From 394f41a9f855821c56434f4eb70cdb871dd9ad98 Mon Sep 17 00:00:00 2001 From: Tim Nguyen Date: Wed, 19 Oct 2022 08:14:32 -0700 Subject: [PATCH] Don't unnecessarily tear down top layer renderers in RenderTreeUpdater https://bugs.webkit.org/show_bug.cgi?id=246735 rdar://101324926 Reviewed by Antti Koivisto. The element.isInTopLayer() check added by https://commits.webkit.org/246767@main is there is because entering top layer forces `display: contents` style to `display: block`. This check is now redundant with https://commits.webkit.org/255527@main, since it is fixing the same issue more globally. Test: fast/css/top-layer-display-contents-crash.html * Source/WebCore/rendering/updating/RenderTreeUpdater.cpp: (WebCore::RenderTreeUpdater::updateElementRenderer): Canonical link: https://commits.webkit.org/255733@main --- Source/WebCore/rendering/updating/RenderTreeUpdater.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp b/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp index 9a04dc82c274..b48614b27492 100644 --- a/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp +++ b/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp @@ -311,7 +311,7 @@ void RenderTreeUpdater::updateElementRenderer(Element& element, const Style::Ele auto elementUpdateStyle = RenderStyle::cloneIncludingPseudoElements(*elementUpdate.style); - bool shouldTearDownRenderers = elementUpdate.change == Style::Change::Renderer && (element.renderer() || element.hasDisplayContents() || element.isInTopLayer() || element.displayContentsChanged()); + bool shouldTearDownRenderers = elementUpdate.change == Style::Change::Renderer && (element.renderer() || element.hasDisplayContents() || element.displayContentsChanged()); if (shouldTearDownRenderers) { if (!element.renderer()) { // We may be tearing down a descendant renderer cached in renderTreePosition.