Closed Bug 1521278 Opened 5 years ago Closed 5 years ago

Toggling scroll anchoring pref can crash

Categories

(Core :: Layout: Scrolling and Overflow, enhancement, P3)

enhancement

Tracking

()

RESOLVED FIXED
mozilla66
Tracking Status
firefox66 --- fixed

People

(Reporter: rhunt, Assigned: rhunt)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

We check the scroll-anchoring pref multiple places in ScrollAnchorContainer. The two important ones if we're disabled are that we won't ever select a new anchor, and we won't invalidate an anchor and queue a future selection.

This is a problem because we use Invalidate when a frame is being destroyed to get rid of dangling pointers. We should allow Invalidate to clear frame references without the pref enabled.

The important piece is just that we don't queue a selection for later. This code runs
for each scroll, so we'd be wasting a lot of effort to do that.

Pushed by rhunt@eqrion.net:
https://hg.mozilla.org/integration/autoland/rev/60944b0fca8f
Allow ScrollAnchorContainer to detach anchor frame even if pref is disabled. r=dholbert
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
See Also: → 1520843
You need to log in before you can comment on or make changes to this bug.