RESOLVED FIXED309558
Add crash test for bug 308359 
https://bugs.webkit.org/show_bug.cgi?id=309558
Summary Add crash test for bug 308359
Frédéric Wang Nélar
Reported 2026-03-10 01:30:22 PDT
This was crashing on main before https://commits.webkit.org/308356@main landed: <!DOCTYPE html> <style> select { flex-direction: column; } button { float: left; } </style> <select id="select"></select> <script> window.testRunner?.dumpAsText(); window.testRunner?.waitUntilDone(); select.appendChild(document.createElement("button")); document.body.scrollLeft; select.options.add(document.createElement("option")); document.body.scrollLeft; document.body.innerHTML = "PASS if no crashes."; window.testRunner?.notifyDone(); </script> Initially I tried fixing it via https://github.com/WebKit/WebKit/pull/59501 ; but that's no longer necessary.
Attachments
Add attachment proposed patch, testcase, etc.
Frédéric Wang Nélar
Comment 1 2026-03-10 03:55:20 PDT
Pull request: https://github.com/WebKit/WebKit/pull/60259
EWS
Comment 2 2026-03-11 02:11:46 PDT
Committed 309046@main (733945bf30e9): <https://commits.webkit.org/309046@main> Reviewed commits have been landed. Closing PR #60259 and removing active labels.
Ryan Haddad
Comment 3 2026-03-12 13:58:16 PDT
rdar://172261674
Radar WebKit Bug Importer
Comment 4 2026-03-12 13:58:23 PDT
<rdar://problem/172409551>
Note You need to log in before you can comment on or make changes to this bug.