[webkit-changes] [WebKit/WebKit] 8195fa: Regression: Mac Buddy crashes after sign in

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 8195fa48866243eab439676fdb43c25e0b65e5f6
      https://github.com/WebKit/WebKit/commit/8195fa48866243eab439676fdb43c25e0b65e5f6
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2024-02-21 (Wed, 21 Feb 2024)

  Changed paths:
    M Source/WebCore/css/query/GenericMediaQueryTypes.h
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/EventPath.cpp
    M Source/WebCore/dom/Node.h
    M Source/WebCore/dom/ShadowRoot.cpp
    M Source/WebCore/dom/ShadowRoot.h
    M Source/WebCore/dom/ShouldNotFireMutationEventsScope.h
    M Source/WebCore/dom/TreeScope.cpp
    M Source/WebCore/dom/TreeScope.h
    M Source/WebCore/html/parser/HTMLDocumentParserFastPath.cpp
    M Source/WebCore/rendering/svg/SVGResources.cpp
    M Source/WebCore/style/StyleScope.cpp
    M Source/WebCore/style/StyleScope.h
    M Source/WebCore/svg/SVGElement.cpp
    M Source/WebCore/svg/SVGTextPathElement.cpp

  Log Message:
  -----------
  Regression: Mac Buddy crashes after sign in
https://bugs.webkit.org/show_bug.cgi?id=269824
rdar://123037271

Reviewed by Ryosuke Niwa and Brent Fulgham.

The crash seems to be caused by a CheckedPtr / CheckedRef pointing to
a Document upon destruction. We've stopped using CheckedPtr / CheckedRef
for Nodes already but it was still in use for Document.

To address the issue, revert the CheckedPtr / CheckedRef adoption for
Document in order to get back in a good state. In a follow-up, we should
work on adopting more smart pointers (ideally WeakPtr / WeakRef).

* Source/WebCore/css/query/GenericMediaQueryTypes.h:
* Source/WebCore/dom/Document.h:
* Source/WebCore/dom/EventPath.cpp:
(WebCore::EventPath::setRelatedTarget):
(WebCore::RelatedNodeRetargeter::RelatedNodeRetargeter):
* Source/WebCore/dom/Node.h:
* Source/WebCore/dom/ShadowRoot.cpp:
* Source/WebCore/dom/ShadowRoot.h:
* Source/WebCore/dom/ShouldNotFireMutationEventsScope.h:
* Source/WebCore/dom/TreeScope.cpp:
(WebCore::TreeScope::ref const):
(WebCore::TreeScope::deref const):
(WebCore::TreeScope::incrementPtrCount const): Deleted.
(WebCore::TreeScope::decrementPtrCount const): Deleted.
* Source/WebCore/dom/TreeScope.h:
* Source/WebCore/html/parser/HTMLDocumentParserFastPath.cpp:
(WebCore::HTMLFastPathParser::parseChildren):
(WebCore::HTMLFastPathParser::parseElementAfterTagName):
* Source/WebCore/rendering/svg/SVGResources.cpp:
(WebCore::SVGResources::buildCachedResources):
* Source/WebCore/style/StyleScope.cpp:
(WebCore::Style::Scope::createDocumentResolver):
(WebCore::Style::Scope::releaseMemory):
(WebCore::Style::Scope::didRemovePendingStylesheet):
(WebCore::Style::Scope::addStyleSheetCandidateNode):
(WebCore::Style::Scope::collectActiveStyleSheets):
(WebCore::Style::Scope::updateActiveStyleSheets):
(WebCore::Style::Scope::invalidateStyleAfterStyleSheetChange):
(WebCore::Style::Scope::activeStyleSheetsForInspector):
(WebCore::Style::Scope::flushPendingDescendantUpdates):
(WebCore::Style::Scope::scheduleUpdate):
(WebCore::Style::Scope::collectResolverScopes):
(WebCore::Style::Scope::didChangeStyleSheetEnvironment):
(WebCore::Style::Scope::didChangeViewportSize):
(WebCore::Style::Scope::invalidateMatchedDeclarationsCache):
(WebCore::Style::Scope::pendingUpdateTimerFired):
(WebCore::Style::Scope::documentScope):
(WebCore::Style::Scope::updateQueryContainerState):
* Source/WebCore/style/StyleScope.h:
* Source/WebCore/svg/SVGElement.cpp:
(WebCore::SVGElement::buildPendingResourcesIfNeeded):
* Source/WebCore/svg/SVGTextPathElement.cpp:
(WebCore::SVGTextPathElement::buildPendingResource):

Canonical link: https://commits.webkit.org/275125@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications