Changeset 280549 in webkit

Timestamp:

Aug 2, 2021, 12:14:48 PM (5 years ago)

Author:

rniwa@webkit.org

Message:

Source/WebCore:
REGRESSION(r279800): IntersectionObserver may never get a delivery of an observation if the element
has been unobserved and is disconnected
​https://bugs.webkit.org/show_bug.cgi?id=228679

Reviewed by Chris Dumez.

The bug was caused by the elements of the pending entries not being considered as opaque roots
of the intersection observer. If the intersection observer is no longer observing those elements,
the JS wrapper of the intersection observer may be collected erroneously.

This patch addresses this issue by explicitly treating the elements of pending entries as
opaque roots of the intersection observer in IntersectionObserver::isReachableFromOpaqueRoots.

Test: intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive.html

• page/IntersectionObserver.cpp:

(WebCore::IntersectionObserver::isReachableFromOpaqueRoots const):

LayoutTests:
REGRESSION(r279800): IntersectionObserver may never get a delivery of an observation if the element has been unobserved and is disconnected
​https://bugs.webkit.org/show_bug.cgi?id=228679

Reviewed by Chris Dumez.

Added a regression test.

• intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive-expected.txt: Added.
• intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive-expected.txt (added)
• LayoutTests/intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/IntersectionObserver.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r279800): IntersectionObserver may never get a delivery of an observation if the element has been unobserved and is disconnected
+        https://bugs.webkit.org/show_bug.cgi?id=228679
+
+        Reviewed by Chris Dumez.
+
+        Added a regression test.
+
+        * intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive-expected.txt: Added.
+        * intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive.html: Added.
+
 2021-08-02  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r279800): IntersectionObserver may never get a delivery of an observation if the element
+        has been unobserved and is disconnected
+        https://bugs.webkit.org/show_bug.cgi?id=228679
+
+        Reviewed by Chris Dumez.
+
+        The bug was caused by the elements of the pending entries not being considered as opaque roots
+        of the intersection observer. If the intersection observer is no longer observing those elements,
+        the JS wrapper of the intersection observer may be collected erroneously.
+
+        This patch addresses this issue by explicitly treating the elements of pending entries as
+        opaque roots of the intersection observer in IntersectionObserver::isReachableFromOpaqueRoots.
+
+        Test: intersection-observer/intersection-observer-keeps-element-of-queued-entry-alive.html
+
+        * page/IntersectionObserver.cpp:
+        (WebCore::IntersectionObserver::isReachableFromOpaqueRoots const):
+
 2021-08-02  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/page/IntersectionObserver.cpp

@@ -291 +291 @@
             return true;
     }
+    for (auto& target : m_pendingTargets) {
+        if (visitor.containsOpaqueRoot(target->opaqueRoot()))
+            return true;
+    }
     return false;
 }