Bug 72723 – [CSS Filters] WebKit crashes when changing the filter

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Alexandru Chiculita]

Created attachment 115797 [details]
Test case

When the -webkit-filter changes, WebKit crashes. See the attached test.

[Alexandru Chiculita]

Created attachment 115798 [details]
Crashlog

[Alexandru Chiculita]

I have a fix already. I will post a patch soon.

[Alexandru Chiculita]

Created attachment 115802 [details]
Patch V1

[Simon Fraser (smfr)]

Comment on attachment 115802 [details]
Patch V1

View in context: https://bugs.webkit.org/attachment.cgi?id=115802&action=review

> LayoutTests/css3/filters/crash-filter-change.html:7
> +<img style="-webkit-filter: hue-rotate(90deg)" src="resources/reference.png">
> +<script>
> +    // force a layout
> +    document.body.offsetTop;
> +    var img = document.getElementsByTagName('img')[0];
> +    img.style['-webkit-filter'] = 'hue-rotate(10deg)';

Why not use CSS classes and change the className?

> Source/WebCore/rendering/FilterEffectRenderer.cpp:238
> +    setMaxEffectRects(m_sourceDrawingRegion);

Could this be tested separately? Does the right thing happen if the size of the filtered element changes?

[Alexandru Chiculita]

(In reply to comment #4)
> (From update of attachment 115802 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=115802&action=review
> 
> > LayoutTests/css3/filters/crash-filter-change.html:7
> > +<img style="-webkit-filter: hue-rotate(90deg)" src="resources/reference.png">
> > +<script>
> > +    // force a layout
> > +    document.body.offsetTop;
> > +    var img = document.getElementsByTagName('img')[0];
> > +    img.style['-webkit-filter'] = 'hue-rotate(10deg)';
> 
> Why not use CSS classes and change the className?

I can use classes. I will change before committing. 

> 
> > Source/WebCore/rendering/FilterEffectRenderer.cpp:238
> > +    setMaxEffectRects(m_sourceDrawingRegion);
> 
> Could this be tested separately? Does the right thing happen if the size of the filtered element changes?

Yes the problem was that the max size was zero after a rebuild of the filter pipeline and  the result would be transparent white. I think this test can also be an image test, like the other ones in the css3/filters, so that we can actually assert that the result is correct. I will convert it to pixel test.

[Dean Jackson]

Thanks Alex!

[Radar WebKit Bug Importer]

<rdar://problem/10471745>

[Alexandru Chiculita]

Created attachment 116336 [details]
Patch for landing

[WebKit Review Bot]

Comment on attachment 116336 [details]
Patch for landing

Clearing flags on attachment: 116336

Committed r101077: <http://trac.webkit.org/changeset/101077>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.