ChangeLog

2020-10-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r267175 and r267779.

        https://bugs.webkit.org/show_bug.cgi?id=217923

        Regressed NYTimes's DOM content loaded time by 400%

        Reverted changesets:

        "MutationObserverRegistration should be ref counted"

        https://bugs.webkit.org/show_bug.cgi?id=216528

        https://trac.webkit.org/changeset/267175

        "Crash while loading a confluence page"

        https://bugs.webkit.org/show_bug.cgi?id=217111

        https://trac.webkit.org/changeset/267779

2020-10-19  Patrick Angle  <pangle@apple.com>

        Web Inspector: REGRESSION(r265231): Overlay: node info sometimes draws on one line

Source/WebCore/dom/MutationObserver.cpp

@@void MutationObserver::disconnect()

{

    m_pendingTargets.clear();

    m_records.clear();

    auto registrationAndNodeList = WTF::compactMap(m_registrations, [](auto* registration) -> Optional<std::pair<Ref<Node>, Ref<MutationObserverRegistration>>> {

        auto node = registration->stopObserving();

        if (!node)

            return WTF::nullopt;

        return { { node.releaseNonNull(), makeRef(*registration) } };

    });

    for (auto& registrationAndNode : registrationAndNodeList)

        registrationAndNode.first->unregisterMutationObserver(registrationAndNode.second.get());

    HashSet<MutationObserverRegistration*> registrations(m_registrations);

    for (auto* registration : registrations)

        registration->node().unregisterMutationObserver(*registration);

}

void MutationObserver::observationStarted(MutationObserverRegistration& registration)

{

135 ~~auto result =~~ m_registrations.~~add~~(&registration);

136 ~~RELEASE_ASSERT(result.isNewEntry~~);

130 ASSERT(!m_registrations.contains(&registration));

131 m_registrations.add(&registration);

}

void MutationObserver::observationEnded(MutationObserverRegistration& registration)

{

141 ~~auto removed =~~ m_registrations.~~remove~~(&registration);

142 ~~RELEASE_ASSERT(~~removed);

136 ASSERT(m_registrations.contains(&registration));

137 m_registrations.remove(&registration);

}

void MutationObserver::enqueueMutationRecord(Ref<MutationRecord>&& mutation)

@@void MutationObserver::deliver()

{

    ASSERT(canDeliver());

    // Calling takeTransientRegistrations() can modify m_registrations, so it's necessary

    // to make a copy of the transient registrations before operating on them.

    Vector<MutationObserverRegistration*, 1> transientRegistrations;

    Vector<std::unique_ptr<HashSet<GCReachableRef<Node>>>, 1> nodesToKeepAlive;

    HashSet<GCReachableRef<Node>> pendingTargets;

    pendingTargets.swap(m_pendingTargets);

197 auto registrations = WTF::map(m_registrations, [](auto* registration) { return makeRef(*registration); });

198 for (auto& registration : registrations) {

195 for (auto* registration : m_registrations) {

199196 if (registration->hasTransientRegistrations())

200 ~~nodesToKeepAlive.append(registration->takeT~~ransientRegistrations());

197 transientRegistrations.append(registration);

201198 }

199 for (auto& registration : transientRegistrations)

200 nodesToKeepAlive.append(registration->takeTransientRegistrations());

    if (m_records.isEmpty()) {

        ASSERT(m_pendingTargets.isEmpty());

Source/WebCore/dom/MutationObserverRegistration.cpp

namespace WebCore {

Ref<MutationObserverRegistration> MutationObserverRegistration::create(MutationObserver& observer, Node& node, MutationObserverOptions options, const HashSet<AtomString>& attributeFilter)

{

    return adoptRef(*new MutationObserverRegistration(observer, node, options, attributeFilter));

}

4540MutationObserverRegistration::MutationObserverRegistration(MutationObserver& observer, Node& node, MutationObserverOptions options, const HashSet<AtomString>& attributeFilter)

4641 : m_observer(observer)

47 , m_node(~~makeWeakPtr(~~node))

42 , m_node(node)

    , m_options(options)

    , m_attributeFilter(attributeFilter)

{

@@void MutationObserverRegistration::observedSubtreeNodeWillDetach(Node& node)

    node.registerTransientMutationObserver(*this);

    m_observer->setHasTransientRegistration(node.document());

75 if (!m_transientRegistrationNodes)

70 if (!m_transientRegistrationNodes) {

7671 m_transientRegistrationNodes = makeUnique<HashSet<GCReachableRef<Node>>>();

        ASSERT(!m_nodeKeptAlive);

        m_nodeKeptAlive = &m_node; // Balanced in takeTransientRegistrations.

    }

    m_transientRegistrationNodes->add(node);

}

std::unique_ptr<HashSet<GCReachableRef<Node>>> MutationObserverRegistration::takeTransientRegistrations()

{

82 if (!m_transientRegistrationNodes)

81 if (!m_transientRegistrationNodes) {

82 ASSERT(!m_nodeKeptAlive);

8383 return nullptr;

84 }

8485

85 auto transientNodes = WTFMove(m_transientRegistrationNodes);

86 for (auto& node : *transientNodes)

86 for (auto& node : *m_transientRegistrationNodes)

8787 node->unregisterTransientMutationObserver(*this);

8888

89 return transientNodes;

    auto returnValue = WTFMove(m_transientRegistrationNodes);

    ASSERT(m_nodeKeptAlive);

    m_nodeKeptAlive = nullptr; // Balanced in observeSubtreeNodeWillDetach.

    return returnValue;

}

bool MutationObserverRegistration::shouldReceiveMutationFrom(Node& node, MutationObserver::MutationType type, const QualifiedName* attributeName) const

@@bool MutationObserverRegistration::shouldReceiveMutationFrom(Node& node, Mutatio

    if (!(m_options & type))

        return false;

98 if (m_node~~.get()~~ != &node && !isSubtree())

103 if (&m_node != &node && !isSubtree())

        return false;

    if (type != MutationObserver::Attributes || !(m_options & MutationObserver::AttributeFilter))

@@bool MutationObserverRegistration::shouldReceiveMutationFrom(Node& node, Mutatio

    return m_attributeFilter.contains(attributeName->localName());

}

RefPtr<Node> MutationObserverRegistration::stopObserving()

{

    if (m_hasStoppedObservingNode)

        return nullptr;

    m_hasStoppedObservingNode = true;

    return makeRefPtr(m_node.get());

}

118115void MutationObserverRegistration::addRegistrationNodesToSet(HashSet<Node*>& nodes) const

119116{

    ASSERT(m_node.get() || m_transientRegistrationNodes);

    if (auto* observedNode = m_node.get())

        nodes.add(observedNode);

117 nodes.add(&m_node);

    if (!m_transientRegistrationNodes)

        return;

    for (auto& node : *m_transientRegistrationNodes)

Source/WebCore/dom/MutationObserverRegistration.h

#include "GCReachableRef.h"

#include "MutationObserver.h"

#include <wtf/HashSet.h>

36 #include <wtf/WeakPtr.h>

#include <wtf/text/AtomString.h>

#include <wtf/text/AtomStringHash.h>

@@namespace WebCore {

class QualifiedName;

44 class MutationObserverRegistration ~~: public RefCounted<MutationObserverRegistration>~~ {

43class MutationObserverRegistration {

4544 WTF_MAKE_FAST_ALLOCATED;

4645public:

47 static Ref<MutationObserverRegistration> create(MutationObserver&, Node&, MutationObserverOptions, const HashSet<AtomString>& attributeFilter);

48

46 MutationObserverRegistration(MutationObserver&, Node&, MutationObserverOptions, const HashSet<AtomString>& attributeFilter);

    ~MutationObserverRegistration();

    void resetObservation(MutationObserverOptions, const HashSet<AtomString>& attributeFilter);

@@public:

    bool isSubtree() const { return m_options & MutationObserver::Subtree; }

    MutationObserver& observer() { return m_observer.get(); }

60 Node* node() { return m_node.get(); }

61 RefPtr<Node> stopObserving();

58 Node& node() { return m_node; }

    MutationRecordDeliveryOptions deliveryOptions() const { return m_options & (MutationObserver::AttributeOldValue | MutationObserver::CharacterDataOldValue); }

    MutationObserverOptions mutationTypes() const { return m_options & MutationObserver::AllMutationTypes; }

    void addRegistrationNodesToSet(HashSet<Node*>&) const;

private:

68 MutationObserverRegistration(MutationObserver&, Node&, MutationObserverOptions, const HashSet<AtomString>& attributeFilter);

69

7065 Ref<MutationObserver> m_observer;

    WeakPtr<Node> m_node;

    bool m_hasStoppedObservingNode { false };

    MutationObserverOptions m_options;

66 Node& m_node;

67 RefPtr<Node> m_nodeKeptAlive;

7468 std::unique_ptr<HashSet<GCReachableRef<Node>>> m_transientRegistrationNodes;

69 MutationObserverOptions m_options;

    HashSet<AtomString> m_attributeFilter;

};

Source/WebCore/dom/Node.cpp

@@inline void Node::NodeRareDataDeleter::operator()(NodeRareData* rareData) const

void Node::clearRareData()

{

    ASSERT(hasRareData());

432 ASSERT(rareData()->transientMutationObserverRegistry().isEmpty());

432 ASSERT(!transientMutationObserverRegistry() || transientMutationObserverRegistry()->isEmpty());

433

    m_rareDataWithBitfields.setPointer(nullptr);

}

@@void Node::moveNodeToNewDocument(Document& oldDocument, Document& newDocument)

    oldDocument.decrementReferencingNodeCount();

    if (hasRareData()) {

2042 auto* rareData = this->rareData();

2043 if (auto* nodeLists = rareData->nodeLists())

2043 if (auto* nodeLists = rareData()->nodeLists())

20442044 nodeLists->adoptDocument(oldDocument, newDocument);

2045 if (auto* registry = ~~rareData->~~mutationObserverRegistry~~IfExists~~()) {

2045 if (auto* registry = mutationObserverRegistry()) {

            for (auto& registration : *registry)

                newDocument.addMutationObserverTypes(registration->mutationTypes());

        }

2049 for (auto& registration : rareData->transientMutationObserverRegistry())

2050 newDocument.addMutationObserverTypes(registration->mutationTypes());

        if (auto* transientRegistry = transientMutationObserverRegistry()) {

            for (auto& registration : *transientRegistry)

                newDocument.addMutationObserverTypes(registration->mutationTypes());

        }

    } else {

        ASSERT(!mutationObserverRegistry());

        ASSERT(!transientMutationObserverRegistry());

    }

    oldDocument.moveNodeIteratorsToNewDocument(*this, newDocument);

@@void Node::clearEventTargetData()

    eventTargetDataMap().remove(this);

}

2250 template<typename Registry> static inline void collectMatchingObserversForMutation(HashMap<Ref<MutationObserver>, MutationRecordDeliveryOptions>& observers, Registry& registry, Node& target, MutationObserver::MutationType type, const QualifiedName* attributeName)

Vector<std::unique_ptr<MutationObserverRegistration>>* Node::mutationObserverRegistry()

{

    if (!hasRareData())

        return nullptr;

    auto* data = rareData()->mutationObserverData();

    if (!data)

        return nullptr;

    return &data->registry;

}

HashSet<MutationObserverRegistration*>* Node::transientMutationObserverRegistry()

22512266{

2252 for (auto& registration : registry) {

    if (!hasRareData())

        return nullptr;

    auto* data = rareData()->mutationObserverData();

    if (!data)

        return nullptr;

    return &data->transientRegistry;

}

template<typename Registry> static inline void collectMatchingObserversForMutation(HashMap<Ref<MutationObserver>, MutationRecordDeliveryOptions>& observers, Registry* registry, Node& target, MutationObserver::MutationType type, const QualifiedName* attributeName)

{

    if (!registry)

        return;

    for (auto& registration : *registry) {

        if (registration->shouldReceiveMutationFrom(target, type, attributeName)) {

            auto deliveryOptions = registration->deliveryOptions();

            auto result = observers.add(registration->observer(), deliveryOptions);

@@HashMap<Ref<MutationObserver>, MutationRecordDeliveryOptions> Node::registeredMu

{

    HashMap<Ref<MutationObserver>, MutationRecordDeliveryOptions> result;

    ASSERT((type == MutationObserver::Attributes && attributeName) || !attributeName);

    for (auto node = makeRefPtr(this); node; node = node->parentNode()) {

        if (!node->hasRareData())

            continue;

        auto* rareData = node->rareData();

        if (auto* registry = rareData->mutationObserverRegistryIfExists())

            collectMatchingObserversForMutation(result, *registry, *this, type, attributeName);

        collectMatchingObserversForMutation(result, rareData->transientMutationObserverRegistry(), *this, type, attributeName);

    collectMatchingObserversForMutation(result, mutationObserverRegistry(), *this, type, attributeName);

    collectMatchingObserversForMutation(result, transientMutationObserverRegistry(), *this, type, attributeName);

    for (Node* node = parentNode(); node; node = node->parentNode()) {

        collectMatchingObserversForMutation(result, node->mutationObserverRegistry(), *this, type, attributeName);

        collectMatchingObserversForMutation(result, node->transientMutationObserverRegistry(), *this, type, attributeName);

    }

    return result;

}

void Node::registerMutationObserver(MutationObserver& observer, MutationObserverOptions options, const HashSet<AtomString>& attributeFilter)

{

    auto& registry = ensureRareData().mutationObserverRegistry();

    auto index = registry.findMatching([&observer](auto& registration) { return &registration->observer() == &observer; });

    if (index != notFound) {

        auto registration = registry[index].copyRef();

        registration->resetObservation(options, attributeFilter);

        document().addMutationObserverTypes(registration->mutationTypes());

        return;

    MutationObserverRegistration* registration = nullptr;

    auto& registry = ensureRareData().ensureMutationObserverData().registry;

    for (auto& candidateRegistration : registry) {

        if (&candidateRegistration->observer() == &observer) {

            registration = candidateRegistration.get();

            registration->resetObservation(options, attributeFilter);

        }

22862313 }

    auto newRegistration = MutationObserverRegistration::create(observer, *this, options, attributeFilter);

    document().addMutationObserverTypes(newRegistration->mutationTypes());

    registry.append(WTFMove(newRegistration));

    if (!registration) {

        registry.append(makeUnique<MutationObserverRegistration>(observer, *this, options, attributeFilter));

        registration = registry.last().get();

    }

    document().addMutationObserverTypes(registration->mutationTypes());

}

void Node::unregisterMutationObserver(MutationObserverRegistration& registration)

{

2294 ASSERT(hasRareData());

2295 auto* registry = rareData()->mutationObserverRegistryIfExists();

2325 auto* registry = mutationObserverRegistry();

22962326 ASSERT(registry);

2297 auto removed = registry->removeFirstMatching([&registration] (auto& current) {

2298 return current.ptr() == &registration;

    if (!registry)

        return;

    registry->removeFirstMatching([&registration] (auto& current) {

        return current.get() == &registration;

22992332 });

2300 RELEASE_ASSERT(removed);

}

void Node::registerTransientMutationObserver(MutationObserverRegistration& registration)

{

2305 ensureRareData().~~transient~~MutationObserverRegistry().add(registration);

2337 ensureRareData().ensureMutationObserverData().transientRegistry.add(&registration);

}

void Node::unregisterTransientMutationObserver(MutationObserverRegistration& registration)

{

    ASSERT(hasRareData());

    bool removed = rareData()->transientMutationObserverRegistry().remove(&registration);

    RELEASE_ASSERT(removed);

    auto* transientRegistry = transientMutationObserverRegistry();

    ASSERT(transientRegistry);

    if (!transientRegistry)

        return;

    ASSERT(transientRegistry->contains(&registration));

    transientRegistry->remove(&registration);

}

void Node::notifyMutationObserversNodeWillDetach()

@@void Node::notifyMutationObserversNodeWillDetach()

        return;

    for (Node* node = parentNode(); node; node = node->parentNode()) {

        if (!node->hasRareData())

            continue;

        auto* rareData = node->rareData();

        if (auto* registry = rareData->mutationObserverRegistryIfExists()) {

2357 if (auto* registry = node->mutationObserverRegistry()) {

            for (auto& registration : *registry)

                registration->observedSubtreeNodeWillDetach(*this);

        }

2328 for (auto& registration : rareData->transientMutationObserverRegistry())

2329 registration->observedSubtreeNodeWillDetach(*this);

        if (auto* transientRegistry = node->transientMutationObserverRegistry()) {

            for (auto* registration : *transientRegistry)

                registration->observedSubtreeNodeWillDetach(*this);

        }

    }

}

Source/WebCore/dom/Node.h

@@private:

    void trackForDebugging();

    void materializeRareData();

    Vector<std::unique_ptr<MutationObserverRegistration>>* mutationObserverRegistry();

    HashSet<MutationObserverRegistration*>* transientMutationObserverRegistry();

    void adjustStyleValidity(Style::Validity, Style::InvalidationMode);

    void* opaqueRootSlow() const;

Source/WebCore/dom/NodeRareData.cpp

@@namespace WebCore {

struct SameSizeAsNodeRareData {

    uint32_t m_tabIndex;

    uint32_t m_childIndexAndIsElementRareDataFlag;

    void* m_pointer[3];

#if CHECK_HASHTABLE_ITERATORS

    void* m_hashTableIteratorsAndMutex[2];

#endif

41 void* m_pointer[2];

};

COMPILE_ASSERT(sizeof(NodeRareData) == sizeof(SameSizeAsNodeRareData), NodeRareDataShouldStaySmall);

Source/WebCore/dom/NodeRareData.h

@@private:

    CollectionCacheMap m_cachedCollections;

};

class NodeMutationObserverData {

    WTF_MAKE_NONCOPYABLE(NodeMutationObserverData); WTF_MAKE_FAST_ALLOCATED;

public:

    Vector<std::unique_ptr<MutationObserverRegistration>> registry;

    HashSet<MutationObserverRegistration*> transientRegistry;

    NodeMutationObserverData() { }

};

DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER(NodeRareData);

class NodeRareData {

    WTF_MAKE_NONCOPYABLE(NodeRareData);

@@public:

        return *m_nodeLists;

    }

    using MutationObserverRegistryVector = Vector<Ref<MutationObserverRegistration>, 4>;

    MutationObserverRegistryVector& mutationObserverRegistry()

    {

        if (!m_mutationObserverRegistry)

            m_mutationObserverRegistry = makeUnique<MutationObserverRegistryVector>();

        return *m_mutationObserverRegistry;

    }

    MutationObserverRegistryVector* mutationObserverRegistryIfExists()

    {

        return m_mutationObserverRegistry.get();

    }

    HashSet<Ref<MutationObserverRegistration>>& transientMutationObserverRegistry()

287 NodeMutationObserverData* mutationObserverData() { return m_mutationObserverData.get(); }

288 NodeMutationObserverData& ensureMutationObserverData()

291289 {

292 return m_transientMutationObserverRegistry;

        if (!m_mutationObserverData)

            m_mutationObserverData = makeUnique<NodeMutationObserverData>();

        return *m_mutationObserverData;

    }

#if DUMP_NODE_STATISTICS

@@public:

        OptionSet<UseType> result;

        if (m_nodeLists)

            result.add(UseType::NodeList);

301 if (m_mutationObserver~~Registry || m_transientMutationObserverRegistry.capacity(~~))

301 if (m_mutationObserverData)

            result.add(UseType::MutationObserver);

        return result;

    }

@@private:

    bool m_isElementRareData;

    std::unique_ptr<NodeListsNodeData> m_nodeLists;

316 std::unique_ptr<MutationObserverRegistryVector> m_mutationObserverRegistry;

317 HashSet<Ref<MutationObserverRegistration>> m_transientMutationObserverRegistry;

316 std::unique_ptr<NodeMutationObserverData> m_mutationObserverData;

};

template<> struct NodeListTypeIdentifier<NameNodeList> {

LayoutTests/ChangeLog

2020-10-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r267175 and r267779.

        https://bugs.webkit.org/show_bug.cgi?id=217923

        Regressed NYTimes's DOM content loaded time by 400%

        Reverted changesets:

        "MutationObserverRegistration should be ref counted"

        https://bugs.webkit.org/show_bug.cgi?id=216528

        https://trac.webkit.org/changeset/267175

        "Crash while loading a confluence page"

        https://bugs.webkit.org/show_bug.cgi?id=217111

        https://trac.webkit.org/changeset/267779

2020-10-19  Hector Lopez  <hector_i_lopez@apple.com>

        REGRESSION(r268615-268616?): [ Win10 wk1 EWS ] 3 animation tests are a constant failure

LayoutTests/fast/dom/MutationObserver/disconnect-twice-expected.txt

This tests disconnecting MutationObserver twice while keeping a transient observation going.

WebKit should not crash and you should see PASS below.

PASS

LayoutTests/fast/dom/MutationObserver/disconnect-twice.html

<!DOCTYPE html>

<html>

<body>

<p>This tests disconnecting MutationObserver twice while keeping a transient observation going.<br>

WebKit should not crash and you should see PASS below.</p>

<div id="child"><div></div></div>

<script>

if (window.testRunner)

    testRunner.dumpAsText();

const observer = new MutationObserver((records) => {

});

observer.observe(document.body, {childList: true, subtree: true});

child.remove();

observer.disconnect();

observer.disconnect();

document.write('PASS');

</script>

</body>

</html>