Changeset 214810 in webkit

Timestamp:

Apr 3, 2017 10:12:27 AM (7 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r214599 - Disconnecting a HTMLObjectElement does not always unload its content document
​https://bugs.webkit.org/show_bug.cgi?id=169606

Reviewed by Andy Estes.

Source/WebCore:

When removing a node, we first disconnect all subframes then update the focused element as we remove each child.
However, when the removed element is a focused object element with a content document, removeFocusedNodeOfSubtree
can update the style tree synchronously inside Document::setFocusedElement, and reload the document.

Avoid this by instantiating a SubframeLoadingDisabler on the parent of the focused element.

Test: fast/dom/removing-focused-object-element.html

• dom/Document.cpp:

(WebCore::Document::removeFocusedNodeOfSubtree):

LayoutTests:

Add a regression test.

• fast/dom/removing-focused-object-element-expected.txt: Added.
• fast/dom/removing-focused-object-element.html: Added.

Location:

releases/WebKitGTK/webkit-2.16

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/removing-focused-object-element-expected.txt (added)
• LayoutTests/fast/dom/removing-focused-object-element.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Document.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog

@@ +1 @@
+2017-03-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Disconnecting a HTMLObjectElement does not always unload its content document
+        https://bugs.webkit.org/show_bug.cgi?id=169606
+
+        Reviewed by Andy Estes.
+
+        Add a regression test.
+
+        * fast/dom/removing-focused-object-element-expected.txt: Added.
+        * fast/dom/removing-focused-object-element.html: Added.
+
 2017-03-29  Zalan Bujtas  <zalan@apple.com>
 

releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog

@@ +1 @@
+2017-03-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Disconnecting a HTMLObjectElement does not always unload its content document
+        https://bugs.webkit.org/show_bug.cgi?id=169606
+
+        Reviewed by Andy Estes.
+
+        When removing a node, we first disconnect all subframes then update the focused element as we remove each child.
+        However, when the removed element is a focused object element with a content document, removeFocusedNodeOfSubtree
+        can update the style tree synchronously inside Document::setFocusedElement, and reload the document.
+
+        Avoid this by instantiating a SubframeLoadingDisabler on the parent of the focused element.
+
+        Test: fast/dom/removing-focused-object-element.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeFocusedNodeOfSubtree):
+
 2017-03-29  Zalan Bujtas  <zalan@apple.com>
 

releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/Document.cpp

@@ -3563 +3563 @@
     
     if (isNodeInSubtree(*focusedElement, node, amongChildrenOnly)) {
+        // FIXME: We should avoid synchronously updating the style inside setFocusedElement.
+        // FIXME: Object elements should avoid loading a frame synchronously in a post style recalc callback.
+        SubframeLoadingDisabler disabler(is<ContainerNode>(node) ? &downcast<ContainerNode>(node) : nullptr);
         setFocusedElement(nullptr, FocusDirectionNone, FocusRemovalEventsMode::DoNotDispatch);
         // Set the focus navigation starting node to the previous focused element so that