Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: e9b4c5f1a9310c8dcc7b331b88fa6e269141b0ea
https://github.com/WebKit/WebKit/commit/e9b4c5f1a9310c8dcc7b331b88fa6e269141b0ea
Author: Zak Ridouh <[email protected]>
Date: 2026-09-13 (Sun, 13 Sep 2026)
Changed paths:
A
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt
A
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
Log Message:
-----------
Cherry-pick [email protected] (039ba968916b).
https://bugs.webkit.org/show_bug.cgi?id=319704
[IFC] Do not leave stale display content when partial merge fails in
InlineContentBuilder
<https://bugs.webkit.org/show_bug.cgi?id=319704>
<rdar://177161065>
Reviewed by Alan Baradlay.
Field MTE reports show a use-after-free destroying InlineDisplay::Content
during
LineLayout::layout()'s clearInlineContent(): a display box's
CheckedPtr<Layout::Box>
still references a Layout::Box that was already freed.
Partial inline layout keeps the previous display content alive so the
newly-built
lines can be spliced into it, relying on
InlineDamage::m_detachedLayoutBoxes to keep
removed layout boxes alive across the merge. When
handlePartialDisplayContentUpdate
cannot compute a valid damaged range, it returned early through
ASSERT_NOT_REACHED()
and left the previous display content untouched. The caller then destroys
the
InlineDamage (m_lineDamage = { }), freeing the detached layout boxes while
the display
boxes still reference them; the next clearInlineContent() touches freed
memory.
Drop the previous display content on that fallback path (after collecting
its ink
overflow for repaint) so we never carry stale CheckedPtr<Layout::Box>
references past
the point their target is released. This hardens an ASSERT_NOT_REACHED()
branch and
does not change behavior on the fast path.
*
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:
(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate
const):
*
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html:
Added.
*
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt:
Added.
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.296@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
