"ASSERTION: CSSUnprefixingService returned an unrecognized type of gradient function"

RESOLVED FIXED in Firefox 54

Status

()

defect
RESOLVED FIXED
4 years ago
2 years ago

People

(Reporter: jruderman, Assigned: dholbert)

Tracking

(Blocks 1 bug, {assertion, testcase})

Trunk
mozilla54
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 wontfix, firefox54 fixed)

Details

Attachments

(4 attachments)

Posted file testcase
With:
  user_pref("layout.css.unprefixing-service.globally-whitelisted", true);

###!!! ASSERTION: CSSUnprefixingService returned an unrecognized type of gradient function: 'Error', file layout/style/nsCSSParser.cpp, line 7009
Posted file stack
Flags: needinfo?(dholbert)
I've got a local fix for this; I'll post it with a test, when I'm back from lunch.

(We could also WONTFIX this like bug 1228796 and bug 1228797, but IMO an assertion-failure seems a bit worse than a JS exception. And the fix is pretty easy; just adding an extra "return false" failure case in the JS.)
Flags: needinfo?(dholbert)
Assignee: nobody → dholbert
Status: NEW → ASSIGNED
Posted patch fix v1Splinter Review
Here's the fix. We just need to check the |type| returned by oldGradientParser up-front, and bail if it's unrecognized (or missing).  This prevents us from returning things like "undefined-gradient" or "bogus-gradient" as the gradient-type, so that we can live up to the following documentation about the gradient-type outparam from this function (in nsICSSUnprefixingService.idl):
> 54    * @param   aUnprefixedFuncName[out]
> 55    *          The resulting unprefixed gradient function name:
> 56    *          either "linear-gradient" or "radial-gradient".
Attachment #8694956 - Flags: review?(hsteen)
Attachment #8694956 - Flags: review?(hsteen) → review+
Not sure why I never landed this, but CSSUnprefixingService is now removed in bug 1259348.

Resolving as FIXED by that removal.
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Depends on: 1259348
Resolution: --- → FIXED
Pushed by dholbert@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/df20322db27b
add this bug's testcase as a crashtest. (no review, test-only)
Flags: in-testsuite+
Target Milestone: --- → mozilla54
You need to log in before you can comment on or make changes to this bug.