Bug 221378 – Nullptr crash in Node::renderStyle() via CSSLinearGradientValue::createGradient

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Ryosuke Niwa]

e.g.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000010d33c39c WebCore::Node::renderStyle() const + 0 (NodeRenderStyle.h:36) [inlined]
1   com.apple.WebCore             	0x000000010d33c39c WebCore::CSSLinearGradientValue::createGradient(WebCore::RenderElement&, WebCore::FloatSize const&) + 76 (CSSGradientValue.cpp:809)
2   com.apple.WebCore             	0x000000010d33b360 WebCore::createGradient(WebCore::CSSGradientValue&, WebCore::RenderElement&, WebCore::FloatSize) + 49 (CSSGradientValue.cpp:46) [inlined]
3   com.apple.WebCore             	0x000000010d33b360 WebCore::CSSGradientValue::image(WebCore::RenderElement&, WebCore::FloatSize const&) + 144 (CSSGradientValue.cpp:63)
4   com.apple.WebCore             	0x000000010d34cad0 WebCore::CSSImageGeneratorValue::image(WebCore::RenderElement&, WebCore::FloatSize const&) + 48
5   com.apple.WebCore             	0x000000010df24512 WebCore::StyleGeneratedImage::image(WebCore::RenderElement*, WebCore::FloatSize const&) const + 18 (StyleGeneratedImage.cpp:104)
6   com.apple.WebCore             	0x000000010dda89b8 WebCore::RenderBoxModelObject::paintFillLayerExtended(WebCore::PaintInfo const&, WebCore::Color const&, WebCore::FillLayer const&, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::InlineFlowBox*, WebCore::LayoutSize const&, WebCore::CompositeOperator, WebCore::RenderElement*, WebCore::BaseBackgroundColorUsage) + 6424 (RenderBoxModelObject.cpp:966)
7   com.apple.WebCore             	0x000000010dda07f4 WebCore::RenderBox::paintFillLayer(WebCore::PaintInfo const&, WebCore::Color const&, WebCore::FillLayer const&, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::CompositeOperator, WebCore::RenderElement*, WebCore::BaseBackgroundColorUsage) + 43 (RenderBox.cpp:1790) [inlined]
8   com.apple.WebCore             	0x000000010dda07f4 WebCore::RenderBox::paintFillLayers(WebCore::PaintInfo const&, WebCore::Color const&, WebCore::FillLayer const&, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::CompositeOperator, WebCore::RenderElement*) + 596 (RenderBox.cpp:1781)
9   com.apple.WebCore             	0x000000010dda3fca WebCore::RenderBox::paintBackground(WebCore::PaintInfo const&, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance) + 314 (RenderBox.cpp:1504)
10  com.apple.WebCore             	0x000000010dda13b0 WebCore::RenderBox::paintBoxDecorations(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 1024 (RenderBox.cpp:1459)
11  com.apple.WebCore             	0x000000010dd730ad WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 77 (RenderBlock.cpp:1231)
12  com.apple.WebCore             	0x000000010dd7296d WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 285 (RenderBlock.cpp:1108)
13  com.apple.WebCore             	0x000000010de7f524 WebCore::RenderScrollbarPart::paintIntoRect(WebCore::GraphicsContext&, WebCore::LayoutPoint const&, WebCore::LayoutRect const&) + 548 (RenderScrollbarPart.cpp:180)
14  com.apple.WebCore             	0x000000010de7f2f1 WebCore::RenderScrollbar::paintPart(WebCore::GraphicsContext&, WebCore::ScrollbarPart, WebCore::IntRect const&) + 481 (RenderScrollbar.cpp:267)
15  com.apple.WebCore             	0x000000010de83275 WebCore::RenderScrollbarTheme::paintScrollbarBackground(WebCore::GraphicsContext&, WebCore::Scrollbar&) + 53 (RenderScrollbarTheme.cpp:136)
16  com.apple.WebCore             	0x000000010db16cb9 WebCore::ScrollbarThemeComposite::paint(WebCore::Scrollbar&, WebCore::GraphicsContext&, WebCore::IntRect const&) + 617 (ScrollbarThemeComposite.cpp:79)
17  com.apple.WebCore             	0x000000010db15f2d WebCore::Scrollbar::paint(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy, WebCore::EventRegionContext*) + 173 (Scrollbar.cpp:153)
18  com.apple.WebCore             	0x000000010de37a60 WebCore::paintScrollbar(WebCore::Scrollbar*, WebCore::GraphicsContext&, WebCore::IntRect const&) + 160 (RenderLayerCompositor.cpp:3562)
19  com.apple.WebCore             	0x000000010de45a85 WebCore::RenderLayerCompositor::paintContents(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, WebCore::FloatRect const&, unsigned int) + 325
20  com.apple.WebCore             	0x000000010db939b6 WebCore::GraphicsLayer::paintGraphicsLayerContents(WebCore::GraphicsContext&, WebCore::FloatRect const&, unsigned int) + 182 (GraphicsLayer.cpp:530)
21  com.apple.WebCore             	0x000000010dbdb0f7 WebCore::GraphicsLayerCA::platformCALayerPaintContents(WebCore::PlatformCALayer*, WebCore::GraphicsContext&, WebCore::FloatRect const&, unsigned int) + 231 (GraphicsLayerCA.cpp:1715)

<rdar://problem/72995309>

[Ryosuke Niwa]

Created attachment 419222 [details]
Test

[Rob Buis]

Created attachment 419403 [details]
Patch

[Rob Buis]

Created attachment 419405 [details]
Patch

[EWS]

Committed r272497: <https://commits.webkit.org/r272497>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 419405 [details].