Modified: trunk/LayoutTests/ChangeLog (199427 => 199428)
--- trunk/LayoutTests/ChangeLog 2016-04-13 08:36:01 UTC (rev 199427)
+++ trunk/LayoutTests/ChangeLog 2016-04-13 08:37:54 UTC (rev 199428)
@@ -1,3 +1,17 @@
+2016-04-12 Antti Koivisto <[email protected]>
+
+ Crash at com.apple._javascript_Core: bool WTF::startsWith<WTF::StringImpl, WTF::StringImpl> + 8
+ https://bugs.webkit.org/show_bug.cgi?id=156512
+ rdar://problem/24220567
+
+ Reviewed by Benjamin Poulain.
+
+ Land a test that verifies that setting attr to null does not crash with attribute selectors.
+ This was fixed by http://trac.webkit.org/changeset/199392.
+
+ * fast/css/attribute-selector-null-crash-expected.html: Added.
+ * fast/css/attribute-selector-null-crash.html: Added.
+
2016-04-12 Mark Lam <[email protected]>
Rollout: ES6: Implement String.prototype.split and RegExp.prototype[@@split].
Added: trunk/LayoutTests/fast/css/attribute-selector-null-crash.html (0 => 199428)
--- trunk/LayoutTests/fast/css/attribute-selector-null-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/attribute-selector-null-crash.html 2016-04-13 08:37:54 UTC (rev 199428)
@@ -0,0 +1,34 @@
+<style>
+[myAttr] { background: white; }
+[myAttr="test"] { background: rgb(1,0,0); }
+[myAttr~="test"] { background: rgb(2,0,0); }
+[myAttr|="test"] { background: rgb(3,0,0); }
+[myAttr^="test"] { background: rgb(4,0,0); }
+[myAttr$="test"] { background: rgb(5,0,0); }
+[myAttr*="test"] { background: rgb(6,0,0); }
+[myAttr="test" i] { background: rgb(7,0,0); }
+[myAttr~="test" i] { background: rgb(8,0,0); }
+[myAttr|="test" i] { background: rgb(9,0,0); }
+[myAttr^="test" i] { background: rgb(10,0,0); }
+[myAttr$="test" i] { background: rgb(11,0,0); }
+[myAttr*="test" i] { background: rgb(12,0,0); }
+[color] { background: white; }
+[color="test"] { background: rgb(1,0,0); }
+[color~="test"] { background: rgb(2,0,0); }
+[color|="test"] { background: rgb(3,0,0); }
+[color^="test"] { background: rgb(4,0,0); }
+[color$="test"] { background: rgb(5,0,0); }
+[color*="test"] { background: rgb(6,0,0); }
+[color="test" i] { background: rgb(7,0,0); }
+[color~="test" i] { background: rgb(8,0,0); }
+[color|="test" i] { background: rgb(9,0,0); }
+[color^="test" i] { background: rgb(10,0,0); }
+[color$="test" i] { background: rgb(11,0,0); }
+[color*="test" i] { background: rgb(12,0,0); }
+</style>
+<div myAttr="" color="" id="test">This test passes if it doesn't crash.</div>
+<script>
+document.querySelector("#test").attributes.myAttr.value = null;
+// 'color' attribute is HTML legacy case sensitive.
+document.querySelector("#test").attributes.color.value = null;
+</script>
