Title: [236440] trunk
- Revision
- 236440
- Author
- [email protected]
- Date
- 2018-09-24 16:11:36 -0700 (Mon, 24 Sep 2018)
Log Message
imported/w3c/web-platform-tests/shadow-dom/slotchange.html is a flaky failure
https://bugs.webkit.org/show_bug.cgi?id=167652
Reviewed by Saam Barati.
Source/WebCore:
The bug appears to be caused by the JS wrappers of slot elements getting prematurely collected.
Deployed GCReachableRef introduced in r236376 to fix the bug.
Test: fast/shadow-dom/signal-slot-list-retains-js-wrappers.html
* dom/MutationObserver.cpp:
(WebCore::signalSlotList):
(WebCore::MutationObserver::enqueueSlotChangeEvent):
(WebCore::MutationObserver::notifyMutationObservers):
LayoutTests:
Added a regression test for signaling a lot of slot elements.
* fast/shadow-dom/signal-slot-list-retains-js-wrappers-expected.txt: Added.
* fast/shadow-dom/signal-slot-list-retains-js-wrappers.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (236439 => 236440)
--- trunk/LayoutTests/ChangeLog 2018-09-24 23:10:01 UTC (rev 236439)
+++ trunk/LayoutTests/ChangeLog 2018-09-24 23:11:36 UTC (rev 236440)
@@ -1,5 +1,17 @@
2018-09-24 Ryosuke Niwa <[email protected]>
+ imported/w3c/web-platform-tests/shadow-dom/slotchange.html is a flaky failure
+ https://bugs.webkit.org/show_bug.cgi?id=167652
+
+ Reviewed by Saam Barati.
+
+ Added a regression test for signaling a lot of slot elements.
+
+ * fast/shadow-dom/signal-slot-list-retains-js-wrappers-expected.txt: Added.
+ * fast/shadow-dom/signal-slot-list-retains-js-wrappers.html: Added.
+
+2018-09-24 Ryosuke Niwa <[email protected]>
+
Release assert when using paper-textarea due to autocorrect IDL attribute missing CEReactions
https://bugs.webkit.org/show_bug.cgi?id=174629
<rdar://problem/33407620>
Added: trunk/LayoutTests/fast/shadow-dom/signal-slot-list-retains-js-wrappers-expected.txt (0 => 236440)
--- trunk/LayoutTests/fast/shadow-dom/signal-slot-list-retains-js-wrappers-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/signal-slot-list-retains-js-wrappers-expected.txt 2018-09-24 23:11:36 UTC (rev 236440)
@@ -0,0 +1,9 @@
+This tests signaling a slot change on lots of slot elements in a single microtask.
+WebKit should retain the JS wrappers of those elements and fire the slotchange event.
+
+PASS
+PASS
+PASS
+PASS
+PASS
+
Added: trunk/LayoutTests/fast/shadow-dom/signal-slot-list-retains-js-wrappers.html (0 => 236440)
--- trunk/LayoutTests/fast/shadow-dom/signal-slot-list-retains-js-wrappers.html (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/signal-slot-list-retains-js-wrappers.html 2018-09-24 23:11:36 UTC (rev 236440)
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests signaling a slot change on lots of slot elements in a single microtask.<br>
+WebKit should retain the JS wrappers of those elements and fire the slotchange event.</p>
+<pre id="log"></pre>
+<script>
+
+function triggerSlotChange(host, shadowRoot, slotchangeListener) {
+ shadowRoot.innerHTML = '<div><slot></slot></div>';
+ shadowRoot.querySelector('slot').addEventListener('slotchange', slotchangeListener);
+ host.innerHTML = 'hello';
+ shadowRoot.innerHTML = '';
+ host.innerHTML = '';
+}
+
+function runTest() {
+ let slotchangeCount = 0;
+ const iteration = window.GCController ? 5 : 500;
+ const host = document.createElement('div');
+ const shadowRoot = host.attachShadow({mode: 'closed'});
+ for (let i = 0; i < iteration; i++) {
+ triggerSlotChange(host, shadowRoot, () => slotchangeCount++);
+ if (window.GCController)
+ GCController.collect();
+ else {
+ const x = new Array(100);
+ for (let j = 0; j < 100; j++)
+ x[j] = new Array;
+ }
+ }
+ return new Promise((resolve) => {
+ setTimeout(() => {
+ log.textContent += slotchangeCount === iteration ? 'PASS' : `FAIL - expected ${iteration} slotchange events but got ${slotchangeCount}`;
+ log.textContent += '\n';
+ resolve();
+ }, 0);
+ });
+}
+
+const promises = [];
+const outerRuns = window.GCController ? 5 : 20;
+for (let i = 0; i < outerRuns; i++)
+ promises[i] = runTest();
+
+if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+ Promise.all(promises).then(() => testRunner.notifyDone());
+}
+
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (236439 => 236440)
--- trunk/Source/WebCore/ChangeLog 2018-09-24 23:10:01 UTC (rev 236439)
+++ trunk/Source/WebCore/ChangeLog 2018-09-24 23:11:36 UTC (rev 236440)
@@ -1,5 +1,22 @@
2018-09-24 Ryosuke Niwa <[email protected]>
+ imported/w3c/web-platform-tests/shadow-dom/slotchange.html is a flaky failure
+ https://bugs.webkit.org/show_bug.cgi?id=167652
+
+ Reviewed by Saam Barati.
+
+ The bug appears to be caused by the JS wrappers of slot elements getting prematurely collected.
+ Deployed GCReachableRef introduced in r236376 to fix the bug.
+
+ Test: fast/shadow-dom/signal-slot-list-retains-js-wrappers.html
+
+ * dom/MutationObserver.cpp:
+ (WebCore::signalSlotList):
+ (WebCore::MutationObserver::enqueueSlotChangeEvent):
+ (WebCore::MutationObserver::notifyMutationObservers):
+
+2018-09-24 Ryosuke Niwa <[email protected]>
+
Release assert when using paper-textarea due to autocorrect IDL attribute missing CEReactions
https://bugs.webkit.org/show_bug.cgi?id=174629
<rdar://problem/33407620>
Modified: trunk/Source/WebCore/dom/MutationObserver.cpp (236439 => 236440)
--- trunk/Source/WebCore/dom/MutationObserver.cpp 2018-09-24 23:10:01 UTC (rev 236439)
+++ trunk/Source/WebCore/dom/MutationObserver.cpp 2018-09-24 23:11:36 UTC (rev 236440)
@@ -34,6 +34,7 @@
#include "MutationObserver.h"
#include "Document.h"
+#include "GCReachableRef.h"
#include "HTMLSlotElement.h"
#include "Microtasks.h"
#include "MutationCallback.h"
@@ -151,9 +152,9 @@
}
// https://dom.spec.whatwg.org/#signal-slot-list
-static Vector<RefPtr<HTMLSlotElement>>& signalSlotList()
+static Vector<GCReachableRef<HTMLSlotElement>>& signalSlotList()
{
- static NeverDestroyed<Vector<RefPtr<HTMLSlotElement>>> list;
+ static NeverDestroyed<Vector<GCReachableRef<HTMLSlotElement>>> list;
return list;
}
@@ -189,8 +190,8 @@
void MutationObserver::enqueueSlotChangeEvent(HTMLSlotElement& slot)
{
ASSERT(isMainThread());
- ASSERT(!signalSlotList().contains(&slot));
- signalSlotList().append(&slot);
+ ASSERT(signalSlotList().findMatching([&slot](auto& entry) { return entry.ptr() == &slot; }) == notFound);
+ signalSlotList().append(slot);
queueMutationObserverCompoundMicrotask();
}
@@ -273,7 +274,7 @@
// 3. Let signalList be a copy of unit of related similar-origin browsing contexts' signal slot list.
// 4. Empty unit of related similar-origin browsing contexts' signal slot list.
- Vector<RefPtr<HTMLSlotElement>> slotList;
+ Vector<GCReachableRef<HTMLSlotElement>> slotList;
if (!signalSlotList().isEmpty()) {
slotList.swap(signalSlotList());
for (auto& slot : slotList)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
