[Webkit-unassigned] [Bug 70105] New: Web Inspector: WebProcess crashes hard when inspecting elements with border-images applied

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=70105

           Summary: Web Inspector: WebProcess crashes hard when inspecting
                    elements with border-images applied
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
               URL: http://jsfiddle.net/fermion/wjqNh/3/
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: Web Inspector
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rob.sterner at gmail.com
                CC: timothy at apple.com, rik at webkit.org, keishi at webkit.org,
                    pmuellr at yahoo.com, joepeck at webkit.org,
                    pfeldman at chromium.org, yurys at chromium.org,
                    bweinstein at apple.com, apavlov at chromium.org,
                    loislo at chromium.org


I've set up an example fiddle (http://jsfiddle.net/fermion/wjqNh/2/) that demonstrates what I've been seeing for a few weeks now.  This occurs in the current Webkit nightly and Chrome dev. channel browsers.

To reproduce:

1) visit the fiddle in Webkit nightly
2) open up DOM inspector and attempt to inspect styles on the <a> tags in the "Result"  pane
3) BOOM

I've attached a trace from OS X's Console related to the event.  Also notice the display, the link text isn't formatted correctly.  In Webkit:

http://p.fermion.us/3A1j0t1c1s1f3T3W3x2T

in Safari 5.1.1:

http://p.fermion.us/3X0A2g283i0r0K2P1u1Y

If I remove applied border-image and -webkit-border-image tags it's fine.  If I set top/left/right/bottom values to 0 as in:

http://jsfiddle.net/fermion/8DCEh/1/

you can inspect the <a> without issue.  Furthermore, setting all but one of top/left/right/bottom to be a non-zero value as in:

http://jsfiddle.net/fermion/Epr2A/1/

is also fine.  It seems that setting all of top/left/right/bottom to non-zero values triggers the crash.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.