Bug 308649

Summary:

Crash when using `shape-outside: shape(...)`

Product:

WebKit

Reporter:

Sam Weinig <sam>

Component:

New Bugs

Assignee:

Sam Weinig <sam>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

Safari 18

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Test case (will crash)	none
Test case (will crash)	none

Sam Weinig

Reported 2026-02-25 09:55:19 PST

Created attachment 478474 [details] Test case (will crash) All use of `shape-outside: shape(...)` crashes due to RELEASE_ASSERT_NOT_REACHED in LayoutShape::createShape(). See attachment for test case.

Attachments
Test case (will crash) (92 bytes, text/html) 2026-02-25 09:55 PST, Sam Weinig	no flags	Details
Test case (will crash) (150 bytes, text/html) 2026-02-25 10:39 PST, Sam Weinig	no flags	Details
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Sam Weinig

Comment 1 2026-02-25 10:01:59 PST

I'm guessing I accidentally turned this from a debug only crash to a release crash in 285966@main. Probably want to extend the check in the parser that disallows path() for shape-outside, to also disallow shape().

Sam Weinig

Comment 2 2026-02-25 10:26:27 PST

Actually, it would have crashed before then as well, since LayoutShape::create() did `shape.releaseNonNull()` for a null shape.

Sam Weinig

Comment 3 2026-02-25 10:39:22 PST

Created attachment 478476 [details] Test case (will crash)

Sam Weinig

Comment 4 2026-02-25 10:59:49 PST

Pull request: https://github.com/WebKit/WebKit/pull/59434

EWS

Comment 5 2026-02-26 09:02:06 PST

Committed 308286@main (5a21376ccff4): <https://commits.webkit.org/308286@main> Reviewed commits have been landed. Closing PR #59434 and removing active labels.

Radar WebKit Bug Importer

Comment 6 2026-02-26 09:03:12 PST

<rdar://problem/171275455>

Note You need to log in before you can comment on or make changes to this bug.