[webkit-changes] [WebKit/WebKit] 4d646a: Fix site isolation overlay crash during teardown

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 4d646a441196993aecaf93b3af2ae2ab7eb87bd5
      https://github.com/WebKit/WebKit/commit/4d646a441196993aecaf93b3af2ae2ab7eb87bd5
  Author: Pascoe <pascoe at apple.com>
  Date:   2024-05-28 (Tue, 28 May 2024)

  Changed paths:
    M Source/WebCore/page/DebugPageOverlays.cpp

  Log Message:
  -----------
  Fix site isolation overlay crash during teardown
https://bugs.webkit.org/show_bug.cgi?id=274612
rdar://128636304

Reviewed by Charlie Wolfe.

The debug overlays are stored in a WeakHashMap from page to a vector of the overlays.
However, when site isolation is on, whenever a value is being removed from the WeakHashMap
because the page has been destrucuted, the overlay will try to access a WeakRef to the page,
which crashes. To fix this, we make the page in a RegionOverlay stored as WeakPtr instead and
check it before accessing it.

* Source/WebCore/page/DebugPageOverlays.cpp:
(WebCore::MouseWheelRegionOverlay::updateRegion):
(WebCore::NonFastScrollableRegionOverlay::updateRegion):
(WebCore::InteractionRegionOverlay::activeLayer const):
(WebCore::InteractionRegionOverlay::activeRegion const):
(WebCore::InteractionRegionOverlay::mouseEvent):
(WebCore::SiteIsolationOverlay::drawRect):
(WebCore::RegionOverlay::~RegionOverlay):
(WebCore::RegionOverlay::protectedPage const): Deleted.

Canonical link: https://commits.webkit.org/279386@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications