Bug 19525 – -webkit-box-reflect in hyperlink causes webkit to crash

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Trevor Downs]

I'm using Mac OS X 10.5.3 PPC and today's build of WebKit. In the attached document I tried to put a reflection effect on a link. It did not render and when I tried to select the text it caused the browser to crash. I've tried 3 times.

To recreate:
1. open the attached HTML file.
2. On the second line try to highlight "CyberSkull"
3. Spinning marble of doom, then crash.

[Trevor Downs]

Created attachment 21666 [details]
A FAQ I am performing stylistic cleaning up on.

[Trevor Downs]

Created attachment 21667 [details]
Log for one of the crashes.

[Trevor Downs]

Created attachment 21668 [details]
Another crash log for this incident

[Matt Lilek]

Confirmed with ToT. Debug stack trage:

Thread 0 Crashed:
0   com.apple.WebCore             	0x0286ad73 WebCore::RenderLayer::reflection() const + 9 (RenderLayer.h:220)
1   com.apple.WebCore             	0x02873cff WebCore::RenderBox::computeAbsoluteRepaintRect(WebCore::IntRect&, bool) + 245 (RenderBox.cpp:1104)
2   com.apple.WebCore             	0x028bd09a WebCore::RenderObject::computeAbsoluteRepaintRect(WebCore::IntRect&, bool) + 448 (RenderObject.cpp:2013)
3   com.apple.WebCore             	0x028edcfd WebCore::RenderText::selectionRect(bool) + 519 (RenderText.cpp:1080)
4   com.apple.WebCore             	0x0290b87c WebCore::RenderObject::SelectionInfo::SelectionInfo(WebCore::RenderObject*, bool) + 92
5   com.apple.WebCore             	0x0290aabd WebCore::RenderView::setSelection(WebCore::RenderObject*, int, WebCore::RenderObject*, int) + 1467 (RenderView.cpp:357)
6   com.apple.WebCore             	0x026062c7 WebCore::Frame::selectionLayoutChanged() + 999 (Frame.cpp:631)
7   com.apple.WebCore             	0x02a3d368 WebCore::SelectionController::setSelection(WebCore::Selection const&, bool, bool, bool) + 648 (SelectionController.cpp:143)

<rdar://problem/5961768> is essentially the same issue.

Created attachment 22291 [details]
Suppress reflections of inline flows

This proved to be hard to do in adjustRenderStyle() because there is no easy way to tell the that element is going to be an inline flow, so instead this patch just overrides the flag on the renderer.

[Dave Hyatt]

Comment on attachment 22291 [details]
Suppress reflections of inline flows

r=me

Fixed in <http://trac.webkit.org/changeset/35186>.