[Webkit-unassigned] [Bug 191532] ASSERTION FAILED: !m_embeddedObjectsToUpdate->contains(nullptr) in WebCore::FrameView::updateEmbeddedObjects

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=191532

--- Comment #6 from Jack <shihchieh_lee at apple.com> ---
New test case is reported in <rdar://problem/56695849>, reduced by Simon and Alan.

<style>
body {
    -webkit-writing-mode: vertical-lr;
    -webkit-text-combine: horizontal;
}
::selection {
    color: red;
}
</style>
<script>
    function eventhandler() {
        document.vlinkColor = "red";
        document.createElement("object").style.color = "red";
    }
</script>
<embed src="data:text/plain;" onbeforeload=eventhandler()>foo

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200215/fa1e6d0c/attachment.htm>