The following code crashes with Webkit for me (can be tested on the url above): <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Test</title> <style> body { background: #eee; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-weight: 200; } #wrapper { margin: 150px auto; width: 700px; } .sleeve_main { background: #fff; margin: 0; padding: 100px 40px; border-radius: 8px; } h2:first-line { background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(#EED200), to(#EDBE00)); } </style> </head> <body> <div id="wrapper"> <div class="sleeve_main"> <h2>Quisque facilisis erat a dui. Nam malesuada ornare dolor.</h2> </div> </div> </body> </html>
<rdar://problem/8045778>
The problem here is that we don't go through the normal updateFillImages() code for the :first-line style (which might be a cached pseudostyle), so the image has no reference to its clients, and the CSSValue fails to cache the Image in its hash table, so nothing keeps the Image alive.
The fact that the RenderObject isn't registered as a client of the image in the pseudostyle is also evident in the fact that animated background-images used in :first-line fail to repaint their renderer.
Created attachment 78648 [details] Patch
http://trac.webkit.org/changeset/75585