- Revision
- 290938
- Author
- [email protected]
- Date
- 2022-03-07 14:10:23 -0800 (Mon, 07 Mar 2022)
Log Message
Cherry-pick r290430. rdar://problem/87713597
RELEASE_ASSERT(!renderer()); in WebCore::Node::~Node() + 479 (Node.cpp:366)
https://bugs.webkit.org/show_bug.cgi?id=235380
Patch by Frédéric Wang <[email protected]> on 2022-02-24
Reviewed by Ryosuke Niwa.
Source/WebCore:
RenderTreeUpdater::tearDownRenderers() browse the composed tree to tear down descendants.
However, element with a shadow root are handled specially in
ComposedTreeIterator::ComposedTreeIterator(), they have to be handled specially by calling
a tearDownLeftoverShadowHostChildren(). This patch does the same for slot elements which
are also handled specially in ComposedTreeIterator(). It also makes names within
tearDownLeftoverShadowHostChildren() more generic. This in particular fixes a release assert
when a slot with pseudo elements children is torn down.
Test: fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::tearDownRenderers): Also call tearDownLeftoverShadowHostChildren
for a slot element and add a comment pointing to the method corresponding to these special
cases.
(WebCore::RenderTreeUpdater::tearDownLeftoverChildrenOfComposedTree): Renamed to remove "shadow host".
* rendering/updating/RenderTreeUpdater.h: Ditto.
LayoutTests:
Add non-regression test.
* fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt: Added.
* fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290430 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-613-branch/LayoutTests/ChangeLog (290937 => 290938)
--- branches/safari-613-branch/LayoutTests/ChangeLog 2022-03-07 22:10:19 UTC (rev 290937)
+++ branches/safari-613-branch/LayoutTests/ChangeLog 2022-03-07 22:10:23 UTC (rev 290938)
@@ -1,5 +1,55 @@
2022-03-07 Russell Epstein <[email protected]>
+ Cherry-pick r290430. rdar://problem/87713597
+
+ RELEASE_ASSERT(!renderer()); in WebCore::Node::~Node() + 479 (Node.cpp:366)
+ https://bugs.webkit.org/show_bug.cgi?id=235380
+
+ Patch by Frédéric Wang <[email protected]> on 2022-02-24
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ RenderTreeUpdater::tearDownRenderers() browse the composed tree to tear down descendants.
+ However, element with a shadow root are handled specially in
+ ComposedTreeIterator::ComposedTreeIterator(), they have to be handled specially by calling
+ a tearDownLeftoverShadowHostChildren(). This patch does the same for slot elements which
+ are also handled specially in ComposedTreeIterator(). It also makes names within
+ tearDownLeftoverShadowHostChildren() more generic. This in particular fixes a release assert
+ when a slot with pseudo elements children is torn down.
+
+ Test: fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html
+
+ * rendering/updating/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::tearDownRenderers): Also call tearDownLeftoverShadowHostChildren
+ for a slot element and add a comment pointing to the method corresponding to these special
+ cases.
+ (WebCore::RenderTreeUpdater::tearDownLeftoverChildrenOfComposedTree): Renamed to remove "shadow host".
+ * rendering/updating/RenderTreeUpdater.h: Ditto.
+
+ LayoutTests:
+
+ Add non-regression test.
+
+ * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt: Added.
+ * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290430 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2022-02-24 Frédéric Wang <[email protected]>
+
+ RELEASE_ASSERT(!renderer()); in WebCore::Node::~Node() + 479 (Node.cpp:366)
+ https://bugs.webkit.org/show_bug.cgi?id=235380
+
+ Reviewed by Ryosuke Niwa.
+
+ Add non-regression test.
+
+ * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt: Added.
+ * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html: Added.
+
+2022-03-07 Russell Epstein <[email protected]>
+
Cherry-pick r290385. rdar://problem/70464703
[Subpixel] imported/w3c/web-platform-tests/css/css-flexbox/auto-margins-001.html fails at certain font sizes
Added: branches/safari-613-branch/LayoutTests/fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt (0 => 290938)
--- branches/safari-613-branch/LayoutTests/fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt (rev 0)
+++ branches/safari-613-branch/LayoutTests/fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt 2022-03-07 22:10:23 UTC (rev 290938)
@@ -0,0 +1 @@
+This test passes if it does not crash.
Added: branches/safari-613-branch/LayoutTests/fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html (0 => 290938)
--- branches/safari-613-branch/LayoutTests/fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html (rev 0)
+++ branches/safari-613-branch/LayoutTests/fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html 2022-03-07 22:10:23 UTC (rev 290938)
@@ -0,0 +1,19 @@
+<body></body>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ let div0 = document.createElement('div');
+ let slot0 = document.createElement('slot');
+ div0.append(slot0);
+ let slot1 = document.createElement('slot');
+ div0.append(slot1);
+ slot1.append(document.createElement('q'));
+ let div1 = document.createElement('div');
+ document.body.append(div1);
+ div1.append('');
+ div1.attachShadow({mode: 'open'}).append(div0);
+ document.body.offsetTop;
+ slot0.remove();
+ slot1.remove();
+ document.body.innerHTML = "This test passes if it does not crash.";
+</script>
Modified: branches/safari-613-branch/Source/WebCore/ChangeLog (290937 => 290938)
--- branches/safari-613-branch/Source/WebCore/ChangeLog 2022-03-07 22:10:19 UTC (rev 290937)
+++ branches/safari-613-branch/Source/WebCore/ChangeLog 2022-03-07 22:10:23 UTC (rev 290938)
@@ -1,5 +1,67 @@
2022-03-07 Russell Epstein <[email protected]>
+ Cherry-pick r290430. rdar://problem/87713597
+
+ RELEASE_ASSERT(!renderer()); in WebCore::Node::~Node() + 479 (Node.cpp:366)
+ https://bugs.webkit.org/show_bug.cgi?id=235380
+
+ Patch by Frédéric Wang <[email protected]> on 2022-02-24
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ RenderTreeUpdater::tearDownRenderers() browse the composed tree to tear down descendants.
+ However, element with a shadow root are handled specially in
+ ComposedTreeIterator::ComposedTreeIterator(), they have to be handled specially by calling
+ a tearDownLeftoverShadowHostChildren(). This patch does the same for slot elements which
+ are also handled specially in ComposedTreeIterator(). It also makes names within
+ tearDownLeftoverShadowHostChildren() more generic. This in particular fixes a release assert
+ when a slot with pseudo elements children is torn down.
+
+ Test: fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html
+
+ * rendering/updating/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::tearDownRenderers): Also call tearDownLeftoverShadowHostChildren
+ for a slot element and add a comment pointing to the method corresponding to these special
+ cases.
+ (WebCore::RenderTreeUpdater::tearDownLeftoverChildrenOfComposedTree): Renamed to remove "shadow host".
+ * rendering/updating/RenderTreeUpdater.h: Ditto.
+
+ LayoutTests:
+
+ Add non-regression test.
+
+ * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt: Added.
+ * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290430 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2022-02-24 Frédéric Wang <[email protected]>
+
+ RELEASE_ASSERT(!renderer()); in WebCore::Node::~Node() + 479 (Node.cpp:366)
+ https://bugs.webkit.org/show_bug.cgi?id=235380
+
+ Reviewed by Ryosuke Niwa.
+
+ RenderTreeUpdater::tearDownRenderers() browse the composed tree to tear down descendants.
+ However, element with a shadow root are handled specially in
+ ComposedTreeIterator::ComposedTreeIterator(), they have to be handled specially by calling
+ a tearDownLeftoverShadowHostChildren(). This patch does the same for slot elements which
+ are also handled specially in ComposedTreeIterator(). It also makes names within
+ tearDownLeftoverShadowHostChildren() more generic. This in particular fixes a release assert
+ when a slot with pseudo elements children is torn down.
+
+ Test: fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html
+
+ * rendering/updating/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::tearDownRenderers): Also call tearDownLeftoverShadowHostChildren
+ for a slot element and add a comment pointing to the method corresponding to these special
+ cases.
+ (WebCore::RenderTreeUpdater::tearDownLeftoverChildrenOfComposedTree): Renamed to remove "shadow host".
+ * rendering/updating/RenderTreeUpdater.h: Ditto.
+
+2022-03-07 Russell Epstein <[email protected]>
+
Cherry-pick r290356. rdar://problem/85765536
Crash when calling WEBGL_lose_context.loseContext() after the context has been lost
Modified: branches/safari-613-branch/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp (290937 => 290938)
--- branches/safari-613-branch/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2022-03-07 22:10:19 UTC (rev 290937)
+++ branches/safari-613-branch/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2022-03-07 22:10:23 UTC (rev 290938)
@@ -576,8 +576,9 @@
auto styleable = Styleable::fromElement(element);
// Make sure we don't leave any renderers behind in nodes outside the composed tree.
- if (element.shadowRoot())
- tearDownLeftoverShadowHostChildren(element, builder);
+ // See ComposedTreeIterator::ComposedTreeIterator().
+ if (is<HTMLSlotElement>(element) || element.shadowRoot())
+ tearDownLeftoverChildrenOfComposedTree(element, builder);
switch (teardownType) {
case TeardownType::FullAfterSlotChange:
@@ -653,17 +654,17 @@
}
}
-void RenderTreeUpdater::tearDownLeftoverShadowHostChildren(Element& host, RenderTreeBuilder& builder)
+void RenderTreeUpdater::tearDownLeftoverChildrenOfComposedTree(Element& element, RenderTreeBuilder& builder)
{
- for (auto* hostChild = host.firstChild(); hostChild; hostChild = hostChild->nextSibling()) {
- if (!hostChild->renderer())
+ for (auto* child = element.firstChild(); child; child = child->nextSibling()) {
+ if (!child->renderer())
continue;
- if (is<Text>(*hostChild)) {
- tearDownTextRenderer(downcast<Text>(*hostChild), builder);
+ if (is<Text>(*child)) {
+ tearDownTextRenderer(downcast<Text>(*child), builder);
continue;
}
- if (is<Element>(*hostChild))
- tearDownRenderers(downcast<Element>(*hostChild), TeardownType::Full, builder);
+ if (is<Element>(*child))
+ tearDownRenderers(downcast<Element>(*child), TeardownType::Full, builder);
}
}
Modified: branches/safari-613-branch/Source/WebCore/rendering/updating/RenderTreeUpdater.h (290937 => 290938)
--- branches/safari-613-branch/Source/WebCore/rendering/updating/RenderTreeUpdater.h 2022-03-07 22:10:19 UTC (rev 290937)
+++ branches/safari-613-branch/Source/WebCore/rendering/updating/RenderTreeUpdater.h 2022-03-07 22:10:23 UTC (rev 290938)
@@ -91,7 +91,7 @@
enum class TeardownType { Full, FullAfterSlotChange, RendererUpdate, RendererUpdateCancelingAnimations };
static void tearDownRenderers(Element&, TeardownType, RenderTreeBuilder&);
static void tearDownTextRenderer(Text&, RenderTreeBuilder&);
- static void tearDownLeftoverShadowHostChildren(Element&, RenderTreeBuilder&);
+ static void tearDownLeftoverChildrenOfComposedTree(Element&, RenderTreeBuilder&);
static void tearDownLeftoverPaginationRenderersIfNeeded(Element&, RenderTreeBuilder&);
RenderView& renderView();
