Created attachment 282572 [details] Test case showing the null image Certain web content results in the 'cachedImage' member of the HTMLImageElement's Renderer being set to nullptr. The attached test case illustrates this problem. It seems to be related to the specific use of "-webkit-image-set". There might be some relationship between the size of the containing div and the native size of the images used in this test case.
<rdar://problem/27138301>
This markup shows the problem: <div style="width: 572px; height: 572px"> <img id="target" src="resources/test_image.jpg" style="content: -webkit-image-set(url(resources/test_image_1x.jpg) 1x); width: 100%; height: 100%;"> </div>
(In reply to comment #2) > This markup shows the problem: > > <div style="width: 572px; height: 572px"> > <img id="target" src="resources/test_image.jpg" style="content: > -webkit-image-set(url(resources/test_image_1x.jpg) 1x); width: 100%; height: > 100%;"> > </div> The scaling is not needed. This is sufficient to trigger the bug: <!DOCTYPE html> <html> <body> <img src="resources/test_image.jpg" style="content: -webkit-image-set(url(resources/test_image_1x.jpg) 1x); width: 100%; height: 100%;"> </body> </html>
I think this might only happen when you have an "image-set" that only contains a 1x image, and you attempt to do the copy on a retina system.
Is this actually a crash?
(In reply to comment #5) > Is this actually a crash? Yes, although I fixed the specific crash that caused me to notice this problem in Bug 159288. Now we do not crash, but attempts to copy the image result in a blank pasteboard buffer.