Bug 66686 - Crash with -webkit-radial-gradient(top) gradient
Summary: Crash with -webkit-radial-gradient(top) gradient
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Major
Assignee: Simon Fraser (smfr)
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2011-08-22 11:04 PDT by Rafał Chłodnicki
Modified: 2011-08-31 12:11 PDT (History)
2 users (show)

See Also:

Attachments
Patch (3.17 KB, patch)
2011-08-31 09:35 PDT, Simon Fraser (smfr) 		darin: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Rafał Chłodnicki 2011-08-22 11:04:07 PDT 
-webkit-radial-gradient(top) crashes browser. Possibly at CSS parsing stage but could be rendering instead.
Comment 1 Simon Fraser (smfr) 2011-08-22 11:09:51 PDT 
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00007fff94013212 WebCore::CSSParser::parseRadialGradient(WTF::RefPtr<WebCore::CSSValue>&, WebCore::CSSGradientRepeat) + 430
1   com.apple.WebCore             	0x00007fff93ab846e WebCore::CSSParser::parseGeneratedImage(WTF::RefPtr<WebCore::CSSValue>&) + 400
2   com.apple.WebCore             	0x00007fff93ab58d6 WebCore::CSSParser::parseFillImage(WTF::RefPtr<WebCore::CSSValue>&) + 462
3   com.apple.WebCore             	0x00007fff93ab4fb8 WebCore::CSSParser::parseFillProperty(int, int&, int&, WTF::RefPtr<WebCore::CSSValue>&, WTF::RefPtr<WebCore::CSSValue>&) + 682
4   com.apple.WebCore             	0x00007fff93a22d5f WebCore::CSSParser::parseValue(int, bool) + 4473
5
Comment 2 Simon Fraser (smfr) 2011-08-22 11:10:45 PDT 
<rdar://problem/9718053>
Comment 3 Simon Fraser (smfr) 2011-08-31 09:35:40 PDT 
Created attachment 105782 [details]
Patch
Comment 4 Darin Adler 2011-08-31 10:33:42 PDT 
Comment on attachment 105782 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=105782&action=review

> LayoutTests/fast/gradients/css3-radial-gradient-crash-expected.txt:1
> +

Usually better to put some output like “this passes if it does not crash” into the document.
Comment 5 Simon Fraser (smfr) 2011-08-31 12:11:43 PDT 
http://trac.webkit.org/changeset/94215