Bug 209695

Summary: [RenderTreeBuilder] Destroy the child first in RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers
Product: WebKit Reporter: zalan <zalan>
Component: Layout and RenderingAssignee: zalan <zalan>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, esprehn+autocc, ews-watchlist, glenn, koivisto, kondapallykalyan, pdr, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=207034
Attachments:
Description Flags
Patch
none
Patch none

Description zalan 2020-03-27 20:49:27 PDT
Before destroying a renderer we check if this renderer is inside an anonymous wrapper (including ancestors) and if so, we get rid of these wrappers too the same time. However because of the 'leaf -> container' tear down direction, we need to destroy the child first.
Comment 1 zalan 2020-03-27 20:55:07 PDT
Created attachment 394786 [details]
Patch
Comment 2 Antti Koivisto 2020-03-28 00:14:57 PDT
If this is the order we want we should probably change RenderTreeBuilder::destroy instead.
Comment 3 zalan 2020-03-28 06:25:16 PDT
(In reply to Antti Koivisto from comment #2)
> If this is the order we want we should probably change
> RenderTreeBuilder::destroy instead.
Yeah, that's a good point. I would guess the ::destroy() is only called with the bottom-most renderer from the updater, and only the builder calls it with depth (in case of anon wrappers).
Comment 4 zalan 2020-03-28 08:07:19 PDT
(In reply to zalan from comment #3)
> (In reply to Antti Koivisto from comment #2)
> > If this is the order we want we should probably change
> > RenderTreeBuilder::destroy instead.
> Yeah, that's a good point. I would guess the ::destroy() is only called with
> the bottom-most renderer from the updater, and only the builder calls it
> with depth (in case of anon wrappers).
Actually we tried that here https://trac.webkit.org/changeset/228606/webkit and had to revert.
Comment 5 zalan 2020-03-28 09:50:40 PDT
Created attachment 394825 [details]
Patch
Comment 6 EWS 2020-03-28 10:21:48 PDT
Committed r259160: <https://trac.webkit.org/changeset/259160>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 394825 [details].
Comment 7 Radar WebKit Bug Importer 2020-03-28 10:22:13 PDT
<rdar://problem/61010688>