[Webkit-unassigned] [Bug 280336] New: Safari crashes when using nested grid layout, subgrid and areas

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=280336

            Bug ID: 280336
           Summary: Safari crashes when using nested grid layout, subgrid
                    and areas
           Product: WebKit
           Version: Safari 17
          Hardware: Mac (Apple Silicon)
                OS: macOS 14
            Status: NEW
          Severity: Critical
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ncardeli at gmail.com
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

Created attachment 472677

  --> https://bugs.webkit.org/attachment.cgi?id=472677&action=review

Crash reporter log

A combination of nested grids, subgrid and grid areas crashes Safari but will work in Chrome and Firefox.

To reproduce, use the following HTML/CSS:

<div class="BlockStack">
  <div class="MoneyLine">
    <div class="Header">first cell</div>
    <div class="Content">second cell</div>
  </div>
</div>

<style>
.BlockStack {
  display: grid;
}

.MoneyLine {
  display: grid;
  grid-template-columns: subgrid;
  grid-template-areas: 'header content';
}

.Header {
  grid-area: header;
}

.Content {
  grid-area: content;
}
</style>

Expected result: Safari renders the HTML with the specified formatting.
Actual result: Safari crashes.

Version information: Version 17.6 (19618.3.11.11.5)
OS: MacOS 14.6.1 (23G93)


Here's a CodePen: https://codepen.io/ncardeli/pen/YzmPEWv

I found that adding grid-column: span 2; to the .MoneyLine class it doesn't crash anymore.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240925/9636c5ad/attachment-0001.htm>