[webkit-changes] [WebKit/WebKit] 3bd3c0: Cherry-pick 285629 at main (72e418d5143c). https://bu...
Adrian Perez
noreply at github.com
Wed Oct 30 04:43:01 PDT 2024
Branch: refs/heads/webkitglib/2.46
Home: https://github.com/WebKit/WebKit
Commit: 3bd3c03811e8e620f6be724e7337fdcebd2bf9bd
https://github.com/WebKit/WebKit/commit/3bd3c03811e8e620f6be724e7337fdcebd2bf9bd
Author: Nathan Solomon <nathan_solomon at apple.com>
Date: 2024-10-29 (Tue, 29 Oct 2024)
Changed paths:
A LayoutTests/editing/mac/selection/word-thai-does-not-leak-expected.txt
A LayoutTests/editing/mac/selection/word-thai-does-not-leak.html
M LayoutTests/editing/mac/selection/word-thai.html
M LayoutTests/resources/document-leak-test.js
M Source/WebCore/dom/BoundaryPoint.h
M Source/WebCore/dom/SimpleRange.cpp
M Source/WebCore/dom/SimpleRange.h
M Source/WebCore/page/EventHandler.cpp
M Source/WebCore/page/EventHandler.h
M Source/WebCore/testing/Internals.cpp
Log Message:
-----------
Cherry-pick 285629 at main (72e418d5143c). https://bugs.webkit.org/show_bug.cgi?id=280688
Document Leak occurs in LayoutTests/editing/mac/selection/word-thai.html
https://bugs.webkit.org/show_bug.cgi?id=280688
rdar://137058331
Reviewed by Ryan Reno.
The document leak occurs because the m_dragStartSelection member in
EventHandler, which is of type SimpleRange, holds Refs to Nodes.
This is a problem because the Document holds Refs to these nodes
because the document holds a strong reference to an Editor, which holds a
strong reference to a LocalFrame, which holds a strong reference to an
EventHandler.
This causes a reference cycle to occur between
the Document and the Nodes the EventHandler holds. Fix this reference
cycle by changing the type of m_dragStartSelection to a new type
that allows the member to hold a WeakReference to these nodes. Creating
this new type instead of modifying SimpleRange to hold WeakPtrs to nodes
prevents making extensive changes to areas of the codebase that can
still use a SimpleRange without causing a
reference cycle. Keep the change isolated to what code
relies on accessing m_dragStartSelection's Nodes to prevent adding
extensive amounts of null checking in other areas.
The test I ran to verify the fix was: run-webkit-tests --world-leaks LayoutTests/editing/mac/selection/word-thai.html
This test would previously fail when --world-leaks was passed in.
* Source/WebCore/dom/BoundaryPoint.h:
(WebCore::BoundaryPointWeak::BoundaryPointWeak):
* Source/WebCore/dom/SimpleRange.cpp:
(WebCore::SimpleRangeWeak::SimpleRangeWeak):
(WebCore::firstIntersectingNode):
(WebCore::nodePastLastIntersectingNode):
(WebCore::firstIntersectingNodeWithDeprecatedZeroOffsetStartQuirk):
(WebCore::commonInclusiveAncestor):
(WebCore::IntersectingNodeIterator::IntersectingNodeIterator):
* Source/WebCore/dom/SimpleRange.h:
(WebCore::SimpleRangeWeak::startContainer const):
(WebCore::SimpleRangeWeak::protectedStartContainer const):
(WebCore::SimpleRangeWeak::startOffset const):
(WebCore::SimpleRangeWeak::endContainer const):
(WebCore::SimpleRangeWeak::protectedEndContainer const):
(WebCore::SimpleRangeWeak::endOffset const):
(WebCore::SimpleRangeWeak::collapsed const):
(WebCore::SimpleRange::operator SimpleRangeWeak const):
* Source/WebCore/page/EventHandler.cpp:
(WebCore::EventHandler::updateSelectionForMouseDrag):
* Source/WebCore/page/EventHandler.h:
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::treeOrderBoundaryPoints):
Canonical link: https://commits.webkit.org/285629@main
Canonical link: https://commits.webkit.org/282416.255@webkitglib/2.46
Commit: d56d57bcfe048b90e2c0a4545758dcd85cf0c916
https://github.com/WebKit/WebKit/commit/d56d57bcfe048b90e2c0a4545758dcd85cf0c916
Author: Ziran Sun <zsun at igalia.com>
Date: 2024-10-29 (Tue, 29 Oct 2024)
Changed paths:
M Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp
Log Message:
-----------
Cherry-pick 285648 at main (770fbed05b83). https://bugs.webkit.org/show_bug.cgi?id=281291
Return MediaTime::zeroTime() when m_mediaTimeDuration is invalid at MediaPlayerPrivateGStreamerMSE::duration().
https://bugs.webkit.org/show_bug.cgi?id=281291
Reviewed by Alicia Boya Garcia.
Bug 280337 added an assertion on validation check for currentTime in
ManageMediaSource::monitorSourceBuffers(). During currentTime
calculation, we call MediaPlayerPrivateGStreamerMSE::duration() to work out the
playbackpostion for the MSE case. The initial m_mediaTimeDuration is NaN. The creation
of a element has its currentTime attribute set to MediaTime::zeroTime() though.
This causes the assertion failure when ManageMediaSource is enabled.
Affected test is media/media-source/media-detachablemse-append.html.
* Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:
(WebCore::MediaPlayerPrivateGStreamerMSE::duration const):
Canonical link: https://commits.webkit.org/285648@main
Canonical link: https://commits.webkit.org/282416.256@webkitglib/2.46
Commit: 18247a2012e74193259cbe2e620900365a13aba6
https://github.com/WebKit/WebKit/commit/18247a2012e74193259cbe2e620900365a13aba6
Author: Alex Studer <alex at studer.dev>
Date: 2024-10-29 (Tue, 29 Oct 2024)
Changed paths:
M Source/WebKit/gtk/gtk3-urlmap.js.in
M Source/WebKit/gtk/gtk3-webkitgtk.toml.in
M Source/WebKit/gtk/gtk4-urlmap.js.in
M Source/WebKit/gtk/gtk4-webkitgtk.toml.in
M Source/WebKit/gtk/migrating-to-webkitgtk-6.0.md
M Source/WebKit/gtk/webkitgtk-web-process-extension.toml.in
M Source/WebKit/wpe/wpe-web-process-extension.toml.in
M Source/WebKit/wpe/wpe1-urlmap.js
M Source/WebKit/wpe/wpe2-urlmap.js
M Source/WebKit/wpe/wpewebkit.toml.in
Log Message:
-----------
Cherry-pick 285753 at main (1d5e51240b77). https://bugs.webkit.org/show_bug.cgi?id=282147
[GTK] Update URLs for libsoup
https://bugs.webkit.org/show_bug.cgi?id=282147
Reviewed by Adrian Perez de Castro.
The libsoup.org domain is no longer used, so update all instances of it
to the new URL.
* Source/WebKit/gtk/gtk3-urlmap.js.in:
* Source/WebKit/gtk/gtk3-webkitgtk.toml.in:
* Source/WebKit/gtk/gtk4-urlmap.js.in:
* Source/WebKit/gtk/gtk4-webkitgtk.toml.in:
* Source/WebKit/gtk/migrating-to-webkitgtk-6.0.md:
* Source/WebKit/gtk/webkitgtk-web-process-extension.toml.in:
* Source/WebKit/wpe/wpe-web-process-extension.toml.in:
* Source/WebKit/wpe/wpe1-urlmap.js:
* Source/WebKit/wpe/wpe2-urlmap.js:
* Source/WebKit/wpe/wpewebkit.toml.in:
Canonical link: https://commits.webkit.org/285753@main
Canonical link: https://commits.webkit.org/282416.257@webkitglib/2.46
Commit: 03cf7ed7363f82dbb382cbfe53a0d39fdd7f4a96
https://github.com/WebKit/WebKit/commit/03cf7ed7363f82dbb382cbfe53a0d39fdd7f4a96
Author: Jani Hautakangas <jani at igalia.com>
Date: 2024-10-30 (Wed, 30 Oct 2024)
Changed paths:
M Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
M Source/WebCore/platform/graphics/texmap/TextureMapper.h
M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
Log Message:
-----------
Cherry-pick 285820 at main (7f89d2259aab). https://bugs.webkit.org/show_bug.cgi?id=281079
[TextureMapper] Preserve-3d layers don't get flattened correctly
https://bugs.webkit.org/show_bug.cgi?id=281079
Reviewed by Nikolas Zimmermann and Fujii Hironori.
The TextureMapper incorrectly flattens layers to wrong 2D plane
in the 3D rendering context. Instead of accumulating 3D transformations
for each layer, it resets transformations to the page root layer's 2D plane
for leaf layers. This fix ensures that proper 3D transforms are applied
throughout the entire 3D context and leaf layers are flattened correctly.
Expected Behavior (as per CSS spec):
"The element establishing the 3D rendering context, along with other 3D transformed
elements participating in the context, should be rendered into its own plane.
This plane includes the element’s backgrounds, borders, box decorations, content,
and descendant elements—excluding descendants that have their own planes."
* Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:
(WebCore::TextureMapperFlattenedLayer::TextureMapperFlattenedLayer):
(WebCore::TextureMapperFlattenedLayer::bind):
(WebCore::TextureMapperFlattenedLayer::layerRect const):
(WebCore::TextureMapperFlattenedLayer::surface const):
(WebCore::TextureMapperFlattenedLayer::paintToTextureMapper):
(WebCore::TextureMapperLayer::preprocess):
(WebCore::TextureMapperLayer::collectLayersToFlattenRecursive):
(WebCore::TextureMapperLayer::flatten):
(WebCore::TextureMapperLayer::computeFlattenedRegion):
(WebCore::TextureMapperLayer::postprocess):
(WebCore::TextureMapperLayer::freeFlattenedLayersRecursive):
(WebCore::TextureMapperLayer::computeTransformsRecursive):
(WebCore::TextureMapperLayer::paint):
(WebCore::TextureMapperLayer::paintSelf):
(WebCore::TextureMapperLayer::paintSelfAndChildren):
(WebCore::TextureMapperLayer::flattensAsLeafOf3DSceneOr3DPerspective const):
(WebCore::TextureMapperLayer::has3DLocalTransform const):
(WebCore::TextureMapperLayer::accumulatesTransform const):
(WebCore::TextureMapperLayer::computeOverlapRegions):
(WebCore::TextureMapperLayer::paintRecursive):
* Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h:
Canonical link: https://commits.webkit.org/285820@main
Canonical link: https://commits.webkit.org/282416.258@webkitglib/2.46
Commit: 92f2254176e9eea835e2865f0d95ce3697ebf9bf
https://github.com/WebKit/WebKit/commit/92f2254176e9eea835e2865f0d95ce3697ebf9bf
Author: Pratiksha Choudhury <p_choudhury at apple.com>
Date: 2024-10-30 (Wed, 30 Oct 2024)
Changed paths:
A LayoutTests/fast/rendering/render-flexiblebox-margin-crash-expected.txt
A LayoutTests/fast/rendering/render-flexiblebox-margin-crash.html
M Source/WebCore/rendering/RenderFlexibleBox.cpp
Log Message:
-----------
Cherry-pick 285786 at main (6f3345017b97). https://bugs.webkit.org/show_bug.cgi?id=281992
SIGTRAP in WebCore::RenderFlexibleBox::marginBoxAscentForChild
https://bugs.webkit.org/show_bug.cgi?id=281992
rdar://137178953
Reviewed by Alan Baradlay.
Changed to use a combination of min and max to avoid any invalid range for the flexItem.
* LayoutTests/fast/rendering/render-flexiblebox-margin-crash-expected.txt: Added.
* LayoutTests/fast/rendering/render-flexiblebox-margin-crash.html: Added.
* Source/WebCore/rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::marginBoxAscentForFlexItem):
Canonical link: https://commits.webkit.org/285786@main
Canonical link: https://commits.webkit.org/282416.259@webkitglib/2.46
Commit: a03516071773c5154e45d9beb5e32e58a67e82f2
https://github.com/WebKit/WebKit/commit/a03516071773c5154e45d9beb5e32e58a67e82f2
Author: Adrian Perez de Castro <aperez at igalia.com>
Date: 2024-10-30 (Wed, 30 Oct 2024)
Changed paths:
M Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp
M Source/WebKit/NetworkProcess/storage/CacheStorageDiskStore.h
Log Message:
-----------
Unreviewed non-unified build fixes
* Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp: Add
missing inclusions of Logging.h.
* Source/WebKit/NetworkProcess/storage/CacheStorageDiskStore.h: Add
missing forward declarations for WebCore::FormData and
WebCore::SharedBuffer.
Canonical link: https://commits.webkit.org/282416.260@webkitglib/2.46
Compare: https://github.com/WebKit/WebKit/compare/24cd11001cb8...a03516071773
To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications
More information about the webkit-changes
mailing list