Apply patch. rdar://125386652

Identifier: 272448.824@safari-7618-branch
WebKit · Mar 29, 2024 · 2fdf54c · 2fdf54c
1 parent 4dcb84b
commit 2fdf54c
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 4 deletions.
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
@@ -70,6 +70,7 @@
 #include "HTMLDialogElement.h"
 #include "HTMLDocument.h"
 #include "HTMLHtmlElement.h"
+#include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLLabelElement.h"
 #include "HTMLNameCollection.h"
@@ -262,6 +263,7 @@ Element::~Element()
     else
         ASSERT(!elementIdentifiersMap().contains(*this));
 
+    ASSERT(!is<HTMLImageElement>(*this) || !intersectionObserverDataIfExists());
     disconnectFromIntersectionObservers();
 
     disconnectFromResizeObservers();
@@ -4537,6 +4539,7 @@ void Element::disconnectFromIntersectionObserversSlow(IntersectionObserverData&
 
 IntersectionObserverData& Element::ensureIntersectionObserverData()
 {
+    ASSERT(!is<HTMLImageElement>(*this));
     auto& rareData = ensureElementRareData();
     if (!rareData.intersectionObserverData())
         rareData.setIntersectionObserverData(makeUnique<IntersectionObserverData>());

diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
@@ -721,8 +721,8 @@ class Element : public ContainerNode {
     using ContainerNode::setAttributeEventListener;
     void setAttributeEventListener(const AtomString& eventType, const QualifiedName& attributeName, const AtomString& value);
 
-    IntersectionObserverData& ensureIntersectionObserverData();
-    IntersectionObserverData* intersectionObserverDataIfExists();
+    virtual IntersectionObserverData& ensureIntersectionObserverData();
+    virtual IntersectionObserverData* intersectionObserverDataIfExists();
 
     ResizeObserverData& ensureResizeObserverData();
     ResizeObserverData* resizeObserverDataIfExists();
@@ -790,6 +790,7 @@ class Element : public ContainerNode {
 
     void updateLabel(TreeScope&, const AtomString& oldForAttributeValue, const AtomString& newForAttributeValue);
 
+    void disconnectFromIntersectionObservers();
     static AtomString makeTargetBlankIfHasDanglingMarkup(const AtomString& target);
 
 private:
@@ -851,7 +852,6 @@ class Element : public ContainerNode {
     LayoutRect absoluteEventBounds(bool& boundsIncludeAllDescendantElements, bool& includesFixedPositionElements);
     LayoutRect absoluteEventBoundsOfElementAndDescendants(bool& includesFixedPositionElements);
 
-    void disconnectFromIntersectionObservers();
     void disconnectFromIntersectionObserversSlow(IntersectionObserverData&);
 
     void disconnectFromResizeObservers();

diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
@@ -103,6 +103,7 @@ Ref<HTMLImageElement> HTMLImageElement::create(const QualifiedName& tagName, Doc
 
 HTMLImageElement::~HTMLImageElement()
 {
+    disconnectFromIntersectionObservers();
     document().removeDynamicMediaQueryDependentImage(*this);
     setForm(nullptr);
 #if ENABLE(ACCESSIBILITY_ANIMATION_CONTROL)
@@ -1128,4 +1129,16 @@ bool HTMLImageElement::originClean(const SecurityOrigin& origin) const
     return true;
 }
 
+IntersectionObserverData& HTMLImageElement::ensureIntersectionObserverData()
+{
+    if (!m_intersectionObserverData)
+        m_intersectionObserverData = makeUnique<IntersectionObserverData>();
+    return *m_intersectionObserverData;
+}
+
+IntersectionObserverData* HTMLImageElement::intersectionObserverDataIfExists()
+{
+    return m_intersectionObserverData.get();
+}
+
 }
diff --git a/Source/WebCore/html/HTMLImageElement.h b/Source/WebCore/html/HTMLImageElement.h
@@ -240,13 +240,17 @@ class HTMLImageElement : public HTMLElement, public FormAssociatedElement, publi
     HTMLSourceElement* sourceElement() const;
     void setSourceElement(HTMLSourceElement*);
 
+    IntersectionObserverData& ensureIntersectionObserverData() final;
+    IntersectionObserverData* intersectionObserverDataIfExists() final;
+
     std::unique_ptr<HTMLImageLoader> m_imageLoader;
+    std::unique_ptr<IntersectionObserverData> m_intersectionObserverData;
 
-    CompositeOperator m_compositeOperator;
     AtomString m_bestFitImageURL;
     URL m_currentURL;
     AtomString m_currentSrc;
     AtomString m_parsedUsemap;
+    CompositeOperator m_compositeOperator;
     float m_imageDevicePixelRatio;
 #if ENABLE(SERVICE_CONTROLS)
     bool m_isImageMenuEnabled { false };