Bug 240795

Summary: REGRESSION (r294291): Another nullptr crash with ::first-letter
Product: WebKit Reporter: Antti Koivisto <koivisto>
Component: Layout and RenderingAssignee: Antti Koivisto <koivisto>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, changseok, esprehn+autocc, ews-watchlist, glenn, kondapallykalyan, msaboff, pdr, simon.fraser, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Description Antti Koivisto 2022-05-23 05:40:49 PDT 
<style>
  html::first-letter {
    width: 0;
  }
</style>
<script>
  onload = () => {
    document.execCommand('SelectAll');
    document.body.append('aa');
    document.documentElement.append('');
    document.body.offsetTop;
    document.body.style.overflow = 'clip';
  };
</script>
Comment 1 Antti Koivisto 2022-05-23 05:41:04 PDT 
rdar://93645746
Comment 2 Antti Koivisto 2022-05-23 05:51:57 PDT 
Created attachment 459671 [details]
Patch
Comment 3 EWS 2022-05-23 11:20:19 PDT 
Found 3 new test failures: webgl/2.0.0/conformance2/textures/image_bitmap_from_image_bitmap/tex-2d-r16f-red-half_float.html, webgl/2.0.0/conformance2/textures/image_bitmap_from_image_bitmap/tex-3d-r32f-red-float.html, webgl/2.0.0/conformance2/textures/image_bitmap_from_image_bitmap/tex-3d-rgba4-rgba-unsigned_short_4_4_4_4.html
Comment 4 EWS 2022-05-23 23:00:57 PDT 
Committed r294736 (250908@main): <https://commits.webkit.org/250908@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 459671 [details].
Comment 5 Rob Buis 2022-06-22 04:41:13 PDT 
*** Bug 241555 has been marked as a duplicate of this bug. ***