Created attachment 269516 [details] Test case See attachment.
<rdar://problem/17198383> Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff96e86464 WebCore::RenderStyle::fontDescription() const + 4 1 com.apple.WebCore 0x00007fff9720ce85 WebCore::CSSPrimitiveValue::computeNonCalcLengthDouble(WebCore::CSSToLengthConversionData const&, unsigned short, double) + 85 2 com.apple.WebCore 0x00007fff971ceb13 WebCore::CSSCalcValue::computeLengthPx(WebCore::CSSToLengthConversionData const&) const + 19 3 com.apple.WebCore 0x00007fff97b77a27 WebCore::Length WebCore::CSSPrimitiveValue::convertToLength<26>(WebCore::CSSToLengthConversionData const&) const + 87 4 com.apple.WebCore 0x00007fff97c6661e WebCore::transformsForValue(WebCore::CSSValue&, WebCore::CSSToLengthConversionData const&, WebCore::TransformOperations&) + 3742 5 com.apple.WebCore 0x00007fff9701c77e WebCore::WebKitCSSMatrix::setMatrixValue(WTF::String const&, int&) + 270 6 com.apple.WebCore 0x00007fff9701c4d0 WebCore::JSWebKitCSSMatrixConstructor::constructJSWebKitCSSMatrix(JSC::ExecState*) + 208
Edge throws a Syntax Error and that's what Gecko is planning on doing too, for caclated values in a transformList.
Spec says "If parsing is not successful or any <transform-function> has <length> values without absolute length units, throw a SyntaxError exception." https://drafts.fxtf.org/geometry/#dom-dommatrix-dommatrix-transformlist
Created attachment 271609 [details] Patch
Comment on attachment 271609 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=271609&action=review > Source/WebCore/ChangeLog:10 > + using absolute length. lengths. > Source/WebCore/css/StyleBuilderConverter.h:358 > + transformsForValue(value, styleResolver.state().cssToLengthConversionData(), false, operations); boolean trap! > Source/WebCore/css/WebKitCSSMatrix.cpp:70 > + if (!transformsForValue(*value, CSSToLengthConversionData(), true, operations)) { Ick. I think i want an enum here.
Committed r196738: <http://trac.webkit.org/changeset/196738>
Re-opened since this is blocked by bug 154380
Safari 16 does not crash on the test case but show following warning in console: [Error] SyntaxError: The string did not match the expected pattern. DOMMatrix (attachment.cgi:5) Global Code (attachment.cgi:5) While Chrome Canary 108 show following in console: attachment.cgi?id=269516:5 Uncaught DOMException: Failed to construct 'DOMMatrix': Lengths must be absolute, not relative at https://bug-153333-attachments.webkit.org/attachment.cgi?id=269516:5:9 In Firefox Nightly 107, we get following: Uncaught DOMException: An invalid or illegal string was specified ______ From Comment 01, it seems that it is expected rather than crash. Should we mark this as "RESOLVED CONFIGURATION CHANGED" since now we are doing right thing? Thanks!