REGRESSION (r240579): com.apple.WebKit.WebContent at WebCore: WebCore::Document:...

https://bugs.webkit.org/show_bug.cgi?id=194284
<rdar://problem/47774298>

Patch by Antoine Quint <graouts@apple.com> on 2019-02-05
Reviewed by Antti Koivisto.

The m_touchActionElements list needs to be HashSet<RefPtr<Element>> instead of HashSet<Element*>. It was initially storing raw pointers based on m_touchEventTargets
which is an EventTargetSet (typedef’d to HashCountedSet<Node*>), but that's because these nodes have an event listener registered for them and as such are kept alive,
whereas elements with a touch-action property aren’t. Elements are removed from this list from Document::nodeWillBeRemoved() and from Document::updateTouchActionElements(),
the latter being called from Style::TreeResolver::resolveElement().

* dom/Document.cpp:
(WebCore::Document::updateTouchActionElements):
* dom/Document.h:
(WebCore::Document::touchActionElements const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@240971 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index c11ea8c..5975164 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,21 @@
+2019-02-05  Antoine Quint  <graouts@apple.com>
+
+        REGRESSION (r240579): com.apple.WebKit.WebContent at WebCore: WebCore::Document::absoluteEventRegionForNode
+        https://bugs.webkit.org/show_bug.cgi?id=194284
+        <rdar://problem/47774298>
+
+        Reviewed by Antti Koivisto.
+
+        The m_touchActionElements list needs to be HashSet<RefPtr<Element>> instead of HashSet<Element*>. It was initially storing raw pointers based on m_touchEventTargets
+        which is an EventTargetSet (typedef’d to HashCountedSet<Node*>), but that's because these nodes have an event listener registered for them and as such are kept alive,
+        whereas elements with a touch-action property aren’t. Elements are removed from this list from Document::nodeWillBeRemoved() and from Document::updateTouchActionElements(),
+        the latter being called from Style::TreeResolver::resolveElement().
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateTouchActionElements):
+        * dom/Document.h:
+        (WebCore::Document::touchActionElements const):
+
 2019-02-05  Benjamin Poulain  <benjamin@webkit.org>
 
         Hit testing functions optimizations

diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 50bccef..31f442b 100644 (file)
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -8690,7 +8690,7 @@ void Document::updateTouchActionElements(Element& element, const RenderStyle& st
 
     if (style.touchActions() != TouchAction::Auto) {
         if (!m_touchActionElements)
-            m_touchActionElements = std::make_unique<HashSet<Element*>>();
+            m_touchActionElements = std::make_unique<HashSet<RefPtr<Element>>>();
         changed |= m_touchActionElements->add(&element).isNewEntry;
     } else if (m_touchActionElements)
         changed |= m_touchActionElements->remove(&element);

diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 8e2878f..18fefe5 100644 (file)
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -1278,7 +1278,7 @@ public:
 #endif
 #if ENABLE(POINTER_EVENTS)
     void updateTouchActionElements(Element&, const RenderStyle&);
-    const HashSet<Element*>* touchActionElements() const { return m_touchActionElements.get(); }
+    const HashSet<RefPtr<Element>>* touchActionElements() const { return m_touchActionElements.get(); }
 #endif
 
     void didAddTouchEventHandler(Node&);
@@ -1881,7 +1881,7 @@ private:
     std::unique_ptr<EventTargetSet> m_touchEventTargets;
 #endif
 #if ENABLE(POINTER_EVENTS)
-    std::unique_ptr<HashSet<Element*>> m_touchActionElements;
+    std::unique_ptr<HashSet<RefPtr<Element>>> m_touchActionElements;
 #endif
     std::unique_ptr<EventTargetSet> m_wheelEventTargets;