Bug 110359 – Web Inspector: CSSAgent.setStyleSheetText crashes on inline styles

• Status: RESOLVED
• Resolution: FIXED
• Component: Web Inspector (Deprecated)

[Timothy Hatcher]

While experimenting with style editing I found that calling CSSAgent.setStyleSheetText on an inline style's StyleSheetId will cause a crash.

This happens because m_pageStyleSheet is always null for InspectorStyleSheetForInlineStyle.

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000010

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000101af332e WebCore::InspectorStyleSheet::reparseStyleSheet(WTF::String const&) + 62 (RefPtr.h:58)
1   com.apple.WebCore             	0x0000000101a953aa WebCore::InspectorCSSAgent::SetStyleSheetTextAction::redo(int&) + 42 (InspectorCSSAgent.cpp:334)
2   com.apple.WebCore             	0x0000000101a9532b WebCore::InspectorCSSAgent::SetStyleSheetTextAction::perform(int&) + 43 (InspectorCSSAgent.cpp:319)
3   com.apple.WebCore             	0x0000000101aca931 WebCore::InspectorHistory::perform(WTF::PassOwnPtr<WebCore::InspectorHistory::Action>, int&) + 33 (InspectorHistory.cpp:92)
4   com.apple.WebCore             	0x0000000101a8cc1c WebCore::InspectorCSSAgent::setStyleSheetText(WTF::String*, WTF::String const&, WTF::String const&) + 108 (PassOwnPtr.h:56)
5   com.apple.WebCore             	0x0000000101a609e2 WebCore::InspectorBackendDispatcherImpl::CSS_setStyleSheetText(long, WebCore::InspectorObject*) + 882 (PassRefPtr.h:97)
6   com.apple.WebCore             	0x0000000101a7e507 WebCore::InspectorBackendDispatcherImpl::dispatch(WTF::String const&) + 1687 (RefPtr.h:56)
7   com.apple.WebCore             	0x0000000101ac7ad5 WebCore::InspectorBackendDispatchTask::onTimer(WebCore::Timer<WebCore::InspectorBackendDispatchTask>*) + 69 (RefPtr.h:56)
8   com.apple.WebCore             	0x0000000102243c6f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175 (ThreadTimers.cpp:132)
9   com.apple.WebCore             	0x00000001020cbeda WebCore::timerFired(__CFRunLoopTimer*, void*) + 58 (SharedTimerMac.mm:167)
10  com.apple.CoreFoundation      	0x00007fff902e4804 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
11  com.apple.CoreFoundation      	0x00007fff902e431d __CFRunLoopDoTimer + 557
12  com.apple.CoreFoundation      	0x00007fff902c9ad9 __CFRunLoopRun + 1529
13  com.apple.CoreFoundation      	0x00007fff902c90e2 CFRunLoopRunSpecific + 290
14  com.apple.HIToolbox           	0x00007fff95e3eeb4 RunCurrentEventLoopInMode + 209
15  com.apple.HIToolbox           	0x00007fff95e3ec52 ReceiveNextEventCommon + 356
16  com.apple.HIToolbox           	0x00007fff95e3eae3 BlockUntilNextEventMatchingListInMode + 62
17  com.apple.AppKit              	0x00007fff93bf5563 _DPSNextEvent + 685
18  com.apple.AppKit              	0x00007fff93bf4e22 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
19  com.apple.AppKit              	0x00007fff93bec1d3 -[NSApplication run] + 517
20  com.apple.WebCore             	0x0000000102076e8c WebCore::RunLoop::run() + 76 (RunLoopMac.mm:43)
21  com.apple.WebKit2             	0x000000010029d29c int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 702 (ChildProcessEntryPoint.h:100)
22  com.apple.WebProcess          	0x0000000100000df7 main + 228 (ChildProcessMain.mm:73)
23  libdyld.dylib                 	0x00007fff8e0c07e1 start + 1

[Alexander Pavlov (apavlov)]

In fact, as you figure InspectorStyleSheetForInlineStyle is not intended to be given a new stylesheet text. How did you extract the styleSheetId for that?

[Timothy Hatcher]

The styleSheetId property on the CSSStyleId.

[Alexander Pavlov (apavlov)]

(In reply to comment #2)
> The styleSheetId property on the CSSStyleId.

OK, so you didn't get it through getAllStyleSheets() or something. Do you think the best option is to make setStyleSheetText() (and some other operations, like addRule()) a no-op (return error) for these stylesheets? Or can you think of some special semantics for [some of] those?

[Alexander Pavlov (apavlov)]

Created attachment 189499 [details]
Patch

[Timothy Hatcher]

Returning an error is fine. Setting the text for any style declaration is tracked by bug 109340. And that should work for inline styles.

[WebKit Review Bot]

Comment on attachment 189499 [details]
Patch

Clearing flags on attachment: 189499

Committed r144025: <http://trac.webkit.org/changeset/144025>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.