Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b74177d136f16042be2d439314e66905ec725fba
https://github.com/WebKit/WebKit/commit/b74177d136f16042be2d439314e66905ec725fba
Author: Chris Dumez <[email protected]>
Date: 2026-06-23 (Tue, 23 Jun 2026)
Changed paths:
A
LayoutTests/fast/dom/lazy-video-clone-after-document-teardown-crash-expected.txt
A LayoutTests/fast/dom/lazy-video-clone-after-document-teardown-crash.html
M Source/WebCore/dom/Document.h
M Source/WebCore/dom/Node.cpp
M Source/WebCore/html/LazyLoadVideoObserver.cpp
M Source/WebCore/html/LazyLoadVideoObserver.h
Log Message:
-----------
REGRESSION(314874@main): CRASH in LazyLoadVideoObserver::observe() after
document teardown
https://bugs.webkit.org/show_bug.cgi?id=317191
rdar://179709492
Reviewed by Darin Adler.
Fix case where early destruction of the Document could cause a use-after-free
of the LazyLoadVideoObserver in LazyLoadVideoObserver::observe(), given
that the Document owns the LazyLoadVideoObserver.
Test: fast/dom/lazy-video-clone-after-document-teardown-crash.html
The code change and test are based almost entirely on initial work
from Kristian Monsen.
*
LayoutTests/fast/dom/lazy-video-clone-after-document-teardown-crash-expected.txt:
Added.
* LayoutTests/fast/dom/lazy-video-clone-after-document-teardown-crash.html:
Added.
Add test coverage.
* Source/WebCore/dom/Document.h:
Add LIFETIME_BOUND to the lazyLoadVideoObserver() getter as this would have
caught the unsafe code in LazyLoadVideoObserver::observe().
* Source/WebCore/dom/Node.cpp:
(WebCore::Node::cloneNode const):
Fix safer cpp issue here where we were failing to protect the Document.
This was caught by the new test also.
* Source/WebCore/html/LazyLoadVideoObserver.cpp:
(WebCore::LazyLoadVideoObserver::observe):
Make sure we keep a Ref to the Document while we're using the
LazyLoadVideoObserver.
Also hold the LazyLoadVideoObserver in a CheckedPtr for extra safety, especially
since Document::m_lazyLoadObserver is nullable.
(WebCore::LazyLoadVideoObserver::intersectionObserver):
* Source/WebCore/html/LazyLoadVideoObserver.h:
Make LazyLoadVideoObserver CanMakeCheckedPtr for extra safety and to catch
more safer cpp violations.
Canonical link: https://commits.webkit.org/315716@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
