Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 914243151f5f88c9d205dda0d5771c9ee83d6524
https://github.com/WebKit/WebKit/commit/914243151f5f88c9d205dda0d5771c9ee83d6524
Author: Chris Dumez <[email protected]>
Date: 2026-06-11 (Thu, 11 Jun 2026)
Changed paths:
A
LayoutTests/fast/dom/CloseWatcher/close-watcher-manager-remove-crash-expected.txt
A LayoutTests/fast/dom/CloseWatcher/close-watcher-manager-remove-crash.html
M Source/WebCore/html/closewatcher/CloseWatcherManager.cpp
Log Message:
-----------
CloseWatcherManager::remove() mutates m_groups while iterating it
https://bugs.webkit.org/show_bug.cgi?id=316895
Reviewed by Anne van Kesteren.
While iterating over m_groups, the code would sometimes call `removeFirst()`
on m_groups, thus modifying the container it is iterating on. It is not
safe to do this so I'm fixing it.
Test: fast/dom/CloseWatcher/close-watcher-manager-remove-crash.html
*
LayoutTests/fast/dom/CloseWatcher/close-watcher-manager-remove-crash-expected.txt:
Added.
* LayoutTests/fast/dom/CloseWatcher/close-watcher-manager-remove-crash.html:
Added.
* Source/WebCore/html/closewatcher/CloseWatcherManager.cpp:
(WebCore::CloseWatcherManager::remove):
Canonical link: https://commits.webkit.org/315063@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
