Skip to content

GitLab

T
tangled
Commit 8a2ded45 authored by Chris Harrelson's avatar Chris Harrelson Committed by Commit Bot
Browse files
Options

Clear a CompositingInputRoot that is being deleted. 

This is probably only a problem with rendersubtree-locked subtrees,
because the compositing inputs dirty bits get left around for these
subtrees.

Bug: 1033795

Change-Id: I3dca73eed34b39c70c7609bdfb9d052dc1b6af2b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1977306Reviewed-by: default avatarvmpstr <vmpstr@chromium.org>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#728046}
parent a1c4568b
Hide whitespace changes
Inline Side-by-side
Showing with 39 additions and 0 deletions
third_party/blink/renderer/core/paint/compositing/compositing_inputs_updater.cc
View file @ 8a2ded45
......@@ -4,6 +4,7 @@
#include "third_party/blink/renderer/core/paint/compositing/compositing_inputs_updater.h"
#include "third_party/blink/renderer/core/display_lock/display_lock_utilities.h"
#include "third_party/blink/renderer/core/dom/document.h"
#include "third_party/blink/renderer/core/frame/local_frame_view.h"
#include "third_party/blink/renderer/core/layout/layout_block.h"
......@@ -48,6 +49,13 @@ void CompositingInputsUpdater::Update() {
UpdateType update_type = kDoNotForceUpdate;
PaintLayer* layer =
compositing_inputs_root_ ? compositing_inputs_root_ : root_layer_;
if (DisplayLockUtilities::NearestLockedExclusiveAncestor(
layer->GetLayoutObject())) {
compositing_inputs_root_ = nullptr;
return;
}
CompositingReasons initial_compositing_reasons =
layer->DirectCompositingReasons();
ApplyAncestorInfoToSelfAndAncestorsRecursively(layer, update_type, info);
......
third_party/blink/renderer/core/paint/paint_layer.cc
View file @ 8a2ded45
......@@ -1368,6 +1368,9 @@ void PaintLayer::RemoveChild(PaintLayer* old_child) {
if (Compositor()) {
if (!old_child_style.IsStacked())
Compositor()->SetNeedsCompositingUpdate(kCompositingUpdateRebuildTree);
if (Compositor()->GetCompositingInputsRoot() == old_child)
Compositor()->ClearCompositingInputsRoot();
}
// Dirty the z-order list in which we are contained.
old_child->DirtyStackingContextZOrderLists();
......
third_party/blink/web_tests/wpt_internal/display-lock/rendersubtree/audio-element-crash.html 0 → 100644
View file @ 8a2ded45
<!doctype HTML>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<div id="parent">
<div id="invisible"></div>
</div>
<audio id="audioEl" controls="controls">
</audio>
<script>
let t = async_test('Does not crash');
let audioEl = document.querySelector('#audioEl');
function boom1() {
audioEl.setAttribute("rendersubtree", "invisible");
audioEl.src = "x";
}
function boom2() {
invisible.setAttribute("rendersubtree", "invisible");
document.caretRangeFromPoint(1, 2);
document.body.appendChild(audioEl);
t.done();
}
onload = () => {
parent.addEventListener("DOMSubtreeModified", boom1);
setTimeout(boom2, 200);
};
</script>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment