[webkit-changes] [WebKit/WebKit] 867fd6: Background tabs often crash (null deref) under Dyn...

[Tim Horton]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 867fd6815a00b9b273ba4d9d0ed1c55e340d00dc
      https://github.com/WebKit/WebKit/commit/867fd6815a00b9b273ba4d9d0ed1c55e340d00dc
  Author: Tim Horton <timothy_horton at apple.com>
  Date:   2024-01-08 (Mon, 08 Jan 2024)

  Changed paths:
    M Source/WebKit/Shared/RemoteLayerTree/DynamicContentScalingBifurcatedImageBuffer.mm

  Log Message:
  -----------
  Background tabs often crash (null deref) under DynamicContentScalingBifurcatedImageBuffer::dynamicContentScalingDisplayList()
https://bugs.webkit.org/show_bug.cgi?id=267246
rdar://120001661

Reviewed by Richard Robinson and Wenson Hsieh.

* Source/WebKit/Shared/RemoteLayerTree/DynamicContentScalingBifurcatedImageBuffer.mm:
(WebKit::DynamicContentScalingBifurcatedImageBuffer::dynamicContentScalingDisplayList):
For a 0x0 layer, allocating the backend will fail (intentionally), and thus we
must not unconditionally dereference it when retrieving a display list.

Canonical link: https://commits.webkit.org/272792@main