Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c0b093ac97f84432039e8e9caca107c6c0ba46b1
https://github.com/WebKit/WebKit/commit/c0b093ac97f84432039e8e9caca107c6c0ba46b1
Author: Kristian Monsen <[email protected]>
Date: 2026-10-14 (Wed, 14 Oct 2026)
Changed paths:
A
LayoutTests/fast/frames/iframe-owner-renderer-destroyed-during-implicit-close-expected.txt
A
LayoutTests/fast/frames/iframe-owner-renderer-destroyed-during-implicit-close.html
A
LayoutTests/fast/frames/resources/subframe-smil-animation-forces-owner-layout.html
M Source/WebCore/dom/Document.cpp
Log Message:
-----------
Document::implicitClose() keeps a CheckedPtr to the frame owner's renderer
across a style and layout update that can destroy it
https://bugs.webkit.org/show_bug.cgi?id=327570
rdar://188692696
Reviewed by Ryosuke Niwa.
The CheckedPtr to the owner's renderer is only needed to decide whether
to update style and layout, but it stays in scope to the end of the
function, where the style update, the layout, and startAnimations() can
all destroy the renderer out from under it. Reduce its scope to the
condition that uses it.
Test: fast/frames/iframe-owner-renderer-destroyed-during-implicit-close.html
*
LayoutTests/fast/frames/iframe-owner-renderer-destroyed-during-implicit-close-expected.txt:
Added.
*
LayoutTests/fast/frames/iframe-owner-renderer-destroyed-during-implicit-close.html:
Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::implicitClose):
*
LayoutTests/fast/frames/resources/subframe-smil-animation-forces-owner-layout.html:
Added.
Canonical link: https://commits.webkit.org/323788@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
