[webkit-changes] [WebKit/WebKit] 4a9d1a: Crash in GraphicsLayerCA::computeVisibleAndCoverag...

[Simon Fraser]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 4a9d1a52a38c2feda07d32b7ec9790ef7a690b20
      https://github.com/WebKit/WebKit/commit/4a9d1a52a38c2feda07d32b7ec9790ef7a690b20
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2023-07-31 (Mon, 31 Jul 2023)

  Changed paths:
    M Source/WebCore/page/mac/ServicesOverlayController.mm
    M Source/WebCore/platform/mac/DataDetectorHighlight.h
    M Source/WebCore/platform/mac/DataDetectorHighlight.mm

  Log Message:
  -----------
  Crash in GraphicsLayerCA::computeVisibleAndCoverageRect() caused by data detector highlights
https://bugs.webkit.org/show_bug.cgi?id=257684
rdar://105900355

Reviewed by Aditya Keerthi.

It was possible for ServicesOverlayController to delete a DataDetectorHighlight, but leave its GraphicsLayer
parented in the page overlay, so the GraphicsLayer client() was deleted.

Fix by having the DataDetectorHighlight's destructor call invalidate(), which unparents the layer. The
ServicesOverlayController destructor no longer needs to explicitly call invalidate().

I attempted for several hours to make an API test for this, but was unable.

* Source/WebCore/page/mac/ServicesOverlayController.mm:
(WebCore::ServicesOverlayController::~ServicesOverlayController): Deleted.
* Source/WebCore/platform/mac/DataDetectorHighlight.h:
* Source/WebCore/platform/mac/DataDetectorHighlight.mm:
(WebCore::DataDetectorHighlight::~DataDetectorHighlight):

Originally-landed-as: 259548.817 at safari-7615-branch (9abef45e45a6). rdar://105900355
Canonical link: https://commits.webkit.org/266434@main