mirror of
https://github.com/servo/servo.git
synced 2025-10-04 02:29:12 +01:00
50312e1457
We want to drop the cascade data memory as soon as possible, so bug 1544546 introduced an UpdateStylistIfNeeded call from ShellDetachedFromDocument. Unfortunately, this call can reenter into the global user-agent cascade data if some of the CSS values kept alive by the cascade data keep alive an SVG document, see the stack on this bug for an example. Make sure to drop the user-agent cascade datas when not holding the cache lock to avoid this situation. Before bug 1535788, we just destroyed the stylist, so we kept holding a reference from the cache, and that reference will be dropped sometime later when other document updated their user-agent stylesheets (if they happened not to match the cache of course). Seems to me this doesn't ended up happening in our automation, but it could happen in the wild, in theory at least. It's nice that Rust made this a safe deadlock caught by our tests rather than a very subtle and infrequent memory corruption. The relevant SVG documents are probably the <input type=number> rules: https://searchfox.org/mozilla-central/rev/d80f0a570736dce76a2eb184fb65517462089e8a/layout/style/res/forms.css#1050 Differential Revision: https://phabricator.services.mozilla.com/D28299 |
||
|---|---|---|
| .. | ||
| allocator | ||
| atoms | ||
| background_hang_monitor | ||
| bluetooth | ||
| bluetooth_traits | ||
| canvas | ||
| canvas_traits | ||
| compositing | ||
| config | ||
| config_plugins | ||
| constellation | ||
| debugger | ||
| deny_public_fields | ||
| derive_common | ||
| devtools | ||
| devtools_traits | ||
| dom_struct | ||
| domobject_derive | ||
| embedder_traits | ||
| fallible | ||
| geometry | ||
| gfx | ||
| gfx_traits | ||
| hashglobe | ||
| jstraceable_derive | ||
| layout | ||
| layout_thread | ||
| layout_traits | ||
| malloc_size_of | ||
| metrics | ||
| msg | ||
| net | ||
| net_traits | ||
| pixels | ||
| profile | ||
| profile_traits | ||
| rand | ||
| range | ||
| remutex | ||
| script | ||
| script_layout_interface | ||
| script_plugins | ||
| script_traits | ||
| selectors | ||
| servo | ||
| servo_arc | ||
| size_of_test | ||
| std_test_override | ||
| style | ||
| style_derive | ||
| style_traits | ||
| to_shmem | ||
| to_shmem_derive | ||
| url | ||
| webdriver_server | ||
| webvr | ||
| webvr_traits | ||