Changeset 245921 in webkit

Timestamp:

May 30, 2019, 5:30:01 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r245300. rdar://problem/51264763

Do not try to issue repaint while the render tree is being destroyed.
​https://bugs.webkit.org/show_bug.cgi?id=197461
<rdar://problem/50368992>

Reviewed by Simon Fraser.

Source/WebCore:

Test: http/tests/svg/crash-on-reload-with-filter.html

We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.

• rendering/svg/RenderSVGResourceContainer.cpp: (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):

LayoutTests:

• http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
• http/tests/svg/crash-on-reload-with-filter.html: Added.
• http/tests/svg/resources/finishTest.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245300 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/svg/crash-on-reload-with-filter-expected.txt (added)
• LayoutTests/http/tests/svg/crash-on-reload-with-filter.html (added)
• LayoutTests/http/tests/svg/resources/finishTest.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (modified) (1 diff)

branches/safari-607-branch/LayoutTests/ChangeLog

@@ +1 @@
+2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r245300. rdar://problem/51264763
+
+    Do not try to issue repaint while the render tree is being destroyed.
+    https://bugs.webkit.org/show_bug.cgi?id=197461
+    <rdar://problem/50368992>
+    
+    Reviewed by Simon Fraser.
+    
+    Source/WebCore:
+    
+    Test: http/tests/svg/crash-on-reload-with-filter.html
+    
+    We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
+    Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
+    
+    * rendering/svg/RenderSVGResourceContainer.cpp:
+    (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
+    
+    LayoutTests:
+    
+    * http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
+    * http/tests/svg/crash-on-reload-with-filter.html: Added.
+    * http/tests/svg/resources/finishTest.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-14  Zalan Bujtas  <zalan@apple.com>
+
+            Do not try to issue repaint while the render tree is being destroyed.
+            https://bugs.webkit.org/show_bug.cgi?id=197461
+            <rdar://problem/50368992>
+
+            Reviewed by Simon Fraser.
+
+            * http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
+            * http/tests/svg/crash-on-reload-with-filter.html: Added.
+            * http/tests/svg/resources/finishTest.html: Added.
+
 2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r245300. rdar://problem/51264763
+
+    Do not try to issue repaint while the render tree is being destroyed.
+    https://bugs.webkit.org/show_bug.cgi?id=197461
+    <rdar://problem/50368992>
+    
+    Reviewed by Simon Fraser.
+    
+    Source/WebCore:
+    
+    Test: http/tests/svg/crash-on-reload-with-filter.html
+    
+    We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
+    Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
+    
+    * rendering/svg/RenderSVGResourceContainer.cpp:
+    (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
+    
+    LayoutTests:
+    
+    * http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
+    * http/tests/svg/crash-on-reload-with-filter.html: Added.
+    * http/tests/svg/resources/finishTest.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-14  Zalan Bujtas  <zalan@apple.com>
+
+            Do not try to issue repaint while the render tree is being destroyed.
+            https://bugs.webkit.org/show_bug.cgi?id=197461
+            <rdar://problem/50368992>
+
+            Reviewed by Simon Fraser.
+
+            Test: http/tests/svg/crash-on-reload-with-filter.html
+
+            We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
+            Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
+
+            * rendering/svg/RenderSVGResourceContainer.cpp:
+            (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
+
 2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp

@@ -123 +123 @@
 void RenderSVGResourceContainer::markAllClientLayersForInvalidation()
 {
+    if (m_clientLayers.isEmpty())
+        return;
+    if ((*m_clientLayers.begin())->renderer().renderTreeBeingDestroyed())
+        return;
     for (auto* clientLayer : m_clientLayers)
         clientLayer->filterNeedsRepaint();