Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bdc84c14a8e6548918f4a62442cdcef2ac507495
https://github.com/WebKit/WebKit/commit/bdc84c14a8e6548918f4a62442cdcef2ac507495
Author: Kiet Ho <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/scroll-compensation-crash.html
Log Message:
-----------
[css-anchor-position-1] removeScrollerFromAnchorScrollAdjusters mutates array
when iterating through it
rdar://175679565
Reviewed by Elika Etemad.
LocalFrameViewLayoutContext::removeScrollerFromAnchorScrollAdjusters iterates
through m_anchorScrollAdjusters, and unregisters adjusters belonging to the
scroller by calling unregisterAnchorScrollAdjusterFor.
unregisterAnchorScrollAdjusterFor
in turn removes adjusters also from m_anchorScrollAdjusters, which is being
iterated on.
Vectors are not safe to modify when iterating through. Change the loop to save
the list
of adjusters to be removed in a HashSet, then remove the saved adjusters after.
NOTE: this was fixed a while ago, but while waiting for a merge-back, it got
fixed in
upstream in 316000@main. The fixes are equivalent, so this merge-back opts to
keep the
upstreamed fix and adds a test.
Test:
imported/w3c/web-platform-tests/css/css-anchor-position/scroll-compensation-crash.html
*
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/scroll-compensation-crash.html:
Added.
Originally-landed-as: 305413.802@safari-7624-branch (444a849510b9).
rdar://180427816
Canonical link: https://commits.webkit.org/316226@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
