Title: [243120] trunk/Source/WebCore
Revision
243120
Author
[email protected]
Date
2019-03-18 17:33:16 -0700 (Mon, 18 Mar 2019)

Log Message

Crash when reloading test with async overflow scrolling
https://bugs.webkit.org/show_bug.cgi?id=195629
<rdar://problem/48814045>

Reviewed by Antoine Quint.

RenderLayerCompositor::removeFromScrollCoordinatedLayers needs to pass the Positioning
bit to make sure we remove RenderLayers added m_scrollingNodeToLayerMap for Positioning
scrolling nodes.

Fixes crashes seen in compositing/clipping/border-radius-async-overflow-non-stacking.html
and scrollingcoordinator/scrolling-tree/remove-coordinated-frame.html.

* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::~RenderLayerBacking):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::removeFromScrollCoordinatedLayers):

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (243119 => 243120)


--- trunk/Source/WebCore/ChangeLog	2019-03-19 00:31:24 UTC (rev 243119)
+++ trunk/Source/WebCore/ChangeLog	2019-03-19 00:33:16 UTC (rev 243120)
@@ -1,3 +1,23 @@
+2019-03-18  Simon Fraser  <[email protected]>
+
+        Crash when reloading test with async overflow scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=195629
+        <rdar://problem/48814045>
+
+        Reviewed by Antoine Quint.
+
+        RenderLayerCompositor::removeFromScrollCoordinatedLayers needs to pass the Positioning
+        bit to make sure we remove RenderLayers added m_scrollingNodeToLayerMap for Positioning
+        scrolling nodes.
+
+        Fixes crashes seen in compositing/clipping/border-radius-async-overflow-non-stacking.html
+        and scrollingcoordinator/scrolling-tree/remove-coordinated-frame.html.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::removeFromScrollCoordinatedLayers):
+
 2019-03-18  Devin Rousso  <[email protected]>
 
         Web Inspector: Timeline: lazily create the agent

Modified: trunk/Source/WebCore/rendering/RenderLayerBacking.cpp (243119 => 243120)


--- trunk/Source/WebCore/rendering/RenderLayerBacking.cpp	2019-03-19 00:31:24 UTC (rev 243119)
+++ trunk/Source/WebCore/rendering/RenderLayerBacking.cpp	2019-03-19 00:33:16 UTC (rev 243120)
@@ -250,6 +250,7 @@
     ASSERT(!m_viewportConstrainedNodeID);
     ASSERT(!m_scrollingNodeID);
     ASSERT(!m_frameHostingNodeID);
+    ASSERT(!m_positioningNodeID);
 
     destroyGraphicsLayers();
 }

Modified: trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp (243119 => 243120)


--- trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp	2019-03-19 00:31:24 UTC (rev 243119)
+++ trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp	2019-03-19 00:33:16 UTC (rev 243120)
@@ -3805,7 +3805,7 @@
         m_legacyScrollingLayerCoordinator->removeLayer(layer);
 #endif
 
-    detachScrollCoordinatedLayer(layer, { ScrollCoordinationRole::Scrolling, ScrollCoordinationRole::ViewportConstrained, ScrollCoordinationRole::FrameHosting });
+    detachScrollCoordinatedLayer(layer, { ScrollCoordinationRole::Scrolling, ScrollCoordinationRole::ViewportConstrained, ScrollCoordinationRole::FrameHosting, ScrollCoordinationRole::Positioning });
 }
 
 FixedPositionViewportConstraints RenderLayerCompositor::computeFixedViewportConstraints(RenderLayer& layer) const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to