Title: [237501] releases/WebKitGTK/webkit-2.22
- Revision
- 237501
- Author
- [email protected]
- Date
- 2018-10-28 06:41:47 -0700 (Sun, 28 Oct 2018)
Log Message
Merged r235956 - imported/w3c/web-platform-tests/shadow-dom/form-control-form-attribute.html hits assertion
https://bugs.webkit.org/show_bug.cgi?id=189493
Reviewed by Alex Christensen.
Source/WebCore:
The debug assertion was caused by RefPtr in FormAssociatedElement::formOwnerRemovedFromTree introduced
by r224390 and r223644 ref'ing ShadowRoot while calling removeDetachedChildren inside ~ShadowRoot.
When a form (or any other) element has more than one ref inside removeDetachedChildren,
addChildNodesToDeletionQueue calls notifyChildNodeRemoved in the tree oreder.
However, when a form associated element of this form element appears later in the tree order,
FormAssociatedElement::formOwnerRemovedFromTree can traverse up ancestors including the ShadowRoot.
Fixed the bug by using raw pointers instead. Luckily, there is no DOM mutations or other non-trivial
operations happening in this function so this should be safe.
Test: imported/w3c/web-platform-tests/shadow-dom/form-control-form-attribute.html
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::formOwnerRemovedFromTree): Fixed the bug.
LayoutTests:
Unskip the test now that it doesn't hit a debug assertion.
* TestExpectations:
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.22/LayoutTests/ChangeLog (237500 => 237501)
--- releases/WebKitGTK/webkit-2.22/LayoutTests/ChangeLog 2018-10-28 07:54:29 UTC (rev 237500)
+++ releases/WebKitGTK/webkit-2.22/LayoutTests/ChangeLog 2018-10-28 13:41:47 UTC (rev 237501)
@@ -1,3 +1,14 @@
+2018-09-11 Ryosuke Niwa <[email protected]>
+
+ imported/w3c/web-platform-tests/shadow-dom/form-control-form-attribute.html hits assertion
+ https://bugs.webkit.org/show_bug.cgi?id=189493
+
+ Reviewed by Alex Christensen.
+
+ Unskip the test now that it doesn't hit a debug assertion.
+
+ * TestExpectations:
+
2018-10-01 Alicia Boya García <[email protected]>
[MSE][GStreamer] Reset running time in PlaybackPipeline::flush()
Modified: releases/WebKitGTK/webkit-2.22/Source/WebCore/ChangeLog (237500 => 237501)
--- releases/WebKitGTK/webkit-2.22/Source/WebCore/ChangeLog 2018-10-28 07:54:29 UTC (rev 237500)
+++ releases/WebKitGTK/webkit-2.22/Source/WebCore/ChangeLog 2018-10-28 13:41:47 UTC (rev 237501)
@@ -1,3 +1,26 @@
+2018-09-11 Ryosuke Niwa <[email protected]>
+
+ imported/w3c/web-platform-tests/shadow-dom/form-control-form-attribute.html hits assertion
+ https://bugs.webkit.org/show_bug.cgi?id=189493
+
+ Reviewed by Alex Christensen.
+
+ The debug assertion was caused by RefPtr in FormAssociatedElement::formOwnerRemovedFromTree introduced
+ by r224390 and r223644 ref'ing ShadowRoot while calling removeDetachedChildren inside ~ShadowRoot.
+ When a form (or any other) element has more than one ref inside removeDetachedChildren,
+ addChildNodesToDeletionQueue calls notifyChildNodeRemoved in the tree oreder.
+
+ However, when a form associated element of this form element appears later in the tree order,
+ FormAssociatedElement::formOwnerRemovedFromTree can traverse up ancestors including the ShadowRoot.
+
+ Fixed the bug by using raw pointers instead. Luckily, there is no DOM mutations or other non-trivial
+ operations happening in this function so this should be safe.
+
+ Test: imported/w3c/web-platform-tests/shadow-dom/form-control-form-attribute.html
+
+ * html/FormAssociatedElement.cpp:
+ (WebCore::FormAssociatedElement::formOwnerRemovedFromTree): Fixed the bug.
+
2018-10-02 Alicia Boya García <[email protected]>
[MSE][GStreamer] Add h264parse to accept MP4 without stss
Modified: releases/WebKitGTK/webkit-2.22/Source/WebCore/html/FormAssociatedElement.cpp (237500 => 237501)
--- releases/WebKitGTK/webkit-2.22/Source/WebCore/html/FormAssociatedElement.cpp 2018-10-28 07:54:29 UTC (rev 237500)
+++ releases/WebKitGTK/webkit-2.22/Source/WebCore/html/FormAssociatedElement.cpp 2018-10-28 13:41:47 UTC (rev 237501)
@@ -122,8 +122,9 @@
void FormAssociatedElement::formOwnerRemovedFromTree(const Node& formRoot)
{
ASSERT(m_form);
- RefPtr<Node> rootNode = &asHTMLElement();
- for (auto ancestor = makeRefPtr(asHTMLElement().parentNode()); ancestor; ancestor = ancestor->parentNode()) {
+ // Can't use RefPtr here beacuse this function might be called inside ~ShadowRoot via addChildNodesToDeletionQueue. See webkit.org/b/189493.
+ Node* rootNode = &asHTMLElement();
+ for (auto* ancestor = asHTMLElement().parentNode(); ancestor; ancestor = ancestor->parentNode()) {
if (ancestor == m_form) {
// Form is our ancestor so we don't need to reset our owner, we also no longer
// need an id observer since we are no longer connected.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
