Changeset 224336 in webkit

Timestamp:

Nov 2, 2017 9:55:26 AM (7 years ago)

Author:

Antti Koivisto

Message:

Clear Node renderer pointer when destroying RenderObject
​https://bugs.webkit.org/show_bug.cgi?id=179112

Reviewed by Zalan Bujtas.

Make sure we don't leave renderer pointers behind in Nodes.
This could be done with WeakPtr but that would add extra indirection between DOM and render tree.

• rendering/RenderObject.cpp:

(WebCore::RenderObject::willBeDestroyed):

Null the node renderer pointer.
With continuations we have a case where renderer points to a node that has a different renderer.
This is is ok as we know no node points to a continuation (they should really be anonymous renderers).

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderObject.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-11-02  Antti Koivisto  <antti@apple.com>
+
+        Clear Node renderer pointer when destroying RenderObject
+        https://bugs.webkit.org/show_bug.cgi?id=179112
+
+        Reviewed by Zalan Bujtas.
+
+        Make sure we don't leave renderer pointers behind in Nodes.
+        This could be done with WeakPtr but that would add extra indirection between DOM and render tree.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willBeDestroyed):
+
+            Null the node renderer pointer.
+            With continuations we have a case where renderer points to a node that has a different renderer.
+            This is is ok as we know no node points to a continuation (they should really be anonymous renderers).
+
 2017-11-02  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/rendering/RenderObject.cpp

@@ -1435 +1435 @@
         cache->remove(this);
 
+    if (auto* node = this->node()) {
+        // FIXME: Continuations should be anonymous.
+        ASSERT(!node->renderer() || node->renderer() == this || (is<RenderElement>(*this) && downcast<RenderElement>(*this).isContinuation()));
+        if (node->renderer() == this)
+            node->setRenderer(nullptr);
+    }
+
     removeRareData();
 }
@@ -1519 +1526 @@
 
     willBeDestroyed();
+
     if (is<RenderWidget>(*this)) {
         downcast<RenderWidget>(*this).deref();