Before destroying a renderer we check if this renderer is inside an anonymous wrapper (including ancestors) and if so, we get rid of these wrappers too the same time. However because of the 'leaf -> container' tear down direction, we need to destroy the child first.
Created attachment 394786 [details] Patch
If this is the order we want we should probably change RenderTreeBuilder::destroy instead.
(In reply to Antti Koivisto from comment #2) > If this is the order we want we should probably change > RenderTreeBuilder::destroy instead. Yeah, that's a good point. I would guess the ::destroy() is only called with the bottom-most renderer from the updater, and only the builder calls it with depth (in case of anon wrappers).
(In reply to zalan from comment #3) > (In reply to Antti Koivisto from comment #2) > > If this is the order we want we should probably change > > RenderTreeBuilder::destroy instead. > Yeah, that's a good point. I would guess the ::destroy() is only called with > the bottom-most renderer from the updater, and only the builder calls it > with depth (in case of anon wrappers). Actually we tried that here https://trac.webkit.org/changeset/228606/webkit and had to revert.
Created attachment 394825 [details] Patch
Committed r259160: <https://trac.webkit.org/changeset/259160> All reviewed patches have been landed. Closing bug and clearing flags on attachment 394825 [details].
<rdar://problem/61010688>