Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 0f98c5a9856a5ee13dcab97a2cef33c189fd5cdd
https://github.com/WebKit/WebKit/commit/0f98c5a9856a5ee13dcab97a2cef33c189fd5cdd
Author: Philippe Normand <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
M Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp
Log Message:
-----------
Cherry-pick 309201@main (e4fd5cb695df).
https://bugs.webkit.org/show_bug.cgi?id=309360
[WPE][GStreamer] 4 webcodecs/video-encoder-rescaling WPT tests crash on
ARM64:
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.worker.html?h264_avc
https://bugs.webkit.org/show_bug.cgi?id=309360
Reviewed by Xabier Rodriguez-Calvar.
Prevent out of bounds access in our video copyPlane() function. More work
is needed but at least we
now avoid a crash. Those tests remain expected to fail for the time being.
* LayoutTests/platform/wpe/TestExpectations:
* Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp:
(WebCore::copyPlane):
Canonical link: https://commits.webkit.org/309201@main
Canonical link: https://commits.webkit.org/305877.221@webkitglib/2.52
Commit: 6323ef86c081dfdbc6f1a1f3c1f70eaf3d87d598
https://github.com/WebKit/WebKit/commit/6323ef86c081dfdbc6f1a1f3c1f70eaf3d87d598
Author: Pascoe <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
M Source/WebCore/animation/StyleOriginatedTimelinesController.cpp
Log Message:
-----------
Cherry-pick 309061@main (55ffc93c06b7).
https://bugs.webkit.org/show_bug.cgi?id=309632
Fix iterator invalidation crash in
StyleOriginatedTimelinesController::styleableWasRemoved
https://bugs.webkit.org/show_bug.cgi?id=309632
rdar://172219384
Reviewed by Antoine Quint.
attachAnimation() calls setTimeline() → setTimelineInternal() →
removeAnimation(*this),
which mutates the ListHashSet being iterated, invalidating the iterator and
causing
EXC_BAD_ACCESS when copying the next Ref.
Snapshot the animations into a Vector before iterating, same pattern used in
AnimationTimelinesController.cpp:150.
* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:
(WebCore::StyleOriginatedTimelinesController::styleableWasRemoved):
Canonical link: https://commits.webkit.org/309061@main
Canonical link: https://commits.webkit.org/305877.222@webkitglib/2.52
Commit: f24ac8bd22ba1a6cebd4233b5bc93e5a6f2f347c
https://github.com/WebKit/WebKit/commit/f24ac8bd22ba1a6cebd4233b5bc93e5a6f2f347c
Author: Antoine Quint <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
M Source/WebCore/animation/StyleOriginatedTimelinesController.cpp
Log Message:
-----------
Cherry-pick 309059@main (f355fb943c1d).
https://bugs.webkit.org/show_bug.cgi?id=309672
[scroll-animations] crash under
`StyleOriginatedTimelinesController::unregisterNamedTimeline()` due to iterator
mutation
https://bugs.webkit.org/show_bug.cgi?id=309672
rdar://172271230
Reviewed by Pascoe.
Ensure we make a copy of a timeline's animations before we iterate over it
and possibly mutate it under `CSSAnimation::syncStyleOriginatedTimeline()`
which can call `WebAnimation::setTimeline()` and change the very timeline
animation list we're iterating over.
* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:
(WebCore::StyleOriginatedTimelinesController::unregisterNamedTimeline):
Canonical link: https://commits.webkit.org/309059@main
Canonical link: https://commits.webkit.org/305877.223@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/22d2f7d88e08...f24ac8bd22ba
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
