<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[170198] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/170198">170198</a></dd>
<dt>Author</dt> <dd>simon.fraser@apple.com</dd>
<dt>Date</dt> <dd>2014-06-20 12:16:30 -0700 (Fri, 20 Jun 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>[iOS WebKit2] Make -webkit-overflow-scrolling:touch work in iframes (breaks MSWord previews)
https://bugs.webkit.org/show_bug.cgi?id=134085

Source/WebCore:
&lt;rdar://problem/16440586&gt;

Reviewed by Tim Horton.

When nodes were detached from the scrolling tree, we would previously throw away
all descendant nodes, expecting that they would be re-attached as we walk the compositing
layer tree in RenderLayerCompositor.

However, this doesn't work across frame boundaries; the subframe may never update
its compositing layers again, so would lose all its scrolling nodes.

Fix by having ScrollingStateTree::detachNode() by default set aside subframe nodes
into a hash map. On reattach, we'll look in the hash map and pull out an existing node
(with its children intact) if possible.

Tests: platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html
       platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html
       platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html

* page/scrolling/ScrollingStateNode.cpp:
(WebCore::ScrollingStateNode::ScrollingStateNode):
* page/scrolling/ScrollingStateTree.cpp:
(WebCore::ScrollingStateTree::attachNode):
(WebCore::ScrollingStateTree::detachNode):
(WebCore::ScrollingStateTree::clear):
(WebCore::ScrollingStateTree::removeNodeAndAllDescendants):
(WebCore::ScrollingStateTree::recursiveNodeWillBeRemoved):
* page/scrolling/ScrollingStateTree.h:
* page/scrolling/ScrollingTree.cpp:
(WebCore::ScrollingTree::commitNewTreeState): Go back to removing the deleted
nodes from m_nodeMap first.
(WebCore::ScrollingTree::removeDestroyedNodes): There is no need for this to
actually make use of ScrollingTreeNode* any more; the ASSERT(!node-&gt;parent())
is bogus because it can fire when whole subtrees are removed, and to clear the
latched node we just need the ID.

Source/WebKit2:
&lt;rdar://problem/16440586&gt;

Reviewed by Tim Horton.

Add some debug-only assertions that check that the number of nodes we encoded is
the expected number.

* Shared/Scrolling/RemoteScrollingCoordinatorTransaction.cpp:
(WebKit::encodeNodeAndDescendants):
(WebKit::RemoteScrollingCoordinatorTransaction::encode):

LayoutTests:

Reviewed by Tim Horton.

Tests that add and remove a fixed container of a scroll-coordinated iframe.

* platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-expected.txt:
* platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor-expected.txt: Added.
* platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html: Added.
* platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-in-fixed-expected.txt:
* platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor-expected.txt: Added.
* platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html: Added.
* platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame-expected.txt: Added.
* platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html: Added.
* platform/mac-wk2/tiled-drawing/scrolling/frames/resources/doc-with-sticky.html:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframeexpectedtxt">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframeinfixedexpectedtxt">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-in-fixed-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframesresourcesdocwithstickyhtml">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/resources/doc-with-sticky.html</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorepagescrollingScrollingStateNodecpp">trunk/Source/WebCore/page/scrolling/ScrollingStateNode.cpp</a></li>
<li><a href="#trunkSourceWebCorepagescrollingScrollingStateTreecpp">trunk/Source/WebCore/page/scrolling/ScrollingStateTree.cpp</a></li>
<li><a href="#trunkSourceWebCorepagescrollingScrollingStateTreeh">trunk/Source/WebCore/page/scrolling/ScrollingStateTree.h</a></li>
<li><a href="#trunkSourceWebCorepagescrollingScrollingTreecpp">trunk/Source/WebCore/page/scrolling/ScrollingTree.cpp</a></li>
<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>
<li><a href="#trunkSourceWebKit2SharedScrollingRemoteScrollingCoordinatorTransactioncpp">trunk/Source/WebKit2/Shared/Scrolling/RemoteScrollingCoordinatorTransaction.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframegainscrollingancestorexpectedtxt">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframegainscrollingancestorhtml">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframelosescrollingancestorexpectedtxt">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframelosescrollingancestorhtml">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframesremovecoordinatedframeexpectedtxt">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingframesremovecoordinatedframehtml">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/LayoutTests/ChangeLog        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2014-06-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
+
+        [iOS WebKit2] Make -webkit-overflow-scrolling:touch work in iframes (breaks MSWord previews)
+        https://bugs.webkit.org/show_bug.cgi?id=134085
+
+        Reviewed by Tim Horton.
+        
+        Tests that add and remove a fixed container of a scroll-coordinated iframe.
+
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-expected.txt:
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor-expected.txt: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-in-fixed-expected.txt:
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor-expected.txt: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame-expected.txt: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/resources/doc-with-sticky.html:
+
</ins><span class="cx"> 2014-06-19  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed GTK gardening.
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframeexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-expected.txt (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-expected.txt        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-expected.txt        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -4,16 +4,17 @@
</span><span class="cx">   (children 1
</span><span class="cx">     (Frame scrolling node
</span><span class="cx">       (scrollable area size 485 300)
</span><del>-      (contents size 485 1868)
</del><ins>+      (contents size 485 420)
</ins><span class="cx">       (children 1
</span><span class="cx">         (Sticky node
</span><del>-          (anchor edges: AnchorEdgeTop )
</del><ins>+          (anchor edges: AnchorEdgeTop AnchorEdgeBottom)
</ins><span class="cx">           (top offset 10.00)
</span><del>-          (containing block rect 8.00, 10.00 469.00 x 1850.00)
-          (sticky box rect 8.00 830.00 100.00 100.00)
</del><ins>+          (bottom offset 10.00)
+          (containing block rect 8.00, 8.00 469.00 x 404.00)
+          (sticky box rect 8.00 312.00 100.00 100.00)
</ins><span class="cx">           (constraining rect 0.00 0.00 485.00 300.00)
</span><del>-          (sticky offset at last layout 0.00 0.00)
-          (layer position at last layout 8.00 830.00)
</del><ins>+          (sticky offset at last layout 0.00 -122.00)
+          (layer position at last layout 8.00 190.00)
</ins><span class="cx">         )
</span><span class="cx">       )
</span><span class="cx">     )
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframegainscrollingancestorexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor-expected.txt (0 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor-expected.txt                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor-expected.txt        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -0,0 +1,30 @@
</span><ins>+(Frame scrolling node
+  (scrollable area size 785 600)
+  (contents size 785 1016)
+  (children 1
+    (Fixed node
+      (anchor edges: AnchorEdgeLeft AnchorEdgeTop)
+      (viewport rect at last layout: 0.00 0.00 785.00 600.00)
+      (layer position at last layout 8.00 10.00)
+      (children 1
+        (Frame scrolling node
+          (scrollable area size 500 300)
+          (contents size 500 420)
+          (children 1
+            (Sticky node
+              (anchor edges: AnchorEdgeTop AnchorEdgeBottom)
+              (top offset 10.00)
+              (bottom offset 10.00)
+              (containing block rect 8.00, 8.00 484.00 x 404.00)
+              (sticky box rect 8.00 312.00 100.00 100.00)
+              (constraining rect 0.00 0.00 500.00 300.00)
+              (sticky offset at last layout 0.00 -122.00)
+              (layer position at last layout 8.00 190.00)
+            )
+          )
+        )
+      )
+    )
+  )
+)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframegainscrollingancestorhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html (0 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -0,0 +1,64 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+    &lt;style&gt;
+        body {
+            height: 1000px;
+        }
+        
+        iframe {
+            display: block;
+            margin: 10px;
+            border: 5px solid black;
+        }
+        
+        #container {
+            position: absolute;
+            top: 10px;
+            border: 4px solid green;
+            padding: 10px;
+        }
+        
+        #container.fixed {
+            position: fixed;
+            top: 10px;
+            border: 4px solid orange;
+        }
+        
+        #tree {
+            position: absolute;
+            top: 375px;
+        }
+    &lt;/style&gt;
+    &lt;script&gt;
+        if (window.testRunner) {
+            testRunner.waitUntilDone();
+            testRunner.dumpAsText();
+            window.internals.settings.setScrollingTreeIncludesFrames(true);
+        }
+
+        function startTest()
+        {
+            window.setTimeout(function() {
+                document.getElementById('container').classList.toggle('fixed');
+
+                if (window.internals)
+                    document.getElementById('tree').innerText = internals.scrollingStateTreeAsText();
+
+                if (window.testRunner)
+                    testRunner.notifyDone();
+
+            }, 0);
+        }
+        
+        window.addEventListener('load', startTest, false);
+    &lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+    
+    &lt;div id=&quot;container&quot;&gt;
+        &lt;iframe src=&quot;resources/doc-with-sticky.html&quot; scrolling=&quot;no&quot; width=&quot;500&quot; height=&quot;300&quot;&gt;&lt;/iframe&gt;
+    &lt;/div&gt;
+&lt;pre id=&quot;tree&quot;&gt;Scrolling tree goes here&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframeinfixedexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-in-fixed-expected.txt (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-in-fixed-expected.txt        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-in-fixed-expected.txt        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -9,16 +9,17 @@
</span><span class="cx">       (children 1
</span><span class="cx">         (Frame scrolling node
</span><span class="cx">           (scrollable area size 485 300)
</span><del>-          (contents size 485 1868)
</del><ins>+          (contents size 485 420)
</ins><span class="cx">           (children 1
</span><span class="cx">             (Sticky node
</span><del>-              (anchor edges: AnchorEdgeTop )
</del><ins>+              (anchor edges: AnchorEdgeTop AnchorEdgeBottom)
</ins><span class="cx">               (top offset 10.00)
</span><del>-              (containing block rect 8.00, 10.00 469.00 x 1850.00)
-              (sticky box rect 8.00 830.00 100.00 100.00)
</del><ins>+              (bottom offset 10.00)
+              (containing block rect 8.00, 8.00 469.00 x 404.00)
+              (sticky box rect 8.00 312.00 100.00 100.00)
</ins><span class="cx">               (constraining rect 0.00 0.00 485.00 300.00)
</span><del>-              (sticky offset at last layout 0.00 0.00)
-              (layer position at last layout 8.00 830.00)
</del><ins>+              (sticky offset at last layout 0.00 -122.00)
+              (layer position at last layout 8.00 190.00)
</ins><span class="cx">             )
</span><span class="cx">           )
</span><span class="cx">         )
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframelosescrollingancestorexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor-expected.txt (0 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor-expected.txt                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor-expected.txt        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+(Frame scrolling node
+  (scrollable area size 785 600)
+  (contents size 785 1016)
+  (children 1
+    (Frame scrolling node
+      (scrollable area size 500 300)
+      (contents size 500 420)
+      (children 1
+        (Sticky node
+          (anchor edges: AnchorEdgeTop AnchorEdgeBottom)
+          (top offset 10.00)
+          (bottom offset 10.00)
+          (containing block rect 8.00, 8.00 484.00 x 404.00)
+          (sticky box rect 8.00 312.00 100.00 100.00)
+          (constraining rect 0.00 0.00 500.00 300.00)
+          (sticky offset at last layout 0.00 -122.00)
+          (layer position at last layout 8.00 190.00)
+        )
+      )
+    )
+  )
+)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframescoordinatedframelosescrollingancestorhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html (0 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -0,0 +1,64 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+    &lt;style&gt;
+        body {
+            height: 1000px;
+        }
+        
+        iframe {
+            display: block;
+            margin: 10px;
+            border: 5px solid black;
+        }
+        
+        #container {
+            position: absolute;
+            top: 10px;
+            border: 4px solid green;
+            padding: 10px;
+        }
+        
+        #container.fixed {
+            position: fixed;
+            top: 10px;
+            border: 4px solid orange;
+        }
+        
+        #tree {
+            position: absolute;
+            top: 375px;
+        }
+    &lt;/style&gt;
+    &lt;script&gt;
+        if (window.testRunner) {
+            testRunner.waitUntilDone();
+            testRunner.dumpAsText();
+            window.internals.settings.setScrollingTreeIncludesFrames(true);
+        }
+
+        function startTest()
+        {
+            window.setTimeout(function() {
+                document.getElementById('container').classList.toggle('fixed');
+
+                if (window.internals)
+                    document.getElementById('tree').innerText = internals.scrollingStateTreeAsText();
+
+                if (window.testRunner)
+                    testRunner.notifyDone();
+
+            }, 0);
+        }
+        
+        window.addEventListener('load', startTest, false);
+    &lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+    
+    &lt;div id=&quot;container&quot; class=&quot;fixed&quot;&gt;
+        &lt;iframe src=&quot;resources/doc-with-sticky.html&quot; scrolling=&quot;no&quot; width=&quot;500&quot; height=&quot;300&quot;&gt;&lt;/iframe&gt;
+    &lt;/div&gt;
+&lt;pre id=&quot;tree&quot;&gt;Scrolling tree goes here&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframesremovecoordinatedframeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame-expected.txt (0 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame-expected.txt                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame-expected.txt        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+(Frame scrolling node
+  (scrollable area size 785 600)
+  (contents size 785 1016)
+  (children 1
+    (Fixed node
+      (anchor edges: AnchorEdgeLeft AnchorEdgeTop)
+      (viewport rect at last layout: 0.00 0.00 785.00 600.00)
+      (layer position at last layout 8.00 10.00)
+      (children 0
+      )
+    )
+  )
+)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframesremovecoordinatedframehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html (0 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -0,0 +1,65 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+    &lt;style&gt;
+        body {
+            height: 1000px;
+        }
+        
+        iframe {
+            display: block;
+            margin: 10px;
+            border: 5px solid black;
+        }
+        
+        #container {
+            position: absolute;
+            top: 10px;
+            border: 4px solid green;
+            padding: 10px;
+        }
+        
+        #container.fixed {
+            position: fixed;
+            top: 10px;
+            border: 4px solid orange;
+        }
+        
+        #tree {
+            position: absolute;
+            top: 375px;
+        }
+    &lt;/style&gt;
+    &lt;script&gt;
+        if (window.testRunner) {
+            testRunner.waitUntilDone();
+            testRunner.dumpAsText();
+            window.internals.settings.setScrollingTreeIncludesFrames(true);
+        }
+
+        function startTest()
+        {
+            window.setTimeout(function() {
+                var iframe = document.getElementById('iframe');
+                iframe.remove();
+
+                if (window.internals)
+                    document.getElementById('tree').innerText = internals.scrollingStateTreeAsText();
+
+                if (window.testRunner)
+                    testRunner.notifyDone();
+
+            }, 0);
+        }
+        
+        window.addEventListener('load', startTest, false);
+    &lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+    
+    &lt;div id=&quot;container&quot; class=&quot;fixed&quot;&gt;
+        &lt;iframe id=&quot;iframe&quot; src=&quot;resources/doc-with-sticky.html&quot; scrolling=&quot;no&quot; width=&quot;500&quot; height=&quot;300&quot;&gt;&lt;/iframe&gt;
+    &lt;/div&gt;
+&lt;pre id=&quot;tree&quot;&gt;Scrolling tree goes here&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingframesresourcesdocwithstickyhtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/resources/doc-with-sticky.html (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/resources/doc-with-sticky.html        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/frames/resources/doc-with-sticky.html        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -9,6 +9,14 @@
</span><span class="cx">             background-color: blue;
</span><span class="cx">         }
</span><span class="cx">         
</span><ins>+        .scrolling {
+            height: 300px;
+            width: 400px;
+            overflow: scroll;
+            -webkit-overflow-scrolling: touch;
+            border: 2px solid black;
+        }
+        
</ins><span class="cx">         .spacer {
</span><span class="cx">             height: 400px;
</span><span class="cx">             margin: 10px;
</span><span class="lines">@@ -17,6 +25,7 @@
</span><span class="cx">         .sticky {
</span><span class="cx">             position: -webkit-sticky;
</span><span class="cx">             top: 10px;
</span><ins>+            bottom: 10px;
</ins><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         .composited {
</span><span class="lines">@@ -25,11 +34,14 @@
</span><span class="cx">     &lt;/style&gt;
</span><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body&gt;
</span><del>-    &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
-    &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
</del><ins>+    &lt;div class=&quot;composited scrolling&quot;&gt;
+        &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
+        &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
+        &lt;div class=&quot;sticky box&quot;&gt;&lt;/div&gt;
+        &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
+        &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
+    &lt;/div&gt;
</ins><span class="cx">     &lt;div class=&quot;sticky box&quot;&gt;&lt;/div&gt;
</span><del>-    &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
-    &lt;div class=&quot;spacer&quot;&gt;&lt;/div&gt;
-    &lt;div class=&quot;composited box&quot;&gt;&lt;/div&gt;
</del><ins>+
</ins><span class="cx"> &lt;/body&gt;
</span><span class="cx"> &lt;/html&gt;
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/Source/WebCore/ChangeLog        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -1,5 +1,45 @@
</span><span class="cx"> 2014-06-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        [iOS WebKit2] Make -webkit-overflow-scrolling:touch work in iframes (breaks MSWord previews)
+        https://bugs.webkit.org/show_bug.cgi?id=134085
+        &lt;rdar://problem/16440586&gt;
+
+        Reviewed by Tim Horton.
+        
+        When nodes were detached from the scrolling tree, we would previously throw away
+        all descendant nodes, expecting that they would be re-attached as we walk the compositing
+        layer tree in RenderLayerCompositor.
+        
+        However, this doesn't work across frame boundaries; the subframe may never update
+        its compositing layers again, so would lose all its scrolling nodes.
+        
+        Fix by having ScrollingStateTree::detachNode() by default set aside subframe nodes
+        into a hash map. On reattach, we'll look in the hash map and pull out an existing node
+        (with its children intact) if possible.
+
+        Tests: platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-gain-scrolling-ancestor.html
+               platform/mac-wk2/tiled-drawing/scrolling/frames/coordinated-frame-lose-scrolling-ancestor.html
+               platform/mac-wk2/tiled-drawing/scrolling/frames/remove-coordinated-frame.html
+
+        * page/scrolling/ScrollingStateNode.cpp:
+        (WebCore::ScrollingStateNode::ScrollingStateNode):
+        * page/scrolling/ScrollingStateTree.cpp:
+        (WebCore::ScrollingStateTree::attachNode):
+        (WebCore::ScrollingStateTree::detachNode):
+        (WebCore::ScrollingStateTree::clear):
+        (WebCore::ScrollingStateTree::removeNodeAndAllDescendants):
+        (WebCore::ScrollingStateTree::recursiveNodeWillBeRemoved):
+        * page/scrolling/ScrollingStateTree.h:
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::commitNewTreeState): Go back to removing the deleted
+        nodes from m_nodeMap first.
+        (WebCore::ScrollingTree::removeDestroyedNodes): There is no need for this to
+        actually make use of ScrollingTreeNode* any more; the ASSERT(!node-&gt;parent())
+        is bogus because it can fire when whole subtrees are removed, and to clear the
+        latched node we just need the ID.
+
+2014-06-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
+
</ins><span class="cx">         Handle scrolling tree modifications which remove intermediate nodes
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=134082
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorepagescrollingScrollingStateNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/scrolling/ScrollingStateNode.cpp (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/scrolling/ScrollingStateNode.cpp        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/Source/WebCore/page/scrolling/ScrollingStateNode.cpp        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     , m_nodeID(nodeID)
</span><span class="cx">     , m_changedProperties(0)
</span><span class="cx">     , m_scrollingStateTree(scrollingStateTree)
</span><del>-    , m_parent(0)
</del><ins>+    , m_parent(nullptr)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx">     , m_nodeID(stateNode.scrollingNodeID())
</span><span class="cx">     , m_changedProperties(stateNode.changedProperties())
</span><span class="cx">     , m_scrollingStateTree(adoptiveTree)
</span><del>-    , m_parent(0)
</del><ins>+    , m_parent(nullptr)
</ins><span class="cx"> {
</span><span class="cx">     if (hasChangedProperty(ScrollLayer))
</span><span class="cx">         setLayer(stateNode.layer().toRepresentation(adoptiveTree.preferredLayerRepresentation()));
</span></span></pre></div>
<a id="trunkSourceWebCorepagescrollingScrollingStateTreecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/scrolling/ScrollingStateTree.cpp (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/scrolling/ScrollingStateTree.cpp        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/Source/WebCore/page/scrolling/ScrollingStateTree.cpp        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -67,6 +67,22 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+PassRefPtr&lt;ScrollingStateNode&gt; ScrollingStateTree::createNode(ScrollingNodeType nodeType, ScrollingNodeID nodeID)
+{
+    switch (nodeType) {
+    case FixedNode:
+        return ScrollingStateFixedNode::create(*this, nodeID);
+    case StickyNode:
+        return ScrollingStateStickyNode::create(*this, nodeID);
+    case FrameScrollingNode:
+        return ScrollingStateFrameScrollingNode::create(*this, nodeID);
+    case OverflowScrollingNode:
+        return ScrollingStateOverflowScrollingNode::create(*this, nodeID);
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
</ins><span class="cx"> ScrollingNodeID ScrollingStateTree::attachNode(ScrollingNodeType nodeType, ScrollingNodeID newNodeID, ScrollingNodeID parentID)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(newNodeID);
</span><span class="lines">@@ -82,7 +98,7 @@
</span><span class="cx">             return newNodeID;
</span><span class="cx"> 
</span><span class="cx">         // The node is being re-parented. To do that, we'll remove it, and then re-create a new node.
</span><del>-        removeNodeAndAllDescendants(node);
</del><ins>+        removeNodeAndAllDescendants(node, SubframeNodeRemoval::Orphan);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ScrollingStateNode* newNode = nullptr;
</span><span class="lines">@@ -98,32 +114,18 @@
</span><span class="cx">         if (!parent)
</span><span class="cx">             return 0;
</span><span class="cx"> 
</span><del>-        switch (nodeType) {
-        case FixedNode: {
-            RefPtr&lt;ScrollingStateFixedNode&gt; fixedNode = ScrollingStateFixedNode::create(*this, newNodeID);
-            newNode = fixedNode.get();
-            parent-&gt;appendChild(fixedNode.release());
-            break;
</del><ins>+        if (nodeType == FrameScrollingNode &amp;&amp; parentID) {
+            if (RefPtr&lt;ScrollingStateNode&gt; orphanedNode = m_orphanedSubframeNodes.take(newNodeID)) {
+                newNode = orphanedNode.get();
+                parent-&gt;appendChild(orphanedNode.release());
+            }
</ins><span class="cx">         }
</span><del>-        case StickyNode: {
-            RefPtr&lt;ScrollingStateStickyNode&gt; stickyNode = ScrollingStateStickyNode::create(*this, newNodeID);
-            newNode = stickyNode.get();
-            parent-&gt;appendChild(stickyNode.release());
-            break;
</del><ins>+
+        if (!newNode) {
+            RefPtr&lt;ScrollingStateNode&gt; stateNode = createNode(nodeType, newNodeID);
+            newNode = stateNode.get();
+            parent-&gt;appendChild(stateNode.release());
</ins><span class="cx">         }
</span><del>-        case FrameScrollingNode: {
-            RefPtr&lt;ScrollingStateFrameScrollingNode&gt; scrollingNode = ScrollingStateFrameScrollingNode::create(*this, newNodeID);
-            newNode = scrollingNode.get();
-            parent-&gt;appendChild(scrollingNode.release());
-            break;
-        }
-        case OverflowScrollingNode: {
-            RefPtr&lt;ScrollingStateOverflowScrollingNode&gt; scrollingNode = ScrollingStateOverflowScrollingNode::create(*this, newNodeID);
-            newNode = scrollingNode.get();
-            parent-&gt;appendChild(scrollingNode.release());
-            break;
-        }
-        }
</del><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_stateNodeMap.set(newNodeID, newNode);
</span><span class="lines">@@ -141,18 +143,23 @@
</span><span class="cx">     if (!node)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    removeNodeAndAllDescendants(node);
</del><ins>+    removeNodeAndAllDescendants(node, SubframeNodeRemoval::Orphan);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ScrollingStateTree::clear()
</span><span class="cx"> {
</span><del>-    removeNodeAndAllDescendants(rootStateNode());
</del><ins>+    if (rootStateNode())
+        removeNodeAndAllDescendants(rootStateNode());
+
</ins><span class="cx">     ASSERT(m_stateNodeMap.isEmpty());
</span><span class="cx">     m_stateNodeMap.clear();
</span><ins>+    m_orphanedSubframeNodes.clear();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> PassOwnPtr&lt;ScrollingStateTree&gt; ScrollingStateTree::commit(LayerRepresentation::Type preferredLayerRepresentation)
</span><span class="cx"> {
</span><ins>+    m_orphanedSubframeNodes.clear();
+
</ins><span class="cx">     // This function clones and resets the current state tree, but leaves the tree structure intact.
</span><span class="cx">     OwnPtr&lt;ScrollingStateTree&gt; treeStateClone = ScrollingStateTree::create();
</span><span class="cx">     treeStateClone-&gt;setPreferredLayerRepresentation(preferredLayerRepresentation);
</span><span class="lines">@@ -178,16 +185,15 @@
</span><span class="cx">     m_stateNodeMap.add(node-&gt;scrollingNodeID(), node);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void ScrollingStateTree::removeNodeAndAllDescendants(ScrollingStateNode* node)
</del><ins>+void ScrollingStateTree::removeNodeAndAllDescendants(ScrollingStateNode* node, SubframeNodeRemoval subframeNodeRemoval)
</ins><span class="cx"> {
</span><del>-    if (!node)
-        return;
</del><ins>+    ScrollingStateNode* parent = node-&gt;parent();
</ins><span class="cx"> 
</span><del>-    recursiveNodeWillBeRemoved(node);
</del><ins>+    recursiveNodeWillBeRemoved(node, subframeNodeRemoval);
</ins><span class="cx"> 
</span><span class="cx">     if (node == m_rootStateNode)
</span><span class="cx">         m_rootStateNode = nullptr;
</span><del>-    else if (ScrollingStateNode* parent = node-&gt;parent()) {
</del><ins>+    else if (parent) {
</ins><span class="cx">         ASSERT(parent-&gt;children() &amp;&amp; parent-&gt;children()-&gt;find(node) != notFound);
</span><span class="cx">         if (auto children = parent-&gt;children()) {
</span><span class="cx">             size_t index = children-&gt;find(node);
</span><span class="lines">@@ -197,13 +203,19 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void ScrollingStateTree::recursiveNodeWillBeRemoved(ScrollingStateNode* currNode)
</del><ins>+void ScrollingStateTree::recursiveNodeWillBeRemoved(ScrollingStateNode* currNode, SubframeNodeRemoval subframeNodeRemoval)
</ins><span class="cx"> {
</span><ins>+    currNode-&gt;setParent(nullptr);
+    if (subframeNodeRemoval == SubframeNodeRemoval::Orphan &amp;&amp; currNode != m_rootStateNode &amp;&amp; currNode-&gt;isFrameScrollingNode()) {
+        m_orphanedSubframeNodes.add(currNode-&gt;scrollingNodeID(), currNode);
+        return;
+    }
+
</ins><span class="cx">     willRemoveNode(currNode);
</span><span class="cx"> 
</span><span class="cx">     if (auto children = currNode-&gt;children()) {
</span><span class="cx">         for (auto&amp; child : *children)
</span><del>-            recursiveNodeWillBeRemoved(child.get());
</del><ins>+            recursiveNodeWillBeRemoved(child.get(), subframeNodeRemoval);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorepagescrollingScrollingStateTreeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/scrolling/ScrollingStateTree.h (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/scrolling/ScrollingStateTree.h        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/Source/WebCore/page/scrolling/ScrollingStateTree.h        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -81,15 +81,23 @@
</span><span class="cx"> 
</span><span class="cx">     void setRootStateNode(PassRefPtr&lt;ScrollingStateFrameScrollingNode&gt; rootStateNode) { m_rootStateNode = rootStateNode; }
</span><span class="cx">     void addNode(ScrollingStateNode*);
</span><del>-    void removeNodeAndAllDescendants(ScrollingStateNode*);
</del><span class="cx"> 
</span><del>-    void recursiveNodeWillBeRemoved(ScrollingStateNode* currNode);
</del><ins>+    PassRefPtr&lt;ScrollingStateNode&gt; createNode(ScrollingNodeType, ScrollingNodeID);
+    
+    enum class SubframeNodeRemoval {
+        Delete,
+        Orphan
+    };
+    void removeNodeAndAllDescendants(ScrollingStateNode*, SubframeNodeRemoval = SubframeNodeRemoval::Delete);
+
+    void recursiveNodeWillBeRemoved(ScrollingStateNode* currNode, SubframeNodeRemoval);
</ins><span class="cx">     void willRemoveNode(ScrollingStateNode*);
</span><span class="cx"> 
</span><span class="cx">     AsyncScrollingCoordinator* m_scrollingCoordinator;
</span><span class="cx">     StateNodeMap m_stateNodeMap;
</span><span class="cx">     RefPtr&lt;ScrollingStateFrameScrollingNode&gt; m_rootStateNode;
</span><span class="cx">     HashSet&lt;ScrollingNodeID&gt; m_nodesRemovedSinceLastCommit;
</span><ins>+    HashMap&lt;ScrollingNodeID, RefPtr&lt;ScrollingStateNode&gt;&gt; m_orphanedSubframeNodes;
</ins><span class="cx">     bool m_hasChangedProperties;
</span><span class="cx">     bool m_hasNewRootStateNode;
</span><span class="cx">     LayerRepresentation::Type m_preferredLayerRepresentation;
</span></span></pre></div>
<a id="trunkSourceWebCorepagescrollingScrollingTreecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/scrolling/ScrollingTree.cpp (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/scrolling/ScrollingTree.cpp        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/Source/WebCore/page/scrolling/ScrollingTree.cpp        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -149,12 +149,10 @@
</span><span class="cx">     bool scrollRequestIsProgammatic = rootNode ? rootNode-&gt;requestedScrollPositionRepresentsProgrammaticScroll() : false;
</span><span class="cx">     TemporaryChange&lt;bool&gt; changeHandlingProgrammaticScroll(m_isHandlingProgrammaticScroll, scrollRequestIsProgammatic);
</span><span class="cx"> 
</span><del>-    {
-        OrphanScrollingNodeMap orphanNodes;
-        updateTreeFromStateNode(rootNode, orphanNodes);
-    }
-
</del><span class="cx">     removeDestroyedNodes(*scrollingStateTree);
</span><ins>+
+    OrphanScrollingNodeMap orphanNodes;
+    updateTreeFromStateNode(rootNode, orphanNodes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ScrollingTree::updateTreeFromStateNode(const ScrollingStateNode* stateNode, OrphanScrollingNodeMap&amp; orphanNodes)
</span><span class="lines">@@ -216,16 +214,10 @@
</span><span class="cx"> 
</span><span class="cx"> void ScrollingTree::removeDestroyedNodes(const ScrollingStateTree&amp; stateTree)
</span><span class="cx"> {
</span><del>-    for (const auto&amp; removedNode : stateTree.removedNodes()) {
-        ScrollingTreeNode* node = m_nodeMap.take(removedNode);
-        if (!node)
-            continue;
-
-        if (node-&gt;scrollingNodeID() == m_latchedNode)
</del><ins>+    for (const auto&amp; removedNodeID : stateTree.removedNodes()) {
+        m_nodeMap.remove(removedNodeID);
+        if (removedNodeID == m_latchedNode)
</ins><span class="cx">             clearLatchedNode();
</span><del>-
-        // We should have unparented this node already via updateTreeFromStateNode().
-        ASSERT(!node-&gt;parent());
</del><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/ChangeLog        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/Source/WebKit2/ChangeLog        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -1,5 +1,20 @@
</span><span class="cx"> 2014-06-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        [iOS WebKit2] Make -webkit-overflow-scrolling:touch work in iframes (breaks MSWord previews)
+        https://bugs.webkit.org/show_bug.cgi?id=134085
+        &lt;rdar://problem/16440586&gt;
+
+        Reviewed by Tim Horton.
+        
+        Add some debug-only assertions that check that the number of nodes we encoded is
+        the expected number.
+
+        * Shared/Scrolling/RemoteScrollingCoordinatorTransaction.cpp:
+        (WebKit::encodeNodeAndDescendants):
+        (WebKit::RemoteScrollingCoordinatorTransaction::encode):
+
+2014-06-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
+
</ins><span class="cx">         Handle scrolling tree modifications which remove intermediate nodes
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=134082
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebKit2SharedScrollingRemoteScrollingCoordinatorTransactioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/Shared/Scrolling/RemoteScrollingCoordinatorTransaction.cpp (170197 => 170198)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/Shared/Scrolling/RemoteScrollingCoordinatorTransaction.cpp        2014-06-20 19:14:50 UTC (rev 170197)
+++ trunk/Source/WebKit2/Shared/Scrolling/RemoteScrollingCoordinatorTransaction.cpp        2014-06-20 19:16:30 UTC (rev 170198)
</span><span class="lines">@@ -317,8 +317,10 @@
</span><span class="cx"> 
</span><span class="cx"> namespace WebKit {
</span><span class="cx"> 
</span><del>-static void encodeNodeAndDescendants(IPC::ArgumentEncoder&amp; encoder, const ScrollingStateNode&amp; stateNode)
</del><ins>+static void encodeNodeAndDescendants(IPC::ArgumentEncoder&amp; encoder, const ScrollingStateNode&amp; stateNode, int&amp; encodedNodeCount)
</ins><span class="cx"> {
</span><ins>+    ++encodedNodeCount;
+
</ins><span class="cx">     switch (stateNode.nodeType()) {
</span><span class="cx">     case FrameScrollingNode:
</span><span class="cx">         encoder &lt;&lt; toScrollingStateFrameScrollingNode(stateNode);
</span><span class="lines">@@ -338,7 +340,7 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     for (const auto&amp; child : *stateNode.children())
</span><del>-        encodeNodeAndDescendants(encoder, *child.get());
</del><ins>+        encodeNodeAndDescendants(encoder, *child.get(), encodedNodeCount);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RemoteScrollingCoordinatorTransaction::encode(IPC::ArgumentEncoder&amp; encoder) const
</span><span class="lines">@@ -352,9 +354,11 @@
</span><span class="cx">     if (m_scrollingStateTree) {
</span><span class="cx">         encoder &lt;&lt; m_scrollingStateTree-&gt;hasChangedProperties();
</span><span class="cx"> 
</span><ins>+        int numNodesEncoded = 0;
</ins><span class="cx">         if (const ScrollingStateNode* rootNode = m_scrollingStateTree-&gt;rootStateNode())
</span><del>-            encodeNodeAndDescendants(encoder, *rootNode);
</del><ins>+            encodeNodeAndDescendants(encoder, *rootNode, numNodesEncoded);
</ins><span class="cx"> 
</span><ins>+        ASSERT_UNUSED(numNodesEncoded, numNodesEncoded == numNodes);
</ins><span class="cx">         encoder &lt;&lt; m_scrollingStateTree-&gt;removedNodes();
</span><span class="cx">     } else
</span><span class="cx">         encoder &lt;&lt; Vector&lt;ScrollingNodeID&gt;();
</span></span></pre>
</div>
</div>

</body>
</html>