There are a couple of places in the rendering of text inputs with placeholders that assume that if the placeholder is rendered, a renderer for the text must exist too. However this is not the case if ::-webkit-textfield-decoration-controller is set it to display: none; (or possibly other unusual values like display: table-cell;) which hides the text renderer's container. This can be reproduced by adding a placeholder="x" attribute to the input element in the fast/forms/search/search-hide-decoration-container-crash.html layout test. I think at least HTMLTextFormControlElement::fixPlaceholderRenderer and RenderTextControlSingleLine::layout need to be fixed.
Created attachment 193242 [details] Patch
Comment on attachment 193242 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=193242&action=review > Source/WebCore/html/HTMLTextFormControlElement.cpp:176 > return; I wonder if it would be possible to do this renderer swizzle using another layer of Shadow DOM instead of these renderer-level hacks. Shadow DOM could certainly swap the order of a couple of renderers.
Comment on attachment 193242 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=193242&action=review > LayoutTests/fast/forms/search/search-hide-decoration-container-crash.html:11 > -<input type="search"> > +<input type="search" placeholder="x"> Rather than replacing the old test, can we add a second <input> with placeholder?
Created attachment 193493 [details] Patch for CQ
Comment on attachment 193493 [details] Patch for CQ Patch updates test based on reviewer's suggestion.
Comment on attachment 193493 [details] Patch for CQ Rejecting attachment 193493 [details] from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=webkit-commit-queue.appspot.com', '--bot-id=gce-cq-03', 'validate-changelog', '--non-interactive', 193493, '--port=chromium-xvfb']" exit_code: 1 cwd: /mnt/git/webkit-commit-queue /mnt/git/webkit-commit-queue/LayoutTests/ChangeLog neither lists a valid reviewer nor contains the string "Unreviewed" or "Rubber stamp" (case insensitive). Full output: http://webkit-commit-queue.appspot.com/results/17114921
Created attachment 193496 [details] Patch for CQ (with "Reviewed by" this time)
Comment on attachment 193496 [details] Patch for CQ (with "Reviewed by" this time) Clearing flags on attachment: 193496 Committed r146038: <http://trac.webkit.org/changeset/146038>
All reviewed patches have been landed. Closing bug.