Bug 186216 – ServicesOverlayController can hold references to Documents after you navigate away

• Status: NEW
• Component: WebCore Misc.

[Simon Fraser (smfr)]

ServiceOverlayController::Highlight() has a Ref<Range>, and Range has a Ref<Document>.

When you change the selection in a view, ServiceOverlayController makes a “potential highlight” Highlight, which retains the Document. If you then navigate, there’s nothing that clears that Highlight, until the selection changes.

We need to either have ServiceOverlayController use weak refs, or clear its highlights on navigation.

[Simon Fraser (smfr)]

rdar://problem/40735219

[Simon Fraser (smfr)]

This is visible with any layout test that makes a selection (like LayoutTests/fast/css/counters/counter-after-style-crash.html) and the patch in bug 186214

[Wenson Hsieh]

(In reply to Simon Fraser (smfr) from comment #0)
> ServiceOverlayController::Highlight() has a Ref<Range>, and Range has a
> Ref<Document>.
> 
> When you change the selection in a view, ServiceOverlayController makes a
> “potential highlight” Highlight, which retains the Document. If you then
> navigate, there’s nothing that clears that Highlight, until the selection
> changes.
> 
> We need to either have ServiceOverlayController use weak refs, or clear its
> highlights on navigation.

We should probably add logic to clear state underneath `Document::willBeRemovedFromFrame()` (similar to how some of the other controller-type objects have a `documentDetached` method).