Changeset 240609 in webkit

Timestamp:

Jan 28, 2019 4:14:58 PM (5 years ago)

Author:

Simon Fraser

Message:

css3/filters/blur-filter-page-scroll-self.html crashes under WebCore::ScrollingStateNode::ScrollingStateNode
​https://bugs.webkit.org/show_bug.cgi?id=193925

Reviewed by Tim Horton.

Some css3/filters/ tests disable accelerated compositing (which is crazy). Make these
tests not crash by ensuring that unparentNode() and unparentChildrenAndDestroyNode() clears the root
node if it's the node being unparented or destroyed.

Tested by existing tests.

• page/scrolling/ScrollingStateTree.cpp:

(WebCore::ScrollingStateTree::unparentNode):
(WebCore::ScrollingStateTree::unparentChildrenAndDestroyNode):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/scrolling/ScrollingStateTree.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        css3/filters/blur-filter-page-scroll-self.html crashes under WebCore::ScrollingStateNode::ScrollingStateNode
+        https://bugs.webkit.org/show_bug.cgi?id=193925
+
+        Reviewed by Tim Horton.
+
+        Some css3/filters/ tests disable accelerated compositing (which is crazy). Make these
+        tests not crash by ensuring that unparentNode() and unparentChildrenAndDestroyNode() clears the root
+        node if it's the node being unparented or destroyed.
+
+        Tested by existing tests.
+
+        * page/scrolling/ScrollingStateTree.cpp:
+        (WebCore::ScrollingStateTree::unparentNode):
+        (WebCore::ScrollingStateTree::unparentChildrenAndDestroyNode):
+
 2019-01-28  Daniel Bates  <dabates@apple.com>
 

trunk/Source/WebCore/page/scrolling/ScrollingStateTree.cpp

@@ -205 +205 @@
         return;
 
+    if (protectedNode == m_rootStateNode)
+        m_rootStateNode = nullptr;
+
     protectedNode->removeFromParent();
     m_unparentedNodes.add(nodeID, WTFMove(protectedNode));
@@ -220 +223 @@
     if (!protectedNode)
         return;
+
+    if (protectedNode == m_rootStateNode)
+        m_rootStateNode = nullptr;
 
     if (auto* children = protectedNode->children()) {