Bug 66686

Summary:

Crash with -webkit-radial-gradient(top) gradient

Product:

WebKit

Reporter:

Rafał Chłodnicki <rchl2k>

Component:

CSS

Assignee:

Simon Fraser (smfr) <simon.fraser>

Status:

RESOLVED FIXED

Severity:

Major

CC:

cachobot, simon.fraser

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
Patch	darin: review+

Description Rafał Chłodnicki 2011-08-22 11:04:07 PDT

-webkit-radial-gradient(top) crashes browser. Possibly at CSS parsing stage but could be rendering instead.

Comment 1 Simon Fraser (smfr) 2011-08-22 11:09:51 PDT

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00007fff94013212 WebCore::CSSParser::parseRadialGradient(WTF::RefPtr<WebCore::CSSValue>&, WebCore::CSSGradientRepeat) + 430
1   com.apple.WebCore             	0x00007fff93ab846e WebCore::CSSParser::parseGeneratedImage(WTF::RefPtr<WebCore::CSSValue>&) + 400
2   com.apple.WebCore             	0x00007fff93ab58d6 WebCore::CSSParser::parseFillImage(WTF::RefPtr<WebCore::CSSValue>&) + 462
3   com.apple.WebCore             	0x00007fff93ab4fb8 WebCore::CSSParser::parseFillProperty(int, int&, int&, WTF::RefPtr<WebCore::CSSValue>&, WTF::RefPtr<WebCore::CSSValue>&) + 682
4   com.apple.WebCore             	0x00007fff93a22d5f WebCore::CSSParser::parseValue(int, bool) + 4473
5

Comment 2 Simon Fraser (smfr) 2011-08-22 11:10:45 PDT

<rdar://problem/9718053>

Comment 3 Simon Fraser (smfr) 2011-08-31 09:35:40 PDT

Created attachment 105782 [details]
Patch

Comment 4 Darin Adler 2011-08-31 10:33:42 PDT

Comment on attachment 105782 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=105782&action=review

> LayoutTests/fast/gradients/css3-radial-gradient-crash-expected.txt:1
> +

Usually better to put some output like “this passes if it does not crash” into the document.

Comment 5 Simon Fraser (smfr) 2011-08-31 12:11:43 PDT

http://trac.webkit.org/changeset/94215