Bug 136945

Summary:

ASSERTION FAILED: columnCount in WebCore::CSSParser::parseGridTemplateAreasRow

Product:

WebKit

Reporter:

Renata Hodovan <rhodovan.u-szeged>

Component:

CSS

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, commit-queue, darin, jfernandez, rego, svillar

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

60731, 116980

Attachments:

Description	Flags
Test case	none
Patch	none
Patch	none
Patch	none

Renata Hodovan

Reported 2014-09-19 01:57:40 PDT

Created attachment 238360 [details] Test case The failing test case: <style> * { -webkit-grid-template-areas: " "; } </style> It's probably the same issue as http://crbug.com/412715. The backtrace: ASSERTION FAILED: columnCount ../../Source/WebCore/css/CSSParser.cpp(5579) : bool WebCore::CSSParser::parseGridTemplateAreasRow(WebCore::NamedGridAreaMap&, unsigned int, unsigned int&) 0x00007fffedbf3127 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007fffedbf3127 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff2ebdce4 in WebCore::CSSParser::parseGridTemplateAreasRow (this=0x7fffffffbb70, gridAreaMap=..., rowCount=0x0, columnCount=@0x7fffffff9008: 0x0) at ../../Source/WebCore/css/CSSParser.cpp:5579 #2 0x00007ffff2ebe120 in WebCore::CSSParser::parseGridTemplateAreas (this=0x7fffffffbb70) at ../../Source/WebCore/css/CSSParser.cpp:5634 #3 0x00007ffff2eaca55 in WebCore::CSSParser::parseValue (this=0x7fffffffbb70, propId=WebCore::CSSPropertyWebkitGridTemplateAreas, important=0x0) at ../../Source/WebCore/css/CSSParser.cpp:2653 #4 0x00007ffff3f60ac9 in cssyyparse (parser=0x7fffffffbb70) at /home/reni/data/REPOS/webkit/WebKitBuild/Debug/DerivedSources/WebCore/CSSGrammar.y:1207 #5 0x00007ffff2ea5104 in WebCore::CSSParser::parseSheet (this=0x7fffffffbb70, sheet=0x9b9cb0, string=..., startLineNumber=0x0, ruleSourceDataResult=0x0, logErrors=0x1) at ../../Source/WebCore/css/CSSParser.cpp:441 #6 0x00007ffff2ff330d in WebCore::StyleSheetContents::parseStringAtLine (this=0x9b9cb0, sheetText=..., startLineNumber=0x0, createdByParser=0x1) at ../../Source/WebCore/css/StyleSheetContents.cpp:326 #7 0x00007ffff30eadcc in WebCore::InlineStyleSheetOwner::createSheet (this=0x85bb88, element=..., text=...) at ../../Source/WebCore/dom/InlineStyleSheetOwner.cpp:147 #8 0x00007ffff30ea811 in WebCore::InlineStyleSheetOwner::createSheetFromTextContents (this=0x85bb88, element=...) at ../../Source/WebCore/dom/InlineStyleSheetOwner.cpp:97 #9 0x00007ffff30ea7cd in WebCore::InlineStyleSheetOwner::finishParsingChildren (this=0x85bb88, element=...) at ../../Source/WebCore/dom/InlineStyleSheetOwner.cpp:91 #10 0x00007ffff3320101 in WebCore::HTMLStyleElement::finishParsingChildren (this=0x85bb20) at ../../Source/WebCore/html/HTMLStyleElement.cpp:90 #11 0x00007ffff33cddde in WebCore::HTMLElementStack::popCommon (this=0x8a9758) at ../../Source/WebCore/html/parser/HTMLElementStack.cpp:578 #12 0x00007ffff33cc652 in WebCore::HTMLElementStack::pop (this=0x8a9758) at ../../Source/WebCore/html/parser/HTMLElementStack.cpp:214 #13 0x00007ffff33f7e2f in WebCore::HTMLTreeBuilder::processEndTag (this=0x8a9720, token=0x7fffffffd030) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2179 #14 0x00007ffff33ede12 in WebCore::HTMLTreeBuilder::processToken (this=0x8a9720, token=0x7fffffffd030) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:386 #15 0x00007ffff33edc24 in WebCore::HTMLTreeBuilder::constructTree (this=0x8a9720, token=0x7fffffffd030) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:354 #16 0x00007ffff33c59e5 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken (this=0x8a9000, rawToken=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:352 #17 0x00007ffff33c561b in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x8a9000, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:309 #18 0x00007ffff33c4db3 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x8a9000, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:189 #19 0x00007ffff33c5f7b in WebCore::HTMLDocumentParser::append (this=0x8a9000, inputSource=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:428 #20 0x00007ffff305463b in WebCore::DecodedDataDocumentParser::flush (this=0x8a9000, writer=...) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #21 0x00007ffff3532297 in WebCore::DocumentWriter::end (this=0x949730) at ../../Source/WebCore/loader/DocumentWriter.cpp:243 #22 0x00007ffff351d9ad in WebCore::DocumentLoader::finishedLoading (this=0x949690, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441 #23 0x00007ffff351d716 in WebCore::DocumentLoader::notifyFinished (this=0x949690, resource=0x8a68e0) at ../../Source/WebCore/loader/DocumentLoader.cpp:375 #24 0x00007ffff35d47c4 in WebCore::CachedResource::checkNotify (this=0x8a68e0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:347 #25 0x00007ffff35d48ce in WebCore::CachedResource::finishLoading (this=0x8a68e0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:363 #26 0x00007ffff35d11f4 in WebCore::CachedRawResource::finishLoading (this=0x8a68e0, data=0x8ac090) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:101 #27 0x00007ffff3580a50 in WebCore::SubresourceLoader::didFinishLoading (this=0x8a6e50, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:309 #28 0x00007ffff357c73b in WebCore::ResourceLoader::didFinishLoading (this=0x8a6e50, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:512 #29 0x00007ffff3eecb0f in WebCore::readCallback (asyncResult=0x8a89a0, data=0x8a74c0) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #30 0x00007fffebac72ea in async_ready_callback_wrapper (source_object=0xa3bb30, res=0x8a89a0, user_data=0x8a74c0) at ginputstream.c:519 #31 0x00007fffebae6ceb in g_task_return_now (task=0x8a89a0) at gtask.c:1108 #32 0x00007fffebae6d09 in complete_in_idle_cb (task=0x8a89a0) at gtask.c:1117 #33 0x00007fffead3d2e6 in g_main_dispatch (context=0x677bb0) at gmain.c:3065 #34 g_main_context_dispatch (context=context@entry=0x677bb0) at gmain.c:3641 #35 0x00007fffead3d638 in g_main_context_iterate (context=0x677bb0, block=block@entry=0x1, dispatch=dispatch@entry=0x1, self=<optimized out>) at gmain.c:3712 #36 0x00007fffead3da3a in g_main_loop_run (loop=0xafe450) at gmain.c:3906 #37 0x00007ffff45e062e in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #38 0x00007ffff2b1c1e2 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=0x2, argv=0x7fffffffd938) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #39 0x00007ffff2b1c047 in WebKit::WebProcessMainUnix (argc=0x2, argv=0x7fffffffd938) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #40 0x000000000040080d in main (argc=0x2, argv=0x7fffffffd938) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32

Attachments
Test case (60 bytes, text/html) 2014-09-19 01:57 PDT, Renata Hodovan	no flags	Details
Patch (4.08 KB, patch) 2014-09-25 02:15 PDT, Javier Fernandez	no flags	Details Formatted Diff Diff
Patch (4.24 KB, patch) 2014-09-25 07:03 PDT, Javier Fernandez	no flags	Details Formatted Diff Diff
Patch (4.25 KB, patch) 2014-09-25 07:06 PDT, Javier Fernandez	no flags	Details Formatted Diff Diff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.

Javier Fernandez

Comment 1 2014-09-25 02:15:43 PDT

Created attachment 238652 [details] Patch

Sergio Villar Senin

Comment 2 2014-09-25 04:04:48 PDT

Comment on attachment 238652 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=238652&action=review > Source/WebCore/css/CSSParser.cpp:5571 > + if (gridRowNames.isEmpty() || gridRowNames.containsOnlyWhitespace()) Does this cover also multiple whitespaces? > LayoutTests/fast/css-grid-layout/grid-template-areas-empty-string-crash-expected.txt:1 > +crbug.com/412715 - ASSERTION FAILED: columnCount in blink::CSSPropertyParser::parseGridTemplateAreasRow Do not mention external bugs. Also remove the blink:: thing > LayoutTests/fast/css-grid-layout/grid-template-areas-empty-string-crash.html:27 > +<p>crbug.com/412715 - ASSERTION FAILED: columnCount in blink::CSSPropertyParser::parseGridTemplateAreasRow</p> Ditto.

Javier Fernandez

Comment 3 2014-09-25 07:03:10 PDT

Created attachment 238657 [details] Patch

Javier Fernandez

Comment 4 2014-09-25 07:06:35 PDT

Created attachment 238658 [details] Patch

WebKit Commit Bot

Comment 5 2014-09-25 07:50:18 PDT

Comment on attachment 238658 [details] Patch Clearing flags on attachment: 238658 Committed r173965: <http://trac.webkit.org/changeset/173965>

WebKit Commit Bot

Comment 6 2014-09-25 07:50:21 PDT

All reviewed patches have been landed. Closing bug.

Darin Adler

Comment 7 2014-09-25 22:05:04 PDT

Comment on attachment 238658 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=238658&action=review > Source/WebCore/css/CSSParser.cpp:5571 > + if (gridRowNames.isEmpty() || gridRowNames.containsOnlyWhitespace()) The isEmpty check here is now redundant. The containsOnlyWhitespace function returns true for empty strings.

Javier Fernandez

Comment 8 2014-09-26 06:47:02 PDT

(In reply to comment #7) > (From update of attachment 238658 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=238658&action=review > > > Source/WebCore/css/CSSParser.cpp:5571 > > + if (gridRowNames.isEmpty() || gridRowNames.containsOnlyWhitespace()) > > The isEmpty check here is now redundant. The containsOnlyWhitespace function returns true for empty strings. This will be address in bug #137146.

Note You need to log in before you can comment on or make changes to this bug.