Bug 170756 – Crash in WebCore::StyleRuleKeyframes::findKeyframeIndex

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Ricci Adams]

Safari crashes (100% of the time) on this page on my site:
http://ricciadams.com/projects/pixel-winch

This occurs on both Safari 10.1 on macOS 10.12.4, Safari Technology Preview 27 on macOS 10.12.4, and iOS Mobile Safari on iOS 10.3.

Top stack frames:
0   com.apple.WebCore             	0x00007fffd42bd0f4 WebCore::StyleRuleKeyframes::findKeyframeIndex(WTF::String const&) const + 84
1   com.apple.WebCore             	0x00007fffd42bd812 WebCore::CSSKeyframesRule::findRule(WTF::String const&) + 18
2   com.apple.WebCore             	0x00007fffd46d9774 WebCore::jsCSSKeyframesRulePrototypeFunctionFindRule(JSC::ExecState*) + 356

Full crash logs are attached.

[Ricci Adams]

Created attachment 306872 [details]
Crash log

[Radar WebKit Bug Importer]

<rdar://problem/31573157>

[Ricci Adams]

Adding a single HTML file which reproduces. I might try fixing this on my site, so I'm not sure how long http://ricciadams.com/projects/pixel-winch will continue to crash.

[Ricci Adams]

Created attachment 306903 [details]
Reduction of crashing page into a single HTML file.

[Antti Koivisto]

Created attachment 310854 [details]
patch

[Antti Koivisto]

Created attachment 310856 [details]
patch

[Build Bot]

Comment on attachment 310856 [details]
patch

Attachment 310856 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/3794234

New failing tests:
imported/w3c/web-platform-tests/media-source/mediasource-buffered.html

[Build Bot]

Created attachment 310872 [details]
Archive of layout-test-results from ews116 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews116  Port: mac-elcapitan  Platform: Mac OS X 10.11.6

[Antti Koivisto]

The failure is unrelated to the patch.

[Build Bot]

Comment on attachment 310856 [details]
patch

Attachment 310856 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: http://webkit-queues.webkit.org/results/3794226

New failing tests:
compositing/absolute-inside-out-of-view-fixed.html

[Build Bot]

Created attachment 310875 [details]
Archive of layout-test-results from ews122 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews122  Port: ios-simulator-wk2  Platform: Mac OS X 10.11.6

[WebKit Commit Bot]

Comment on attachment 310856 [details]
patch

Clearing flags on attachment: 310856

Committed r217227: <http://trac.webkit.org/changeset/217227>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Antti Koivisto]

Thanks for the test case Ricci!

[Ricci Adams]

Thanks for the fix!

In case anybody else hits this: the issue was my JavaScript calling CSSKeyframesRule.findRule() with an argument of "0" or "1".

Per https://drafts.csswg.org/css-animations/#csskeyframesrule , the argument needs to be a "comma-separated list of percentage values between 0% and 100%", "from", or "to".