Bug 93380 - Crash when inspecting an element with border-image
Summary: Crash when inspecting an element with border-image
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Major
Assignee: Matt Arsenault
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-08-07 11:35 PDT by Alexander Pavlov (apavlov)
Modified: 2012-08-08 03:22 PDT (History)
9 users (show)

See Also:


Attachments
Repro that doesn't involve the inspector (249 bytes, text/html)
2012-08-07 22:38 PDT, Tim Horton
no flags Details
Fix this bug (3.07 KB, patch)
2012-08-07 23:57 PDT, Matt Arsenault
no flags Details | Formatted Diff | Diff
Fix quality English (3.06 KB, patch)
2012-08-08 00:09 PDT, Matt Arsenault
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Pavlov (apavlov) 2012-08-07 11:35:56 PDT
In the following document:

<html>
<head>
<style>
div {
    border-image:  url(images/shadow-border.png) stretch 10;
}
</style>
</head>
<body>
    <div>FOO</div>
</body>
</html>


Inspect the FOO div. A crash.

The crashing line:
        case CSS_PAIR:
            text = m_value.pair->first()->cssText();
            if (m_value.pair->second() != m_value.pair->first()) {
                text += " ";
                text += m_value.pair->second()->cssText();  // <-------------
            }

This is due to CSSParser::parseBorderImageRepeat(RefPtr<CSSValue>& result)
building a CSSPair with second() equal to 0 (last else-branch inside "if (val)" does not initialize secondValue).

Upstreaming http://crbug.com/141139
Comment 1 Simon Fraser (smfr) 2012-08-07 11:39:57 PDT
Similar to bug 70105.
Comment 2 Tim Horton 2012-08-07 22:38:56 PDT
Created attachment 157117 [details]
Repro that doesn't involve the inspector
Comment 3 Matt Arsenault 2012-08-07 23:07:37 PDT
I know what's going on, I have a patch.
Comment 4 Matt Arsenault 2012-08-07 23:57:55 PDT
Created attachment 157133 [details]
Fix this bug
Comment 5 Matt Arsenault 2012-08-08 00:09:43 PDT
Created attachment 157136 [details]
Fix quality English
Comment 6 WebKit Review Bot 2012-08-08 03:22:18 PDT
Comment on attachment 157136 [details]
Fix quality English

Clearing flags on attachment: 157136

Committed r125016: <http://trac.webkit.org/changeset/125016>
Comment 7 WebKit Review Bot 2012-08-08 03:22:22 PDT
All reviewed patches have been landed.  Closing bug.