third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp - Issue 2365173002: Detach PaintLayerScrollableArea from RootFrameViewport when disposed.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp

Issue 2365173002: Detach PaintLayerScrollableArea from RootFrameViewport when disposed. (Closed)

Patch Set: Fixed ASAN failure in previous patch Created 4 years, 3 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

« no previous file with comments | « third_party/WebKit/Source/core/page/scrolling/RootScrollerController.h ('k') | third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

Index: third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp

diff --git a/third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp b/third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp

index 6dfa436619f353c1f553182fe0ce08030e4a2ecb..b8bb4cc8bf34a2ccb44b1682ab5ac679cc7c97f1 100644

--- a/third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp

+++ b/third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp

@@ -88,6 +88,19 @@ void RootScrollerController::didUpdateLayout()

recomputeEffectiveRootScroller();

}

+void RootScrollerController::didDisposePaintLayerScrollableArea(

+ PaintLayerScrollableArea& area)

+ // If the document is being torn down we'll skip a bunch of notifications

+ // so recomputing the effective root scroller could touch dead objects.

+ // (e.g. ScrollAnchor keeps a pointer to dead LayoutObjects).

+ if (!m_effectiveRootScroller || area.box().documentBeingDestroyed())

+ return;

+ if (&area.box() == m_effectiveRootScroller->layoutObject())

+ recomputeEffectiveRootScroller();

void RootScrollerController::recomputeEffectiveRootScroller()

{

bool rootScrollerValid =

@@ -150,8 +163,11 @@ PaintLayer* RootScrollerController::rootScrollerPaintLayer() const

// PaintLayer (i.e. the PaintLayerCompositor's root layer). The reason the root

// scroller is the <html> layer and not #document is because the latter is a Node

// but not an Element.

- if (m_effectiveRootScroller->isSameNode(m_document->documentElement()))

+ if (m_effectiveRootScroller->isSameNode(m_document->documentElement())) {

+ if (!layer || !layer->compositor())

+ return nullptr;

return layer->compositor()->rootLayer();

+ }

return layer;

}