[Webkit-unassigned] [Bug 182908] New: [RenderTreeBuilder] REGRESSION(r228238) Detach renderer before destroying its subtree.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=182908

            Bug ID: 182908
           Summary: [RenderTreeBuilder] REGRESSION(r228238) Detach
                    renderer before destroying its subtree.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: zalan at apple.com
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

r228238 changed the order and now when a renderer is getting destroyed, we nuke its subtree while the renderer is still attached. Apparently we first need to detach it first so that while we are nuking the subtree, the renderers can't get access to previous/next siblings and do "smart" normalization. 

rdar://problem/37619394

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180218/60e82c10/attachment.html>