Diff
Modified: trunk/Source/WebCore/ChangeLog (230822 => 230823)
--- trunk/Source/WebCore/ChangeLog 2018-04-19 22:21:21 UTC (rev 230822)
+++ trunk/Source/WebCore/ChangeLog 2018-04-19 22:31:05 UTC (rev 230823)
@@ -1,3 +1,27 @@
+2018-04-19 Antti Koivisto <an...@apple.com>
+
+ Don't use RenderTreeBuilder::current() in RenderTreeUpdater
+ https://bugs.webkit.org/show_bug.cgi?id=184794
+
+ Reviewed by Zalan Bujtas.
+
+ Pass the builder as a parameter where needed.
+
+ * rendering/updating/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::updateElementRenderer):
+ (WebCore::RenderTreeUpdater::updateTextRenderer):
+ (WebCore::RenderTreeUpdater::tearDownRenderers):
+ (WebCore::RenderTreeUpdater::tearDownRenderer):
+ (WebCore::RenderTreeUpdater::tearDownTextRenderer):
+ (WebCore::RenderTreeUpdater::tearDownLeftoverPaginationRenderersIfNeeded):
+ (WebCore::RenderTreeUpdater::tearDownLeftoverShadowHostChildren):
+ * rendering/updating/RenderTreeUpdater.h:
+ * rendering/updating/RenderTreeUpdaterGeneratedContent.cpp:
+ (WebCore::RenderTreeUpdater::GeneratedContent::updatePseudoElement):
+ (WebCore::RenderTreeUpdater::GeneratedContent::removeBeforePseudoElement):
+ (WebCore::RenderTreeUpdater::GeneratedContent::removeAfterPseudoElement):
+ * rendering/updating/RenderTreeUpdaterGeneratedContent.h:
+
2018-04-19 Eric Carlson <eric.carl...@apple.com>
Runtime logging during GC can cause crash
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp (230822 => 230823)
--- trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2018-04-19 22:21:21 UTC (rev 230822)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2018-04-19 22:31:05 UTC (rev 230823)
@@ -318,7 +318,7 @@
// display:none cancels animations.
auto teardownType = update.style->display() == NONE ? TeardownType::RendererUpdateCancelingAnimations : TeardownType::RendererUpdate;
- tearDownRenderers(element, teardownType);
+ tearDownRenderers(element, teardownType, m_builder);
renderingParent().didCreateOrDestroyChildRenderer = true;
}
@@ -484,7 +484,7 @@
if (existingRenderer && textUpdate && textUpdate->inheritedDisplayContentsStyle) {
if (existingRenderer->inlineWrapperForDisplayContents() || *textUpdate->inheritedDisplayContentsStyle) {
// FIXME: We could update without teardown.
- tearDownTextRenderer(text);
+ tearDownTextRenderer(text, m_builder);
existingRenderer = nullptr;
}
}
@@ -495,7 +495,7 @@
existingRenderer->setTextWithOffset(text.data(), textUpdate->offset, textUpdate->length);
return;
}
- tearDownTextRenderer(text);
+ tearDownTextRenderer(text, m_builder);
renderingParent().didCreateOrDestroyChildRenderer = true;
return;
}
@@ -520,7 +520,7 @@
if (!view)
return;
RenderTreeBuilder builder(*view);
- tearDownRenderers(root, TeardownType::Full);
+ tearDownRenderers(root, TeardownType::Full, builder);
}
void RenderTreeUpdater::tearDownRenderer(Text& text)
@@ -529,10 +529,10 @@
if (!view)
return;
RenderTreeBuilder builder(*view);
- tearDownTextRenderer(text);
+ tearDownTextRenderer(text, builder);
}
-void RenderTreeUpdater::tearDownRenderers(Element& root, TeardownType teardownType)
+void RenderTreeUpdater::tearDownRenderers(Element& root, TeardownType teardownType, RenderTreeBuilder& builder)
{
WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
@@ -563,17 +563,17 @@
if (teardownType == TeardownType::Full)
element.clearHoverAndActiveStatusBeforeDetachingRenderer();
- GeneratedContent::removeBeforePseudoElement(element);
- GeneratedContent::removeAfterPseudoElement(element);
+ GeneratedContent::removeBeforePseudoElement(element, builder);
+ GeneratedContent::removeAfterPseudoElement(element, builder);
if (auto* renderer = element.renderer()) {
- RenderTreeBuilder::current()->destroyAndCleanUpAnonymousWrappers(*renderer);
+ builder.destroyAndCleanUpAnonymousWrappers(*renderer);
element.setRenderer(nullptr);
}
// Make sure we don't leave any renderers behind in nodes outside the composed tree.
if (element.shadowRoot())
- tearDownLeftoverShadowHostChildren(element);
+ tearDownLeftoverShadowHostChildren(element, builder);
if (element.hasCustomStyleResolveCallbacks())
element.didDetachRenderers();
@@ -587,7 +587,7 @@
pop(it.depth());
if (is<Text>(*it)) {
- tearDownTextRenderer(downcast<Text>(*it));
+ tearDownTextRenderer(downcast<Text>(*it), builder);
continue;
}
@@ -596,19 +596,19 @@
pop(0);
- tearDownLeftoverPaginationRenderersIfNeeded(root);
+ tearDownLeftoverPaginationRenderersIfNeeded(root, builder);
}
-void RenderTreeUpdater::tearDownTextRenderer(Text& text)
+void RenderTreeUpdater::tearDownTextRenderer(Text& text, RenderTreeBuilder& builder)
{
auto* renderer = text.renderer();
if (!renderer)
return;
- RenderTreeBuilder::current()->destroyAndCleanUpAnonymousWrappers(*renderer);
+ builder.destroyAndCleanUpAnonymousWrappers(*renderer);
text.setRenderer(nullptr);
}
-void RenderTreeUpdater::tearDownLeftoverPaginationRenderersIfNeeded(Element& root)
+void RenderTreeUpdater::tearDownLeftoverPaginationRenderersIfNeeded(Element& root, RenderTreeBuilder& builder)
{
if (&root != root.document().documentElement())
return;
@@ -615,22 +615,22 @@
for (auto* child = root.document().renderView()->firstChild(); child;) {
auto* nextSibling = child->nextSibling();
if (is<RenderMultiColumnFlow>(*child) || is<RenderMultiColumnSet>(*child))
- RenderTreeBuilder::current()->destroyAndCleanUpAnonymousWrappers(*child);
+ builder.destroyAndCleanUpAnonymousWrappers(*child);
child = nextSibling;
}
}
-void RenderTreeUpdater::tearDownLeftoverShadowHostChildren(Element& host)
+void RenderTreeUpdater::tearDownLeftoverShadowHostChildren(Element& host, RenderTreeBuilder& builder)
{
for (auto* hostChild = host.firstChild(); hostChild; hostChild = hostChild->nextSibling()) {
if (!hostChild->renderer())
continue;
if (is<Text>(*hostChild)) {
- tearDownTextRenderer(downcast<Text>(*hostChild));
+ tearDownTextRenderer(downcast<Text>(*hostChild), builder);
continue;
}
if (is<Element>(*hostChild))
- tearDownRenderers(downcast<Element>(*hostChild), TeardownType::Full);
+ tearDownRenderers(downcast<Element>(*hostChild), TeardownType::Full, builder);
}
}
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.h (230822 => 230823)
--- trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.h 2018-04-19 22:21:21 UTC (rev 230822)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.h 2018-04-19 22:31:05 UTC (rev 230823)
@@ -87,10 +87,10 @@
void popParentsToDepth(unsigned depth);
enum class TeardownType { Full, RendererUpdate, RendererUpdateCancelingAnimations };
- static void tearDownRenderers(Element&, TeardownType);
- static void tearDownTextRenderer(Text&);
- static void tearDownLeftoverShadowHostChildren(Element&);
- static void tearDownLeftoverPaginationRenderersIfNeeded(Element&);
+ static void tearDownRenderers(Element&, TeardownType, RenderTreeBuilder&);
+ static void tearDownTextRenderer(Text&, RenderTreeBuilder&);
+ static void tearDownLeftoverShadowHostChildren(Element&, RenderTreeBuilder&);
+ static void tearDownLeftoverPaginationRenderersIfNeeded(Element&, RenderTreeBuilder&);
RenderView& renderView();
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.cpp (230822 => 230823)
--- trunk/Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.cpp 2018-04-19 22:21:21 UTC (rev 230822)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.cpp 2018-04-19 22:31:05 UTC (rev 230823)
@@ -99,9 +99,9 @@
if (!needsPseudoElement(update)) {
if (pseudoElement) {
if (pseudoId == BEFORE)
- removeBeforePseudoElement(current);
+ removeBeforePseudoElement(current, m_updater.m_builder);
else
- removeAfterPseudoElement(current);
+ removeAfterPseudoElement(current, m_updater.m_builder);
}
return;
}
@@ -165,21 +165,21 @@
return true;
}
-void RenderTreeUpdater::GeneratedContent::removeBeforePseudoElement(Element& element)
+void RenderTreeUpdater::GeneratedContent::removeBeforePseudoElement(Element& element, RenderTreeBuilder& builder)
{
auto* pseudoElement = element.beforePseudoElement();
if (!pseudoElement)
return;
- tearDownRenderers(*pseudoElement, TeardownType::Full);
+ tearDownRenderers(*pseudoElement, TeardownType::Full, builder);
element.clearBeforePseudoElement();
}
-void RenderTreeUpdater::GeneratedContent::removeAfterPseudoElement(Element& element)
+void RenderTreeUpdater::GeneratedContent::removeAfterPseudoElement(Element& element, RenderTreeBuilder& builder)
{
auto* pseudoElement = element.afterPseudoElement();
if (!pseudoElement)
return;
- tearDownRenderers(*pseudoElement, TeardownType::Full);
+ tearDownRenderers(*pseudoElement, TeardownType::Full, builder);
element.clearAfterPseudoElement();
}
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.h (230822 => 230823)
--- trunk/Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.h 2018-04-19 22:21:21 UTC (rev 230822)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.h 2018-04-19 22:31:05 UTC (rev 230823)
@@ -41,8 +41,8 @@
void updatePseudoElement(Element&, const std::optional<Style::ElementUpdate>&, PseudoId);
void updateRemainingQuotes();
- static void removeBeforePseudoElement(Element&);
- static void removeAfterPseudoElement(Element&);
+ static void removeBeforePseudoElement(Element&, RenderTreeBuilder&);
+ static void removeAfterPseudoElement(Element&, RenderTreeBuilder&);
private:
void updateQuotesUpTo(RenderQuote*);
