1691652 - Consistent crash from CSS with percentages in linear-gradient

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Daniel Wang]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:85.0) Gecko/20100101 Firefox/85.0

Steps to reproduce:

1. Load this one-liner html file:

<style> body { background: linear-gradient(black calc(0% * (1e39 - 1e39)), black 0%); } </style>

2. The page crashes

Actual results:

I get sent to the Tab crash reporter on load

Expected results:

I should see a empty document with black background

Comment 1

[Daniel Wang]

I should add that I found this while playing with that CSS double truncating hack: https://stackoverflow.com/a/64921523

It really feels like an edge case in the CSS! It doesn't crash unless you multiply with a percent (0% * ...) and it doesn't crash if the big number is any smaller, like 1e38 - 1e38.

Comment 2

[Daniel Wang]

(In reply to Daniel Wang from comment #1)

I should add that I found this while playing with that CSS double truncating hack: https://stackoverflow.com/a/64921523

It really feels like an edge case in the CSS! It doesn't crash unless you multiply with a percent (0% * ...) and it doesn't crash if the big number is any smaller, like 1e38 - 1e38.

Comment 3

[Mayank Bansal]

Can repro this crash

https://crash-stats.mozilla.org/report/index/2e4988a3-1fb3-4171-a0cb-123770210209#tab-bugzilla

Comment 4

[Mayank Bansal]

Attachment: testcase.html

Comment 5

[Mayank Bansal]

I get a crash with HW-WR, SW-WR, and Basic
With Direct3d11, I get a black tab, but no crash

Comment 6

[Emilio Cobos Álvarez (:emilio)]

1e39 - 1e39 ends up being std::f32::INFINITY + -1.0 * std::f32::INFINITY, which is NaN, and when we multiply 0% times that is NaN, so we end up passing that `NaN all the way down to rendering.

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1691652 - Normalize NaN to zero as a result of calc(). r=#style,#layout-reviewers

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1691652 - Don't require a spec link for crashtests under css/. r=jgraham

The only purpose of a crashtest is not crashing, there's no great spec
link for that.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0679e32a0faf
Don't require a spec link for crashtests under css/. r=jgraham

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/27558 for changes under testing/web-platform/tests

Comment 11

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/0679e32a0faf

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/64e2b89ff57f
Normalize NaN to zero as a result of calc(). r=layout-reviewers,jfkthame

Comment 13

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/64e2b89ff57f

Comment 14

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9202117 [details]
Bug 1691652 - Normalize NaN to zero as a result of calc(). r=#style,#layout-reviewers

Beta/Release Uplift Approval Request

• User impact if declined: Crashes when large CSS values are used. Blocks bug 1682607 too.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Handle floating point edge cases earlier to avoid making WR sad.
• String changes made/needed: none

Comment 15

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 16

[Pascal Chevrel:pascalc]

Comment on attachment 9202117 [details]
Bug 1691652 - Normalize NaN to zero as a result of calc(). r=#style,#layout-reviewers

Approved for our last beta, thanks.

Comment 17

[Julien Cristau [:jcristau] (back August 18)]

https://hg.mozilla.org/releases/mozilla-beta/rev/dc6b23c1b8b1
https://hg.mozilla.org/releases/mozilla-beta/rev/a9358e648e8f