[Webkit-unassigned] [Bug 209695] New: [RenderTreeBuilder] Destroy the child first in RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=209695

            Bug ID: 209695
           Summary: [RenderTreeBuilder] Destroy the child first in
                    RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: zalan at apple.com
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

Before destroying a renderer we check if this renderer is inside an anonymous wrapper (including ancestors) and if so, we get rid of these wrappers too the same time. However because of the 'leaf -> container' tear down direction, we need to destroy the child first.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200328/bca7875c/attachment-0001.htm>