Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d195540b4317093ef9b0e69fa51eaed7ad9d90e0
https://github.com/WebKit/WebKit/commit/d195540b4317093ef9b0e69fa51eaed7ad9d90e0
Author: Pablo Saavedra <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M Source/WebCore/rendering/svg/SVGRenderSupport.cpp
M Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
Log Message:
-----------
Work around Clang 18 crash when mapping SVG stroke dash arrays
Reviewed by Nikolas Zimmermann.
Clang 18 segfaults in Sema::tryCaptureVariable() while compiling the rendering
unified sources with -std=c++23:
3 clang::Sema::tryCaptureVariable(...)
4 clang::Sema::BuildDeclRefExpr(...)
12 clang::Sema::SubstConstraintExpr(...)
16 clang::Sema::CheckInstantiatedFunctionTemplateConstraints(...)
21 clang::Sema::AddTemplateOverloadCandidate(...)
27 clang::Sema::AddMethodCandidate(...)
28 clang::Sema::BuildCallToMemberFunction(...)
Resolving lengthContext.valueForLength(dash, zoom) inside the DashArray::map()
lambdas makes the compiler check whether the argument converts to each of the
eight SVGLengthContext::valueForLength() parameter types. The Style wrappers
among them inherit PrimitiveNumericWrapperBase's variadic constructor, whose
requires-clause mentions its own function parameters:
template<typename... Args>
ALWAYS_INLINE PrimitiveNumericWrapperBase(Args&&... args)
requires (requires { { LengthPercentage<R, V>(args...) }; })
Both call sites took the dash element as auto&, so that constraint is
substituted while the generic lambda body is being instantiated. Clang 18 then
tries to capture the constructor's parameters and dereferences null.
Upstream fixed this in llvm/llvm-project#93206, "[clang] Fix crash in
tryCaptureVariable for unevaluated lambdas" (commit 3d361b2, merged into main
on 2024-06-04) but this was never backported to Clang 18.x release and still
crashes.
Spelling the lambda parameter type out keeps the body non-dependent, so the
constraint is checked in an ordinary function context instead and the crash
goes away.
* Source/WebCore/rendering/svg/SVGRenderSupport.cpp:
(WebCore::SVGRenderSupport::applyStrokeStyleToContext):
* Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp:
(WebCore::writeSVGStrokePaintingResource):
Canonical link: https://commits.webkit.org/320746@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
