Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9c6099bea06bf812084dc9118bbae1dcda5937a0
https://github.com/WebKit/WebKit/commit/9c6099bea06bf812084dc9118bbae1dcda5937a0
Author: Zak Ridouh <[email protected]>
Date: 2026-08-17 (Mon, 17 Aug 2026)
Changed paths:
A
LayoutTests/fast/dom/MutationObserver/observed-node-collected-during-delivery-crash-expected.txt
A
LayoutTests/fast/dom/MutationObserver/observed-node-collected-during-delivery-crash.html
M Source/WebCore/dom/MutationObserver.cpp
Log Message:
-----------
Keep observed nodes alive across MutationObserver delivery
https://bugs.webkit.org/show_bug.cgi?id=321878
rdar://183913289
Reviewed by David Kilzer.
MutationObserver::deliver() collects the observer's registrations that have
transient
registrations into a Vector<Ref<MutationObserverRegistration>> and keeps them
alive for
the rest of the function, including across the mutation callback. It then calls
takeTransientRegistrations() on each of them, which clears
MutationObserverRegistration::m_nodeKeptAlive, the registration's only strong
reference
to the node it observes.
When that was the last reference to the observed node, the node is destroyed
while
deliver() still holds its registration alive, and the registration is still in
MutationObserver::m_registrations. Its reference to the observed node is a
WeakRef<Node>, so it is now dangling, and dereferencing it hits the
RELEASE_ASSERT in
WeakRef::ptr(). MutationObserverRegistration::isReachableFromOpaqueRoots() does
so on a
GC thread, and MutationObserver::disconnect() does so on the main thread.
Keep the observed nodes alive for as long as deliver() keeps their
registrations alive.
Declare the vector before transientRegistrations so that the nodes outlive the
registrations, and use GCReachableRef so that the nodes' JS wrappers are kept
alive as
well, matching how deliver() already handles the transient registration nodes.
Test:
fast/dom/MutationObserver/observed-node-collected-during-delivery-crash.html
*
LayoutTests/fast/dom/MutationObserver/observed-node-collected-during-delivery-crash-expected.txt:
Added.
*
LayoutTests/fast/dom/MutationObserver/observed-node-collected-during-delivery-crash.html:
Added.
* Source/WebCore/dom/MutationObserver.cpp:
(WebCore::MutationObserver::deliver):
Canonical link: https://commits.webkit.org/319335@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
