Summary: | ASSERT(m_callback->hasCallback()) under IntersectionObserver::notify() | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Chris Dumez <cdumez> | ||||||||
Component: | WebCore Misc. | Assignee: | Chris Dumez <cdumez> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | cdumez, ggaren, rniwa, simon.fraser, webkit-bug-importer | ||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||
Version: | WebKit Nightly Build | ||||||||||
Hardware: | Unspecified | ||||||||||
OS: | Unspecified | ||||||||||
See Also: |
https://bugs.webkit.org/show_bug.cgi?id=231260 https://bugs.webkit.org/show_bug.cgi?id=251015 |
||||||||||
Attachments: |
|
Description
Chris Dumez
2021-10-05 09:54:43 PDT
Created attachment 440227 [details]
Patch
Created attachment 440240 [details]
Patch
Does Resize Observer need the same fix? (In reply to Simon Fraser (smfr) from comment #4) > Does Resize Observer need the same fix? I'll check but I doubt we'd expect a resize observation to ever be sent for a detached element? (In reply to Chris Dumez from comment #5) > (In reply to Simon Fraser (smfr) from comment #4) > > Does Resize Observer need the same fix? > > I'll check but I doubt we'd expect a resize observation to ever be sent for > a detached element? I think we do for the initial observation. Also, right after the element got detached from the document because then the element becomes (0, 0) instead of whatever size it used to have. Come to think of it, wouldn't intersection observer do the same thing? If a node was in the document and intersection observer notified of its current position, wouldn't removing the node result in another notification? (In reply to Ryosuke Niwa from comment #6) > (In reply to Chris Dumez from comment #5) > > (In reply to Simon Fraser (smfr) from comment #4) > > > Does Resize Observer need the same fix? > > > > I'll check but I doubt we'd expect a resize observation to ever be sent for > > a detached element? > > I think we do for the initial observation. Also, right after the element got > detached from the document because then the element becomes (0, 0) instead > of whatever size it used to have. Come to think of it, wouldn't intersection > observer do the same thing? > > If a node was in the document and intersection observer notified of its > current position, wouldn't removing the node result in another notification? I am adding a test to cover the case where the target is initially visible and then we remove it from the document (it does trigger an observation notification in the intersection handler case). I will need to test the resize observer too. It may well have the exact same bug based on your comments. (In reply to Ryosuke Niwa from comment #6) > (In reply to Chris Dumez from comment #5) > > (In reply to Simon Fraser (smfr) from comment #4) > > > Does Resize Observer need the same fix? > > > > I'll check but I doubt we'd expect a resize observation to ever be sent for > > a detached element? > > I think we do for the initial observation. Also, right after the element got > detached from the document because then the element becomes (0, 0) instead > of whatever size it used to have. Come to think of it, wouldn't intersection > observer do the same thing? Based on my local testing, the same test does not crash for the resize observer. We don't dispatch an initial observation at all it seems when the element is initially disconnected. Created attachment 440270 [details]
Patch
(In reply to Chris Dumez from comment #8) > (In reply to Ryosuke Niwa from comment #6) > > (In reply to Chris Dumez from comment #5) > > > (In reply to Simon Fraser (smfr) from comment #4) > > > > Does Resize Observer need the same fix? > > > > > > I'll check but I doubt we'd expect a resize observation to ever be sent for > > > a detached element? > > > > I think we do for the initial observation. Also, right after the element got > > detached from the document because then the element becomes (0, 0) instead > > of whatever size it used to have. Come to think of it, wouldn't intersection > > observer do the same thing? > > Based on my local testing, the same test does not crash for the resize > observer. We don't dispatch an initial observation at all it seems when the > element is initially disconnected. I'll add some corresponding resize observer tests in a separate patch. I could not get them to hit the assertion though. (In reply to Chris Dumez from comment #8) > Based on my local testing, the same test does not crash for the resize > observer. We don't dispatch an initial observation at all it seems when the > element is initially disconnected. That would make a nice layout/wpt test. Committed r283590 (?): <https://commits.webkit.org/r283590> All reviewed patches have been landed. Closing bug and clearing flags on attachment 440270 [details]. |