuedTasks()+0x127 (WebCore.framework/Versions/A/WebCore:x86_64+0x422dc57)
    #75 0x1b450001c in WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&&)+0xfc (WebCore.framework/Versions/A/WebCore:x86_64+0x428601c)
    #76 0x1b44b1785 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&)+0x135 (WebCore.framework/Versions/A/WebCore:x86_64+0x4237785)
    #77 0x1b44b1163 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&)+0x163 (WebCore.framework/Versions/A/WebCore:x86_64+0x4237163)
    #78 0x1b44b02de in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)+0x17e (WebCore.framework/Versions/A/WebCore:x86_64+0x42362de)
    #79 0x1b44afe58 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode)+0x38 (WebCore.framework/Versions/A/WebCore:x86_64+0x4235e58)
    #80 0x1b44b2279 in WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl> >&&)+0x2d9 (WebCore.framework/Versions/A/WebCore:x86_64+0x4238279)
    #81 0x1b3afce4e in WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, char const*, unsigned long)+0x16e (WebCore.framework/Versions/A/WebCore:x86_64+0x3882e4e)
    #82 0x1b4a184f8 in WebCore::DocumentWriter::addData(char const*, unsigned long)+0x78 (WebCore.framework/Versions/A/WebCore:x86_64+0x479e4f8)

<rdar://75202478>

Comment 1 Rob Buis 2021-03-17 02:37:44 PDT

Created attachment 423457 [details]
Patch

Comment 2 Rob Buis 2021-03-17 05:50:44 PDT

Created attachment 423477 [details]
Patch

Comment 3 zalan 2021-03-17 18:33:56 PDT

Comment on attachment 423477 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=423477&action=review

> Source/WebCore/ChangeLog:8
> +        Use double instead of LayoutUnit division.

Please change it to say 'why' not 'what' e.g LayoutUnit resolution is not high enough to support...

Comment 4 Rob Buis 2021-03-18 01:29:56 PDT

Created attachment 423572 [details]
Patch

Comment 5 EWS 2021-03-18 08:44:01 PDT

Committed r274646: <https://commits.webkit.org/r274646>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 423572 [details].