<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[160847] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/160847">160847</a></dd>
<dt>Author</dt> <dd>rniwa@webkit.org</dd>
<dt>Date</dt> <dd>2013-12-19 11:10:31 -0800 (Thu, 19 Dec 2013)</dd>
</dl>
<h3>Log Message</h3>
<pre>overflowchanged event could cause a crash
https://bugs.webkit.org/show_bug.cgi?id=125978
Reviewed by Tim Horton.
Source/WebCore:
Made the event asynchrnous by re-using Document's event queuing ability. Also removed
the infrastructure to queue up events in FrameView.
Test: fast/events/overflowchanged-inside-selection-collapse-crash.html
* dom/Document.cpp:
(WebCore::Document::recalcStyle):
(WebCore::Document::enqueueOverflowEvent):
* dom/Document.h:
* page/FrameView.cpp:
(WebCore::FrameView::FrameView):
(WebCore::FrameView::~FrameView):
(WebCore::FrameView::layout):
(WebCore::FrameView::performPostLayoutTasks):
(WebCore::FrameView::updateOverflowStatus):
* page/FrameView.h:
* rendering/RenderBlock.cpp:
(WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::scrollRectToVisible):
* rendering/RenderMarquee.cpp:
(WebCore::RenderMarquee::start):
LayoutTests:
Add a regression test.
* fast/events/overflowchanged-inside-selection-collapse-crash-expected.txt: Added.
* fast/events/overflowchanged-inside-selection-collapse-crash.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomDocumentcpp">trunk/Source/WebCore/dom/Document.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDocumenth">trunk/Source/WebCore/dom/Document.h</a></li>
<li><a href="#trunkSourceWebCorepageFrameViewcpp">trunk/Source/WebCore/page/FrameView.cpp</a></li>
<li><a href="#trunkSourceWebCorepageFrameViewh">trunk/Source/WebCore/page/FrameView.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockcpp">trunk/Source/WebCore/rendering/RenderBlock.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLayercpp">trunk/Source/WebCore/rendering/RenderLayer.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMarqueecpp">trunk/Source/WebCore/rendering/RenderMarquee.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfasteventsoverflowchangedinsideselectioncollapsecrashexpectedtxt">trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfasteventsoverflowchangedinsideselectioncollapsecrashhtml">trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/LayoutTests/ChangeLog 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2013-12-19 Ryosuke Niwa <rniwa@webkit.org>
+
+ overflowchanged event could cause a crash
+ https://bugs.webkit.org/show_bug.cgi?id=125978
+
+ Reviewed by Tim Horton.
+
+ Add a regression test.
+
+ * fast/events/overflowchanged-inside-selection-collapse-crash-expected.txt: Added.
+ * fast/events/overflowchanged-inside-selection-collapse-crash.html: Added.
+
</ins><span class="cx"> 2013-12-19 Mario Sanchez Prada <mario.prada@samsung.com>
</span><span class="cx">
</span><span class="cx"> [ATK] [WK2] platform/gtk/accessibility/roles-exposed.html is failing
</span></span></pre></div>
<a id="trunkLayoutTestsfasteventsoverflowchangedinsideselectioncollapsecrashexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash-expected.txt (0 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash-expected.txt 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -0,0 +1,3 @@
</span><ins>+This tests removing the iframe for which overflowchanged is dispatched. WebKit should not crash.
+
+PASS.
</ins></span></pre></div>
<a id="trunkLayoutTestsfasteventsoverflowchangedinsideselectioncollapsecrashhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash.html (0 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash.html (rev 0)
+++ trunk/LayoutTests/fast/events/overflowchanged-inside-selection-collapse-crash.html 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -0,0 +1,40 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<body>
+<script>
+
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function prepare() {
+ var iframe = document.createElement('iframe');
+ document.body.appendChild(iframe);
+ var doc = iframe.contentDocument;
+ doc.body.innerHTML = '<div>hello</div>';
+ doc.execCommand('SelectAll', false, null);
+ iframe.style.width = '50px';
+ iframe.style.height = '50px';
+ iframe.offsetLeft; // Force layout
+ iframe.style.width = '200%';
+ iframe.style.height = '200%';
+ return iframe.contentWindow.getSelection();
+}
+
+document.body.addEventListener('overflowchanged', function () {
+ document.body.innerHTML = 'This tests removing the iframe for which overflowchanged is dispatched. WebKit should not crash.';
+ GCController.collect();
+ setTimeout(function () {
+ document.body.innerHTML += '<br><br>PASS.';
+ testRunner.notifyDone();
+ }, 0);
+});
+
+if (window.GCController) {
+ testRunner.waitUntilDone();
+ prepare().collapseToStart();
+} else
+ document.write('This test requires GCController.');
+
+</script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/ChangeLog 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -1,3 +1,33 @@
</span><ins>+2013-12-19 Ryosuke Niwa <rniwa@webkit.org>
+
+ overflowchanged event could cause a crash
+ https://bugs.webkit.org/show_bug.cgi?id=125978
+
+ Reviewed by Tim Horton.
+
+ Made the event asynchrnous by re-using Document's event queuing ability. Also removed
+ the infrastructure to queue up events in FrameView.
+
+ Test: fast/events/overflowchanged-inside-selection-collapse-crash.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::recalcStyle):
+ (WebCore::Document::enqueueOverflowEvent):
+ * dom/Document.h:
+ * page/FrameView.cpp:
+ (WebCore::FrameView::FrameView):
+ (WebCore::FrameView::~FrameView):
+ (WebCore::FrameView::layout):
+ (WebCore::FrameView::performPostLayoutTasks):
+ (WebCore::FrameView::updateOverflowStatus):
+ * page/FrameView.h:
+ * rendering/RenderBlock.cpp:
+ (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
+ * rendering/RenderLayer.cpp:
+ (WebCore::RenderLayer::scrollRectToVisible):
+ * rendering/RenderMarquee.cpp:
+ (WebCore::RenderMarquee::start):
+
</ins><span class="cx"> 2013-12-19 Daniel Bates <dabates@apple.com>
</span><span class="cx">
</span><span class="cx"> Fix the Windows build after <http://trac.webkit.org/changeset/160841>
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.cpp (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.cpp 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/dom/Document.cpp 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -1745,7 +1745,6 @@
</span><span class="cx"> PostAttachCallbackDisabler disabler(*this);
</span><span class="cx"> WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
</span><span class="cx">
</span><del>- frameView.pauseScheduledEvents();
</del><span class="cx"> frameView.beginDeferredRepaints();
</span><span class="cx">
</span><span class="cx"> if (m_pendingStyleRecalcShouldForce)
</span><span class="lines">@@ -1772,7 +1771,6 @@
</span><span class="cx"> if (m_styleResolver)
</span><span class="cx"> m_styleSheetCollection.resetCSSFeatureFlags();
</span><span class="cx">
</span><del>- frameView.resumeScheduledEvents();
</del><span class="cx"> frameView.endDeferredRepaints();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -3715,6 +3713,11 @@
</span><span class="cx"> m_eventQueue.enqueueEvent(event);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void Document::enqueueOverflowEvent(PassRefPtr<Event> event)
+{
+ m_eventQueue.enqueueEvent(event);
+}
+
</ins><span class="cx"> PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
</span><span class="cx"> {
</span><span class="cx"> RefPtr<Event> event = EventFactory::create(eventType);
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.h (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.h 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/dom/Document.h 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -1052,6 +1052,7 @@
</span><span class="cx">
</span><span class="cx"> void enqueueWindowEvent(PassRefPtr<Event>);
</span><span class="cx"> void enqueueDocumentEvent(PassRefPtr<Event>);
</span><ins>+ void enqueueOverflowEvent(PassRefPtr<Event>);
</ins><span class="cx"> void enqueuePageshowEvent(PageshowEventPersistence);
</span><span class="cx"> void enqueueHashchangeEvent(const String& oldURL, const String& newURL);
</span><span class="cx"> void enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject);
</span></span></pre></div>
<a id="trunkSourceWebCorepageFrameViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/FrameView.cpp (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/FrameView.cpp 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/page/FrameView.cpp 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -199,7 +199,6 @@
</span><span class="cx"> , m_milestonesPendingPaint(0)
</span><span class="cx"> , m_visualUpdatesAllowedByClient(true)
</span><span class="cx"> , m_scrollPinningBehavior(DoNotPin)
</span><del>- , m_scheduledEventSuppressionCount(0)
</del><span class="cx"> {
</span><span class="cx"> init();
</span><span class="cx">
</span><span class="lines">@@ -226,11 +225,8 @@
</span><span class="cx">
</span><span class="cx"> FrameView::~FrameView()
</span><span class="cx"> {
</span><del>- if (m_postLayoutTasksTimer.isActive()) {
</del><ins>+ if (m_postLayoutTasksTimer.isActive())
</ins><span class="cx"> m_postLayoutTasksTimer.stop();
</span><del>- m_scheduledEventSuppressionCount = 0;
- m_scheduledEvents.clear();
- }
</del><span class="cx">
</span><span class="cx"> removeFromAXObjectCache();
</span><span class="cx"> resetScrollbars();
</span><span class="lines">@@ -243,7 +239,6 @@
</span><span class="cx"> setHasVerticalScrollbar(false);
</span><span class="cx">
</span><span class="cx"> ASSERT(!m_scrollCorner);
</span><del>- ASSERT(m_scheduledEvents.isEmpty());
</del><span class="cx">
</span><span class="cx"> ASSERT(frame().view() != this || !frame().contentRenderer());
</span><span class="cx"> }
</span><span class="lines">@@ -1241,8 +1236,6 @@
</span><span class="cx">
</span><span class="cx"> layer = root->enclosingLayer();
</span><span class="cx">
</span><del>- pauseScheduledEvents();
-
</del><span class="cx"> bool disableLayoutState = false;
</span><span class="cx"> if (subtree) {
</span><span class="cx"> disableLayoutState = root->view().shouldDisableLayoutStateForSubtree(root);
</span><span class="lines">@@ -1327,9 +1320,7 @@
</span><span class="cx"> if (document.hasListenerType(Document::OVERFLOWCHANGED_LISTENER))
</span><span class="cx"> updateOverflowStatus(layoutWidth() < contentsWidth(), layoutHeight() < contentsHeight());
</span><span class="cx">
</span><del>- if (m_postLayoutTasksTimer.isActive())
- resumeScheduledEvents();
- else {
</del><ins>+ if (!m_postLayoutTasksTimer.isActive()) {
</ins><span class="cx"> if (!m_inSynchronousPostLayout) {
</span><span class="cx"> if (inChildFrameLayoutWithFrameFlattening)
</span><span class="cx"> updateWidgetPositions();
</span><span class="lines">@@ -1345,10 +1336,8 @@
</span><span class="cx"> // can make us need to update again, and we can get stuck in a nasty cycle unless
</span><span class="cx"> // we call it through the timer here.
</span><span class="cx"> m_postLayoutTasksTimer.startOneShot(0);
</span><del>- if (needsLayout()) {
- pauseScheduledEvents();
</del><ins>+ if (needsLayout())
</ins><span class="cx"> layout();
</span><del>- }
</del><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2562,41 +2551,6 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-struct FrameView::ScheduledEvent {
- ScheduledEvent(PassRefPtr<Event> e, PassRefPtr<Node> t) : event(e), target(t) { }
- RefPtr<Event> event;
- RefPtr<Node> target;
-};
-
-void FrameView::scheduleEvent(PassRefPtr<Event> event, PassRefPtr<Node> eventTarget)
-{
- if (!m_scheduledEventSuppressionCount) {
- eventTarget->dispatchEvent(event, IGNORE_EXCEPTION);
- return;
- }
- m_scheduledEvents.append(ScheduledEvent(event, eventTarget));
-}
-
-void FrameView::pauseScheduledEvents()
-{
- ++m_scheduledEventSuppressionCount;
-}
-
-void FrameView::resumeScheduledEvents()
-{
- ASSERT(m_scheduledEventSuppressionCount);
- --m_scheduledEventSuppressionCount;
- if (m_scheduledEventSuppressionCount)
- return;
-
- Vector<ScheduledEvent> eventsToDispatch = std::move(m_scheduledEvents);
- for (auto& scheduledEvent : eventsToDispatch) {
- if (!scheduledEvent.target->inDocument())
- continue;
- scheduledEvent.target->dispatchEvent(scheduledEvent.event.release(), IGNORE_EXCEPTION);
- }
-}
-
</del><span class="cx"> void FrameView::scrollToAnchor()
</span><span class="cx"> {
</span><span class="cx"> RefPtr<Node> anchorNode = m_maintainScrollPositionAnchor;
</span><span class="lines">@@ -2764,8 +2718,6 @@
</span><span class="cx">
</span><span class="cx"> scrollToAnchor();
</span><span class="cx">
</span><del>- resumeScheduledEvents();
-
</del><span class="cx"> sendResizeEventIfNeeded();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2955,9 +2907,12 @@
</span><span class="cx"> if (horizontalOverflowChanged || verticalOverflowChanged) {
</span><span class="cx"> m_horizontalOverflow = horizontalOverflow;
</span><span class="cx"> m_verticalOverflow = verticalOverflow;
</span><del>-
- scheduleEvent(OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow,
- verticalOverflowChanged, verticalOverflow), m_viewportRenderer->element());
</del><ins>+
+ RefPtr<OverflowEvent> overflowEvent = OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow,
+ verticalOverflowChanged, verticalOverflow);
+ overflowEvent->setTarget(m_viewportRenderer->element());
+
+ frame().document()->enqueueOverflowEvent(overflowEvent.release());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorepageFrameViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/FrameView.h (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/FrameView.h 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/page/FrameView.h 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -41,7 +41,6 @@
</span><span class="cx">
</span><span class="cx"> class AXObjectCache;
</span><span class="cx"> class Element;
</span><del>-class Event;
</del><span class="cx"> class FloatSize;
</span><span class="cx"> class Frame;
</span><span class="cx"> class HTMLFrameOwnerElement;
</span><span class="lines">@@ -254,9 +253,6 @@
</span><span class="cx">
</span><span class="cx"> void restoreScrollbar();
</span><span class="cx">
</span><del>- void scheduleEvent(PassRefPtr<Event>, PassRefPtr<Node>);
- void pauseScheduledEvents();
- void resumeScheduledEvents();
</del><span class="cx"> void postLayoutTimerFired(Timer<FrameView>*);
</span><span class="cx">
</span><span class="cx"> bool wasScrolledByUser() const;
</span><span class="lines">@@ -674,11 +670,6 @@
</span><span class="cx"> bool m_visualUpdatesAllowedByClient;
</span><span class="cx">
</span><span class="cx"> ScrollPinningBehavior m_scrollPinningBehavior;
</span><del>-
- unsigned m_scheduledEventSuppressionCount;
-
- struct ScheduledEvent;
- Vector<ScheduledEvent> m_scheduledEvents;
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> inline void FrameView::incrementVisuallyNonEmptyCharacterCount(unsigned count)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -157,8 +157,12 @@
</span><span class="cx">
</span><span class="cx"> bool horizontalLayoutOverflowChanged = hasHorizontalLayoutOverflow != m_hadHorizontalLayoutOverflow;
</span><span class="cx"> bool verticalLayoutOverflowChanged = hasVerticalLayoutOverflow != m_hadVerticalLayoutOverflow;
</span><del>- if (horizontalLayoutOverflowChanged || verticalLayoutOverflowChanged)
- m_block->view().frameView().scheduleEvent(OverflowEvent::create(horizontalLayoutOverflowChanged, hasHorizontalLayoutOverflow, verticalLayoutOverflowChanged, hasVerticalLayoutOverflow), m_block->element());
</del><ins>+ if (!horizontalLayoutOverflowChanged && !verticalLayoutOverflowChanged)
+ return;
+
+ RefPtr<OverflowEvent> overflowEvent = OverflowEvent::create(horizontalLayoutOverflowChanged, hasHorizontalLayoutOverflow, verticalLayoutOverflowChanged, hasVerticalLayoutOverflow);
+ overflowEvent->setTarget(m_block->element());
+ m_block->document().enqueueOverflowEvent(overflowEvent.release());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLayercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLayer.cpp (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLayer.cpp 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/rendering/RenderLayer.cpp 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -2423,7 +2423,6 @@
</span><span class="cx"> // We may end up propagating a scroll event. It is important that we suspend events until
</span><span class="cx"> // the end of the function since they could delete the layer or the layer's renderer().
</span><span class="cx"> FrameView& frameView = renderer().view().frameView();
</span><del>- frameView.pauseScheduledEvents();
</del><span class="cx">
</span><span class="cx"> bool restrictedByLineClamp = false;
</span><span class="cx"> if (renderer().parent()) {
</span><span class="lines">@@ -2507,8 +2506,6 @@
</span><span class="cx">
</span><span class="cx"> if (parentLayer)
</span><span class="cx"> parentLayer->scrollRectToVisible(newRect, alignX, alignY);
</span><del>-
- frameView.resumeScheduledEvents();
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void RenderLayer::updateCompositingLayersAfterScroll()
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMarqueecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMarquee.cpp (160846 => 160847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMarquee.cpp 2013-12-19 19:10:01 UTC (rev 160846)
+++ trunk/Source/WebCore/rendering/RenderMarquee.cpp 2013-12-19 19:10:31 UTC (rev 160847)
</span><span class="lines">@@ -156,11 +156,6 @@
</span><span class="cx"> if (m_timer.isActive() || m_layer->renderer().style().marqueeIncrement().isZero())
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- // We may end up propagating a scroll event. It is important that we suspend events until
- // the end of the function since they could delete the layer, including the marquee.
- FrameView& frameView = m_layer->renderer().view().frameView();
- frameView.pauseScheduledEvents();
-
</del><span class="cx"> if (!m_suspended && !m_stopped) {
</span><span class="cx"> if (isHorizontal())
</span><span class="cx"> m_layer->scrollToOffset(IntSize(m_start, 0));
</span><span class="lines">@@ -173,8 +168,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_timer.startRepeating(speed() * 0.001);
</span><del>-
- frameView.resumeScheduledEvents();
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void RenderMarquee::suspend()
</span></span></pre>
</div>
</div>
</body>
</html>