tree 4d436a2582a80bb2ac40e80f580fdb7d8314c2a1
parent bc8b45293df25604c32ffb764d15ad9a124f2d2b
author zalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557864226 +0000
committer zalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557864226 +0000

Do not try to issue repaint while the render tree is being destroyed.
https://bugs.webkit.org/show_bug.cgi?id=197461
<rdar://problem/50368992>

Reviewed by Simon Fraser.

Source/WebCore:

Test: http/tests/svg/crash-on-reload-with-filter.html

We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.

* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):

LayoutTests:

* http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
* http/tests/svg/crash-on-reload-with-filter.html: Added.
* http/tests/svg/resources/finishTest.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@245300 268f45cc-cd09-0410-ab3c-d52691b4dbfc