Changeset 175970 in webkit

Timestamp:

Nov 11, 2014, 1:13:59 PM (12 years ago)

Author:

commit-queue@webkit.org

Message:

Unreviewed, rolling out r175852.
​https://bugs.webkit.org/show_bug.cgi?id=138626

Broke PLT by introducing a crash. (Requested by rniwa on
#webkit).

Reverted changeset:

"Lazily create HTMLInputElement's inputType and shadow
subtree"
​https://bugs.webkit.org/show_bug.cgi?id=138524
​http://trac.webkit.org/changeset/175852

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Element.cpp (modified) (1 diff)
• dom/Element.h (modified) (1 diff)
• html/HTMLInputElement.cpp (modified) (7 diffs)
• html/HTMLInputElement.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-11-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r175852.
+        https://bugs.webkit.org/show_bug.cgi?id=138626
+
+        Broke PLT by introducing a crash. (Requested by rniwa on
+        #webkit).
+
+        Reverted changeset:
+
+        "Lazily create HTMLInputElement's inputType and shadow
+        subtree"
+        https://bugs.webkit.org/show_bug.cgi?id=138524
+        http://trac.webkit.org/changeset/175852
+
 2014-11-11  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/dom/Element.cpp

@@ -1234 +1234 @@
     ASSERT(!m_elementData);
 
-    if (!attributeVector.isEmpty()) {
-        if (document().sharedObjectPool())
-            m_elementData = document().sharedObjectPool()->cachedShareableElementDataWithAttributes(attributeVector);
-        else
-            m_elementData = ShareableElementData::createWithAttributes(attributeVector);
-
-        // Use attributeVector instead of m_elementData because attributeChanged might modify m_elementData.
-        for (const auto& attribute : attributeVector)
-            attributeChanged(attribute.name(), nullAtom, attribute.value(), ModifiedDirectly);
-    }
-
-    parserDidFinishParsingAttributes();
-}
-
-void Element::parserDidFinishParsingAttributes()
-{
+    if (attributeVector.isEmpty())
+        return;
+
+    if (document().sharedObjectPool())
+        m_elementData = document().sharedObjectPool()->cachedShareableElementDataWithAttributes(attributeVector);
+    else
+        m_elementData = ShareableElementData::createWithAttributes(attributeVector);
+
+    // Use attributeVector instead of m_elementData because attributeChanged might modify m_elementData.
+    for (unsigned i = 0; i < attributeVector.size(); ++i)
+        attributeChanged(attributeVector[i].name(), nullAtom, attributeVector[i].value(), ModifiedDirectly);
 }
 

trunk/Source/WebCore/dom/Element.h

@@ -556 +556 @@
     virtual void childrenChanged(const ChildChange&) override;
     virtual void removeAllEventListeners() override final;
-    virtual void parserDidFinishParsingAttributes();
 
     void clearTabIndexExplicitlyIfNeeded();    

trunk/Source/WebCore/html/HTMLInputElement.cpp

@@ -122 +122 @@
     , m_hasTouchEventHandler(false)
 #endif
-    // m_inputType is lazily created when constructed by the parser to avoid constructing unnecessarily a text inputType and
-    // its shadow subtree, just to destroy them when the |type| attribute gets set by the parser to something else than 'text'.
-    , m_inputType(createdByParser ? nullptr : InputType::createText(*this))
+    , m_inputType(InputType::createText(*this))
 {
     ASSERT(hasTagName(inputTag) || hasTagName(isindexTag));
@@ -132 +130 @@
 PassRefPtr<HTMLInputElement> HTMLInputElement::create(const QualifiedName& tagName, Document& document, HTMLFormElement* form, bool createdByParser)
 {
-    bool shouldCreateShadowRootLazily = createdByParser;
     RefPtr<HTMLInputElement> inputElement = adoptRef(new HTMLInputElement(tagName, document, form, createdByParser));
-    if (!shouldCreateShadowRootLazily)
-        inputElement->ensureUserAgentShadowRoot();
+    inputElement->ensureUserAgentShadowRoot();
     return inputElement.release();
 }
@@ -437 +433 @@
 void HTMLInputElement::updateType()
 {
-    ASSERT(m_inputType);
     auto newType = InputType::create(*this, fastGetAttribute(typeAttr));
     bool hadType = m_hasType;
@@ -462 +457 @@
     m_inputType->createShadowSubtree();
     updateInnerTextElementEditability();
+
+#if ENABLE(TOUCH_EVENTS)
+    bool hasTouchEventHandler = m_inputType->hasTouchEventHandler();
+    if (hasTouchEventHandler != m_hasTouchEventHandler) {
+        if (hasTouchEventHandler)
+            document().didAddTouchEventHandler(this);
+        else
+            document().didRemoveTouchEventHandler(this);
+        m_hasTouchEventHandler = hasTouchEventHandler;
+    }
+#endif
 
     setNeedsWillValidateCheck();
@@ -497 +503 @@
             attributeChanged(alignAttr, nullAtom, align->value());
     }
-
-    runPostTypeUpdateTasks();
-}
-
-inline void HTMLInputElement::runPostTypeUpdateTasks()
-{
-    ASSERT(m_inputType);
-#if ENABLE(TOUCH_EVENTS)
-    bool hasTouchEventHandler = m_inputType->hasTouchEventHandler();
-    if (hasTouchEventHandler != m_hasTouchEventHandler) {
-        if (hasTouchEventHandler)
-            document().didAddTouchEventHandler(this);
-        else
-            document().didRemoveTouchEventHandler(this);
-        m_hasTouchEventHandler = hasTouchEventHandler;
-    }
-#endif
 
     if (renderer())
@@ -608 +597 @@
 }
 
-inline void HTMLInputElement::ensureInputType()
-{
-    ASSERT(m_parsingInProgress);
-    if (m_inputType)
-        return;
-
-    if (!hasAttribute(typeAttr)) {
-        m_inputType = InputType::createText(*this);
-        ensureUserAgentShadowRoot();
-        return;
-    }
-
-    m_hasType = true;
-    m_inputType = InputType::create(*this, fastGetAttribute(typeAttr));
-    ensureUserAgentShadowRoot();
-    registerForSuspensionCallbackIfNeeded();
-    runPostTypeUpdateTasks();
-}
-
 void HTMLInputElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
-    if (m_parsingInProgress) {
-        // A lot of the code below requires m_inputType to be initialized so make sure we do.
-        // By the time parseAttribute() is called during parsing anyway, all attributes have
-        // been set on the element already so there is no point in delaying m_inputType
-        // initialization further.
-        ensureInputType();
-    }
-
     if (name == nameAttr) {
         removeFromRadioButtonGroup();
@@ -744 +706 @@
 }
 
-void HTMLInputElement::parserDidFinishParsingAttributes()
-{
-    ASSERT(m_inputType || !hasAttributes());
-    ensureInputType();
-}
-
 void HTMLInputElement::finishParsingChildren()
 {

trunk/Source/WebCore/html/HTMLInputElement.h

@@ -360 +360 @@
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStyleProperties&) override;
     virtual void finishParsingChildren() override;
-    virtual void parserDidFinishParsingAttributes() override final;
 
     virtual void copyNonAttributePropertiesFromElement(const Element&) override;
@@ -400 +399 @@
     virtual void requiredAttributeChanged() override;
 
-    void ensureInputType();
     void updateType();
-    void runPostTypeUpdateTasks();
     
     virtual void subtreeHasChanged() override;