Starting with <http://trac.webkit.org/r166860>, debug WK1 bots are hitting an assertion almost every time: ASSERTION FAILED: !isCalculated() /Volumes/Data/slave/mountainlion-debug/build/Source/WebCore/platform/Length.h(246) : float WebCore::Length::value() const 1 0x10bccc0c0 WTFCrash 2 0x10d71b619 WebCore::Length::value() const 3 0x10d9cae02 WebCore::valueForNinePieceImageSlice(WebCore::NinePieceImage const&) 4 0x10d9c37d6 WebCore::ComputedStyleExtractor::propertyValue(WebCore::CSSPropertyID, WebCore::EUpdateLayout) const 5 0x10d9cd7fe WebCore::ComputedStyleExtractor::copyPropertiesInSet(WebCore::CSSPropertyID const*, unsigned int) const 6 0x10d9c6ef8 WebCore::ComputedStyleExtractor::copyProperties() const 7 0x10dd3da81 WebCore::copyPropertiesFromComputedStyle(WebCore::ComputedStyleExtractor&, WebCore::EditingStyle::PropertiesToInclude) 8 0x10dd3d345 WebCore::EditingStyle::init(WebCore::Node*, WebCore::EditingStyle::PropertiesToInclude) 9 0x10dd3d23b WebCore::EditingStyle::EditingStyle(WebCore::Node*, WebCore::EditingStyle::PropertiesToInclude) 10 0x10dd3d1d3 WebCore::EditingStyle::EditingStyle(WebCore::Node*, WebCore::EditingStyle::PropertiesToInclude) 11 0x10d7cc8ff WebCore::EditingStyle::create(WebCore::Node*, WebCore::EditingStyle::PropertiesToInclude) 12 0x10dd3f135 WebCore::EditingStyle::styleAtSelectionStart(WebCore::VisibleSelection const&, bool) 13 0x10dd500c8 WebCore::Editor::selectionStartHasStyle(WebCore::CSSPropertyID, WTF::String const&) const 14 0x10dd69d6d WebCore::executeToggleStyle(WebCore::Frame&, WebCore::EditorCommandSource, WebCore::EditAction, WebCore::CSSPropertyID, char const*, char const*)
Skipped the test in debug builds in <http://trac.webkit.org/r167070>.
What’s new here is the assertion. The bug isn’t new. I’ll fix this.
I wonder why it’s *almost* every time instead of every time.
It’s bizarre; this test case does not involve calculated values. I wonder how a calculated value gets in there.
FWIW, it's reproducible for me locally.
Looking at the flakiness dashboard results more closely, I think that it's actually every time - some of the runs are shown as timeouts, but I'm pretty certain that it's a tools bug, and we just fail to detect a crash that happened.
The calculation here is created as part of animation. We are animating from the value 26829% to the value 2, so during the animation the current value of the property is a combination of both. The CSSComputedStyle code doesn’t know how to serialize something that is neither a percentage nor a number. I imagine there are a lot more cases like this in computed style.
Because the code depends on the timing of the animation, I imagine it won’t always crash the same way every time.
Created attachment 229209 [details] Patch
Comment on attachment 229209 [details] Patch r=me, but you should also unskip the test.
Committed r167192: <http://trac.webkit.org/changeset/167192>
Part of the fix for CVE-2014-4410.