Bug 263381 - Regression(269372@main) Crash under SVGPathElement::attributeChanged() after memory pressure
Summary: Regression(269372@main) Crash under SVGPathElement::attributeChanged() after ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: SVG (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-10-19 09:33 PDT by Chris Dumez
Modified: 2023-10-19 15:13 PDT (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2023-10-19 09:33:22 PDT 
Crash under SVGPathElement::attributeChanged() after memory pressure caused by 269372@main:
```
Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   WebCore                       	       0x283372c2c WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::size() const + 12 (Vector.h:782)
1   WebCore                       	       0x285e94650 WebCore::SVGPathElement::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason) + 540 (SVGPathElement.cpp:80)
2   WebCore                       	       0x283c66d14 WebCore::Element::notifyAttributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason) + 120 (Element.cpp:2088)
3   WebCore                       	       0x283c6a090 WebCore::Element::parserSetAttributes(std::__1::span<WebCore::Attribute const, 18446744073709551615ul>) + 696 (Element.cpp:2535)
4   WebCore                       	       0x2843ebe6c WebCore::setAttributes(WebCore::Element&, WTF::Vector<WebCore::Attribute, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::HasDuplicateAttribute, WTF::OptionSet<WebCore::ParserContentPolicy>) + 132 (HTMLConstructionSite.cpp:73)
5   WebCore                       	       0x2843e8734 WebCore::setAttributes(WebCore::Element&, WebCore::AtomHTMLToken&, WTF::OptionSet<WebCore::ParserContentPolicy>) + 112 (HTMLConstructionSite.cpp:79)
6   WebCore                       	       0x2843ec760 WebCore::HTMLConstructionSite::createElement(WebCore::AtomHTMLToken&, WTF::AtomString const&) + 164 (HTMLConstructionSite.cpp:768)
7   WebCore                       	       0x2843ec5c0 WebCore::HTMLConstructionSite::insertForeignElement(WebCore::AtomHTMLToken&&, WTF::AtomString const&) + 244 (HTMLConstructionSite.cpp:632)
```
Comment 1 Chris Dumez 2023-10-19 09:33:32 PDT 
<rdar://117176058>
Comment 2 Chris Dumez 2023-10-19 09:36:36 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/19284
Comment 3 EWS 2023-10-19 15:12:58 PDT 
Committed 269547@main (ec2d23a0902a): <https://commits.webkit.org/269547@main>

Reviewed commits have been landed. Closing PR #19284 and removing active labels.