[webkit-changes] [WebKit/WebKit] 43e993: REGRESSION(273101 at main?): [ wk2 debug ] imported/w...

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 43e9932d0120efd8b701913f7aa4cc0b68b14ff2
      https://github.com/WebKit/WebKit/commit/43e9932d0120efd8b701913f7aa4cc0b68b14ff2
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M LayoutTests/platform/wk2/TestExpectations
    M Source/WebCore/rendering/RenderBox.cpp
    M Source/WebCore/rendering/RenderBox.h

  Log Message:
  -----------
  REGRESSION(273101 at main?): [ wk2 debug ] imported/w3c/web-platform-tests/css/css-flexbox/anonymous-flex-item-006.html is flakily crashing.
https://bugs.webkit.org/show_bug.cgi?id=267715
rdar://121206812

Reviewed by Alan Baradlay.

The RenderFlexibleBox::m_intrinsicSizeAlongMainAxis HashMap could end up
with stale pointer as keys and adopting smart pointers in 273101 at main
exposed this bug.

To address the issue, make sure RenderBox renderers remove themselves from
their parent's map when getting detached from the render tree.

* LayoutTests/platform/wk2/TestExpectations:
Unskip flaky test.

* Source/WebCore/rendering/RenderBox.cpp:
(WebCore::RenderBox::willBeRemovedFromTree):
* Source/WebCore/rendering/RenderBox.h:

Canonical link: https://commits.webkit.org/273192@main