Toggling scroll anchoring pref can crash

RESOLVED FIXED in Firefox 66

Status

()

enhancement
P3
normal
RESOLVED FIXED
4 months ago
4 months ago

People

(Reporter: rhunt, Assigned: rhunt)

Tracking

(Blocks 1 bug)

unspecified
mozilla66
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox66 fixed)

Details

Attachments

(1 attachment)

Assignee

Description

4 months ago

We check the scroll-anchoring pref multiple places in ScrollAnchorContainer. The two important ones if we're disabled are that we won't ever select a new anchor, and we won't invalidate an anchor and queue a future selection.

This is a problem because we use Invalidate when a frame is being destroyed to get rid of dangling pointers. We should allow Invalidate to clear frame references without the pref enabled.

Assignee

Comment 1

4 months ago

The important piece is just that we don't queue a selection for later. This code runs
for each scroll, so we'd be wasting a lot of effort to do that.

Comment 2

4 months ago
Pushed by rhunt@eqrion.net:
https://hg.mozilla.org/integration/autoland/rev/60944b0fca8f
Allow ScrollAnchorContainer to detach anchor frame even if pref is disabled. r=dholbert

Comment 3

4 months ago
bugherder
Status: NEW → RESOLVED
Last Resolved: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
Assignee

Updated

4 months ago
See Also: → 1520843
You need to log in before you can comment on or make changes to this bug.