Bug 228735 - REGRESSION(r279050): Crash under CSSImageValue::createDeprecatedCSSOMWrapper with cursor images
Summary: REGRESSION(r279050): Crash under CSSImageValue::createDeprecatedCSSOMWrapper ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-08-03 03:02 PDT by Antti Koivisto
Modified: 2021-08-03 18:48 PDT (History)
10 users (show)

See Also:

Attachments
patch (3.13 KB, patch)
2021-08-03 03:46 PDT, Antti Koivisto 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Antti Koivisto 2021-08-03 03:02:46 PDT 
CSSCursorImageValue is not a CSSImageValue.
Comment 1 Antti Koivisto 2021-08-03 03:46:34 PDT 
Created attachment 434824 [details]
patch
Comment 2 Maciej Stachowiak 2021-08-03 09:45:01 PDT 
<rdar://81119647>
Comment 3 Radar WebKit Bug Importer 2021-08-03 09:45:15 PDT 
<rdar://problem/81466490>
Comment 4 EWS 2021-08-03 09:55:04 PDT 
Committed r280599 (240217@main): <https://commits.webkit.org/240217@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 434824 [details].
Comment 5 Darin Adler 2021-08-03 18:48:55 PDT 
Comment on attachment 434824 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=434824&action=review

> Source/WebCore/css/CSSValue.cpp:498
> +    if (isImageValue())
>          return downcast<CSSImageValue>(this)->createDeprecatedCSSOMWrapper(styleDeclaration);
>      if (isPrimitiveValue())

Occurs to me that we could come back here and make this more obviously correct by using is<CSSImageValue>, is<CSSPrimitiveValue>, and is<CSSValueList>.