RESOLVED FIXED 255956
[1c8922b0f08df135] stack-overflow | WebCore::RenderObject::repaintRectangle; WebCore::RenderObject::repaintRectangle; WebCore::RenderObject::repaintRectangle 
https://bugs.webkit.org/show_bug.cgi?id=255956
Summary [1c8922b0f08df135] stack-overflow | WebCore::RenderObject::repaintRectangle; ...
JC Alvarado
Reported 2023-04-25 15:02:56 PDT
rdar://107953410 Testcase: ======= <style> track:checked,*:scope,.class2+#x33 { open;text-align: center;-webkit-ruby-position: } .class3,#x24,*:read-only { } #x31:not(form),*:last-child { visible;column-span: all;-webkit-padding-start: 0.44;font-variant: normal;hyphens: alpha;border-style: double } *:empty { -0s;position: sticky;mask-size: } .class3:not(#x55) { } #x55,*:nth-child(even) { normal;list-style: url(data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAIAAABt+uBvAAAAAXNSR0IArs4c6QAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9wDGhYvCNVA1EIAAAAZdEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVBXgQ4XAAAAjklEQVR42u3QIQEAMAgAsHNNVspTgARY1BZh0ZWP3VcgSJAgQYIECRKEIEGCBAkSJEgQggQJEiRIkCBBCBIkSJAgQYIECUKQIEGCBAkSJAhBggQJEiRIkCAECRIkSJAgQYIEIUiQIEGCBAkShCBBggQJEiRIEIIECRIkSJAgQYIQJEiQIEGCBAlCkCBBdwaeugIthHvZ+AAAAABJRU5ErkJggg==) disclosure-closed;outline: auto rgb(250,129,67);font-size-adjust: 0;transition-property: auto;-webkit-column-width: 288px;background-image: } </style> <script> function gc() { for(var i=0;i<100;i++) { } } function main() { try { x58.toBlob(f1,"image/jpeg",1); } catch { } try { x2.replaceWith("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); } catch { } } function f0() { try { } catch { } try { document.execCommand("justifyLeft",false,null); } catch { } try { x58.addEventListener("DOMSubtreeModified",f3); } catch { } try { document.execCommand("indent",false,null); } catch { } try { x44.setAttribute("class","class1"); } catch { } try { document.execCommand("justifyRight",false,null); } catch { } try { document.execCommand("insertOrderedList",false,null); } catch { } try { v73 } catch { } try { } catch { } } function f1() { try { document.designMode = "on"; } catch { } try { x32.addEventListener("DOMSubtreeModified",f0); } catch { } try { window.find("AA"); } catch { } try { document.execCommand("insertText",false,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); } catch { } try { x19.click(); } catch { } try { x58.width = 1; } catch { } } function f3() { try { x32.append(x69); } catch { } try { v17 = window.document; } catch { } try { document.execCommand("justifyFull",false,null); } catch { } try { } catch { } try { v17.execCommand("insertOrderedList",false,null); } catch { } try { v17.execCommand("createLink",false,"x"); } catch { } } </script> <body onload="main()"> <span sticky"> </span> <dir slot="foo"> </dir> AAAAAAAAAAAAAAA <blockquote onclick="f3()" hidden="" id="x19" space-between"> <blockquote itemid="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"> </blockquote> <canvas id="x58" spellcheck="false"> </canvas> <samp id="x32" onfocusout="f4()"> <dialog id="x44" itemid="AA"> </blockquote> <object accesskey=""> <track id="x69" contenteditable="false" spellcheck="false"> </dialog> </progress> </marquee> </dialog> <img contextmenu="x54"> <dl id="x2" webkitdropzone="move">
Attachments
Add attachment proposed patch, testcase, etc.
JC Alvarado
Comment 1 2023-04-25 15:15:57 PDT
Pull request: https://github.com/WebKit/WebKit/pull/13172
EWS
Comment 2 2023-04-28 06:51:52 PDT
Committed 263501@main (25d4c61111c5): <https://commits.webkit.org/263501@main> Reviewed commits have been landed. Closing PR #13172 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.