Bug 273803

Summary:	Assertion may fail when repainting the RenderView of an SVGImage
Product:	WebKit	Reporter:	Said Abou-Hallawa <sabouhallawa>
Component:	Layout and Rendering	Assignee:	Said Abou-Hallawa <sabouhallawa>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Said Abou-Hallawa

Reported 2024-05-06 17:17:06 PDT

While repainting a renderer, its container SVGImage may be deleted. Deleting the SVGImage will call Document::destroyRenderTree() and hence delete the renderer itself. So this renderer should not be a CheckedPtr in RenderLayer::recursiveUpdateLayerPositions().

Attachments
Add attachment proposed patch, testcase, etc.

Said Abou-Hallawa

Comment 1 2024-05-06 17:17:26 PDT

rdar://127102474

Said Abou-Hallawa

Comment 2 2024-05-06 17:21:02 PDT

Pull request: https://github.com/WebKit/WebKit/pull/28212

EWS

Comment 3 2024-05-13 22:14:11 PDT

Committed 278734@main (9e2447a61281): <https://commits.webkit.org/278734@main> Reviewed commits have been landed. Closing PR #28212 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.