This test crashes: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000072a2e6adc WebCore::CSSValue::classType() const + 12 (CSSValue.h:217) 1 com.apple.WebCore 0x000000072a3318f7 WebCore::CSSValue::cssText() const + 39 (CSSValue.cpp:245) 2 com.apple.WebCore 0x000000072a2d34f4 WebCore::CSSLinearGradientValue::customCSSText() const + 2804 (CSSGradientValue.cpp:765) 3 com.apple.WebCore 0x000000072a331a6c WebCore::CSSValue::cssText() const + 412 (CSSValue.cpp:275) 4 com.apple.WebCore 0x000000072a3dbb70 WebCore::StyleProperties::getPropertyValue(WebCore::CSSPropertyID) const + 112 (StyleProperties.cpp:129) 5 com.apple.WebCore 0x000000072a3b78f6 WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal(WebCore::CSSPropertyID) + 54 (PropertySetCSSStyleDeclaration.cpp:303) 6 com.apple.WebCore 0x000000072a3b78b3 WebCore::PropertySetCSSStyleDeclaration::getPropertyValue(WTF::String const&) + 195 (PropertySetCSSStyleDeclaration.cpp:203) 7 com.apple.WebCore 0x0000000728549c5e WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueBody(JSC::ExecState*, WebCore::JSCSSStyleDeclaration*, JSC::ThrowScope&) + 318 (JSCSSStyleDeclaration.cpp:431) 8 com.apple.WebCore 0x000000072853a4f0 long long WebCore::IDLOperation<WebCore::JSCSSStyleDeclaration>::call<&(WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueBody(JSC::ExecState*, WebCore::JSCSSStyleDeclaration*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) + 768 (JSDOMOperation.h:53) 9 com.apple.WebCore 0x000000072853a1dc WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(JSC::ExecState*) + 28 (JSCSSStyleDeclaration.cpp:436) 10 ??? 0x0000248e5600116b 0 + 40193746801003 11 com.apple.JavaScriptCore 0x000000073fb65387 llint_entry + 117405 (LowLevelInterpreter.asm:910) 12 com.apple.JavaScriptCore 0x000000073fb65387 llint_entry + 117405 (LowLevelInterpreter.asm:910)
Created attachment 375047 [details] Patch
Patch requires the patch from bug 200210.
Comment on attachment 375047 [details] Patch r=me I also found this crash when working on bug 200716 and I locally simply fixed it by null-checking stop.m_color, but I like much more your fix. This sharing of the code you did inside this new function writeColorStop() is cool.
This patch needs a rebase after r249013 and r250993
Created attachment 381491 [details] Patch
Created attachment 381506 [details] Patch
Created attachment 381509 [details] Patch
https://trac.webkit.org/changeset/251437/webkit
<rdar://problem/56503997>