To avoid tricky ordering dependencies between compositing/scrolling tree updates in child and parent frames, we need to make it possible to create ScrollingStateNodes in a detached state (basically calling ScrollingCoordinator::attachToStateTree() with no parent node). This will allow subframes to have a detached subtree of scrolling nodes, then attach this subtree when the iframe layers are hooked up by RenderLayerCompositor.
This is really a consequence of scrolling tree nodes being hidden behind the ScrollingCoordinator interface; a client can't hang on to a scrolling tree node; all it has to hang onto is a ScrollingNodeID.
Created attachment 360248 [details] Patch
<rdar://problem/47577565>
https://trac.webkit.org/changeset/240551/webkit
It appears that the changes in https://trac.webkit.org/changeset/240551/webkit Has caused this test css3/filters/blur-filter-page-scroll-self.html To become a flaky crash on Mac Debug WK2 History https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=css3%2Ffilters%2Fblur-filter-page-scroll-self.html I reproduce this with run-webkit-tests --root debug-240551 css3/filters/blur-filter-page-scroll-self.html --iterations 500 -f --debug I was able to reproduce crashes on 240551, but unable to reproduce crashes on 240550
(In reply to Shawn Roberts from comment #5) > It appears that the changes in > https://trac.webkit.org/changeset/240551/webkit > > Has caused this test css3/filters/blur-filter-page-scroll-self.html > > To become a flaky crash on Mac Debug WK2 > > History > https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard. > html#showAllRuns=true&tests=css3%2Ffilters%2Fblur-filter-page-scroll-self. > html > > I reproduce this with run-webkit-tests --root debug-240551 > css3/filters/blur-filter-page-scroll-self.html --iterations 500 -f --debug > > I was able to reproduce crashes on 240551, but unable to reproduce crashes > on 240550 That seems to be bug 193925, do you still see it after r240609?
Comment on attachment 360248 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=360248&action=review > Source/WebCore/page/scrolling/ScrollingStateTree.cpp:222 > + for (auto child : *children) { This was modified later r240610 (bug 193930 but I don't have access to it). And the children variable is no longer used.
Committed r240651: <https://trac.webkit.org/changeset/240651>
(In reply to Frédéric Wang (:fredw) from comment #8) > Committed r240651: <https://trac.webkit.org/changeset/240651> It appears it has been resolved. Thank you!