Bug 18636 - Changing gradients via JavaScript crashes the browser
Summary: Changing gradients via JavaScript crashes the browser
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.5
: P1 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-04-20 08:34 PDT by Sam Jacobs
Modified: 2009-06-20 03:55 PDT (History)
2 users (show)

See Also:

Attachments
Apple Crash Reporter crash log (28.60 KB, text/plain)
2008-04-20 08:39 PDT, Sam Jacobs 		no flags Details
reduction (1.20 KB, application/xhtml+xml)
2009-06-20 03:53 PDT, Sam Jacobs 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam Jacobs 2008-04-20 08:34:58 PDT 
Using .style.backgroundImage on an element to set a gradient will initially work, but afterwards will crash the browser.

See the URL for an example, and also see the attached crash log.

Thanks,
Sam
Comment 1 Sam Jacobs 2008-04-20 08:39:24 PDT 
Created attachment 20698 [details]
Apple Crash Reporter crash log
Comment 2 Matt Lilek 2008-04-20 09:50:36 PDT 
r32266 debug build stack trace:

Thread 0 Crashed:
0   com.apple.WebCore             	0x022e207e WTF::IdentityHashTranslator<int, std::pair<int, WebCore::IntSize>, WTF::IntHash<int> >::equal(int const&, int const&) + 14 (HashTable.h:269)
1   com.apple.WebCore             	0x022e21f6 std::pair<int, WebCore::IntSize>* WTF::HashTable<int, std::pair<int, WebCore::IntSize>, WTF::PairFirstExtractor<std::pair<int, WebCore::IntSize> >, WTF::IntHash<int>, WTF::PairHashTraits<WTF::HashTraits<int>, WTF::HashTraits<WebCore::IntSize> >, WTF::HashTraits<int> >::lookup<int, WTF::IdentityHashTranslator<int, std::pair<int, WebCore::IntSize>, WTF::IntHash<int> > >(int const&) + 334 (HashTable.h:454)
2   com.apple.WebCore             	0x022e50b8 WTF::HashTable<int, std::pair<int, WebCore::IntSize>, WTF::PairFirstExtractor<std::pair<int, WebCore::IntSize> >, WTF::IntHash<int>, WTF::PairHashTraits<WTF::HashTraits<int>, WTF::HashTraits<WebCore::IntSize> >, WTF::HashTraits<int> >::lookup(int const&) + 24 (HashTable.h:331)
3   com.apple.WebCore             	0x022e50ee WTF::HashMap<WebCore::RenderObject*, WebCore::IntSize, WTF::PtrHash<WebCore::RenderObject*>, WTF::HashTraits<WebCore::RenderObject*>, WTF::HashTraits<WebCore::IntSize> >::get(WebCore::RenderObject* const&) const + 52 (HashMap.h:298)
4   com.apple.WebCore             	0x022e3721 WebCore::CSSImageGeneratorValue::removeClient(WebCore::RenderObject*) + 27 (CSSImageGeneratorValue.cpp:57)
5   com.apple.WebCore             	0x020a830b WebCore::StyleGeneratedImage::removeClient(WebCore::RenderObject*) + 27 (RenderStyle.cpp:217)
6   com.apple.WebCore             	0x0208b411 WebCore::RenderObject::updateBackgroundImages(WebCore::RenderStyle*) + 195 (RenderObject.cpp:2297)
7   com.apple.WebCore             	0x0208e2bd WebCore::RenderObject::setStyle(WebCore::RenderStyle*) + 2957 (RenderObject.cpp:2256)
8   com.apple.WebCore             	0x0204f931 WebCore::RenderBox::setStyle(WebCore::RenderStyle*) + 91 (RenderBox.cpp:86)
9   com.apple.WebCore             	0x0202edd3 WebCore::RenderBlock::setStyle(WebCore::RenderStyle*) + 53 (RenderBlock.cpp:129)
10  com.apple.WebCore             	0x0208ad96 WebCore::RenderObject::setAnimatableStyle(WebCore::RenderStyle*) + 126 (RenderObject.cpp:2112)
11  com.apple.WebCore             	0x0200293f WebCore::Node::setRenderStyle(WebCore::RenderStyle*) + 37 (Node.cpp:1052)
12  com.apple.WebCore             	0x01dc7bb0 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 920 (Element.cpp:790)
Comment 3 Cameron Zwarich (cpst) 2009-02-26 00:03:20 PST 
Sam, can you post the reduction of the bug here?
Comment 4 Simon Fraser (smfr) 2009-06-18 20:21:48 PDT 
URL is dead. Sam?
Comment 5 Sam Jacobs 2009-06-20 03:53:15 PDT 
Created attachment 31593 [details]
reduction

Hi all,

Sorry for the length of time it has taken me to get around to doing this!

I've finally uploaded a reduction to the bugzilla, but it now seems to work as expected, in Safari 4.0 (Version 4.0 (5530.17) on Mac OS X 10.5.7 on a unibody MacBook).

As it seems that the bug causing the crash has since been fixed, I'll mark this bug as fixed.

Thanks,
Sam