[webkit-changes] [WebKit/WebKit] 834ac7: jsc_fuz/wktr: RELEASE_ASSERT(!m_count); in WebCore...

[NKRosario]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 834ac739e6035e29f4558a196ba5f4f6e25cf64e
      https://github.com/WebKit/WebKit/commit/834ac739e6035e29f4558a196ba5f4f6e25cf64e
  Author: Nicole Rosario <nicole_rosario at apple.com>
  Date:   2023-11-14 (Tue, 14 Nov 2023)

  Changed paths:
    A LayoutTests/fast/dom/load-offsetWidth-expected.txt
    A LayoutTests/fast/dom/load-offsetWidth.html
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  jsc_fuz/wktr: RELEASE_ASSERT(!m_count); in WebCore::RenderObject::~RenderObject()
https://bugs.webkit.org/show_bug.cgi?id=264828
rdar://117994923

Reviewed by Chris Dumez.

Hitting release assert in CheckedPtr from `~RenderObject()` because `CheckedPtr renderer =
element.renderer()`is outliving the renderer (RenderObject). Limited the scope so it gets
destroyed first.

* LayoutTests/fast/dom/load-offsetWidth-expected.txt: Added.
* LayoutTests/fast/dom/load-offsetWidth.html: Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::updateLayoutIfDimensionsOutOfDate): limited the scope of `CheckedPtr
renderer = element.renderer()` so that it would be destroyed after being used instead of
staying available for the whole method

Canonical link: https://commits.webkit.org/270747@main