Bug 255956

Summary: [1c8922b0f08df135] stack-overflow | WebCore::RenderObject::repaintRectangle; WebCore::RenderObject::repaintRectangle; WebCore::RenderObject::repaintRectangle
Product: WebKit Reporter: JC Alvarado <joncarlo>
Component: Layout and RenderingAssignee: JC Alvarado <joncarlo>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description JC Alvarado 2023-04-25 15:02:56 PDT 
rdar://107953410

Testcase:
=======

<style>
track:checked,*:scope,.class2+#x33 { open;text-align: center;-webkit-ruby-position: }
.class3,#x24,*:read-only { }
#x31:not(form),*:last-child { visible;column-span: all;-webkit-padding-start: 0.44;font-variant: normal;hyphens: alpha;border-style: double }
*:empty { -0s;position: sticky;mask-size: }
.class3:not(#x55) { }
#x55,*:nth-child(even) { normal;list-style: url(data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAIAAABt+uBvAAAAAXNSR0IArs4c6QAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9wDGhYvCNVA1EIAAAAZdEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVBXgQ4XAAAAjklEQVR42u3QIQEAMAgAsHNNVspTgARY1BZh0ZWP3VcgSJAgQYIECRKEIEGCBAkSJEgQggQJEiRIkCBBCBIkSJAgQYIECUKQIEGCBAkSJAhBggQJEiRIkCAECRIkSJAgQYIEIUiQIEGCBAkShCBBggQJEiRIEIIECRIkSJAgQYIQJEiQIEGCBAlCkCBBdwaeugIthHvZ+AAAAABJRU5ErkJggg==) disclosure-closed;outline: auto rgb(250,129,67);font-size-adjust: 0;transition-property: auto;-webkit-column-width: 288px;background-image: }
</style>
<script>
function gc() {
 for(var i=0;i<100;i++) {
 }
}
function main() {
try { x58.toBlob(f1,"image/jpeg",1); } catch { }
try { x2.replaceWith("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); } catch { }
}
function f0() {
try { } catch { }
try { document.execCommand("justifyLeft",false,null); } catch { }
try { x58.addEventListener("DOMSubtreeModified",f3); } catch { }
try { document.execCommand("indent",false,null); } catch { }
try { x44.setAttribute("class","class1"); } catch { }
try { document.execCommand("justifyRight",false,null); } catch { }
try { document.execCommand("insertOrderedList",false,null); } catch { }
try { v73 } catch { }
try { } catch { }
}
function f1() {
try { document.designMode = "on"; } catch { }
try { x32.addEventListener("DOMSubtreeModified",f0); } catch { }
try { window.find("AA"); } catch { }
try { document.execCommand("insertText",false,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); } catch { }
try { x19.click(); } catch { }
try { x58.width = 1; } catch { }
}
function f3() {
try { x32.append(x69); } catch { }
try { v17 = window.document; } catch { }
try { document.execCommand("justifyFull",false,null); } catch { }
try { } catch { }
try { v17.execCommand("insertOrderedList",false,null); } catch { }
try { v17.execCommand("createLink",false,"x"); } catch { }
}
</script>
<body onload="main()">
<span sticky">
</span>
<dir slot="foo">
</dir>
AAAAAAAAAAAAAAA
<blockquote onclick="f3()" hidden="" id="x19" space-between">
<blockquote itemid="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA">
</blockquote>
<canvas id="x58" spellcheck="false">
</canvas>
<samp id="x32" onfocusout="f4()">
<dialog id="x44" itemid="AA">
</blockquote>
<object accesskey="">
<track id="x69" contenteditable="false" spellcheck="false">
</dialog>
</progress>
</marquee>
</dialog>
<img contextmenu="x54">
<dl id="x2" webkitdropzone="move">
Comment 1 JC Alvarado 2023-04-25 15:15:57 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/13172
Comment 2 EWS 2023-04-28 06:51:52 PDT 
Committed 263501@main (25d4c61111c5): <https://commits.webkit.org/263501@main>

Reviewed commits have been landed. Closing PR #13172 and removing active labels.