⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 162972 in webkit


Ignore:
Timestamp:
Jan 28, 2014, 3:36:04 PM (13 years ago)
Author:
mmaxfield@apple.com
Message:

ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
​https://bugs.webkit.org/show_bug.cgi?id=114586

Reviewed by Dave Hyatt.

Taken mostly from ​https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8

If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
Instead, we should make it a subclass of RenderElement, so that it can be split properly.

Source/WebCore:

Test: fast/css-generated-content/quote-first-letter.html

  • dom/PseudoElement.cpp:

(WebCore::PseudoElement::didRecalcStyle):

  • rendering/RenderQuote.cpp:

(WebCore::RenderQuote::RenderQuote):
(WebCore::RenderQuote::willBeDestroyed):
(WebCore::RenderQuote::willBeRemovedFromTree):
(WebCore::RenderQuote::styleDidChange):
(WebCore::RenderQuote::updateText):
(WebCore::RenderQuote::computeText):
(WebCore::RenderQuote::updateDepth):

  • rendering/RenderQuote.h:
  • rendering/style/ContentData.cpp:

(WebCore::QuoteContentData::createContentRenderer):

LayoutTests:

This adds a test to make sure that the splitting behavior occurs, as well as updates existing tests that
didn't use the splitting behavior.

  • fast/css-generated-content/quote-first-letter-expected.html: Added.
  • fast/css-generated-content/quote-first-letter.html: Added.
  • platform/mac/fast/css-generated-content/005-expected.txt:
  • platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt:
  • platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt:
  • platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt:
Location:
trunk
Files:
2 added
14 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r162963 r162972  
     12014-01-23  Myles C. Maxfield  <mmaxfield@apple.com>
     2
     3        ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
     4        https://bugs.webkit.org/show_bug.cgi?id=114586
     5
     6        Reviewed by Dave Hyatt.
     7
     8        Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8
     9
     10        If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
     11        Instead, we should make it a subclass of RenderElement, so that it can be split properly.
     12
     13        This adds a test to make sure that the splitting behavior occurs, as well as updates existing tests that
     14        didn't use the splitting behavior.
     15
     16        * fast/css-generated-content/quote-first-letter-expected.html: Added.
     17        * fast/css-generated-content/quote-first-letter.html: Added.
     18        * platform/mac/fast/css-generated-content/005-expected.txt:
     19        * platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt:
     20        * platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt:
     21        * platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt:
     22
    1232014-01-28  Carlos Alberto Lopez Perez  <clopez@igalia.com>
    224

  • trunk/LayoutTests/platform/mac/fast/css-generated-content/005-expected.txt

    r80151 r162972  
    88          RenderInline (generated) at (0,0) size 7x18
    99            RenderQuote at (0,0) size 7x18
    10               text run at (0,0) width 7: "\""
     10              RenderText at (0,0) size 7x18
     11                text run at (0,0) width 7: "\""
    1112          RenderText {#text} at (7,0) size 151x18
    1213            text run at (7,0) width 151: "Quotes should surround"
    … …  
    1819            text run at (0,0) width 53: "this text."
    1920          RenderInline (generated) at (0,0) size 7x18
    20             RenderQuote at (53,0) size 7x18
    21               text run at (53,0) width 7: "\""
     21            RenderQuote at (0,0) size 7x18
     22              RenderText at (53,0) size 7x18
     23                text run at (53,0) width 7: "\""
    2224        RenderText {#text} at (0,0) size 0x0

  • trunk/LayoutTests/platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt

    r80151 r162972  
    2020            RenderInline (generated) at (0,0) size 7x18
    2121              RenderQuote at (0,0) size 7x18
    22                 text run at (0,0) width 7: "\""
     22                RenderText at (0,0) size 7x18
     23                  text run at (0,0) width 7: "\""
    2324            RenderText {#text} at (7,0) size 151x18
    2425              text run at (7,0) width 151: "Quotes should surround"
    … …  
    3031              text run at (0,0) width 53: "this text."
    3132            RenderInline (generated) at (0,0) size 7x18
    32               RenderQuote at (53,0) size 7x18
    33                 text run at (53,0) width 7: "\""
     33              RenderQuote at (0,0) size 7x18
     34                RenderText at (53,0) size 7x18
     35                  text run at (53,0) width 7: "\""

  • trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt

    r117339 r162972  
    1717                      RenderInline (generated) at (0,0) size 16x16
    1818                        RenderQuote at (0,0) size 16x16
    19                           text run at (0,0) width 16: "\""
     19                          RenderText at (0,0) size 16x16
     20                            text run at (0,0) width 16: "\""
    2021                      RenderInline (generated) at (0,0) size 16x16
    21                         RenderQuote at (16,0) size 16x16
    22                           text run at (16,0) width 16: "\""
     22                        RenderQuote at (0,0) size 16x16
     23                          RenderText at (16,0) size 16x16
     24                            text run at (16,0) width 16: "\""
    2325      RenderText {#text} at (0,0) size 0x0
    2426      RenderText {#text} at (0,0) size 0x0

  • trunk/LayoutTests/platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt

    r80151 r162972  
    88          RenderText at (0,0) size 8x18
    99            text run at (0,0) width 8: "*"
    10           RenderQuote at (0,0) size 0x0
     10          RenderQuote at (0,0) size 0x18
    1111        RenderText {#text} at (8,0) size 425x18
    1212          text run at (8,0) width 114: "This is some text. "
    … …  
    1515          RenderText at (433,0) size 8x18
    1616            text run at (433,0) width 8: "*"
    17           RenderQuote at (0,0) size 0x0
     17          RenderQuote at (0,0) size 0x18

  • trunk/Source/WebCore/ChangeLog

    r162962 r162972  
     12014-01-23  Myles C. Maxfield  <mmaxfield@apple.com>
     2
     3        ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
     4        https://bugs.webkit.org/show_bug.cgi?id=114586
     5
     6        Reviewed by Dave Hyatt.
     7
     8        Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8
     9
     10        If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
     11        Instead, we should make it a subclass of RenderElement, so that it can be split properly.
     12
     13        Test: fast/css-generated-content/quote-first-letter.html
     14
     15        * dom/PseudoElement.cpp:
     16        (WebCore::PseudoElement::didRecalcStyle):
     17        * rendering/RenderQuote.cpp:
     18        (WebCore::RenderQuote::RenderQuote):
     19        (WebCore::RenderQuote::willBeDestroyed):
     20        (WebCore::RenderQuote::willBeRemovedFromTree):
     21        (WebCore::RenderQuote::styleDidChange):
     22        (WebCore::RenderQuote::updateText):
     23        (WebCore::RenderQuote::computeText):
     24        (WebCore::RenderQuote::updateDepth):
     25        * rendering/RenderQuote.h:
     26        * rendering/style/ContentData.cpp:
     27        (WebCore::QuoteContentData::createContentRenderer):
     28
    1292014-01-28  Antti Koivisto  <antti@apple.com>
    230

  • trunk/Source/WebCore/dom/PseudoElement.cpp

    r162679 r162972  
    113113    for (RenderObject* child = renderer->nextInPreOrder(renderer); child; child = child->nextInPreOrder(renderer)) {
    114114        // We only manage the style for the generated content which must be images or text.
    115         if (!child->isRenderImage())
     115        if (!child->isRenderImage() && !child->isQuote())
    116116            continue;
    117         toRenderImage(*child).setStyle(RenderImage::createStyleInheritingFromPseudoStyle(renderer->style()));
     117        PassRef<RenderStyle> createdStyle = RenderStyle::createStyleInheritingFromPseudoStyle(renderer->style());
     118        toRenderElement(*child).setStyle(std::move(createdStyle));
    118119    }
    119120}

  • trunk/Source/WebCore/rendering/RenderImage.cpp

    r162356 r162972  
    143143}
    144144
    145 PassRef<RenderStyle> RenderImage::createStyleInheritingFromPseudoStyle(const RenderStyle& pseudoStyle)
    146 {
    147     ASSERT(pseudoStyle.styleType() == BEFORE || pseudoStyle.styleType() == AFTER);
    148 
    149     // Images are special and must inherit the pseudoStyle so the width and height of
    150     // the pseudo element doesn't change the size of the image. In all other cases we
    151     // can just share the style.
    152     auto style = RenderStyle::create();
    153     style.get().inheritFrom(&pseudoStyle);
    154     return style;
    155 }
    156 
    157145// If we'll be displaying either alt text or an image, add some padding.
    158146static const unsigned short paddingWidth = 4;

  • trunk/Source/WebCore/rendering/RenderImage.h

    r162356 r162972  
    3939    RenderImage(Document&, PassRef<RenderStyle>, StyleImage* = nullptr);
    4040    virtual ~RenderImage();
    41 
    42     // Create a RenderStyle for generated content by inheriting from a pseudo style.
    43     static PassRef<RenderStyle> createStyleInheritingFromPseudoStyle(const RenderStyle&);
    4441
    4542    RenderImageResource& imageResource() { return *m_imageResource; }

  • trunk/Source/WebCore/rendering/RenderQuote.cpp

    r162907 r162972  
    2525
    2626#include "QuotesData.h"
     27#include "RenderTextFragment.h"
    2728#include "RenderView.h"
    2829
    … …  
    3132namespace WebCore {
    3233
    33 RenderQuote::RenderQuote(Document& document, QuoteType quote)
    34     : RenderText(document, emptyString())
     34RenderQuote::RenderQuote(Document& document, PassRef<RenderStyle> style, QuoteType quote)
     35    : RenderInline(document, std::move(style))
    3536    , m_type(quote)
    3637    , m_depth(-1)
    … …  
    5152{
    5253    detachQuote();
    53     RenderText::willBeDestroyed();
     54    RenderInline::willBeDestroyed();
    5455}
    5556
    5657void RenderQuote::willBeRemovedFromTree()
    5758{
    58     RenderText::willBeRemovedFromTree();
     59    RenderInline::willBeRemovedFromTree();
    5960    detachQuote();
    6061}
    … …  
    6263void RenderQuote::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
    6364{
    64     RenderText::styleDidChange(diff, oldStyle);
    65     setText(originalText(), true);
     65    RenderInline::styleDidChange(diff, oldStyle);
     66    updateText();
    6667}
    6768
    … …  
    337338}
    338339
    339 String RenderQuote::originalText() const
     340void RenderQuote::updateText()
     341{
     342    String text = computeText();
     343    if (m_text == text)
     344        return;
     345
     346    while (RenderObject* child = firstChild())
     347        child->destroy();
     348
     349    if (text == emptyString() || text == String()) {
     350        m_text = String();
     351        return;
     352    }
     353
     354    m_text = text;
     355
     356    RenderTextFragment* fragment = new RenderTextFragment(document(), m_text.impl());
     357    addChild(fragment);
     358}
     359
     360String RenderQuote::computeText() const
    340361{
    341362    if (m_depth < 0)
    … …  
    453474        return;
    454475    m_depth = depth;
    455     setText(originalText(), true);
     476    updateText();
    456477}
    457478

  • trunk/Source/WebCore/rendering/RenderQuote.h

    r162158 r162972  
    2424#define RenderQuote_h
    2525
    26 #include "RenderText.h"
     26#include "RenderInline.h"
    2727
    2828namespace WebCore {
    2929
    30 class RenderQuote final : public RenderText {
     30class RenderQuote final : public RenderInline {
    3131public:
    32     RenderQuote(Document&, QuoteType);
     32    RenderQuote(Document&, PassRef<RenderStyle>, QuoteType);
    3333    virtual ~RenderQuote();
    3434
    … …  
    4141    virtual const char* renderName() const override { return "RenderQuote"; }
    4242    virtual bool isQuote() const override { return true; };
    43     virtual String originalText() const override;
    4443    virtual void styleDidChange(StyleDifference, const RenderStyle*) override;
    4544    virtual void willBeRemovedFromTree() override;
    4645
     46    String computeText() const;
     47    void updateText();
    4748    void updateDepth();
    4849
    … …  
    5253    RenderQuote* m_previous;
    5354    bool m_isAttached;
     55    String m_text;
    5456};
    5557

  • trunk/Source/WebCore/rendering/style/ContentData.cpp

    r162356 r162972  
    5050RenderPtr<RenderObject> ImageContentData::createContentRenderer(Document& document, const RenderStyle& pseudoStyle) const
    5151{
    52     auto image = createRenderer<RenderImage>(document, RenderImage::createStyleInheritingFromPseudoStyle(pseudoStyle), m_image.get());
     52    auto image = createRenderer<RenderImage>(document, RenderStyle::createStyleInheritingFromPseudoStyle(pseudoStyle), m_image.get());
    5353    image->initializeStyle();
    5454    image->setAltText(altText());
    … …  
    6868}
    6969
    70 RenderPtr<RenderObject> QuoteContentData::createContentRenderer(Document& document, const RenderStyle&) const
     70RenderPtr<RenderObject> QuoteContentData::createContentRenderer(Document& document, const RenderStyle& pseudoStyle) const
    7171{
    72     return createRenderer<RenderQuote>(document, m_quote);
     72    auto quote = createRenderer<RenderQuote>(document, RenderStyle::createStyleInheritingFromPseudoStyle(pseudoStyle), m_quote);
     73    quote->initializeStyle();
     74    return std::move(quote);
    7375}
    7476

  • trunk/Source/WebCore/rendering/style/RenderStyle.cpp

    r162907 r162972  
    106106{
    107107    return adoptRef(*new RenderStyle(*other));
     108}
     109
     110PassRef<RenderStyle> RenderStyle::createStyleInheritingFromPseudoStyle(const RenderStyle& pseudoStyle)
     111{
     112    ASSERT(pseudoStyle.styleType() == BEFORE || pseudoStyle.styleType() == AFTER);
     113
     114    // Images are special and must inherit the pseudoStyle so the width and height of
     115    // the pseudo element doesn't change the size of the image. In all other cases we
     116    // can just share the style.
     117    auto style = RenderStyle::create();
     118    style.get().inheritFrom(&pseudoStyle);
     119    return style;
    108120}
    109121

  • trunk/Source/WebCore/rendering/style/RenderStyle.h

    r162795 r162972  
    352352    static PassRef<RenderStyle> createAnonymousStyleWithDisplay(const RenderStyle* parentStyle, EDisplay);
    353353    static PassRef<RenderStyle> clone(const RenderStyle*);
     354
     355    // Create a RenderStyle for generated content by inheriting from a pseudo style.
     356    static PassRef<RenderStyle> createStyleInheritingFromPseudoStyle(const RenderStyle& pseudoStyle);
    354357
    355358    enum IsAtShadowBoundary {
Note: See TracChangeset for help on using the changeset viewer.