Check displayContentsChanged in destroyRenderTreeIfNeeded

https://bugs.webkit.org/show_bug.cgi?id=248776 rdar://102807985> Reviewed by Antti Koivisto. Check displayContentsChanged in destroyRenderTreeIfNeeded since display: contents may be removed due to focus removal while removing subtrees but we still need to clean up pseudo elements. * LayoutTests/fast/css/content/quote-display-contents-crash-expected.txt: Added. * LayoutTests/fast/css/content/quote-display-contents-crash.html: Added. * Source/WebCore/dom/ContainerNode.cpp: (WebCore::destroyRenderTreeIfNeeded): * Source/WebCore/dom/Element.cpp: (WebCore::Element::resolveComputedStyle): Canonical link: https://commits.webkit.org/256843.5@webkit-2022.12-embargoed
WebKit · Dec 16, 2022 · 312254f · 312254f
1 parent 6234ec9
commit 312254f
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 2 deletions.
diff --git a/LayoutTests/fast/css/content/quote-display-contents-crash-expected.txt b/LayoutTests/fast/css/content/quote-display-contents-crash-expected.txt
@@ -0,0 +1 @@
+Pass if no crash.
diff --git a/LayoutTests/fast/css/content/quote-display-contents-crash.html b/LayoutTests/fast/css/content/quote-display-contents-crash.html
@@ -0,0 +1,18 @@
+<style>
+  q { border-image: url(about:blank); }
+  label:focus-within { display: contents; }
+</style>
+<script>
+if (window.testRunner)
+   testRunner.dumpAsText();
+function runTest() {
+   label.remove();
+   document.write("Pass if no crash.");
+}
+</script>
+<body onload="runTest()">
+  <label id="label" >
+    <textarea autofocus></textarea>
+    <q></q>
+  </label>
+</body>
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
@@ -330,7 +330,7 @@ void ContainerNode::removeDetachedChildren()
 static inline void destroyRenderTreeIfNeeded(Node& child)
 {
     auto childAsElement = dynamicDowncast<Element>(child);
-    auto hasDisplayContents = childAsElement && childAsElement->hasDisplayContents();
+    auto hasDisplayContents = childAsElement && (childAsElement->hasDisplayContents() || childAsElement->displayContentsChanged());
     if (!child.renderer() && !hasDisplayContents)
         return;
     if (childAsElement)

diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
@@ -3782,7 +3782,7 @@ const RenderStyle* Element::resolveComputedStyle(ResolveComputedStyleMode mode)
         rareData.setComputedStyle(WTFMove(style));
         element->clearNodeFlag(NodeFlag::IsComputedStyleInvalidFlag);
         if (hadDisplayContents && computedStyle->display() != DisplayType::Contents)
-            setDisplayContentsChanged();
+            element->setDisplayContentsChanged();
 
         if (mode == ResolveComputedStyleMode::RenderedOnly && computedStyle->display() == DisplayType::None)
             return nullptr;