New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 607095 link

Starred by 1 user
Status: Fixed
Owner:
timloh@chromium.org
Closed: Jul 2016
Cc:
█ kochi@chromium.org
style-bugs@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

CSSWG test imported/csswg-test/css-namespaces-3/syntax-013.xml crashes on debug

Project Member Reported by kochi@chromium.org, Apr 27 2016 
crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: ASSERTION FAILED: uri.type() == StringToken
STDERR: ../../third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp(446) : WTF::AtomicString blink::consumeStringOrURI(blink::CSSParserTokenRange &)
STDERR: 1   0x7f2ba0ee9aab
STDERR: 2   0x7f2ba0ee8772
STDERR: 3   0x7f2ba0ee61a0
STDERR: 4   0x7f2ba0ee70ba
STDERR: 5   0x7f2ba0ee6b67
STDERR: 6   0x7f2ba0ede555 blink::CSSParser::parseSheet(blink::CSSParserContext const&, blink::StyleSheetContents*, WTF::String const&)
STDERR: 7   0x7f2ba0ec5cd0 blink::StyleSheetContents::parseStringAtPosition(WTF::String const&, WTF::TextPosition const&)
STDERR: 8   0x7f2ba0a0c5d6 blink::StyleEngine::parseSheet(blink::Element*, WTF::String const&, WTF::TextPosition)
STDERR: 9   0x7f2ba0a0c0a9 blink::StyleEngine::createSheet(blink::Element*, WTF::String const&, WTF::TextPosition)
STDERR: 10  0x7f2ba0a07e8f
STDERR: 11  0x7f2ba0a071ec
STDERR: 12  0x7f2ba0a079bf
STDERR: 13  0x7f2ba0b98569
STDERR: 14  0x7f2ba146de71
STDERR: 15  0x7f2ba146f2a9
STDERR: 16  0x7f2ba19cac9c
STDERR: 17  0x7f2ba19cf4f7
STDERR: 18  0x7f2ba19cd90f
STDERR: 19  0x7f2ba146d115
STDERR: 20  0x7f2ba146ac3c
STDERR: 21  0x7f2ba146a9d1
STDERR: 22  0x7f2ba08aa736
STDERR: 23  0x7f2ba08aa69b
STDERR: 24  0x7f2ba12c0ef9
STDERR: 25  0x7f2ba12aff3d blink::DocumentLoader::commitData(char const*, unsigned long)
STDERR: 26  0x7f2ba12b1a03 blink::DocumentLoader::processData(char const*, unsigned long)
STDERR: 27  0x7f2ba12b18a2 blink::DocumentLoader::dataReceived(blink::Resource*, char const*, unsigned long)
STDERR: 28  0x7f2ba10b34d4 blink::RawResource::appendData(char const*, unsigned long)
STDERR: 29  0x7f2ba10da760 blink::ResourceLoader::didReceiveData(blink::WebURLLoader*, char const*, int, int)
STDERR: 30  0x7f2ba992f364 content::WebURLLoaderImpl::Context::OnReceivedData(std::unique_ptr<content::RequestPeer::ReceivedData, std::default_delete<content::RequestPeer::ReceivedData> >)
STDERR: 31  0x7f2ba992ff53 content::WebURLLoaderImpl::RequestPeerImpl::OnReceivedData(std::unique_ptr<content::RequestPeer::ReceivedData, std::default_delete<content::RequestPeer::ReceivedData> >)
STDERR: [12762:13891:0427/163423:1400475402123:WARNING:crash_handler_host_linux.cc(293)] Could not translate tid - assuming crashing thread is thread group leader; syscall_supported=1

Comment 1 by kochi@chromium.org, Apr 27 2016

Cc: timloh@chromium.org kochi@chromium.org
Components: Blink>CSS
Status: Available (was: Untriaged)
The test was prematurely imported from csswg-test (no owners yet) but
still the crash seems relevant.

Comment 2 by kochi@chromium.org, Apr 27 2016 

For the convenience, attaching the file here.

% out/Default/content_shell -run-layout-test syntax-013.xml

can reproduce the crash.
syntax-013.xml
1.4 KB View Download

Comment 3 by timloh@chromium.org, Apr 27 2016

Cc: -timloh@chromium.org
Owner: timloh@chromium.org
Status: Assigned (was: Available)
Will fix tomorrow. consumeStringOrURI just needs to check for BadStringToken (the other place in the CSS parser where we parse urls, consumeUrl, already gets this right)
Project Member

Comment 4 by bugdroid1@chromium.org, Jul 1 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/76a6f7c50105f7e7b1335aee6ab73297e6e85b6f

commit 76a6f7c50105f7e7b1335aee6ab73297e6e85b6f
Author: timloh <timloh@chromium.org>
Date: Fri Jul 01 03:00:52 2016

Fix assertion when parsing @namespace/@import with url(<bad-string-token>)

This patch fixes incorrect handling of <bad-string-token> inside
@namespace/@import rules. Currently a url(<bad-string-token>) is
incorrectly interpreted as url(url).

The added tests pass in Firefox.

BUG= 607095 , 607500 

Review-Url: https://codereview.chromium.org/1930823002
Cr-Commit-Position: refs/heads/master@{#403396}

[add] https://crrev.com/76a6f7c50105f7e7b1335aee6ab73297e6e85b6f/third_party/WebKit/LayoutTests/fast/css/import-with-bad-string.html
[add] https://crrev.com/76a6f7c50105f7e7b1335aee6ab73297e6e85b6f/third_party/WebKit/LayoutTests/fast/css/namespaces/invalid-url-in-namespace.html
[modify] https://crrev.com/76a6f7c50105f7e7b1335aee6ab73297e6e85b6f/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

Comment 5 by timloh@chromium.org, Jul 1 2016

Status: Fixed (was: Assigned)
►

Sign in to add a comment