[webkit-changes] [WebKit/WebKit] ec2d23: Regression(269372 at main) Crash under SVGPathElement...

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ec2d23a0902a7c2e65afbd221a275ce3040b9e1c
      https://github.com/WebKit/WebKit/commit/ec2d23a0902a7c2e65afbd221a275ce3040b9e1c
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2023-10-19 (Thu, 19 Oct 2023)

  Changed paths:
    A LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure-expected.txt
    A LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure.html
    M Source/WebCore/svg/SVGPathElement.cpp

  Log Message:
  -----------
  Regression(269372 at main) Crash under SVGPathElement::attributeChanged() after memory pressure
https://bugs.webkit.org/show_bug.cgi?id=263381
rdar://117176058

Reviewed by Said Abou-Hallawa.

We were failing to reset pathSegListCacheSize to 0 after clearing the cache. As a result,
SVGPathElement::attributeChanged() could get in a state where pathSegListCacheSize becomes
greater than maxPathSegListCacheSize even though the cache map is empty. As a result, we
would try to remove `cache.random()` which returns `cache.end()` when the cache is empty.

I also moved the caching logic to a new class for better insulation / clarity.

* LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure-expected.txt: Added.
* LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure.html: Added.
* Source/WebCore/svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::attributeChanged):
(WebCore::SVGPathElement::clearCache):

Canonical link: https://commits.webkit.org/269547@main