Title: [224336] trunk/Source/WebCore
- Revision
- 224336
- Author
- [email protected]
- Date
- 2017-11-02 09:55:26 -0700 (Thu, 02 Nov 2017)
Log Message
Clear Node renderer pointer when destroying RenderObject
https://bugs.webkit.org/show_bug.cgi?id=179112
Reviewed by Zalan Bujtas.
Make sure we don't leave renderer pointers behind in Nodes.
This could be done with WeakPtr but that would add extra indirection between DOM and render tree.
* rendering/RenderObject.cpp:
(WebCore::RenderObject::willBeDestroyed):
Null the node renderer pointer.
With continuations we have a case where renderer points to a node that has a different renderer.
This is is ok as we know no node points to a continuation (they should really be anonymous renderers).
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (224335 => 224336)
--- trunk/Source/WebCore/ChangeLog 2017-11-02 16:38:38 UTC (rev 224335)
+++ trunk/Source/WebCore/ChangeLog 2017-11-02 16:55:26 UTC (rev 224336)
@@ -1,5 +1,22 @@
2017-11-02 Antti Koivisto <[email protected]>
+ Clear Node renderer pointer when destroying RenderObject
+ https://bugs.webkit.org/show_bug.cgi?id=179112
+
+ Reviewed by Zalan Bujtas.
+
+ Make sure we don't leave renderer pointers behind in Nodes.
+ This could be done with WeakPtr but that would add extra indirection between DOM and render tree.
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::willBeDestroyed):
+
+ Null the node renderer pointer.
+ With continuations we have a case where renderer points to a node that has a different renderer.
+ This is is ok as we know no node points to a continuation (they should really be anonymous renderers).
+
+2017-11-02 Antti Koivisto <[email protected]>
+
Remove empty continuations in RenderObject::removeFromParentAndDestroyCleaningUpAnonymousWrappers
https://bugs.webkit.org/show_bug.cgi?id=179014
Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (224335 => 224336)
--- trunk/Source/WebCore/rendering/RenderObject.cpp 2017-11-02 16:38:38 UTC (rev 224335)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp 2017-11-02 16:55:26 UTC (rev 224336)
@@ -1434,6 +1434,13 @@
if (AXObjectCache* cache = document().existingAXObjectCache())
cache->remove(this);
+ if (auto* node = this->node()) {
+ // FIXME: Continuations should be anonymous.
+ ASSERT(!node->renderer() || node->renderer() == this || (is<RenderElement>(*this) && downcast<RenderElement>(*this).isContinuation()));
+ if (node->renderer() == this)
+ node->setRenderer(nullptr);
+ }
+
removeRareData();
}
@@ -1518,6 +1525,7 @@
#endif
willBeDestroyed();
+
if (is<RenderWidget>(*this)) {
downcast<RenderWidget>(*this).deref();
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
