[webkit-changes] [WebKit/WebKit] 46572d: Assert that the scrolling tree is valid, and fix i...

[Simon Fraser]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 46572d8428cba7c77d2ea1182c7a1c9502b12ab8
      https://github.com/WebKit/WebKit/commit/46572d8428cba7c77d2ea1182c7a1c9502b12ab8
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2023-05-02 (Tue, 02 May 2023)

  Changed paths:
    M Source/WebCore/page/scrolling/ScrollingStateTree.cpp
    M Source/WebCore/page/scrolling/ScrollingStateTree.h
    M Source/WebCore/rendering/RenderLayerCompositor.cpp
    M Source/WebCore/rendering/RenderLayerCompositor.h

  Log Message:
  -----------
  Assert that the scrolling tree is valid, and fix issues with negative z-index layers
https://bugs.webkit.org/show_bug.cgi?id=256193
rdar://108769471

Reviewed by Tim Horton.

To make it easier to detect invalid scrolling trees which can result in MESSAGE_CHECKs
(rdar://108204370) add code to check the validity of the scrolling tree in the web process, and
assert when not valid. This code checks that nodes that have cross-references to other scrolling
tree nodes actually point to live nodes.

This detected a case where we have incorrect behavior (tested by
scrollingcoordinator/scrolling-tree/scroller-with-negative-z-child.html and two similar tests); when
an overflow:scroll has composited descendant which is not a paint-order child, the child gets an
"ancestor clipping stack" which points to ScrollingStateOverflowScrollProxyNodes, which reference
the actual overflow scrolling node. However, if the child has negative z-index, we encounter the
child before the overflow scroller so fail to find its scrolling tree node.

Fix this by keeping track of RenderLayers with unresolved scrolling tree references in
m_layersWithUnresolvedRelations, and updating them at the end of the "update backing and hierarchy"
compositing phase.

* Source/WebCore/page/scrolling/ScrollingStateTree.cpp:
(WebCore::ScrollingStateTree::commit):
(WebCore::ScrollingStateTree::traverse const):
(WebCore::ScrollingStateTree::isValid const):
* Source/WebCore/page/scrolling/ScrollingStateTree.h:
* Source/WebCore/rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::updateCompositingLayers):
(WebCore::RenderLayerCompositor::setupScrollProxyRelatedOverflowScrollingNode):
(WebCore::RenderLayerCompositor::updateScrollingNodeForScrollingProxyRole):
(WebCore::RenderLayerCompositor::resolveScrollingTreeRelationships):
* Source/WebCore/rendering/RenderLayerCompositor.h:

Canonical link: https://commits.webkit.org/263620@main