Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f9ade7a024fb0e64b2f8898e20d9c580ffd52020
https://github.com/WebKit/WebKit/commit/f9ade7a024fb0e64b2f8898e20d9c580ffd52020
Author: Sammy Gill <[email protected]>
Date: 2026-05-15 (Fri, 15 May 2026)
Changed paths:
M Source/WebCore/rendering/RelayoutScopeForScrollbarChange.cpp
M Source/WebCore/rendering/RenderBlock.cpp
Log Message:
-----------
SubtreeScrollbarChangesStateScope can outlive LayoutScope.
https://bugs.webkit.org/show_bug.cgi?id=314822
rdar://problem/177077505
Reviewed by Alan Baradlay.
If LayoutScope is destroyed before SubtreeScrollbarChangesStateScope we
can end up in an odd state. SubtreeScrollbarChangesStateScope is
supposed to be used to track any changes in descendants' scrollbars
during the initial layout of the renderer so after this is done we
should not need to keep it around any longer.
Otherwise, when that renderer's LayoutScope destructor runs and sets up a
RelayoutScopeForScrollbarChange, it will see the
SubtreeScrollbarChangesStateScope
still alive, add the renderer to the list of renderers to process later
(which is already wrong because we only care about its descendants), but
not doing anything with it.
Restructure RenderBlock::layout() so the scrollbar-tracking guards are
nested inside the LayoutScope branch rather than declared alongside it
via std::optional. The three cases (track + handle / handle only /
neither) are now spelled out explicitly, which removes the optional, the
intermediate willHandleDescendantScrollbarChanges flag, and the reliance
on reverse declaration order to get destruction sequencing right. In the
tracking branch, destruction now flows handler -> scrollbar state scope ->
LayoutScope.
Also add an assert in ~RelayoutScopeForScrollbarChange that the block
recording a scrollbar change is not the subtree root itself.
While I have not been able to find any sort of functional issue with
this on trunk, we will need to get this ordering correct to solve a bug
in a follow up patch.
Canonical link: https://commits.webkit.org/313323@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
