Changing transform-box style from fill-box to border-box causes DCHECK failure |
||||||||||
Issue description
Chrome Version: ToT build, 66.0.3356.0 (Developer Build) (64-bit)
OS Version: Only tested on Linux, suspect it will happen on all platforms.
The attached HTML (reproduced below), causes a DCHECK failure in a ToT DCHECK-enabled build:
[1:1:0226/114229.502931:FATAL:CSSValueIDMappingsGenerated.h(1017)] Check failed: v >= CSSValueFillBox (457 vs. 476)
#0 0x7f94517356ad base::debug::StackTrace::StackTrace()
#1 0x7f9451733b9c base::debug::StackTrace::StackTrace()
#2 0x7f94517bbd8a logging::LogMessage::~LogMessage()
#3 0x7f9448cd95cd blink::detail::cssValueIDToPlatformEnumGenerated<>()
#4 0x7f9448cd9503 blink::CssValueIDToPlatformEnum<>()
#5 0x7f9448cd94e8 blink::CSSIdentifierValue::ConvertTo<>()
#6 0x7f9448cd9452 blink::CSSLonghand::TransformBox::ApplyValue()
#7 0x7f94488e33a7 blink::StyleBuilder::ApplyProperty()
#8 0x7f9448d30f05 blink::StyleBuilder::ApplyProperty()
#9 0x7f9448d47fa3 blink::StyleResolver::ApplyProperties<>()
#10 0x7f9448d4225b blink::StyleResolver::ApplyMatchedProperties<>()
#11 0x7f9448d3fc67 blink::StyleResolver::ApplyMatchedStandardProperties()
#12 0x7f9448d3b651 blink::StyleResolver::ApplyMatchedPropertiesAndCustomPropertyAnimations()
#13 0x7f9448d3b158 blink::StyleResolver::StyleForElement()
...
#36 0x7f944a5a26ed blink::HTMLParserScheduler::ContinueParsing()
HTML:
<div id="target" style="transform-box: fill-box;"></div>
<script>
window.addEventListener('load', function () {
target.style.transformBox = 'border-box';
});
</script>
,
Feb 26 2018
,
Feb 27 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/2a4de97d98d814d010155ca0a9ee5fad035eaec4 commit 2a4de97d98d814d010155ca0a9ee5fad035eaec4 Author: Stephen McGruer <smcgruer@chromium.org> Date: Tue Feb 27 18:48:54 2018 Allow null elements in EffectInput::Convert By the spec, a KeyframeEffect may be created with a null target, although unfortunately the spec doesn't then say what Document to use to resolve style/etc. This CL adds null-target handling, falling back to the Document extracted from the ScriptState if there is no target. In terms of changes to tests: - Three WPT tests no longer timeout (woo), but unfortunately they currently crash on a DCHECK for setting transform-box to 'border-box' and so are still disabled. See http://crbug.com/816534 - A number of tests for processing a keyframes argument start failing due to a bug in that code; previously this went unseen because the tests pass null for the element. Bug: 772014 , 816534 Change-Id: I01502c82bf758a796fe83c87ed395c6b9f6c4e11 Reviewed-on: https://chromium-review.googlesource.com/934625 Commit-Queue: Stephen McGruer <smcgruer@chromium.org> Reviewed-by: Robert Flack <flackr@chromium.org> Cr-Commit-Position: refs/heads/master@{#539509} [modify] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/LayoutTests/TestExpectations [add] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/accumulation-per-property-expected.txt [add] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/addition-per-property-expected.txt [add] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/interpolation-per-property-expected.txt [modify] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/LayoutTests/external/wpt/web-animations/interfaces/KeyframeEffect/processing-a-keyframes-argument-001-expected.txt [modify] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/Source/core/animation/AnimationInputHelpers.cpp [modify] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/Source/core/animation/AnimationInputHelpers.h [modify] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/Source/core/animation/EffectInput.cpp [modify] https://crrev.com/2a4de97d98d814d010155ca0a9ee5fad035eaec4/third_party/WebKit/Source/core/animation/EffectInput.h
,
Feb 28 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/6d0b0aeeaf811fdc77bcd845a6ad3efaf3c21e6a commit 6d0b0aeeaf811fdc77bcd845a6ad3efaf3c21e6a Author: Tsuyoshi Horo <horo@chromium.org> Date: Wed Feb 28 05:39:47 2018 Mark animation-type tests as [Pass Crash Failure] https://test-results.appspot.com/dashboards/flakiness_dashboard.html#testType=webkit_layout_tests&tests=animation-types Bug: 816534 Change-Id: Ibc56622bda32588099e02c1f4121c380c42787c5 TBR: smcgruer@ Reviewed-on: https://chromium-review.googlesource.com/940825 Reviewed-by: Tsuyoshi Horo <horo@chromium.org> Cr-Commit-Position: refs/heads/master@{#539723} [modify] https://crrev.com/6d0b0aeeaf811fdc77bcd845a6ad3efaf3c21e6a/third_party/WebKit/LayoutTests/TestExpectations
,
Mar 14 2018
,
Mar 14 2018
,
Mar 14 2018
,
Mar 14 2018
I am not the correct owner for this bug. This is a bug in the CSS engine as far as I can tell, and eae@'s team owns that.
,
Mar 14 2018
,
Mar 17 2018
,
Apr 23 2018
I believe I have located why this crash is happening, and am sending a CL out shortly to fix it (if I understand the code correctly!)
,
Apr 23 2018
,
Apr 24 2018
Issue 836185 has been merged into this issue.
,
Apr 24 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b commit 010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b Author: Stephen McGruer <smcgruer@chromium.org> Date: Tue Apr 24 19:15:48 2018 Fix DCHECK when setting transform-box style to 'border-box'. This is an invalid value for the property, but had been incorrectly left in the CSS parser fast-path code as allowed. Bug: 816534 Change-Id: Ic787508d21b3f385a37e5c4d50989c69d8dd48ac Reviewed-on: https://chromium-review.googlesource.com/1024775 Commit-Queue: Stephen McGruer <smcgruer@chromium.org> Reviewed-by: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#553224} [modify] https://crrev.com/010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b/third_party/WebKit/LayoutTests/TestExpectations [modify] https://crrev.com/010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/accumulation-per-property-expected.txt [modify] https://crrev.com/010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/addition-per-property-expected.txt [modify] https://crrev.com/010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b/third_party/WebKit/LayoutTests/platform/mac/external/wpt/web-animations/animation-model/animation-types/accumulation-per-property-expected.txt [modify] https://crrev.com/010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b/third_party/WebKit/LayoutTests/platform/mac/external/wpt/web-animations/animation-model/animation-types/addition-per-property-expected.txt [modify] https://crrev.com/010c0cc318b4d718edcb7c7bb4d4af2b81ebac8b/third_party/blink/renderer/core/css/parser/css_parser_fast_paths.cc
,
Apr 24 2018
|
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by smcgruer@chromium.org
, Feb 26 2018