[webkit-changes] [WebKit/WebKit] 5cb648: Cherry-pick 276187 at main (5aa139649dd7). https://bu...

[Ryosuke Niwa]

  Branch: refs/heads/webkitglib/2.44
  Home:   https://github.com/WebKit/WebKit
  Commit: 5cb6485df85a0aa0e9496d7ab93f3889801da696
      https://github.com/WebKit/WebKit/commit/5cb6485df85a0aa0e9496d7ab93f3889801da696
  Author: David Degazio <d_degazio at apple.com>
  Date:   2024-05-02 (Thu, 02 May 2024)

  Changed paths:
    M Source/bmalloc/libpas/src/libpas/pas_enumerator_region.h

  Log Message:
  -----------
  Cherry-pick 276187 at main (5aa139649dd7). https://bugs.webkit.org/show_bug.cgi?id=270993

    Fix assertion failure in pas_enumerator_create due to wrong alignment
    https://bugs.webkit.org/show_bug.cgi?id=270993
    rdar://124562475

    Reviewed by Yusuke Suzuki.

    In pas_enumerator_create, we assert that the payload of a pas_enumerator_region
    is aligned to PAS_INTERNAL_MIN_ALIGN. This patch adds that alignment requirement
    to the type definition of pas_enumerator_region so we always respect this
    requirement.

    * Source/bmalloc/libpas/src/libpas/pas_enumerator_region.h:

    Canonical link: https://commits.webkit.org/276187@main

Canonical link: https://commits.webkit.org/274313.202@webkitglib/2.44


  Commit: 70b734acef04f13071be880281f2cb10f2e69296
      https://github.com/WebKit/WebKit/commit/70b734acef04f13071be880281f2cb10f2e69296
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2024-05-03 (Fri, 03 May 2024)

  Changed paths:
    A LayoutTests/editing/style/apply-style-split-text-element-at-end-crash-expected.txt
    A LayoutTests/editing/style/apply-style-split-text-element-at-end-crash.html
    M Source/WebCore/editing/CompositeEditCommand.cpp
    M Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp

  Log Message:
  -----------
  Cherry-pick 278242 at main (6de0a6e596b6). https://bugs.webkit.org/show_bug.cgi?id=273581

    Crash in CheckedPtr::decrementPtrCount via SplitTextNodeContainingElementCommand::doApply
    https://bugs.webkit.org/show_bug.cgi?id=273581
    <rdar://127116949>

    Reviewed by Wenson Hsieh.

    The crash was caused by SplitTextNodeContainingElementCommand::doApply holding onto a CheckedPtr
    of RenderObject until across a call to splitElement, which could trigger a layout and delete
    the render object. Fixed the crash by reducing the scope of CheckedPtr.

    Also remove the debug assertion in CompositeEditCommand::appendNode which gets hit with the
    newly added test case.

    * LayoutTests/editing/style/apply-style-split-text-element-at-end-crash-expected.txt: Added.
    * LayoutTests/editing/style/apply-style-split-text-element-at-end-crash.html: Added.
    * Source/WebCore/editing/CompositeEditCommand.cpp:
    (WebCore::CompositeEditCommand::appendNode):
    * Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp:
    (WebCore::SplitTextNodeContainingElementCommand::doApply):

    Canonical link: https://commits.webkit.org/278242@main

Canonical link: https://commits.webkit.org/274313.203@webkitglib/2.44


Compare: https://github.com/WebKit/WebKit/compare/808c22103b7f...70b734acef04

To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications