287905 2025-02-18 15:55:11 -0800 Flatenning may be triggered before tree is connected, and the function crashes when reaching a non-connected parent. 2025-05-07 12:45:14 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 pvarangot webkit-unassigned webkit-bug-importer oldest_to_newest 2095646 0 pvarangot 2025-02-18 15:55:11 -0800 This requires some specific timing/layout like in this test: <html> <head> <style> .class7 { perspective: 0px; } :not(.active) { grid; white-space-collapse: preserve-breaks; container: a0 / inline-size; -webkit-mask-box-image: url(); } </style> <script> function runTest() { body = document.body; body.style.setProperty("border-bottom-width", "thin"); something = document.elementFromPoint(0, 0); htmlElement = document.documentElement; htmlElement.append(body); testRunner?.dumpAsText(); testRunner?.notifyDone(); } testRunner?.waitUntilDone(); </script> </head> <body onload=runTest()> <title>Title</title> <p>This test passes if webkit doesn't crash</p> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <form class="class7"> <keygen /> </form> <br /> <br /> <br /> <br /> </body> </html> 2095649 1 pvarangot 2025-02-18 15:59:46 -0800 <rdar://problem/143296083> 2095897 2 ap 2025-02-19 09:35:44 -0800 https://github.com/WebKit/WebKit/pull/40805 2096656 3 ews-feeder 2025-02-21 00:19:15 -0800 Committed 290774@main (4810d0915bd9): <https://commits.webkit.org/290774@main> Reviewed commits have been landed. Closing PR #40805 and removing active labels. 2115692 4 ews-feeder 2025-05-07 12:45:14 -0700 Committed 289651.483@safari-7621-branch (43b00d11a701): <https://commits.webkit.org/289651.483@safari-7621-branch> Reviewed commits have been landed. Closing PR #3057 and removing active labels.