Branch: refs/heads/webkitglib/2.44 Home: https://github.com/WebKit/WebKit Commit: 5cb6485df85a0aa0e9496d7ab93f3889801da696 https://github.com/WebKit/WebKit/commit/5cb6485df85a0aa0e9496d7ab93f3889801da696 Author: David Degazio <d_dega...@apple.com> Date: 2024-05-02 (Thu, 02 May 2024)
Changed paths: M Source/bmalloc/libpas/src/libpas/pas_enumerator_region.h Log Message: ----------- Cherry-pick 276187@main (5aa139649dd7). https://bugs.webkit.org/show_bug.cgi?id=270993 Fix assertion failure in pas_enumerator_create due to wrong alignment https://bugs.webkit.org/show_bug.cgi?id=270993 rdar://124562475 Reviewed by Yusuke Suzuki. In pas_enumerator_create, we assert that the payload of a pas_enumerator_region is aligned to PAS_INTERNAL_MIN_ALIGN. This patch adds that alignment requirement to the type definition of pas_enumerator_region so we always respect this requirement. * Source/bmalloc/libpas/src/libpas/pas_enumerator_region.h: Canonical link: https://commits.webkit.org/276187@main Canonical link: https://commits.webkit.org/274313.202@webkitglib/2.44 Commit: 70b734acef04f13071be880281f2cb10f2e69296 https://github.com/WebKit/WebKit/commit/70b734acef04f13071be880281f2cb10f2e69296 Author: Ryosuke Niwa <rn...@webkit.org> Date: 2024-05-03 (Fri, 03 May 2024) Changed paths: A LayoutTests/editing/style/apply-style-split-text-element-at-end-crash-expected.txt A LayoutTests/editing/style/apply-style-split-text-element-at-end-crash.html M Source/WebCore/editing/CompositeEditCommand.cpp M Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp Log Message: ----------- Cherry-pick 278242@main (6de0a6e596b6). https://bugs.webkit.org/show_bug.cgi?id=273581 Crash in CheckedPtr::decrementPtrCount via SplitTextNodeContainingElementCommand::doApply https://bugs.webkit.org/show_bug.cgi?id=273581 <rdar://127116949> Reviewed by Wenson Hsieh. The crash was caused by SplitTextNodeContainingElementCommand::doApply holding onto a CheckedPtr of RenderObject until across a call to splitElement, which could trigger a layout and delete the render object. Fixed the crash by reducing the scope of CheckedPtr. Also remove the debug assertion in CompositeEditCommand::appendNode which gets hit with the newly added test case. * LayoutTests/editing/style/apply-style-split-text-element-at-end-crash-expected.txt: Added. * LayoutTests/editing/style/apply-style-split-text-element-at-end-crash.html: Added. * Source/WebCore/editing/CompositeEditCommand.cpp: (WebCore::CompositeEditCommand::appendNode): * Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp: (WebCore::SplitTextNodeContainingElementCommand::doApply): Canonical link: https://commits.webkit.org/278242@main Canonical link: https://commits.webkit.org/274313.203@webkitglib/2.44 Compare: https://github.com/WebKit/WebKit/compare/808c22103b7f...70b734acef04 To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes