[Webkit-unassigned] [Bug 224408] Crash in WebCore::SlotAssignment::assignedNodesForSlot

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=224408

--- Comment #11 from Ryosuke Niwa <rniwa at webkit.org> ---
(In reply to Michael Catanzaro from comment #9)
> (In reply to Michael Catanzaro from comment #8)
> > Hm, I tried your reproducer with a build of WebKit trunk from sometime last
> > week. It is *not* fixed.
> 
> Confirmed, r278350 from this morning is still affected so this is definitely
> not resolved.
> 
> I don't know why you were unable to reproduce in Safari 14.2. I guess that
> is Safari Tech Preview? Maybe you're using an older Tech Preview that
> actually doesn't yet have whatever commit introduced this regression, and it
> got backported to 14.1? Dunno.

I can reproduce it in STP124.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210602/a7a7f155/attachment.htm>