Bug 139391 – Should never reach failure in WebCore::CSSPrimitiveValue::computeLengthDouble

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Renata Hodovan]

Created attachment 242803 [details]
Test case

Load this test:

<style>
* {
-webkit-border-image: radial-gradient(circle closest-side at right bottom 8187%, InactiveBorder,transparent 50%);
}
</style>


Backtrace:

SHOULD NEVER BE REACHED
../../Source/WebCore/css/CSSPrimitiveValue.cpp(658) : double WebCore::CSSPrimitiveValue::computeLengthDouble(const WebCore::CSSToLengthConversionData&) const

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff98927700 (LWP 24923)]
0x00007fffedbca36f in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321	    *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007fffedbca36f in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007ffff2f2e26a in WebCore::CSSPrimitiveValue::computeLengthDouble (this=0x7d0830, conversionData=...) at ../../Source/WebCore/css/CSSPrimitiveValue.cpp:658
#2  0x00007ffff2f2ddbf in WebCore::CSSPrimitiveValue::computeLength<float> (this=0x7d0830, conversionData=...) at ../../Source/WebCore/css/CSSPrimitiveValue.cpp:581
#3  0x00007ffff2eb9155 in WebCore::positionFromValue (value=..., conversionData=..., size=..., isHorizontal=true) at ../../Source/WebCore/css/CSSGradientValue.cpp:528
#4  0x00007ffff2eb91e8 in WebCore::CSSGradientValue::computeEndPoint (this=0x6590a0, horizontal=0x7d0830, vertical=0x7d0880, conversionData=..., size=...) at ../../Source/WebCore/css/CSSGradientValue.cpp:536
#5  0x00007ffff2ebcf56 in WebCore::CSSRadialGradientValue::createGradient (this=0x6590a0, renderer=..., size=...) at ../../Source/WebCore/css/CSSGradientValue.cpp:1094
#6  0x00007ffff2eb6953 in WebCore::CSSGradientValue::image (this=0x6590a0, renderer=0x7ceeb0, size=...) at ../../Source/WebCore/css/CSSGradientValue.cpp:66
#7  0x00007ffff2ec808e in WebCore::CSSImageGeneratorValue::image (this=0x6590a0, renderer=0x7ceeb0, size=...) at ../../Source/WebCore/css/CSSImageGeneratorValue.cpp:120
#8  0x00007ffff3bb00bb in WebCore::StyleGeneratedImage::image (this=0x693110, renderer=0x7ceeb0, size=...) at ../../Source/WebCore/rendering/style/StyleGeneratedImage.cpp:90
#9  0x00007ffff39b78c6 in WebCore::RenderBoxModelObject::paintNinePieceImage (this=0x7ceeb0, graphicsContext=0x65a170, rect=..., style=..., ninePieceImage=..., op=WebCore::CompositeSourceOver) at ../../Source/WebCore/rendering/RenderBoxModelObject.cpp:1318
#10 0x00007ffff39bb1cb in WebCore::RenderBoxModelObject::paintBorder (this=0x7ceeb0, info=..., rect=..., style=..., bleedAvoidance=WebCore::BackgroundBleedNone, includeLogicalLeftEdge=true, includeLogicalRightEdge=true) at ../../Source/WebCore/rendering/RenderBoxModelObject.cpp:1740
#11 0x00007ffff3992c79 in WebCore::RenderBox::paintBoxDecorations (this=0x7ceeb0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBox.cpp:1297
#12 0x00007ffff3937551 in WebCore::RenderBlock::paintObject (this=0x7ceeb0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1563
#13 0x00007ffff39368ac in WebCore::RenderBlock::paint (this=0x7ceeb0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1434
#14 0x00007ffff3a4ad6f in WebCore::RenderLayer::paintBackgroundForFragments (this=0x7cf340, layerFragments=..., context=0x65a170, transparencyLayerContext=0x65a170, transparencyPaintDirtyRect=..., haveTransparency=false, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0) at ../../Source/WebCore/rendering/RenderLayer.cpp:4488
#15 0x00007ffff3a492ab in WebCore::RenderLayer::paintLayerContents (this=0x7cf340, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4148
#16 0x00007ffff3a47f8c in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x7cf340, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:3848
#17 0x00007ffff3a47e6b in WebCore::RenderLayer::paintLayer (this=0x7cf340, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:3830
#18 0x00007ffff3a49b34 in WebCore::RenderLayer::paintList (this=0x73ff50, list=0x4f5210, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4252
#19 0x00007ffff3a4944a in WebCore::RenderLayer::paintLayerContents (this=0x73ff50, context=0x65a170, paintingInfo=..., paintFlags=224) at ../../Source/WebCore/rendering/RenderLayer.cpp:4169
#20 0x00007ffff3a47f8c in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x73ff50, context=0x65a170, paintingInfo=..., paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3848
#21 0x00007ffff3a47e6b in WebCore::RenderLayer::paintLayer (this=0x73ff50, context=0x65a170, paintingInfo=..., paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3830
#22 0x00007ffff3a46edf in WebCore::RenderLayer::paint (this=0x73ff50, context=0x65a170, damageRect=..., subpixelAccumulation=..., paintBehavior=0, subtreePaintRoot=0x0, paintFlags=0) at ../../Source/WebCore/rendering/RenderLayer.cpp:3633
#23 0x00007ffff36a5433 in WebCore::FrameView::paintContents (this=0x7cd720, context=0x65a170, dirtyRect=...) at ../../Source/WebCore/page/FrameView.cpp:3846
#24 0x00007ffff3769da7 in WebCore::ScrollView::paint (this=0x7cd720, context=0x65a170, rect=...) at ../../Source/WebCore/platform/ScrollView.cpp:1203
#25 0x00007ffff2a40c7d in WebKit::WebPage::drawRect (this=0x849ed0, graphicsContext=..., rect=...) at ../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:1330
#26 0x00007ffff2b360c4 in WebKit::DrawingAreaImpl::display (this=0x6e2410, updateInfo=...) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:634
#27 0x00007ffff2b35954 in WebKit::DrawingAreaImpl::display (this=0x6e2410) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:550
#28 0x00007ffff2b35812 in WebKit::DrawingAreaImpl::displayTimerFired (this=0x6e2410) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:529
#29 0x00007ffff2b37cd1 in WTF::RunLoop::Timer<WebKit::DrawingAreaImpl>::fired (this=0x6e2608) at ../../Source/WTF/wtf/RunLoop.h:121
#30 0x00007ffff45dfee9 in WTF::RunLoop::TimerBase::__lambda1::operator() (__closure=0x7cf2d0) at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:121
#31 0x00007ffff45e038f in std::_Function_handler<bool(), WTF::RunLoop::TimerBase::start(double, bool)::__lambda1>::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/4.8/functional:2057
#32 0x00007ffff45df570 in std::function<bool ()>::operator()() const (this=0x7fffffffd5d8) at /usr/include/c++/4.8/functional:2464
#33 0x00007fffedc140b6 in WTF::GMainLoopSource::boolCallback (this=0x6e2618) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:405
#34 0x00007fffedc1452b in WTF::GMainLoopSource::boolSourceCallback (source=0x6e2618, source@entry=<error reading variable: value has been optimized out>) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:462
#35 0x00007fffeaa11443 in g_timeout_dispatch (source=0x693890, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4472
#36 0x00007fffeaa10a1d in g_main_dispatch (context=0x478020) at gmain.c:3064
#37 g_main_context_dispatch (context=context@entry=0x478020) at gmain.c:3663
#38 0x00007fffeaa10d88 in g_main_context_iterate (context=0x478020, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734
#39 0x00007fffeaa1104a in g_main_loop_run (loop=0x8eb810) at gmain.c:3928
#40 0x00007ffff45df9dc in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59
#41 0x00007ffff2b44f82 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#42 0x00007ffff2b44de7 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73
#43 0x0000000000400891 in main (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44

[Brent Fulgham]

This issue reproduces in r204037.

[Radar WebKit Bug Importer]

<rdar://problem/27702894>

[Brent Fulgham]

Primitive Type is CSS_PAIR, which is not expected.

[Rob Buis]

Can't reproduce anymore, likely fixed by https://bugs.webkit.org/show_bug.cgi?id=189142.