willBeRemovedFromTree assumes all the cleanup has already happened.
<rdar://problem/60434672>
Created attachment 393571 [details] Patch
Comment on attachment 393571 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=393571&action=review > Source/WebCore/ChangeLog:3 > + [Tree building] Reset the fragmented flow status before signal will-be-removed. Maybe "before calling child.willBeRemovedFromTree()" > Source/WebCore/ChangeLog:9 > + ::willBeRemoved() assumes all the cleanup has happened and it's the final step before calling d'tor. It this referring to the child.willBeRemovedFromTree()?
Created attachment 393582 [details] Patch
(In reply to Simon Fraser (smfr) from comment #3) > Comment on attachment 393571 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=393571&action=review > > > Source/WebCore/ChangeLog:3 > > + [Tree building] Reset the fragmented flow status before signal will-be-removed. > > Maybe "before calling child.willBeRemovedFromTree()" > > > Source/WebCore/ChangeLog:9 > > + ::willBeRemoved() assumes all the cleanup has happened and it's the final step before calling d'tor. > > It this referring to the child.willBeRemovedFromTree()? Correct. I confused it with willBeDestroyed.
Comment on attachment 393582 [details] Patch Clearing flags on attachment: 393582 Committed r258466: <https://trac.webkit.org/changeset/258466>
All reviewed patches have been landed. Closing bug.