Created attachment 115797 [details] Test case When the -webkit-filter changes, WebKit crashes. See the attached test.
Created attachment 115798 [details] Crashlog
I have a fix already. I will post a patch soon.
Created attachment 115802 [details] Patch V1
Comment on attachment 115802 [details] Patch V1 View in context: https://bugs.webkit.org/attachment.cgi?id=115802&action=review > LayoutTests/css3/filters/crash-filter-change.html:7 > +<img style="-webkit-filter: hue-rotate(90deg)" src="resources/reference.png"> > +<script> > + // force a layout > + document.body.offsetTop; > + var img = document.getElementsByTagName('img')[0]; > + img.style['-webkit-filter'] = 'hue-rotate(10deg)'; Why not use CSS classes and change the className? > Source/WebCore/rendering/FilterEffectRenderer.cpp:238 > + setMaxEffectRects(m_sourceDrawingRegion); Could this be tested separately? Does the right thing happen if the size of the filtered element changes?
(In reply to comment #4) > (From update of attachment 115802 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=115802&action=review > > > LayoutTests/css3/filters/crash-filter-change.html:7 > > +<img style="-webkit-filter: hue-rotate(90deg)" src="resources/reference.png"> > > +<script> > > + // force a layout > > + document.body.offsetTop; > > + var img = document.getElementsByTagName('img')[0]; > > + img.style['-webkit-filter'] = 'hue-rotate(10deg)'; > > Why not use CSS classes and change the className? I can use classes. I will change before committing. > > > Source/WebCore/rendering/FilterEffectRenderer.cpp:238 > > + setMaxEffectRects(m_sourceDrawingRegion); > > Could this be tested separately? Does the right thing happen if the size of the filtered element changes? Yes the problem was that the max size was zero after a rebuild of the filter pipeline and the result would be transparent white. I think this test can also be an image test, like the other ones in the css3/filters, so that we can actually assert that the result is correct. I will convert it to pixel test.
Thanks Alex!
<rdar://problem/10471745>
Created attachment 116336 [details] Patch for landing
Comment on attachment 116336 [details] Patch for landing Clearing flags on attachment: 116336 Committed r101077: <http://trac.webkit.org/changeset/101077>
All reviewed patches have been landed. Closing bug.