Bug 182908 - [RenderTreeBuilder] REGRESSION(r228238) Detach renderer before destroying its subtree.
Summary: [RenderTreeBuilder] REGRESSION(r228238) Detach renderer before destroying its...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: zalan
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-02-17 22:24 PST by zalan
Modified: 2018-02-18 10:44 PST (History)
6 users (show)

See Also:


Attachments
Patch (4.69 KB, patch)
2018-02-17 22:57 PST, zalan
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description zalan 2018-02-17 22:24:41 PST
r228238 changed the order and now when a renderer is getting destroyed, we nuke its subtree while the renderer is still attached. Apparently we first need to detach it first so that while we are nuking the subtree, the renderers can't get access to previous/next siblings and do "smart" normalization. 

rdar://problem/37619394
Comment 1 zalan 2018-02-17 22:25:07 PST
<rdar://problem/37619394>
Comment 2 zalan 2018-02-17 22:57:54 PST
Created attachment 334115 [details]
Patch
Comment 3 WebKit Commit Bot 2018-02-18 10:44:39 PST
Comment on attachment 334115 [details]
Patch

Clearing flags on attachment: 334115

Committed r228606: <https://trac.webkit.org/changeset/228606>
Comment 4 WebKit Commit Bot 2018-02-18 10:44:41 PST
All reviewed patches have been landed.  Closing bug.