Remove sources of panic when laying out an iframe without a nested browsing context.

This commit is contained in:
Alan Jeffrey 2017-09-14 15:53:12 -05:00
parent 6a791cd7f2
commit fbfb9a80b4
6 changed files with 58 additions and 30 deletions

View file

@ -1021,8 +1021,8 @@ pub trait LayoutNodeHelpers {
fn image_url(&self) -> Option<ServoUrl>;
fn canvas_data(&self) -> Option<HTMLCanvasData>;
fn svg_data(&self) -> Option<SVGSVGData>;
fn iframe_browsing_context_id(&self) -> BrowsingContextId;
fn iframe_pipeline_id(&self) -> PipelineId;
fn iframe_browsing_context_id(&self) -> Option<BrowsingContextId>;
fn iframe_pipeline_id(&self) -> Option<PipelineId>;
fn opaque(&self) -> OpaqueNode;
}
@ -1172,16 +1172,16 @@ impl LayoutNodeHelpers for LayoutJS<Node> {
.map(|svg| svg.data())
}
fn iframe_browsing_context_id(&self) -> BrowsingContextId {
fn iframe_browsing_context_id(&self) -> Option<BrowsingContextId> {
let iframe_element = self.downcast::<HTMLIFrameElement>()
.expect("not an iframe element!");
iframe_element.browsing_context_id().unwrap()
iframe_element.browsing_context_id()
}
fn iframe_pipeline_id(&self) -> PipelineId {
fn iframe_pipeline_id(&self) -> Option<PipelineId> {
let iframe_element = self.downcast::<HTMLIFrameElement>()
.expect("not an iframe element!");
iframe_element.pipeline_id().unwrap()
iframe_element.pipeline_id()
}
#[allow(unsafe_code)]

View file

@ -1750,10 +1750,35 @@ impl ScriptThread {
load.pipeline_id == id
});
let document = self.documents.borrow_mut().remove(id);
// We should never have a pipeline that's still an incomplete load,
// but also has a Document.
debug_assert!(idx.is_none() || document.is_none());
// Remove any incomplete load.
let chan = if let Some(idx) = idx {
let load = self.incomplete_loads.borrow_mut().remove(idx);
load.layout_chan.clone()
} else if let Some(document) = self.documents.borrow_mut().remove(id) {
} else if let Some(ref document) = document {
document.window().layout_chan().clone()
} else {
return warn!("Exiting nonexistant pipeline {}.", id);
};
// We shut down layout before removing the document,
// since layout might still be in the middle of laying it out.
debug!("preparing to shut down layout for page {}", id);
let (response_chan, response_port) = channel();
chan.send(message::Msg::PrepareToExit(response_chan)).ok();
let _ = response_port.recv();
debug!("shutting down layout for page {}", id);
chan.send(message::Msg::ExitNow).ok();
self.script_sender.send((id, ScriptMsg::PipelineExited)).ok();
// Now that layout is shut down, it's OK to remove the document.
if let Some(document) = document {
// We don't want to dispatch `mouseout` event pointing to non-existing element
if let Some(target) = self.topmost_mouse_over_target.get() {
if target.upcast::<Node>().owner_doc() == document {
@ -1761,22 +1786,14 @@ impl ScriptThread {
}
}
// We discard the browsing context after requesting layout shut down,
// to avoid running layout on detached iframes.
let window = document.window();
if discard_bc == DiscardBrowsingContext::Yes {
window.window_proxy().discard_browsing_context();
}
window.clear_js_runtime();
window.layout_chan().clone()
} else {
return warn!("Exiting nonexistant pipeline {}.", id);
};
let (response_chan, response_port) = channel();
chan.send(message::Msg::PrepareToExit(response_chan)).ok();
debug!("shutting down layout for page {}", id);
let _ = response_port.recv();
chan.send(message::Msg::ExitNow).ok();
self.script_sender.send((id, ScriptMsg::PipelineExited)).ok();
}
debug!("Exited pipeline {}.", id);
}