Bug 308573
| Summary: | LocalFrame::frameWasDisconnectedFromOwner does not properly reset RenderView | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Brent Fulgham <bfulgham> |
| Component: | DOM | Assignee: | Brent Fulgham <bfulgham> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bfulgham, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Brent Fulgham
The Document object holds a pointer to a RenderView (m_renderView) that holds a CheckedRef to a LocalFrameView. The LocalFrameView is an aspect of the m_frame member of the Document. When the Document detaches from a frame, the RenderView pointer it holds is no longer valid. Crash data indicated that the RenderView was not being properly cleaned up when the frame member was cleared or changed.
This seems to be because of Document::frameWasDisconnectedFromOwner (and more recent Site isolation versions of this logic) improperly called Document::detachFromFrame directly, rather than Document::willBeRemovedFromFrame, which handles the bookkeeping for keeping RenderView (as well as selection views, etc.) in sync.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/171101953>
Brent Fulgham
Pull request: https://github.com/WebKit/WebKit/pull/59459
EWS
Committed 308317@main (7ff8905cfd09): <https://commits.webkit.org/308317@main>
Reviewed commits have been landed. Closing PR #59459 and removing active labels.