Changeset 272900 in webkit

Timestamp:

Feb 16, 2021, 3:57:17 AM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Teardown shadow root renderers on hostChildElementDidChange
​https://bugs.webkit.org/show_bug.cgi?id=221386

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-02-16
Reviewed by Antti Koivisto.

Source/WebCore:

When details element has a display contents style, the default summary renderer is not cleared when a new
summary element is added. This causes that both summary elements are rendered at the same time, instead of the
active one. The crash happens when the details element is removed from the document, because the default summary
element still has a valid renderer on destroy.

• dom/SlotAssignment.h:

(WebCore::ShadowRoot::hostChildElementDidChange):

LayoutTests:

• tables/table-col-indent-crash-expected.txt:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/tables/table-col-indent-crash-expected.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/SlotAssignment.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Teardown shadow root renderers on hostChildElementDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=221386
+
+        Reviewed by Antti Koivisto.
+
+        * tables/table-col-indent-crash-expected.txt:
+
 2021-02-16  Chris Lord  <clord@igalia.com>
 

trunk/LayoutTests/tables/table-col-indent-crash-expected.txt

@@ -1 +1 @@
 
 This test passes if it doesn't crash.
-

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Teardown shadow root renderers on hostChildElementDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=221386
+
+        Reviewed by Antti Koivisto.
+
+        When details element has a display contents style, the default summary renderer is not cleared when a new
+        summary element is added. This causes that both summary elements are rendered at the same time, instead of the
+        active one. The crash happens when the details element is removed from the document, because the default summary
+        element still has a valid renderer on destroy.
+
+        * dom/SlotAssignment.h:
+        (WebCore::ShadowRoot::hostChildElementDidChange):
+
 2021-02-16  Antoine Quint  <graouts@webkit.org>
 

trunk/Source/WebCore/dom/SlotAssignment.h

@@ -132 +132 @@
 inline void ShadowRoot::hostChildElementDidChange(const Element& childElement)
 {
-    if (m_slotAssignment)
-        m_slotAssignment->hostChildElementDidChange(childElement, *this);
+    if (!m_slotAssignment)
+        return;
+    if (m_host)
+        RenderTreeUpdater::tearDownRenderers(*m_host);
+    m_slotAssignment->hostChildElementDidChange(childElement, *this);
 }