Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 202580d81145c23c273cc4d3a82dae062c449321
https://github.com/WebKit/WebKit/commit/202580d81145c23c273cc4d3a82dae062c449321
Author: Anne van Kesteren <[email protected]>
Date: 2025-12-02 (Tue, 02 Dec 2025)
Changed paths:
A
LayoutTests/fast/html/HTMLPluginElement-renderer-destroyed-crash-expected.txt
A LayoutTests/fast/html/HTMLPluginElement-renderer-destroyed-crash.html
M Source/WebCore/html/HTMLPlugInElement.cpp
Log Message:
-----------
REGRESSION(302165@main) Crash under HTMLPlugInElement::defaultEventHandler()
https://bugs.webkit.org/show_bug.cgi?id=303369
rdar://165336179
Reviewed by Ryosuke Niwa and Chris Dumez.
Reduce scope of renderer variable to what's strictly needed as it's a
CheckedPtr.
Thanks to Rob Buis for the fix and test! The only additional change
here is to also clear renderer before handleEvent() as that could
invalidate it as well.
Canonical link: https://commits.webkit.org/303752@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
