RESOLVED FIXED294670
CSS TypedOM crash under BuilderFunctions::applyValueTranslate 
https://bugs.webkit.org/show_bug.cgi?id=294670
Summary CSS TypedOM crash under BuilderFunctions::applyValueTranslate
Antti Koivisto
Reported 2025-06-18 05:05:28 PDT
<script> const n2 = document.createElement('div'); document.documentElement.appendChild(n2); n2.attributeStyleMap.set('translate', ...document.documentElement.computedStyleMap().getAll('border-image-slice')); </script>
Attachments
Add attachment proposed patch, testcase, etc.
Antti Koivisto
Comment 1 2025-06-18 05:05:45 PDT
rdar://146650025
Antti Koivisto
Comment 2 2025-06-18 11:13:23 PDT
Pull request: https://github.com/WebKit/WebKit/pull/46917
EWS
Comment 3 2025-06-23 13:03:10 PDT
Committed 296528@main (00b74e1a7b8c): <https://commits.webkit.org/296528@main> Reviewed commits have been landed. Closing PR #46917 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.