[Webkit-unassigned] [Bug 157982] New: WebCore::CalculationValueMap::ref asserts when using CSS Calc

Sun May 22 20:10:38 PDT 2016

https://bugs.webkit.org/show_bug.cgi?id=157982

            Bug ID: 157982
           Summary: WebCore::CalculationValueMap::ref asserts when using
                    CSS Calc
    Classification: Unclassified
           Product: WebKit
           Version: Other
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit EFL
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: hyongyoub.kim at navercorp.com
                CC: demarchi at webkit.org

Here is a test page.

<html>
<style>
@-webkit-keyframes move {
  0% {
    -webkit-transform: translate3d(0px, 0px, 0);
  }
  100% {
    -webkit-transform: translate3d(0px, calc(100% + 64px), 0);
  }
}

#foo img {
  width: 100px;
  height: 100px;
  background: #222;
  -webkit-animation-name: move;
  -webkit-animation-duration: 10s;
  -webkit-animation-iteration-count: infinite;
}
</style>

<div id="foo">
  <img src="http://www.html5rocks.com/static/images/identity/HTML5_Badge_256.png">
</div>
</html>

Note 'calc(100% + 64px)' in transform. That expression becomes CalculationValue. transformsForValue creates TranslateTransformOperation with the 'y' value of Calculated Length that indirectly points to the CalculationValue. This Length gets shipped over to UIProcess as POD (SimpleArgumentCoder<Length>). When UIProcess decodes this, it crashes because its handle to CalculationValue is invalid. It looks like we need to send CalculationValue to UIProcess along with Length?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160523/c661a215/attachment.html>