Created attachment 464036 [details]
Patch

Pull request: https://github.com/WebKit/WebKit/pull/7604

<rdar://problem/103591863>

Committed 258238@main (80db98e4cb00): <https://commits.webkit.org/258238@main>

Reviewed commits have been landed. Closing PR #7604 and removing active labels.

Re-opened since this is blocked by bug 249874

Pull request: https://github.com/WebKit/WebKit/pull/8102

Committed 258366@main (763cf9e589db): <https://commits.webkit.org/258366@main>

Reviewed commits have been landed. Closing PR #8102 and removing active labels.

Comment on attachment 464036 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=464036&action=review

> Source/WebCore/dom/Element.cpp:151
> +struct SameSizeAsElement : public ContainerNode {

This doesn't detect when ContainerNode grows (and it has no size check).

Comment on attachment 464036 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=464036&action=review

>> Source/WebCore/dom/Element.cpp:151
>> +struct SameSizeAsElement : public ContainerNode {
> 
> This doesn't detect when ContainerNode grows (and it has no size check).

I have a follow up patch for asserting Element base class sizes, as suggested by Sam on slack, will put it up tomorrow.

Note that we are not seeing Speedometer2 regression with the relanded revised change (using EventTargetFlag).