Branch: refs/heads/safari-7615.1.26.100-branch
Home: https://github.com/WebKit/WebKit
Commit: ca8ecf6caa268fdd50c575623e9a3f9d2a904eb1
https://github.com/WebKit/WebKit/commit/ca8ecf6caa268fdd50c575623e9a3f9d2a904eb1
Author: Russell Epstein <[email protected]>
Date: 2023-04-10 (Mon, 10 Apr 2023)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7615.1.26.100.1
Canonical link:
https://commits.webkit.org/[email protected]
Commit: e8bbb1979f3e6eb1026f8b722ec2fcd325f39bb8
https://github.com/WebKit/WebKit/commit/e8bbb1979f3e6eb1026f8b722ec2fcd325f39bb8
Author: Antoine Quint <[email protected]>
Date: 2023-04-10 (Mon, 10 Apr 2023)
Changed paths:
M Source/WebCore/animation/WebAnimation.cpp
Log Message:
-----------
Cherry-pick 1d6fe184ea53. rdar://problem/107856564
Potential use-after-free in WebAnimation::commitStyles
https://bugs.webkit.org/show_bug.cgi?id=254840
rdar://107444873
Reviewed by Dean Jackson and Darin Adler.
Ensure that the animation's effect and target are kept alive for the
duration of this method
since it is possible that calling updateStyleIfNeeded() could call into
JavaScript and thus
these two pointers could be changed to a null value using the Web
Animations API.
* Source/WebCore/animation/WebAnimation.cpp:
(WebCore::WebAnimation::commitStyles):
Canonical link: https://commits.webkit.org/259548.532@safari-7615-branch
Canonical link:
https://commits.webkit.org/[email protected]
Commit: 4eb9ee50a616bfb5da8b7932fd1778627354b3b2
https://github.com/WebKit/WebKit/commit/4eb9ee50a616bfb5da8b7932fd1778627354b3b2
Author: Michael Saboff <[email protected]>
Date: 2023-04-10 (Mon, 10 Apr 2023)
Changed paths:
A JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js
M Source/JavaScriptCore/runtime/StringPrototype.cpp
M Source/JavaScriptCore/yarr/YarrInterpreter.cpp
Log Message:
-----------
Cherry-pick e34edaa74575. rdar://problem/107856432
[JSC] RegExpGlobalData::performMatch issue leading to OOB read
https://bugs.webkit.org/show_bug.cgi?id=254930
rdar://107436732
Reviewed by Alexey Shvayka.
Fixed two issues:
1) In YarrInterpreter.cpp::matchAssertionBOL() we were advancing the string
position for non-BMP
characters. Since it is an assertion, we shouldn't advance the
character position.
Made the same fix to matchAssertionEOL().
2) In StringPrototype.cpp::replaceUsingRegExpSearch(), we need to advance
past both elements of
a non-BMP character for the case where the RegExp match is empty.
* JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js: New
test.
* Source/JavaScriptCore/runtime/StringPrototype.cpp:
(JSC::replaceUsingRegExpSearch):
* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::InputStream::readCheckedDontAdvance):
(JSC::Yarr::Interpreter::matchAssertionBOL):
(JSC::Yarr::Interpreter::matchAssertionEOL):
Canonical link: https://commits.webkit.org/259548.551@safari-7615-branch
Canonical link:
https://commits.webkit.org/[email protected]
Commit: 0b4da5022ccb64dee6861ecf7d694efb93f341c7
https://github.com/WebKit/WebKit/commit/0b4da5022ccb64dee6861ecf7d694efb93f341c7
Author: Russell Epstein <[email protected]>
Date: 2023-04-28 (Fri, 28 Apr 2023)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning
WebKit-7615.1.26.100.2
Canonical link:
https://commits.webkit.org/[email protected]
Compare: https://github.com/WebKit/WebKit/compare/ca8ecf6caa26%5E...0b4da5022ccb
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
