RESOLVED FIXED308649
Crash when using `shape-outside: shape(...)` 
https://bugs.webkit.org/show_bug.cgi?id=308649
Summary Crash when using `shape-outside: shape(...)`
Sam Weinig
Reported 2026-02-25 09:55:19 PST
Created attachment 478474 [details] Test case (will crash) All use of `shape-outside: shape(...)` crashes due to RELEASE_ASSERT_NOT_REACHED in LayoutShape::createShape(). See attachment for test case.
Attachments
Test case (will crash) (92 bytes, text/html)
2026-02-25 09:55 PST, Sam Weinig 		no flags
Details
Test case (will crash) (150 bytes, text/html)
2026-02-25 10:39 PST, Sam Weinig 		no flags
Details
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Sam Weinig
Comment 1 2026-02-25 10:01:59 PST
I'm guessing I accidentally turned this from a debug only crash to a release crash in 285966@main. Probably want to extend the check in the parser that disallows path() for shape-outside, to also disallow shape().
Sam Weinig
Comment 2 2026-02-25 10:26:27 PST
Actually, it would have crashed before then as well, since LayoutShape::create() did `shape.releaseNonNull()` for a null shape.
Sam Weinig
Comment 3 2026-02-25 10:39:22 PST
Created attachment 478476 [details] Test case (will crash)
Sam Weinig
Comment 4 2026-02-25 10:59:49 PST
Pull request: https://github.com/WebKit/WebKit/pull/59434
EWS
Comment 5 2026-02-26 09:02:06 PST
Committed 308286@main (5a21376ccff4): <https://commits.webkit.org/308286@main> Reviewed commits have been landed. Closing PR #59434 and removing active labels.
Radar WebKit Bug Importer
Comment 6 2026-02-26 09:03:12 PST
<rdar://problem/171275455>
Note You need to log in before you can comment on or make changes to this bug.