Commits on Feb 13, 2024

1. Crash under ~RenderMenuList due to CheckedPtr usage …

   https://bugs.webkit.org/show_bug.cgi?id=269322
   rdar://119790256
   
   Reviewed by Alan Baradlay.
   
   From the crash trace, we can see that HTMLSelectElement::defaultEventHandler()
   holds a CheckedPtr to its RenderMenuList renderer and calls showPopup() on
   the renderer. This ends up running JS, which removes the select element from
   the DOM and in turns destroys the renderer. The usage is currently safe since
   nothing is using the renderer after the JS has run. However, it was tripping
   the CheckedPtr assertion.
   
   To address the issue, switch to using WeakPtr for now and add comments to
   clarify lifetime. We should consider refactoring this in a follow up though.
   
   * Source/WebCore/html/HTMLSelectElement.cpp:
   (WebCore::HTMLSelectElement::platformHandleKeydownEvent):
   (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
   (WebCore::HTMLSelectElement::showPicker):
   * Source/WebCore/rendering/RenderMenuList.cpp:
   (RenderMenuList::showPopup):
   
   Canonical link: https://commits.webkit.org/274586@main

   

   cdumez committed Feb 13, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 35318b4
   • Browse repository at this point

   Copy the full SHA

   35318b4 View commit details

   Browse the repository at this point in the history