Changeset 245453 in webkit

Timestamp:

May 17, 2019, 4:25:14 AM (7 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r245300 - Do not try to issue repaint while the render tree is being destroyed.
​https://bugs.webkit.org/show_bug.cgi?id=197461
<rdar://problem/50368992>

Reviewed by Simon Fraser.

Source/WebCore:

Test: http/tests/svg/crash-on-reload-with-filter.html

We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.

• rendering/svg/RenderSVGResourceContainer.cpp:

(WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):

LayoutTests:

• http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
• http/tests/svg/crash-on-reload-with-filter.html: Added.
• http/tests/svg/resources/finishTest.html: Added.

Location:

releases/WebKitGTK/webkit-2.24

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/svg/crash-on-reload-with-filter-expected.txt (added)
• LayoutTests/http/tests/svg/crash-on-reload-with-filter.html (added)
• LayoutTests/http/tests/svg/resources/finishTest.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog

@@ +1 @@
+2019-05-14  Zalan Bujtas  <zalan@apple.com>
+
+        Do not try to issue repaint while the render tree is being destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=197461
+        <rdar://problem/50368992>
+
+        Reviewed by Simon Fraser.
+
+        * http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
+        * http/tests/svg/crash-on-reload-with-filter.html: Added.
+        * http/tests/svg/resources/finishTest.html: Added.
+
 2019-05-04  Tadeu Zagallo  <tzagallo@apple.com>
 

releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog

@@ +1 @@
+2019-05-14  Zalan Bujtas  <zalan@apple.com>
+
+        Do not try to issue repaint while the render tree is being destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=197461
+        <rdar://problem/50368992>
+
+        Reviewed by Simon Fraser.
+
+        Test: http/tests/svg/crash-on-reload-with-filter.html
+
+        We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
+        Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
+
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
+
 2019-05-09  Brent Fulgham  <bfulgham@apple.com>
 

releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp

@@ -123 +123 @@
 void RenderSVGResourceContainer::markAllClientLayersForInvalidation()
 {
+    if (m_clientLayers.isEmpty())
+        return;
+    if ((*m_clientLayers.begin())->renderer().renderTreeBeingDestroyed())
+        return;
     for (auto* clientLayer : m_clientLayers)
         clientLayer->filterNeedsRepaint();