Changeset 220066 in webkit

Timestamp:

Jul 31, 2017, 7:37:42 AM (9 years ago)

Author:

jmarcell@apple.com

Message:

Cherry-pick r220048. rdar://problem/33619591

Location:

branches/safari-604-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/images/image-element-image-content-data-expected.txt (added)
• LayoutTests/fast/images/image-element-image-content-data.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/CSSCrossfadeValue.cpp (modified) (1 diff)
• Source/WebCore/css/CSSFilterImageValue.cpp (modified) (1 diff)
• Source/WebCore/page/EventHandler.cpp (modified) (1 diff)
• Source/WebCore/page/PageSerializer.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderElement.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderImageResource.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderImageResourceStyleImage.cpp (modified) (4 diffs)
• Source/WebCore/rendering/style/ContentData.cpp (modified) (1 diff)
• Source/WebCore/rendering/style/StyleCachedImage.cpp (modified) (1 diff)
• Source/WebCore/style/StylePendingResources.cpp (modified) (1 diff)

branches/safari-604-branch/LayoutTests/ChangeLog

@@ +1 @@
+2017-07-31  Jason Marcell  <jmarcell@apple.com>
+
+        Cherry-pick r220048. rdar://problem/33619591
+
+    2017-07-30  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+            RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available
+            https://bugs.webkit.org/show_bug.cgi?id=174874
+            <rdar://problem/33530130>
+
+            Reviewed by Darin Adler.
+
+            * fast/images/image-element-image-content-data-expected.txt: Added.
+            * fast/images/image-element-image-content-data.html: Added.
+
 2017-07-31  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-604-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2017-07-31  Jason Marcell  <jmarcell@apple.com>
+
+        Cherry-pick r220048. rdar://problem/33619591
+
+    2017-07-30  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+            RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available
+            https://bugs.webkit.org/show_bug.cgi?id=174874
+            <rdar://problem/33530130>
+
+            Reviewed by Darin Adler.
+
+            If an <img> element has image content data for a none cached image, e.g.
+            -webkit-named-image, RenderImageResourceStyleImage will be created and
+            attached to the RenderImage. RenderImageResourceStyleImage::m_cachedImage
+            will be set to null because the m_styleImage->isCachedImage() is false in
+            this case. When ImageLoader finishes loading the url of the src attribute,
+            RenderImageResource::setCachedImage() will be called to set m_cachedImage.
+
+            A crash will happen when the RenderImage is destroyed. Destroying the
+            RenderImage calls RenderImageResourceStyleImage::shutdown() which checks
+            m_cachedImage and finds it not null, so it calls RenderImageResourceStyleImage::image()
+            which ends up calling CSSNamedImageValue::image() which returns a null pointer
+            because the size is empty. RenderImageResourceStyleImage::shutdown() calls
+            image()->stopAnimation() without checking the return value of image().
+
+            Like the base class virtual method RenderImageResource::image(),
+            RenderImageResourceStyleImage::image() should return the nullImage() if
+            the image is not available.
+
+            Test: fast/images/image-element-image-content-data.html
+
+            * css/CSSCrossfadeValue.cpp:
+            * css/CSSFilterImageValue.cpp:
+            * page/EventHandler.cpp:
+            * page/PageSerializer.cpp:
+            * rendering/RenderElement.cpp:
+            * rendering/RenderImageResource.cpp:
+            * rendering/RenderImageResourceStyleImage.cpp:
+            (WebCore::RenderImageResourceStyleImage::initialize):
+
+            (WebCore::RenderImageResourceStyleImage::shutdown): Revert back the changes
+            of r208511 in this function. Add a call to image()->stopAnimation() without
+            checking the return of image() since it will return the nullImage() if
+            the image not available. There is no need to check m_cachedImage before
+            calling image() because image() does not check or access m_cachedImage.
+
+            (WebCore::RenderImageResourceStyleImage::image): The base class method
+            RenderImageResource::image() returns the nullImage() if the image not
+            available. This is because CachedImage::imageForRenderer() returns
+            the nullImage() if the image is not available; see CachedImage.h. We should
+            do the same for the derived class for consistency.
+
+            * rendering/style/ContentData.cpp:
+            * rendering/style/StyleCachedImage.cpp:
+            * style/StylePendingResources.cpp:
+
 2017-07-31  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-604-branch/Source/WebCore/css/CSSCrossfadeValue.cpp

@@ -34 +34 @@
 #include "CrossfadeGeneratedImage.h"
 #include "RenderElement.h"
-#include "StyleCachedImage.h"
 #include <wtf/text/StringBuilder.h>
 

branches/safari-604-branch/Source/WebCore/css/CSSFilterImageValue.cpp

@@ -34 +34 @@
 #include "ImageBuffer.h"
 #include "RenderElement.h"
-#include "StyleCachedImage.h"
 #include "StyleResolver.h"
 #include <wtf/text/StringBuilder.h>

branches/safari-604-branch/Source/WebCore/page/EventHandler.cpp

@@ -86 +86 @@
 #include "ShadowRoot.h"
 #include "SpatialNavigation.h"
-#include "StyleCachedImage.h"
 #include "TextEvent.h"
 #include "TextIterator.h"

branches/safari-604-branch/Source/WebCore/page/PageSerializer.cpp

@@ -53 +53 @@
 #include "Page.h"
 #include "RenderElement.h"
-#include "StyleCachedImage.h"
 #include "StyleImage.h"
 #include "StyleProperties.h"

branches/safari-604-branch/Source/WebCore/rendering/RenderElement.cpp

@@ -51 +51 @@
 #include "RenderFlexibleBox.h"
 #include "RenderImage.h"
-#include "RenderImageResourceStyleImage.h"
 #include "RenderInline.h"
 #include "RenderIterator.h"

branches/safari-604-branch/Source/WebCore/rendering/RenderImageResource.cpp

@@ -33 +33 @@
 #include "RenderElement.h"
 #include "RenderImage.h"
-#include "RenderImageResourceStyleImage.h"
 
 namespace WebCore {

branches/safari-604-branch/Source/WebCore/rendering/RenderImageResourceStyleImage.cpp

@@ -31 +31 @@
 #include "CachedImage.h"
 #include "RenderElement.h"
-#include "StyleCachedImage.h"
 
 namespace WebCore {
@@ -49 +48 @@
 
     if (m_styleImage->isCachedImage())
-        m_cachedImage = m_styleImage.get().cachedImage();
+        m_cachedImage = m_styleImage->cachedImage();
 
     m_styleImage->addClient(m_renderer);
@@ -57 +56 @@
 {
     ASSERT(m_renderer);
+    image()->stopAnimation();
     m_styleImage->removeClient(m_renderer);
-    if (m_cachedImage) {
-        image()->stopAnimation();
-        m_cachedImage = nullptr;
-    }
+    m_cachedImage = nullptr;
 }
 
@@ -67 +64 @@
 {
     // Generated content may trigger calls to image() while we're still pending, don't assert but gracefully exit.
-    return !m_styleImage->isPending() ? m_styleImage->image(m_renderer, size) : &Image::nullImage();
+    if (m_styleImage->isPending())
+        return &Image::nullImage();
+    if (auto image = m_styleImage->image(m_renderer, size))
+        return image;
+    return &Image::nullImage();
 }
 

branches/safari-604-branch/Source/WebCore/rendering/style/ContentData.cpp

@@ -26 +26 @@
 #include "RenderImage.h"
 #include "RenderImageResource.h"
-#include "RenderImageResourceStyleImage.h"
 #include "RenderQuote.h"
 #include "RenderStyle.h"

branches/safari-604-branch/Source/WebCore/rendering/style/StyleCachedImage.cpp

@@ -30 +30 @@
 #include "CachedImage.h"
 #include "RenderElement.h"
-#include "RenderView.h"
 
 namespace WebCore {

branches/safari-604-branch/Source/WebCore/style/StylePendingResources.cpp

@@ -35 +35 @@
 #include "RenderStyle.h"
 #include "SVGURIReference.h"
-#include "StyleCachedImage.h"
 #include "StyleGeneratedImage.h"
 #include "TransformFunctions.h"