⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 202324 in webkit


Ignore:
Timestamp:
Jun 21, 2016, 10:52:05 PM (10 years ago)
Author:
commit-queue@webkit.org
Message:

:hover CSS pseudo-class sometimes keeps matching ever after mouse has left the element
​https://bugs.webkit.org/show_bug.cgi?id=158340

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-06-21
Reviewed by Simon Fraser.

Source/WebCore:

When removing a hovered subtree from the document, we were getting
into an inconsistent state where m_hoveredElement is in the detached
subtree and we have no way of clearing the existing IsHovered flags.

What happens is:
-The root "a" has an child "b" that is hovered.
-"a" starts being removed from the tree, its renderer is destroyed.
-RenderTreeUpdater::tearDownRenderers() pushes "a" on the teardownStack

and calls hoveredElementDidDetach().

-hoveredElementDidDetach() is called with "a". "a" is not the hovered

element, the function does nothing.

-RenderTreeUpdater::tearDownRenderers() pushes "b" on the teardownStack

and calls hoveredElementDidDetach().

-hoveredElementDidDetach() is called with "b". The next parent with a renderer

is "a", m_hoveredElement is set to "a".

-"a"'s parent is set to nullptr.

-> We have a m_hoveredElement on the root of a detached tree, making

it impossible to clear the real dirty tree.

This patch changes the order in which we clear the flags.
It is done in the order in which we clear the renderers to ensure
the last element with a dead renderer is the last to update m_hoveredElement.

Tests: fast/css/ancestor-of-hovered-element-detached.html

fast/css/ancestor-of-hovered-element-removed.html

  • Source/WebCore/style/RenderTreeUpdater.cpp:

LayoutTests:

  • fast/css/ancestor-of-hovered-element-detached-expected.txt: Added.
  • fast/css/ancestor-of-hovered-element-detached.html: Added.
  • fast/css/ancestor-of-hovered-element-removed-expected.txt: Added.
  • fast/css/ancestor-of-hovered-element-removed.html: Added.
Location:
trunk
Files:
4 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r202322 r202324  
     12016-06-21  Benjamin Poulain  <bpoulain@apple.com>
     2
     3        :hover CSS pseudo-class sometimes keeps matching ever after mouse has left the element
     4        https://bugs.webkit.org/show_bug.cgi?id=158340
     5
     6        Reviewed by Simon Fraser.
     7
     8        * fast/css/ancestor-of-hovered-element-detached-expected.txt: Added.
     9        * fast/css/ancestor-of-hovered-element-detached.html: Added.
     10        * fast/css/ancestor-of-hovered-element-removed-expected.txt: Added.
     11        * fast/css/ancestor-of-hovered-element-removed.html: Added.
     12
    1132016-06-21  Alexey Proskuryakov  <ap@apple.com>
    214

  • trunk/LayoutTests/platform/ios-simulator/TestExpectations

    r202292 r202324  
    13901390fast/css-generated-content/table-parts-before-and-after.html [ Failure ]
    13911391fast/css/absolute-child-with-percent-height-inside-relative-parent.html [ Failure ]
     1392fast/css/ancestor-of-hovered-element-detached.html [ Failure ]
     1393fast/css/ancestor-of-hovered-element-removed.html [ Failure ]
    13921394fast/css/background-image-with-baseurl.html [ Failure ]
    13931395fast/css/button-height.html [ Failure ]

  • trunk/Source/WebCore/ChangeLog

    r202323 r202324  
     12016-06-21  Benjamin Poulain  <bpoulain@apple.com>
     2
     3        :hover CSS pseudo-class sometimes keeps matching ever after mouse has left the element
     4        https://bugs.webkit.org/show_bug.cgi?id=158340
     5
     6        Reviewed by Simon Fraser.
     7
     8        When removing a hovered subtree from the document, we were getting
     9        into an inconsistent state where m_hoveredElement is in the detached
     10        subtree and we have no way of clearing the existing IsHovered flags.
     11
     12        What happens is:
     13        -The root "a" has an child "b" that is hovered.
     14        -"a" starts being removed from the tree, its renderer is destroyed.
     15        -RenderTreeUpdater::tearDownRenderers() pushes "a" on the teardownStack
     16         and calls hoveredElementDidDetach().
     17        -hoveredElementDidDetach() is called with "a". "a" is not the hovered
     18         element, the function does nothing.
     19        -RenderTreeUpdater::tearDownRenderers() pushes "b" on the teardownStack
     20         and calls hoveredElementDidDetach().
     21        -hoveredElementDidDetach() is called with "b". The next parent with a renderer
     22         is "a", m_hoveredElement is set to "a".
     23        -"a"'s parent is set to nullptr.
     24
     25        -> We have a m_hoveredElement on the root of a detached tree, making
     26           it impossible to clear the real dirty tree.
     27
     28        This patch changes the order in which we clear the flags.
     29        It is done in the order in which we clear the renderers to ensure
     30        the last element with a dead renderer is the last to update m_hoveredElement.
     31
     32        Tests: fast/css/ancestor-of-hovered-element-detached.html
     33               fast/css/ancestor-of-hovered-element-removed.html
     34
     35        * Source/WebCore/style/RenderTreeUpdater.cpp:
     36
    1372016-06-21  Youenn Fablet  <youennf@gmail.com>
    238

  • trunk/Source/WebCore/style/RenderTreeUpdater.cpp

    r201393 r202324  
    519519        if (element.hasCustomStyleResolveCallbacks())
    520520            element.willDetachRenderers();
    521         if (teardownType != TeardownType::KeepHoverAndActive)
    522             element.clearHoverAndActiveStatusBeforeDetachingRenderer();
    523         element.clearStyleDerivedDataBeforeDetachingRenderer();
    524 
    525521        teardownStack.append(&element);
    526522    };
    … …  
    529525        while (teardownStack.size() > depth) {
    530526            auto& element = *teardownStack.takeLast();
     527
     528            if (teardownType != TeardownType::KeepHoverAndActive)
     529                element.clearHoverAndActiveStatusBeforeDetachingRenderer();
     530            element.clearStyleDerivedDataBeforeDetachingRenderer();
    531531
    532532            if (auto* renderer = element.renderer()) {
Note: See TracChangeset for help on using the changeset viewer.