Attachment 341782 Details for Bug 186207 – Patch

[patch] Patch

bug-186207-20180601224219.patch (text/plain), 4.24 KB, created by Antoine Quint on 2018-06-01 13:42:21 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Antoine Quint

Created: 2018-06-01 13:42:21 PDT

Size: 4.24 KB

patch

obsolete

>Subversion Revision: 232255
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index a831ad401580f95d3fe5ea58f7e6f2a1d04defca..d2fb79a85f4e37f1b89ec85660e18f7f36330c29 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,23 @@
>+2018-06-01  Antoine Quint  <graouts@apple.com>
>+
>+        [ASan / StressGC] DumpRenderTree crashed in com.apple.WebCore: WebCore::EventTarget::ref + 16
>+        https://bugs.webkit.org/show_bug.cgi?id=186207
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Ensure that we clear the DOM event queue for declarative animations once an animation is cleared for
>+        an element since the element can be deleted before events get dispatched asynchronouly for this animation.
>+
>+        * animation/AnimationTimeline.cpp:
>+        (WebCore::AnimationTimeline::removeAnimationsForElement):
>+        * animation/DeclarativeAnimation.cpp:
>+        (WebCore::DeclarativeAnimation::~DeclarativeAnimation):
>+        (WebCore::DeclarativeAnimation::prepareAnimationForRemoval):
>+        * animation/DeclarativeAnimation.h:
>+        * animation/WebAnimation.cpp:
>+        (WebCore::WebAnimation::prepareAnimationForRemoval):
>+        * animation/WebAnimation.h:
>+
> 2018-05-29  Antoine Quint  <graouts@apple.com>
> 
>         [Web Animations] Handle relative length units
>diff --git a/Source/WebCore/animation/AnimationTimeline.cpp b/Source/WebCore/animation/AnimationTimeline.cpp
>index 3334ad3270ad78f17c746b5eaad67c8c130dd8d9..f2dc31f1133451d9b0bef24a29cefff2d35b5d23 100644
>--- a/Source/WebCore/animation/AnimationTimeline.cpp
>+++ b/Source/WebCore/animation/AnimationTimeline.cpp
>@@ -153,7 +153,7 @@ Vector<RefPtr<WebAnimation>> AnimationTimeline::animationsForElement(Element& el
> void AnimationTimeline::removeAnimationsForElement(Element& element)
> {
>     for (auto& animation : animationsForElement(element)) {
>-        animation->setEffectInternal(nullptr);
>+        animation->prepareAnimationForRemoval();
>         removeAnimation(animation.releaseNonNull());
>     }
> }
>diff --git a/Source/WebCore/animation/DeclarativeAnimation.cpp b/Source/WebCore/animation/DeclarativeAnimation.cpp
>index 6404aa343e160ddb46480f2f7f94d5b7703a661c..646b0eb50f5eeb95f08a3728cc48a04547340857 100644
>--- a/Source/WebCore/animation/DeclarativeAnimation.cpp
>+++ b/Source/WebCore/animation/DeclarativeAnimation.cpp
>@@ -47,6 +47,11 @@ DeclarativeAnimation::DeclarativeAnimation(Element& target, const Animation& bac
> 
> DeclarativeAnimation::~DeclarativeAnimation()
> {
>+}
>+
>+void DeclarativeAnimation::prepareAnimationForRemoval()
>+{
>+    WebAnimation::prepareAnimationForRemoval();
>     m_eventQueue.close();
> }
> 
>diff --git a/Source/WebCore/animation/DeclarativeAnimation.h b/Source/WebCore/animation/DeclarativeAnimation.h
>index 80d280a5aa93711c7bda18bee4d0176b7cd2afb5..a9bec97a5c8c38722ac8342e54fb6cee0607e72e 100644
>--- a/Source/WebCore/animation/DeclarativeAnimation.h
>+++ b/Source/WebCore/animation/DeclarativeAnimation.h
>@@ -45,6 +45,7 @@ public:
>     const Animation& backingAnimation() const { return m_backingAnimation; }
>     void setBackingAnimation(const Animation&);
>     void invalidateDOMEvents(Seconds elapsedTime = 0_s);
>+    void prepareAnimationForRemoval() final;
> 
>     void setTimeline(RefPtr<AnimationTimeline>&&) final;
>     void cancel() final;
>diff --git a/Source/WebCore/animation/WebAnimation.cpp b/Source/WebCore/animation/WebAnimation.cpp
>index 63d74b6903105d7ead950e63b070fee2fe34aa31..9753c0183c094f3340524fb4222739838d1ccdcf 100644
>--- a/Source/WebCore/animation/WebAnimation.cpp
>+++ b/Source/WebCore/animation/WebAnimation.cpp
>@@ -70,6 +70,11 @@ WebAnimation::~WebAnimation()
> {
> }
> 
>+void WebAnimation::prepareAnimationForRemoval()
>+{
>+    setEffectInternal(nullptr);
>+}
>+
> void WebAnimation::suspendEffectInvalidation()
> {
>     ++m_suspendCount;
>diff --git a/Source/WebCore/animation/WebAnimation.h b/Source/WebCore/animation/WebAnimation.h
>index 5314b7e84187dc0065ef921d20ec575b10f9c585..baa42f24272b0c535efde3b5ae64cfd5fad5e501 100644
>--- a/Source/WebCore/animation/WebAnimation.h
>+++ b/Source/WebCore/animation/WebAnimation.h
>@@ -109,6 +109,7 @@ public:
>     void unsuspendEffectInvalidation();
>     void setSuspended(bool);
>     bool isSuspended() const { return m_isSuspended; }
>+    virtual void prepareAnimationForRemoval();
> 
>     String description();
>

Actions: View | Formatted Diff | Diff

Attachments on bug 186207: 341782 | 341787 | 341788 | 341795 | 341796 | 342152