REGRESSION (r240698): fast/scrolling/sticky-to-fixed.html can cause a crash
authorsimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 Feb 2019 16:45:15 +0000 (16:45 +0000)
committersimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 Feb 2019 16:45:15 +0000 (16:45 +0000)
commitb290ec73eec8e4ce61f70bb9466a951708be3403
treeae4c7501e3342d29cc0b41201cfeddbf90398166
parentc372e2e59ba80aeecb23f1d152b878a2a4fffbfb
REGRESSION (r240698): fast/scrolling/sticky-to-fixed.html can cause a crash
https://bugs.webkit.org/show_bug.cgi?id=194134
rdar://problem/47721210

Reviewed by Daniel Bates.

fast/scrolling/sticky-to-fixed.html changes the scrolling node type, which causes
scrollingCoordinator->insertNode() to return a different ScrollingNodeID to the one
passed in. We have to handle this, removing the node for the nodeID and unregistering
the layer with the old nodeID.

* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::attachScrollingNode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@240849 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderLayerCompositor.cpp