Unreviewed, rolling out r196837.
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 20 Feb 2016 11:01:15 +0000 (11:01 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 20 Feb 2016 11:01:15 +0000 (11:01 +0000)
https://bugs.webkit.org/show_bug.cgi?id=154495

It caused a lot of crashes in EFL and GTK bots (Requested by
KaL on #webkit).

Reverted changeset:

"Wheel event callback removing the window causes crash in
WebCore."
https://bugs.webkit.org/show_bug.cgi?id=150871
http://trac.webkit.org/changeset/196837

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@196858 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/events/wheel-event-destroys-frame-expected.txt [deleted file]
LayoutTests/fast/events/wheel-event-destroys-frame.html [deleted file]
Source/WebCore/ChangeLog
Source/WebCore/page/EventHandler.cpp
Source/WebCore/page/WheelEventDeltaFilter.cpp
Source/WebCore/page/mac/EventHandlerMac.mm
Source/WebCore/rendering/RenderLayer.cpp

index 88c0b40..d7ccafa 100644 (file)
@@ -1,3 +1,18 @@
+2016-02-20  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196837.
+        https://bugs.webkit.org/show_bug.cgi?id=154495
+
+        It caused a lot of crashes in EFL and GTK bots (Requested by
+        KaL on #webkit).
+
+        Reverted changeset:
+
+        "Wheel event callback removing the window causes crash in
+        WebCore."
+        https://bugs.webkit.org/show_bug.cgi?id=150871
+        http://trac.webkit.org/changeset/196837
+
 2016-02-19  Doug Russell  <d_russell@apple.com>
 
         Bug 154366: AX: AXObjectCache::visiblePositionForTextMarkerData() doesn't account for visibly equivalent positions
diff --git a/LayoutTests/fast/events/wheel-event-destroys-frame-expected.txt b/LayoutTests/fast/events/wheel-event-destroys-frame-expected.txt
deleted file mode 100644 (file)
index 6fb47db..0000000
+++ /dev/null
@@ -1,3 +0,0 @@
-This test should not crash
-
-
diff --git a/LayoutTests/fast/events/wheel-event-destroys-frame.html b/LayoutTests/fast/events/wheel-event-destroys-frame.html
deleted file mode 100644 (file)
index 4e67f07..0000000
+++ /dev/null
@@ -1,39 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <script>
-        if (window.testRunner) {
-            testRunner.waitUntilDone();
-            testRunner.dumpAsText();
-        }
-
-        function frameLoaded(iframe)
-        {
-            iframe.contentWindow.addEventListener('wheel', function() {
-                // Removing the window during event firing causes crash.
-                window.document.body.removeChild(iframe);
-                window.setTimeout(function() {
-                    if (window.testRunner)
-                        testRunner.notifyDone();
-                }, 0);
-            });
-
-            if (!window.eventSender)
-                return;
-
-            var iframeTarget = document.getElementById('iframe');
-            var iframeBounds = iframeTarget.getBoundingClientRect();
-
-            eventSender.mouseMoveTo(iframeBounds.left + 10, iframeBounds.top + 10);
-            eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'began', 'none');
-            eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'changed', 'none');
-            eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'changed', 'none');
-            eventSender.mouseScrollByWithWheelAndMomentumPhases(0, 0, 'ended', 'none');
-        }
-    </script>
-</head>
-<body>
-    <p>This test should not crash</p>
-    <iframe id="iframe" onload="frameLoaded(this)" src="data:text/html,<body>Wheel here</body>"></iframe>
-</body>
-</html>
index ea627c2..5db52e6 100644 (file)
@@ -1,3 +1,18 @@
+2016-02-20  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196837.
+        https://bugs.webkit.org/show_bug.cgi?id=154495
+
+        It caused a lot of crashes in EFL and GTK bots (Requested by
+        KaL on #webkit).
+
+        Reverted changeset:
+
+        "Wheel event callback removing the window causes crash in
+        WebCore."
+        https://bugs.webkit.org/show_bug.cgi?id=150871
+        http://trac.webkit.org/changeset/196837
+
 2016-02-19  Chris Dumez  <cdumez@apple.com>
 
         Land release assertions to help track down a possible HTMLCollection lifetime bug
index 4d5f620..a1e58e3 100644 (file)
@@ -452,7 +452,9 @@ void EventHandler::clear()
     m_mousePressed = false;
     m_capturesDragging = false;
     m_capturingMouseEventsElement = nullptr;
-    clearLatchedState();
+#if PLATFORM(MAC)
+    m_frame.mainFrame().resetLatchingState();
+#endif
 #if ENABLE(TOUCH_EVENTS) && !ENABLE(IOS_TOUCH_EVENTS)
     m_originatingTouchPointTargets.clear();
     m_originatingTouchPointDocument = nullptr;
@@ -2662,8 +2664,7 @@ void EventHandler::clearLatchedState()
 #if PLATFORM(MAC)
     m_frame.mainFrame().resetLatchingState();
 #endif
-    if (WheelEventDeltaFilter* filter = m_frame.mainFrame().wheelEventDeltaFilter())
-        filter->endFilteringDeltas();
+    m_frame.mainFrame().wheelEventDeltaFilter()->endFilteringDeltas();
 }
 
 void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEvent)
index 229ab21..597b666 100644 (file)
@@ -31,8 +31,6 @@
 #endif
 
 #include "FloatSize.h"
-#include "Logging.h"
-#include "TextStream.h"
 
 namespace WebCore {
     
@@ -60,7 +58,6 @@ bool WheelEventDeltaFilter::isFilteringDeltas() const
 
 FloatSize WheelEventDeltaFilter::filteredDelta() const
 {
-    LOG_WITH_STREAM(Scrolling, stream << "BasicWheelEventDeltaFilter::filteredDelta returning " << m_currentFilteredDelta);
     return m_currentFilteredDelta;
 }
 
index e8f96a5..73ee3c0 100644 (file)
@@ -1008,10 +1008,9 @@ static FrameView* frameViewForLatchingState(Frame& frame, ScrollLatchingState* l
 
 bool EventHandler::platformCompleteWheelEvent(const PlatformWheelEvent& wheelEvent, ContainerNode* scrollableContainer, ScrollableArea* scrollableArea)
 {
-    FrameView* view = m_frame.view();
     // We do another check on the frame view because the event handler can run JS which results in the frame getting destroyed.
-    if (!view)
-        return false;
+    ASSERT(m_frame.view());
+    FrameView* view = m_frame.view();
 
     ScrollLatchingState* latchingState = m_frame.mainFrame().latchingState();
     if (wheelEvent.useLatchedEventElement() && !latchingIsLockedToAncestorOfThisFrame(m_frame) && latchingState && latchingState->scrollableContainer()) {
index dfcbf67..2da5622 100644 (file)
@@ -2349,8 +2349,6 @@ void RenderLayer::scrollTo(const ScrollPosition& position)
     if (!box)
         return;
 
-    LOG_WITH_STREAM(Scrolling, stream << "RenderLayer::scrollTo " << position);
-
     ScrollPosition newPosition = position;
     if (box->style().overflowX() != OMARQUEE) {
         // Ensure that the dimensions will be computed if they need to be (for overflow:hidden blocks).