Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3ca64a2480faae34c7cea448cdece5f91b320f38
https://github.com/WebKit/WebKit/commit/3ca64a2480faae34c7cea448cdece5f91b320f38
Author: Tim Horton <[email protected]>
Date: 2026-06-26 (Fri, 26 Jun 2026)
Changed paths:
M Source/WebCore/page/LocalFrameView.cpp
Log Message:
-----------
Rare null derefs under LocalFrameView::textFragmentIndicatorTimerFired()
https://bugs.webkit.org/show_bug.cgi?id=317908
rdar://180240279
Reviewed by Abrar Rahman Protyasha.
* Source/WebCore/page/LocalFrameView.cpp:
(WebCore::LocalFrameView::textFragmentIndicatorTimerFired):
Keep a local copy of m_pendingTextFragmentIndicatorRange when calling into
plainText(), because plainText() does layout, which can in turn result in
m_pendingTextFragmentIndicatorRange being reset, subsequently causing a null
deref.
Canonical link: https://commits.webkit.org/315876@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
