ASSERT on renderer lifecycle

Source/core/rendering/RenderObject.cpp

Index: Source/core/rendering/RenderObject.cpp
diff --git a/Source/core/rendering/RenderObject.cpp b/Source/core/rendering/RenderObject.cpp
index f96b3e8e279e98f33374b337fd121df94b189e8f..1735c04e3a31f9739acde7cd0295a6adafd98e8a 100644
--- a/Source/core/rendering/RenderObject.cpp
+++ b/Source/core/rendering/RenderObject.cpp
@@ -96,6 +96,12 @@ using namespace std;
 
 namespace WebCore {
 
+namespace {
+
+static bool gModifyRenderTreeStructureAnyState = false;
+
+} // namespace
+
 using namespace HTMLNames;
 
 #ifndef NDEBUG
@@ -143,6 +149,8 @@ void RenderObject::operator delete(void* ptr)
 
 RenderObject* RenderObject::createObject(Element* element, RenderStyle* style)
 {
+    ASSERT(isAllowedToModifyRenderTreeStructure(element->document()));
+
     // Minimal support for content properties replacing an entire element.
     // Works only if we have exactly one piece of content and it's a URL.
     // Otherwise acts as if we didn't support this feature.
@@ -296,6 +304,8 @@ bool RenderObject::requiresAnonymousTableWrappers(const RenderObject* newChild)
 
 void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
+    ASSERT(isAllowedToModifyRenderTreeStructure(document()));
+
     RenderObjectChildList* children = virtualChildren();
     ASSERT(children);
     if (!children)
@@ -334,6 +344,8 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
 
 void RenderObject::removeChild(RenderObject* oldChild)
 {
+    ASSERT(isAllowedToModifyRenderTreeStructure(document()));
+
     RenderObjectChildList* children = virtualChildren();
     ASSERT(children);
     if (!children)
@@ -2763,6 +2775,10 @@ void RenderObject::removeFromRenderFlowThreadRecursive(RenderFlowThread* renderF
 
 void RenderObject::destroyAndCleanupAnonymousWrappers()
 {
+    // FIXME: We should not modify the structure of the render tree during
+    // layout. crbug.com/370463
+    DeprecatedDisableModifyRenderTreeStructureAsserts disabler;

[eseidel, 2014/05/07 16:48:22]

It seems like the bug talked about moving this up into Node::detach()?

[dsinclair, 2014/05/07 20:32:34]

Done.

I kept the fixme over the move as it sounds like there is still some question on
the correct behaviour.

+
     // If the tree is destroyed, there is no need for a clean-up phase.
     if (documentBeingDestroyed()) {
         destroy();
@@ -3411,6 +3427,20 @@ void RenderObject::clearRepaintState()
     setMayNeedInvalidation(false);
 }
 
+bool RenderObject::isAllowedToModifyRenderTreeStructure(Document& document)
+{
+    return DeprecatedDisableModifyRenderTreeStructureAsserts::canModifyRenderTreeStateInAnyState()
+        || document.lifecycle().stateAllowsRenderTreeMutations();
+}
+
+DeprecatedDisableModifyRenderTreeStructureAsserts::DeprecatedDisableModifyRenderTreeStructureAsserts()
+    : m_disabler(gModifyRenderTreeStructureAnyState, true) { }
+
+bool DeprecatedDisableModifyRenderTreeStructureAsserts::canModifyRenderTreeStateInAnyState()
+{
+    return gModifyRenderTreeStructureAnyState;
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG