Bug 22161 – Assertion failure in RenderThemeWin::systemColor when loading microsoftpdc.com

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Adam Roben (:aroben)]

To reproduce:

1. Go to http://www.microsoftpdc.com/

You'll hit the following assertion:

    ASSERT(sysColorIndex != -1);

Here's the backtrace:

>	WebKit_debug.dll!WebCore::RenderThemeWin::systemColor(int cssValueId=248)  Line 805 + 0x22 bytes	C++
 	WebKit_debug.dll!WebCore::colorForCSSValue(int cssValueId=248)  Line 5598 + 0x1f bytes	C++
 	WebKit_debug.dll!WebCore::CSSStyleSelector::getColorFromPrimitiveValue(WebCore::CSSPrimitiveValue * primitiveValue=0x075b0900)  Line 5625 + 0xd bytes	C++
 	WebKit_debug.dll!WebCore::CSSStyleSelector::applyProperty(int id=1071, WebCore::CSSValue * value=0x075b0900)  Line 3198 + 0x13 bytes	C++
 	WebKit_debug.dll!WebCore::CSSStyleSelector::applyDeclarations(bool applyFirst=false, bool isImportant=false, int startIndex=0, int endIndex=0)  Line 2646	C++
 	WebKit_debug.dll!WebCore::CSSStyleSelector::styleForElement(WebCore::Element * e=0x076c28d8, WebCore::RenderStyle * defaultParent=0x00000000, bool allowSharing=true, bool resolveForRootDefault=false)  Line 1146	C++
 	WebKit_debug.dll!WebCore::Node::styleForRenderer()  Line 1048 + 0x24 bytes	C++
 	WebKit_debug.dll!WebCore::Node::createRendererIfNeeded()  Line 1030 + 0xc bytes	C++
 	WebKit_debug.dll!WebCore::Element::attach()  Line 656	C++
 	WebKit_debug.dll!WebCore::HTMLParser::insertNode(WebCore::Node * n=0x076c28d8, bool flat=false)  Line 348 + 0x12 bytes	C++
 	WebKit_debug.dll!WebCore::HTMLParser::handleError(WebCore::Node * n=0x076c28d8, bool flat=false, const WebCore::AtomicString & localName={...}, int tagPriority=1)  Line 652	C++
 	WebKit_debug.dll!WebCore::HTMLParser::insertNode(WebCore::Node * n=0x076c28d8, bool flat=false)  Line 326 + 0x18 bytes	C++
 	WebKit_debug.dll!WebCore::HTMLParser::handleError(WebCore::Node * n=0x076c28d8, bool flat=false, const WebCore::AtomicString & localName={...}, int tagPriority=1)  Line 652	C++
 	WebKit_debug.dll!WebCore::HTMLParser::insertNode(WebCore::Node * n=0x076c28d8, bool flat=false)  Line 326 + 0x18 bytes	C++
 	WebKit_debug.dll!WebCore::HTMLParser::parseToken(WebCore::Token * t=0x070fa03c)  Line 257 + 0x18 bytes	C++
 	WebKit_debug.dll!WebCore::HTMLTokenizer::processToken()  Line 1923 + 0x19 bytes	C++
 	WebKit_debug.dll!WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString & src={...}, WebCore::HTMLTokenizer::State state={...})  Line 1502 + 0xf bytes	C++
 	WebKit_debug.dll!WebCore::HTMLTokenizer::write(const WebCore::SegmentedString & str={...}, bool appendData=true)  Line 1752 + 0x1d bytes	C++
 	WebKit_debug.dll!WebCore::FrameLoader::write(const char * str=0x07165040, int len=42, bool flush=false)  Line 1041 + 0x21 bytes	C++
 	WebKit_debug.dll!WebCore::FrameLoader::addData(const char * bytes=0x07165040, int length=42)  Line 1889	C++
 	WebKit_debug.dll!WebFrameLoaderClient::receivedData(const char * data=0x07165040, int length=42, const WebCore::String & textEncoding={us-ascii})  Line 401	C++
 	WebKit_debug.dll!WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader * loader=0x076e1028, const char * data=0x07165040, int length=42)  Line 372	C++
 	WebKit_debug.dll!WebCore::FrameLoader::committedLoad(WebCore::DocumentLoader * loader=0x076e1028, const char * data=0x07165040, int length=42)  Line 3458 + 0x24 bytes	C++
 	WebKit_debug.dll!WebCore::DocumentLoader::commitLoad(const char * data=0x07165040, int length=42)  Line 356	C++
 	WebKit_debug.dll!WebCore::DocumentLoader::receivedData(const char * data=0x07165040, int length=42)  Line 368	C++
 	WebKit_debug.dll!WebCore::FrameLoader::receivedData(const char * data=0x07165040, int length=42)  Line 2344	C++
 	WebKit_debug.dll!WebCore::MainResourceLoader::addData(const char * data=0x07165040, int length=42, bool allAtOnce=false)  Line 146	C++
 	WebKit_debug.dll!WebCore::ResourceLoader::didReceiveData(const char * data=0x07165040, int length=42, __int64 lengthReceived=42, bool allAtOnce=false)  Line 251 + 0x1b bytes	C++
 	WebKit_debug.dll!WebCore::MainResourceLoader::didReceiveData(const char * data=0x07165040, int length=42, __int64 lengthReceived=42, bool allAtOnce=false)  Line 315	C++
 	WebKit_debug.dll!WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle * __formal=0x04e5f2d0, const char * data=0x07165040, int length=42, int lengthReceived=42)  Line 393 + 0x1f bytes	C++
 	WebKit_debug.dll!WebCore::didReceiveData(_CFURLConnection * conn=0x07752ef8, const __CFData * data=0x07165028, long originalLength=42, const void * clientInfo=0x04e5f2d0)  Line 109 + 0x2a bytes	C++

[Adam Roben (:aroben)]

The problem is that the following rule has been specified in the site's CSS:

a, img {
    outline-color: invert;
}

But RenderThemeWin doesn't support "invert" as a color value. In Release builds, this will cause the outline to be opaque black, but should not crash.

[Adam Roben (:aroben)]

<rdar://problem/6340628>

[Adam Roben (:aroben)]

Created attachment 25026 [details]
Patch + ChangeLog

Comment on attachment 25026 [details]
Patch + ChangeLog

r=me

[Adam Roben (:aroben)]

Committed in r38274 <http://trac.webkit.org/changeset/38274>