commit 9c675e742f620d2bac5fc6c2f20c6267a0baffcc
author antti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jan 26 14:35:52 2022 +0000
committer antti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jan 26 14:35:52 2022 +0000
tree b2114e6a3bbdad87217817af59e4d4cdb4347cc8
parent f64820ba37606d7c880d16da6349920f48425859

ASSERTION FAILED: !hasPendingSheets() under WebCore::Style::Scope::~Scope()
https://bugs.webkit.org/show_bug.cgi?id=235612
<rdar://problem/88046988>

Reviewed by Alan Bujtas.

* dom/Document.cpp:
(WebCore::Document::didRemoveAllPendingStylesheet):

Don't try to scroll to anchor if we don't have a view. This avoids hitting ASSERT(!m_inRemovedLastRefFunction)
trying to ref the document during teardown (with refererencing node count still non-zero).

* dom/InlineStyleSheetOwner.cpp:
(WebCore::InlineStyleSheetOwner::removedFromDocument):

Ensure we always remove the Element from the pending sheet list when it is removed from the document.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@288617 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 9a6598b..eea6aed 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2022-01-26  Antti Koivisto  <antti@apple.com>
+
+        ASSERTION FAILED: !hasPendingSheets() under WebCore::Style::Scope::~Scope()
+        https://bugs.webkit.org/show_bug.cgi?id=235612
+        <rdar://problem/88046988>
+
+        Reviewed by Alan Bujtas.
+
+        * dom/Document.cpp:
+        (WebCore::Document::didRemoveAllPendingStylesheet):
+
+        Don't try to scroll to anchor if we don't have a view. This avoids hitting ASSERT(!m_inRemovedLastRefFunction)
+        trying to ref the document during teardown (with refererencing node count still non-zero).
+
+        * dom/InlineStyleSheetOwner.cpp:
+        (WebCore::InlineStyleSheetOwner::removedFromDocument):
+
+        Ensure we always remove the Element from the pending sheet list when it is removed from the document.
+
 2022-01-26  Jean-Yves Avenard  <jya@apple.com>
 
         REGRESSION(r287684) speedtest.net uses many GB of memory

Source/WebCore/dom/Document.cpp

diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index c8bf5d2..b5a415a 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -3703,7 +3703,7 @@
     if (RefPtr parser = scriptableDocumentParser())
         parser->executeScriptsWaitingForStylesheetsSoon();
 
-    if (m_gotoAnchorNeededAfterStylesheetsLoad) {
+    if (m_gotoAnchorNeededAfterStylesheetsLoad && view()) {
         // https://html.spec.whatwg.org/multipage/browsing-the-web.html#try-to-scroll-to-the-fragment
         eventLoop().queueTask(TaskSource::Networking, [protectedThis = Ref { *this }, this] {
             RefPtr frameView = view();

Source/WebCore/dom/InlineStyleSheetOwner.cpp

diff --git a/Source/WebCore/dom/InlineStyleSheetOwner.cpp b/Source/WebCore/dom/InlineStyleSheetOwner.cpp
index cb7d53c..d2aa8d1 100644
--- a/Source/WebCore/dom/InlineStyleSheetOwner.cpp
+++ b/Source/WebCore/dom/InlineStyleSheetOwner.cpp
@@ -96,7 +96,7 @@
 void InlineStyleSheetOwner::removedFromDocument(Element& element)
 {
     if (m_styleScope) {
-        if (m_sheet && m_sheet->isLoading())
+        if (m_styleScope->hasPendingSheet(element))
             m_styleScope->removePendingSheet(element);
         m_styleScope->removeStyleSheetCandidateNode(element);
         m_styleScope = nullptr;