Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 884e3169771bfde0f93c3bc3ed12c55144d5cd04
https://github.com/WebKit/WebKit/commit/884e3169771bfde0f93c3bc3ed12c55144d5cd04
Author: Zak Ridouh <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt
A
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
Log Message:
-----------
[IFC] Do not leave stale display content when partial merge fails in
InlineContentBuilder
<https://bugs.webkit.org/show_bug.cgi?id=319704>
<rdar://177161065>
Reviewed by Alan Baradlay.
Field MTE reports show a use-after-free destroying InlineDisplay::Content during
LineLayout::layout()'s clearInlineContent(): a display box's
CheckedPtr<Layout::Box>
still references a Layout::Box that was already freed.
Partial inline layout keeps the previous display content alive so the
newly-built
lines can be spliced into it, relying on InlineDamage::m_detachedLayoutBoxes to
keep
removed layout boxes alive across the merge. When
handlePartialDisplayContentUpdate
cannot compute a valid damaged range, it returned early through
ASSERT_NOT_REACHED()
and left the previous display content untouched. The caller then destroys the
InlineDamage (m_lineDamage = { }), freeing the detached layout boxes while the
display
boxes still reference them; the next clearInlineContent() touches freed memory.
Drop the previous display content on that fallback path (after collecting its
ink
overflow for repaint) so we never carry stale CheckedPtr<Layout::Box>
references past
the point their target is released. This hardens an ASSERT_NOT_REACHED() branch
and
does not change behavior on the fast path.
*
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:
(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate
const):
*
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html:
Added.
*
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt:
Added.
Originally-landed-as: [email protected] (039ba968916b).
rdar://185369077
Canonical link: https://commits.webkit.org/319657@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
