Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6a802affc4a59dcaad42ea26824b18d191c514d9
https://github.com/WebKit/WebKit/commit/6a802affc4a59dcaad42ea26824b18d191c514d9
Author: Alan Baradlay <[email protected]>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
A
LayoutTests/fast/css/pseudo-element-text-transform-invalidation-crash-expected.txt
A LayoutTests/fast/css/pseudo-element-text-transform-invalidation-crash.html
M Source/WebCore/rendering/RenderText.cpp
Log Message:
-----------
REGRESSION(311201@main): Crash when loading drafts.csswg.org/css-grid-3
https://bugs.webkit.org/show_bug.cgi?id=313610
rdar://175790849
Reviewed by Antti Koivisto.
If two text nodes in the same block both get a
text-transform change in the same render tree update (e.g. both ::before
and ::after pseudo-elements), the first call clears the inline layout
and the second call enters the function (layout path is still set),
walks the children, and dereferences the now-null inline layout pointer
when it encounters an out-of-flow element - crash.
The fix adds a null check for inlineLayout() before calling
invalidateLineLayout, matching how the rest of the codebase guards this call.
*
LayoutTests/fast/css/pseudo-element-text-transform-invalidation-crash-expected.txt:
Added.
* LayoutTests/fast/css/pseudo-element-text-transform-invalidation-crash.html:
Added.
* Source/WebCore/rendering/RenderText.cpp:
(WebCore::RenderText::updateRenderedText):
Canonical link: https://commits.webkit.org/312278@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
