tree 1007d79033963a5fe4b5f588840f491e2cb22347
parent 8e29b3d7cb791dc7cac89a3f1ad250bef2d6f1cb
author shihchieh_lee@apple.com <shihchieh_lee@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1590213232 +0000
committer shihchieh_lee@apple.com <shihchieh_lee@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1590213232 +0000

ASSERTION FAILED: (!s_current || &m_view != &s_current->m_view) in RenderTreeBuilder::RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=212163
<rdar://problem/57028096>

Reviewed by Geoffrey Garen.

Source/WebCore:

Calling ~PostResolutionCallbackDisabler() before completing render tree updating and releasing RenderTreeBuilder
triggers this assertion. Therefore we added a utility function "updateRenderTree" in which PostResolutionCallback
is delayed until RenderTreeUpdater is released and m_inRenderTreeUpdate is cleared.

Test: fast/rendering/nested-render-tree-update-crash.html

* Headers.cmake:
* WebCore.xcodeproj/project.pbxproj:
* dom/Document.cpp:
(WebCore::Document::updateRenderTree):
(WebCore::Document::resolveStyle):
(WebCore::Document::updateTextRenderer):
* dom/Document.h:
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::RenderTreeUpdater):
(WebCore::RenderTreeUpdater::commit):
* rendering/updating/RenderTreeUpdater.h:

LayoutTests:

Added a regression test for the crash.

* fast/rendering/nested-render-tree-update-crash-expected.txt: Added.
* fast/rendering/nested-render-tree-update-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@262095 268f45cc-cd09-0410-ab3c-d52691b4dbfc