Diff
Modified: trunk/Source/WebCore/ChangeLog (228237 => 228238)
--- trunk/Source/WebCore/ChangeLog 2018-02-07 19:33:27 UTC (rev 228237)
+++ trunk/Source/WebCore/ChangeLog 2018-02-07 19:52:45 UTC (rev 228238)
@@ -1,3 +1,28 @@
+2018-02-07 Zalan Bujtas <[email protected]>
+
+ [RenderTreeBuilder] Remove RenderElement::destroyLeftoverChildren.
+ https://bugs.webkit.org/show_bug.cgi?id=182518
+ <rdar://problem/37256035>
+
+ Reviewed by Antti Koivisto.
+
+ Remove leftover children before we call takeChild() on the parent (as opposed to when
+ we finally call destroy() on the parent).
+ This patch also explicitly destroys the top level pagination renderers.
+
+ Covered by existing tests.
+
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::removeAndDestroyChild):
+ (WebCore::RenderElement::destroyLeftoverChildren): Deleted.
+ * rendering/RenderElement.h:
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::destroy):
+ * rendering/updating/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::tearDownRenderers):
+ (WebCore::RenderTreeUpdater::tearDownLeftoverPaginationRenderersIfNeeded):
+ * rendering/updating/RenderTreeUpdater.h:
+
2018-02-07 Daniel Bates <[email protected]>
Log error when authentication challenge is blocked due to an insecure request
Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (228237 => 228238)
--- trunk/Source/WebCore/rendering/RenderElement.cpp 2018-02-07 19:33:27 UTC (rev 228237)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp 2018-02-07 19:52:45 UTC (rev 228238)
@@ -136,6 +136,7 @@
RenderElement::~RenderElement()
{
// Do not add any code here. Add it to willBeDestroyed() instead.
+ ASSERT(!m_firstChild);
}
RenderPtr<RenderElement> RenderElement::createFor(Element& element, RenderStyle&& style, RendererCreationType creationType)
@@ -487,18 +488,18 @@
void RenderElement::removeAndDestroyChild(RenderTreeBuilder& builder, RenderObject& oldChild)
{
+ if (is<RenderElement>(oldChild)) {
+ auto& child = downcast<RenderElement>(oldChild);
+ while (child.firstChild()) {
+ auto& firstChild = *child.firstChild();
+ if (auto* node = firstChild.node())
+ node->setRenderer(nullptr);
+ child.removeAndDestroyChild(builder, firstChild);
+ }
+ }
auto toDestroy = takeChild(builder, oldChild);
}
-void RenderElement::destroyLeftoverChildren()
-{
- while (m_firstChild) {
- if (auto* node = m_firstChild->node())
- node->setRenderer(nullptr);
- removeAndDestroyChild(*RenderTreeBuilder::current(), *m_firstChild);
- }
-}
-
RenderObject* RenderElement::attachRendererInternal(RenderPtr<RenderObject> child, RenderObject* beforeChild)
{
child->setParent(this);
Modified: trunk/Source/WebCore/rendering/RenderElement.h (228237 => 228238)
--- trunk/Source/WebCore/rendering/RenderElement.h 2018-02-07 19:33:27 UTC (rev 228237)
+++ trunk/Source/WebCore/rendering/RenderElement.h 2018-02-07 19:52:45 UTC (rev 228238)
@@ -228,7 +228,6 @@
bool isFirstLetter() const { return m_isFirstLetter; }
void setIsFirstLetter() { m_isFirstLetter = true; }
- void destroyLeftoverChildren();
RenderObject* attachRendererInternal(RenderPtr<RenderObject> child, RenderObject* beforeChild);
RenderPtr<RenderObject> detachRendererInternal(RenderObject&);
Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (228237 => 228238)
--- trunk/Source/WebCore/rendering/RenderObject.cpp 2018-02-07 19:33:27 UTC (rev 228237)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp 2018-02-07 19:52:45 UTC (rev 228238)
@@ -1477,9 +1477,6 @@
RELEASE_ASSERT(!m_previous);
RELEASE_ASSERT(!m_bitfields.beingDestroyed());
- if (is<RenderElement>(*this))
- downcast<RenderElement>(*this).destroyLeftoverChildren();
-
m_bitfields.setBeingDestroyed(true);
#if PLATFORM(IOS)
Modified: trunk/Source/WebCore/rendering/RenderView.cpp (228237 => 228238)
--- trunk/Source/WebCore/rendering/RenderView.cpp 2018-02-07 19:33:27 UTC (rev 228237)
+++ trunk/Source/WebCore/rendering/RenderView.cpp 2018-02-07 19:52:45 UTC (rev 228238)
@@ -47,6 +47,7 @@
#include "RenderMultiColumnSet.h"
#include "RenderMultiColumnSpannerPlaceholder.h"
#include "RenderQuote.h"
+#include "RenderTreeBuilder.h"
#include "RenderWidget.h"
#include "ScrollbarTheme.h"
#include "Settings.h"
@@ -613,6 +614,12 @@
void RenderView::willBeDestroyed()
{
RenderBlockFlow::willBeDestroyed();
+ // FIXME: This is a workaround for leftover content (see webkit.org/b/182547).
+ if (firstChild()) {
+ RenderTreeBuilder builder(*this);
+ while (firstChild())
+ removeAndDestroyChild(builder, *firstChild());
+ }
ASSERT_WITH_MESSAGE(m_rendererCount == 1, "All other renderers in this render tree should have been destroyed");
}
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp (228237 => 228238)
--- trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2018-02-07 19:33:27 UTC (rev 228237)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2018-02-07 19:52:45 UTC (rev 228238)
@@ -579,6 +579,8 @@
}
pop(0);
+
+ tearDownLeftoverPaginationRenderersIfNeeded(root);
}
void RenderTreeUpdater::tearDownTextRenderer(Text& text)
@@ -590,6 +592,18 @@
text.setRenderer(nullptr);
}
+void RenderTreeUpdater::tearDownLeftoverPaginationRenderersIfNeeded(Element& root)
+{
+ if (&root != root.document().documentElement())
+ return;
+ for (auto* child = root.document().renderView()->firstChild(); child;) {
+ auto* nextSibling = child->nextSibling();
+ if (is<RenderMultiColumnFlow>(*child) || is<RenderMultiColumnSet>(*child))
+ RenderTreeBuilder::current()->removeFromParentAndDestroyCleaningUpAnonymousWrappers(*child);
+ child = nextSibling;
+ }
+}
+
void RenderTreeUpdater::tearDownLeftoverShadowHostChildren(Element& host)
{
for (auto* hostChild = host.firstChild(); hostChild; hostChild = hostChild->nextSibling()) {
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.h (228237 => 228238)
--- trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.h 2018-02-07 19:33:27 UTC (rev 228237)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.h 2018-02-07 19:52:45 UTC (rev 228238)
@@ -89,6 +89,7 @@
static void tearDownRenderers(Element&, TeardownType);
static void tearDownTextRenderer(Text&);
static void tearDownLeftoverShadowHostChildren(Element&);
+ static void tearDownLeftoverPaginationRenderersIfNeeded(Element&);
RenderView& renderView();
