Bug 209695

Summary: [RenderTreeBuilder] Destroy the child first in RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers
Product: WebKit Reporter: alan <zalan>
Component: Layout and RenderingAssignee: alan <zalan>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, esprehn+autocc, ews-watchlist, glenn, koivisto, kondapallykalyan, pdr, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=207034
Attachments:
Description Flags
Patch
none
Patch none

alan
Reported 2020-03-27 20:49:27 PDT
Before destroying a renderer we check if this renderer is inside an anonymous wrapper (including ancestors) and if so, we get rid of these wrappers too the same time. However because of the 'leaf -> container' tear down direction, we need to destroy the child first.
Attachments
Patch (4.98 KB, patch)
2020-03-27 20:55 PDT, alan 		no flags
DetailsFormatted DiffDiff
Patch (5.43 KB, patch)
2020-03-28 09:50 PDT, alan 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
alan
Comment 1 2020-03-27 20:55:07 PDT
Created attachment 394786 [details] Patch
Antti Koivisto
Comment 2 2020-03-28 00:14:57 PDT
If this is the order we want we should probably change RenderTreeBuilder::destroy instead.
alan
Comment 3 2020-03-28 06:25:16 PDT
(In reply to Antti Koivisto from comment #2) > If this is the order we want we should probably change > RenderTreeBuilder::destroy instead. Yeah, that's a good point. I would guess the ::destroy() is only called with the bottom-most renderer from the updater, and only the builder calls it with depth (in case of anon wrappers).
alan
Comment 4 2020-03-28 08:07:19 PDT
(In reply to zalan from comment #3) > (In reply to Antti Koivisto from comment #2) > > If this is the order we want we should probably change > > RenderTreeBuilder::destroy instead. > Yeah, that's a good point. I would guess the ::destroy() is only called with > the bottom-most renderer from the updater, and only the builder calls it > with depth (in case of anon wrappers). Actually we tried that here https://trac.webkit.org/changeset/228606/webkit and had to revert.
alan
Comment 5 2020-03-28 09:50:40 PDT
Created attachment 394825 [details] Patch
EWS
Comment 6 2020-03-28 10:21:48 PDT
Committed r259160: <https://trac.webkit.org/changeset/259160> All reviewed patches have been landed. Closing bug and clearing flags on attachment 394825 [details].
Radar WebKit Bug Importer
Comment 7 2020-03-28 10:22:13 PDT
<rdar://problem/61010688>
Note You need to log in before you can comment on or make changes to this bug.