[RenderTreeBuilder] REGRESSION(r228238) Detach renderer before destroying its subtree.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 18 Feb 2018 18:44:34 +0000 (18:44 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 18 Feb 2018 18:44:34 +0000 (18:44 +0000)
commit2e0820074a70a5c350e627a4edb428f20c8cac65
tree8f9417fb8efce1a0385919f2efbf27576e50aad8
parent3c60fd5a55cd25375ccb9342e4d38c140fdd69e4
[RenderTreeBuilder] REGRESSION(r228238) Detach renderer before destroying its subtree.
https://bugs.webkit.org/show_bug.cgi?id=182908
<rdar://problem/37619394>

Reviewed by Antti Koivisto.

Source/WebCore:

Prior to r228238 we first detached the to-be-destroyed renderer and then
started nuking its descendants. r228238 changed the order and now the descendants are
destroyed while they are still attached to the tree. Apparently some of the takeChild()
normalization logic gets triggered now that the renderers still have access to their previous/next
siblings. This is unexpected and it shouldn't matter whether the subtree is still attached.
Let's revert it to the original order for now (see webkit.org/b/182909).

Test: fast/block/crash-when-subtree-is-still-attached.html

* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeAndDestroyChild):

LayoutTests:

* fast/block/crash-when-subtree-is-still-attached-expected.txt: Added.
* fast/block/crash-when-subtree-is-still-attached.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@228606 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/block/crash-when-subtree-is-still-attached-expected.txt [new file with mode: 0644]
LayoutTests/fast/block/crash-when-subtree-is-still-attached.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderElement.cpp