Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 479cba7de88ccd438fc40c4b44fff6c1d19e91bd
https://github.com/WebKit/WebKit/commit/479cba7de88ccd438fc40c4b44fff6c1d19e91bd
Author: Rob Buis <[email protected]>
Date: 2025-11-21 (Fri, 21 Nov 2025)
Changed paths:
A LayoutTests/fast/parser/xml-parser-detach-crash-expected.txt
A LayoutTests/fast/parser/xml-parser-detach-crash.html
M Source/WebCore/xml/parser/XMLDocumentParser.cpp
M Source/WebCore/xml/parser/XMLDocumentParser.h
Log Message:
-----------
ASAN_ILL | WebCore::XMLDocumentParser::detach;
WebCore::Document::removedLastRef; WebCore::HTMLCollection::~HTMLCollection
https://bugs.webkit.org/show_bug.cgi?id=302967
Reviewed by Ryosuke Niwa.
The xml document can have a parse error in which case insertErrorMessageBlock
is called.
This will replace the existing DOM tree and elements in the node stack and
current node
may end up with a reference count of just one. The CheckedPtr based logic in
clearCurrentNodeStack
will further deref and the CheckedPtr will have a release assert on destruction
of the CheckedPtr.
To fix this, convert the node stack and current node member variables to use a
WeakPtr instead.
Test: fast/parser/xml-parser-detach-crash.html
* LayoutTests/fast/parser/xml-parser-detach-crash-expected.txt: Added.
* LayoutTests/fast/parser/xml-parser-detach-crash.html: Added.
* Source/WebCore/xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::clearCurrentNodeStack):
(WebCore::XMLDocumentParser::createLeafTextNode):
* Source/WebCore/xml/parser/XMLDocumentParser.h:
Originally-landed-as:
https://commits.webkit.org/[email protected] (2157624f4f2c).
Canonical link: https://commits.webkit.org/303426@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
