From 921890154c82d1560329764df3f45fc03a01e62a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= Date: Wed, 4 Mar 2020 21:11:43 +0000 Subject: [PATCH] Bug 1619858 - Use an intersection observer per document for lazyload. r=hiro We can't observe when the sub-document gets detached from the root document to drop the observation, so this is the sound thing to do. Differential Revision: https://phabricator.services.mozilla.com/D65362 --HG-- extra : moz-landing-system : lando --- dom/base/Document.cpp | 17 +++++------- ...-loading-lazy-subframe-detached-crash.html | 26 +++++++++++++++++++ 2 files changed, 32 insertions(+), 11 deletions(-) create mode 100644 testing/web-platform/tests/html/semantics/embedded-content/the-img-element/image-loading-lazy-subframe-detached-crash.html diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp index 2a71d9662eb2..021ddcc9cc5c 100644 --- a/dom/base/Document.cpp +++ b/dom/base/Document.cpp @@ -14688,19 +14688,14 @@ void Document::NotifyIntersectionObservers() { } DOMIntersectionObserver* Document::GetLazyLoadImageObserver() { - Document* rootDoc = nsContentUtils::GetRootDocument(this); - MOZ_ASSERT(rootDoc); - - if (rootDoc->mLazyLoadImageObserver) { - return rootDoc->mLazyLoadImageObserver; + if (!mLazyLoadImageObserver) { + if (nsPIDOMWindowInner* inner = GetInnerWindow()) { + mLazyLoadImageObserver = + DOMIntersectionObserver::CreateLazyLoadObserver(inner); + } } - if (nsPIDOMWindowInner* inner = rootDoc->GetInnerWindow()) { - rootDoc->mLazyLoadImageObserver = - DOMIntersectionObserver::CreateLazyLoadObserver(inner); - } - - return rootDoc->mLazyLoadImageObserver; + return mLazyLoadImageObserver; } static CallState NotifyLayerManagerRecreatedCallback(Document& aDocument, diff --git a/testing/web-platform/tests/html/semantics/embedded-content/the-img-element/image-loading-lazy-subframe-detached-crash.html b/testing/web-platform/tests/html/semantics/embedded-content/the-img-element/image-loading-lazy-subframe-detached-crash.html new file mode 100644 index 000000000000..86a290d50db1 --- /dev/null +++ b/testing/web-platform/tests/html/semantics/embedded-content/the-img-element/image-loading-lazy-subframe-detached-crash.html @@ -0,0 +1,26 @@ + + +Crash when detaching a frame during a lazy-load operation + + + + +