Created attachment 63895 [details] Repro The following code triggers a NULL ptr in Chromium latest: <html> <head> <style> :before{ content:"" }; </style> </head> <body onload="document.linkColor=0;"> <ruby> <rt></rt> </ruby> </body> </html> id: WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks ReadAV@NULL (8861963c2158cde00d41e1ee9baea2f1) description: Attempt to read from NULL pointer (+0xC) in WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks signatures: Function: WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks Basic signature: WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks(...)-2D824F8 stack: WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks WebCore::RenderBlock::addChildIgnoringContinuation WebCore::RenderBlock::addChild WebCore::RenderRubyRun::addChild WebCore::RenderRubyAsInline::addChild WebCore::RenderObjectChildList::updateBeforeAfterContent WebCore::RenderInline::styleDidChange WebCore::RenderObject::setStyle WebCore::RenderObject::setAnimatableStyle WebCore::Node::setRenderStyle WebCore::Element::recalcStyle WebCore::Element::recalcStyle WebCore::Element::recalcStyle WebCore::Document::recalcStyle WebCore::StyledElement::attributeChanged WebCore::NamedNodeMap::addAttribute WebCore::Element::setAttribute WebCore::Element::setAttribute WebCore::HTMLBodyElement::setLink WebCore::HTMLDocument::setLinkColor WebCore::HTMLDocumentInternal::linkColorAttrSetter v8::internal::JSObject::SetPropertyWithCallback v8::internal::JSObject::SetProperty v8::internal::JSObject::SetPropertyPostInterceptor v8::internal::JSObject::SetPropertyWithInterceptor v8::internal::JSObject::SetProperty v8::internal::JSObject::SetProperty v8::internal::StoreIC::Store v8::internal::StoreIC_Miss v8::internal::Invoke v8::internal::Execution::Call ... During fuzzzing, I have seen NULL ptr crashes two levels up the stack as well, in Renderblock::AddChild. I expect the cause is the same.
Created attachment 63911 [details] Patch (review carefully)
I'm not sure who does ruby stuff.
Roland, any comments?
Comment on attachment 63911 [details] Patch (review carefully) Clearing flags on attachment: 63911 Committed r66371: <http://trac.webkit.org/changeset/66371>
All reviewed patches have been landed. Closing bug.
<rdar://problem/8375382>
Whoa, this bug thread completely sneaked by me, sorry about that! :( FWIW, I think the patch is fine. My recently r+'d patch for https://bugs.webkit.org/show_bug.cgi?id=41040 (not yet landed) also concerns :before/:after content. AFAICT it will subsume this patch once merged and landed.