Bug 66686

Summary: Crash with -webkit-radial-gradient(top) gradient
Product: WebKit Reporter: Rafał Chłodnicki <rchl2k>
Component: CSSAssignee: Simon Fraser (smfr) <simon.fraser>
Status: RESOLVED FIXED    
Severity: Major CC: cachobot, simon.fraser
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch darin: review+

Rafał Chłodnicki
Reported 2011-08-22 11:04:07 PDT
-webkit-radial-gradient(top) crashes browser. Possibly at CSS parsing stage but could be rendering instead.
Attachments
Patch (3.17 KB, patch)
2011-08-31 09:35 PDT, Simon Fraser (smfr) 		darin: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Simon Fraser (smfr)
Comment 1 2011-08-22 11:09:51 PDT
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff94013212 WebCore::CSSParser::parseRadialGradient(WTF::RefPtr<WebCore::CSSValue>&, WebCore::CSSGradientRepeat) + 430 1 com.apple.WebCore 0x00007fff93ab846e WebCore::CSSParser::parseGeneratedImage(WTF::RefPtr<WebCore::CSSValue>&) + 400 2 com.apple.WebCore 0x00007fff93ab58d6 WebCore::CSSParser::parseFillImage(WTF::RefPtr<WebCore::CSSValue>&) + 462 3 com.apple.WebCore 0x00007fff93ab4fb8 WebCore::CSSParser::parseFillProperty(int, int&, int&, WTF::RefPtr<WebCore::CSSValue>&, WTF::RefPtr<WebCore::CSSValue>&) + 682 4 com.apple.WebCore 0x00007fff93a22d5f WebCore::CSSParser::parseValue(int, bool) + 4473 5
Simon Fraser (smfr)
Comment 2 2011-08-22 11:10:45 PDT
<rdar://problem/9718053>
Simon Fraser (smfr)
Comment 3 2011-08-31 09:35:40 PDT
Created attachment 105782 [details] Patch
Darin Adler
Comment 4 2011-08-31 10:33:42 PDT
Comment on attachment 105782 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=105782&action=review > LayoutTests/fast/gradients/css3-radial-gradient-crash-expected.txt:1 > + Usually better to put some output like “this passes if it does not crash” into the document.
Simon Fraser (smfr)
Comment 5 2011-08-31 12:11:43 PDT
http://trac.webkit.org/changeset/94215
Note You need to log in before you can comment on or make changes to this bug.