RESOLVED DUPLICATE of bug 237389 157982
WebCore::CalculationValueMap::ref asserts when using CSS Calc 
https://bugs.webkit.org/show_bug.cgi?id=157982
Summary WebCore::CalculationValueMap::ref asserts when using CSS Calc
Hyongyoub Kim
Reported 2016-05-22 20:10:38 PDT
Here is a test page. <html> <style> @-webkit-keyframes move { 0% { -webkit-transform: translate3d(0px, 0px, 0); } 100% { -webkit-transform: translate3d(0px, calc(100% + 64px), 0); } } #foo img { width: 100px; height: 100px; background: #222; -webkit-animation-name: move; -webkit-animation-duration: 10s; -webkit-animation-iteration-count: infinite; } </style> <div id="foo"> <img src="http://www.html5rocks.com/static/images/identity/HTML5_Badge_256.png"> </div> </html> Note 'calc(100% + 64px)' in transform. That expression becomes CalculationValue. transformsForValue creates TranslateTransformOperation with the 'y' value of Calculated Length that indirectly points to the CalculationValue. This Length gets shipped over to UIProcess as POD (SimpleArgumentCoder<Length>). When UIProcess decodes this, it crashes because its handle to CalculationValue is invalid. It looks like we need to send CalculationValue to UIProcess along with Length?
Attachments
Proof of concept patch to show what is needed (4.83 KB, patch)
2016-05-22 23:00 PDT, Hyongyoub Kim 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Hyongyoub Kim
Comment 1 2016-05-22 22:49:37 PDT
This affects EFL, not Safari.
Hyongyoub Kim
Comment 2 2016-05-22 23:00:10 PDT
Created attachment 279555 [details] Proof of concept patch to show what is needed Here is a rough patch. Not trying to get this applied, but simply wanting to show you what sort of work is needed to ship Calculated Length over to UIProcess. It would be great if someone can take a look and give me some feedback. Am I going in the right direction? Where this code should move to, etc. Thanks.
Martin Robinson
Comment 3 2022-04-14 23:28:55 PDT
*** This bug has been marked as a duplicate of bug 237389 ***
Note You need to log in before you can comment on or make changes to this bug.