286727 2025-01-29 21:00:08 -0800 Drop use of WTF_ALLOW_UNSAFE_BUFFER_USAGE in CSSCalcTree+Parser.cpp 2025-01-30 08:26:08 -0800 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 286743 286745 1 cdumez cdumez fujii koivisto rcaliman webkit-bug-importer oldest_to_newest 2090635 0 cdumez 2025-01-29 21:00:08 -0800 Drop use of WTF_ALLOW_UNSAFE_BUFFER_USAGE in CSSCalcTree+Parser.cpp. 2090636 1 cdumez 2025-01-29 21:04:23 -0800 Pull request: https://github.com/WebKit/WebKit/pull/39746 2090649 2 ews-feeder 2025-01-29 22:19:32 -0800 Committed 289546@main (a4af661503b7): <https://commits.webkit.org/289546@main> Reviewed commits have been landed. Closing PR #39746 and removing active labels. 2090650 3 webkit-bug-importer 2025-01-29 22:20:14 -0800 <rdar://problem/143867680> 2090654 4 fujii 2025-01-29 23:15:58 -0800 289546@main added "originalTokens[tokens.begin() - originalTokens.data() - 1]" This expression accesses "originalTokens[-1]". With MS STL + Debug build, the problem crashes. > Debug Assertion Failed! > > Program: C:\webkit\wa\webkitbuild\debug\bin\WebCore.dll > File: C:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Tools\MSVC\14.42.34433\include\span > Line: 454 > > Expression: span index out of range Can I revert this change? 2090714 5 rcaliman 2025-01-30 06:08:31 -0800 Revert in https://bugs.webkit.org/show_bug.cgi?id=286743 2090722 6 cdumez 2025-01-30 07:44:25 -0800 Reopened Bugzilla. Unreviewed, revert 289546@main as it introduced crashes, tracking revert in https://bugs.webkit.org/show_bug.cgi?id=286745. 2090738 7 cdumez 2025-01-30 08:26:08 -0800 Follow-up fix in https://commits.webkit.org/289558@main.