RESOLVED FIXED 240795
REGRESSION (r294291): Another nullptr crash with ::first-letter 
https://bugs.webkit.org/show_bug.cgi?id=240795
Summary REGRESSION (r294291): Another nullptr crash with ::first-letter
Antti Koivisto
Reported 2022-05-23 05:40:49 PDT
<style> html::first-letter { width: 0; } </style> <script> onload = () => { document.execCommand('SelectAll'); document.body.append('aa'); document.documentElement.append(''); document.body.offsetTop; document.body.style.overflow = 'clip'; }; </script>
Attachments
Patch (5.46 KB, patch)
2022-05-23 05:51 PDT, Antti Koivisto 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Antti Koivisto
Comment 1 2022-05-23 05:41:04 PDT
rdar://93645746
Antti Koivisto
Comment 2 2022-05-23 05:51:57 PDT
Created attachment 459671 [details] Patch
EWS
Comment 3 2022-05-23 11:20:19 PDT
Found 3 new test failures: webgl/2.0.0/conformance2/textures/image_bitmap_from_image_bitmap/tex-2d-r16f-red-half_float.html, webgl/2.0.0/conformance2/textures/image_bitmap_from_image_bitmap/tex-3d-r32f-red-float.html, webgl/2.0.0/conformance2/textures/image_bitmap_from_image_bitmap/tex-3d-rgba4-rgba-unsigned_short_4_4_4_4.html
EWS
Comment 4 2022-05-23 23:00:57 PDT
Committed r294736 (250908@main): <https://commits.webkit.org/250908@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 459671 [details].
Rob Buis
Comment 5 2022-06-22 04:41:13 PDT
*** Bug 241555 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.