Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 869aebafb6b4c4d590bba4ab6a2913ff203624ed
https://github.com/WebKit/WebKit/commit/869aebafb6b4c4d590bba4ab6a2913ff203624ed
Author: Rob Buis <[email protected]>
Date: 2025-06-06 (Fri, 06 Jun 2025)
Changed paths:
A LayoutTests/css3/masking/shared-clip-path-reference-crash-expected.txt
A LayoutTests/css3/masking/shared-clip-path-reference-crash.html
M Source/WebCore/rendering/RenderLayer.cpp
M Source/WebCore/rendering/RenderLayer.h
M Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceContainer.cpp
Log Message:
-----------
ASAN_TRAP | WTF::HashTable::lookup;
WebCore::LegacyRenderSVGResource::markForLayoutAndParentResourceInvalidation;
WebCore::SVGResourcesCache::clientStyleChanged
https://bugs.webkit.org/show_bug.cgi?id=288442
rdar://144407636
Reviewed by Simon Fraser.
LegacyRenderSVGResourceClipper.m_clipperMap is used to keep track of clipper
data per client, the client
can be a HTML element referencing the clipper by using the clip-path property.
The registering for that is done
in RenderLayer::setupClipPath but there is no code to deregister on HTML
element removal, so the m_clipperMap
keys will become a WeakRef with empty internal pointer for HTML elements,
causing a RELEASE_ASSERT.
To fix this, include deregistering code on RenderLayer destruction.
* LayoutTests/css3/masking/shared-clip-path-reference-crash-expected.txt: Added.
* LayoutTests/css3/masking/shared-clip-path-reference-crash.html: Added.
* Source/WebCore/rendering/RenderLayer.cpp:
(WebCore::RenderLayer::~RenderLayer):
(WebCore::RenderLayer::removeClipperClientIfNeeded const):
* Source/WebCore/rendering/RenderLayer.h:
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceContainer.cpp:
(WebCore::LegacyRenderSVGResourceContainer::markClientForInvalidation):
Originally-landed-as: [email protected] (ff0112ba3d52).
rdar://151715112
Canonical link: https://commits.webkit.org/295938@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
