261421 2023-09-11 11:41:25 -0700 REGRESSION(267280@main): costco.com crash in WebCore::ShorthandSerializer::serializeGridTemplate const 2023-09-25 11:45:40 -0700 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://github.com/web-platform-tests/wpt/pull/41946 InRadar P2 Normal --- 1 sgill26 sgill26 w0nka webkit-bug-importer oldest_to_newest 1976868 0 467643 sgill26 2023-09-11 11:41:25 -0700 Created attachment 467643 Testcase Costco's checkout page uses element.TextContent = "" and this ends up disconnecting some nodes from the tree. When the ShorthandSerializer tries to get the value for each of the longhands of grid-template, the ComputedStyleExtractor is unable to resolve the RenderStyle to use via computeRenderStyleForProperty and returns nullptr for the longhand value. This results in a hard nullptr deref ShorthandSerializer::longhandValue 1976869 1 sgill26 2023-09-11 11:42:15 -0700 rdar://115046351 1976870 2 sgill26 2023-09-11 11:54:04 -0700 Pull request: https://github.com/WebKit/WebKit/pull/17661 1977136 3 sgill26 2023-09-12 14:10:09 -0700 Submitted web-platform-tests pull request: https://github.com/web-platform-tests/wpt/pull/41946 1977502 4 ews-feeder 2023-09-14 09:19:48 -0700 Committed 267989@main (7d7be769ce2d): <https://commits.webkit.org/267989@main> Reviewed commits have been landed. Closing PR #17661 and removing active labels. 1979886 5 sgill26 2023-09-25 11:45:40 -0700 *** Bug 261760 has been marked as a duplicate of this bug. *** 467643 2023-09-11 11:41:25 -0700 2023-09-11 11:41:25 -0700 Testcase costco-reduced.html text/html 453 sgill26 PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8c3R5bGU+CiNjb250YWluZXIgewogIHdpZHRoOiA1MHB4 OwogIGhlaWdodDogNTBweDsKICBib3JkZXI6IDFweCBzb2xpZCBibGFjazsKfQoKI2NoaWxkIHsK ICB3aWR0aDogMTBweDsKICBoZWlnaHQ6IDEwcHg7CiAgYmFja2dyb3VuZC1jb2xvcjogZ3JlZW47 CiAgZ3JpZC10ZW1wbGF0ZTogMTBweCAvIDEwcHg7Cn0KPC9zdHlsZT4KCjxkaXYgaWQ9ImNvbnRh aW5lciI+CiAgPGRpdiBpZD0iY2hpbGQiPjwvZGl2Pgo8L2Rpdj4KCjxzY3JpcHQ+CmxldCBzdHls ZT0gd2luZG93LmdldENvbXB1dGVkU3R5bGUoZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNoaWxk IikpOwpkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29udGFpbmVyIikudGV4dENvbnRlbnQgPSAi IjsKY29uc29sZS5sb2coc3R5bGUuZ3JpZFRlbXBsYXRlKTsKPC9zY3JpcHQ+Cgo8L2h0bWw+