Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8cbb239f5237007ac3adc5c11a0dedf2ad10cec8
https://github.com/WebKit/WebKit/commit/8cbb239f5237007ac3adc5c11a0dedf2ad10cec8
Author: Tyler Wilcock <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
A LayoutTests/accessibility/dynamic-frame-prepend-crash-expected.txt
A LayoutTests/accessibility/dynamic-frame-prepend-crash.html
M Source/WebCore/accessibility/AXObjectCache.cpp
Log Message:
-----------
AX: The Node& variant of AXObjectCache::getOrCreate scopes a renderer
CheckedPtr far larger than necessary, which can cause an unnecessary crash
https://bugs.webkit.org/show_bug.cgi?id=300254
rdar://161953366
Reviewed by Joshua Hoffman.
Limit the scope of this CheckedPtr to where it's actually used. This avoids an
unnecessary crash from side effects later
in the function destroying the renderer (but we don't actually care if it's
destroyed, since our use for the renderer
stopped earlier in the function).
Test: accessibility/dynamic-frame-prepend-crash.html
* LayoutTests/accessibility/dynamic-frame-prepend-crash-expected.txt: Added.
* LayoutTests/accessibility/dynamic-frame-prepend-crash.html: Added.
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::getOrCreateSlow):
Canonical link: https://commits.webkit.org/301101@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
