Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ec2d23a0902a7c2e65afbd221a275ce3040b9e1c
https://github.com/WebKit/WebKit/commit/ec2d23a0902a7c2e65afbd221a275ce3040b9e1c
Author: Chris Dumez <[email protected]>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
A
LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure-expected.txt
A LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure.html
M Source/WebCore/svg/SVGPathElement.cpp
Log Message:
-----------
Regression(269372@main) Crash under SVGPathElement::attributeChanged() after
memory pressure
https://bugs.webkit.org/show_bug.cgi?id=263381
rdar://117176058
Reviewed by Said Abou-Hallawa.
We were failing to reset pathSegListCacheSize to 0 after clearing the cache. As
a result,
SVGPathElement::attributeChanged() could get in a state where
pathSegListCacheSize becomes
greater than maxPathSegListCacheSize even though the cache map is empty. As a
result, we
would try to remove `cache.random()` which returns `cache.end()` when the cache
is empty.
I also moved the caching logic to a new class for better insulation / clarity.
*
LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure-expected.txt:
Added.
* LayoutTests/fast/svg/path-element-d-attribute-crash-memory-pressure.html:
Added.
* Source/WebCore/svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::attributeChanged):
(WebCore::SVGPathElement::clearCache):
Canonical link: https://commits.webkit.org/269547@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
