Changeset 230607 in webkit


Ignore:
Timestamp:
Apr 12, 2018 4:27:43 PM (6 years ago)
Author:
Kocsen Chung
Message:

Cherry-pick r229505. rdar://problem/39371567

Turn off offset*/scroll* optimization for input elements with shadow content
​https://bugs.webkit.org/show_bug.cgi?id=182383
<rdar://problem/37114190>

Reviewed by Antti Koivisto.

Source/WebCore:

We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
the previously computed values even when some part of the tree is dirty.
In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
for the root, while true (needs layout) for the shadow content.
This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.

Test: fast/forms/scrollheight-with-mutation-crash.html

  • dom/Document.cpp: (WebCore::Document::updateLayoutIfDimensionsOutOfDate):

LayoutTests:

  • fast/forms/scrollheight-with-mutation-crash-expected.txt: Added.
  • fast/forms/scrollheight-with-mutation-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@229505 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-605.1.33.1-branch
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-605.1.33.1-branch/LayoutTests/ChangeLog

    r229105 r230607  
     12018-04-12  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r229505. rdar://problem/39371567
     4
     5    Turn off offset*/scroll* optimization for input elements with shadow content
     6    https://bugs.webkit.org/show_bug.cgi?id=182383
     7    <rdar://problem/37114190>
     8   
     9    Reviewed by Antti Koivisto.
     10   
     11    Source/WebCore:
     12   
     13    We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
     14    In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
     15    the previously computed values even when some part of the tree is dirty.
     16    In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
     17    for the root, while true (needs layout) for the shadow content.
     18    This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.
     19   
     20    Test: fast/forms/scrollheight-with-mutation-crash.html
     21   
     22    * dom/Document.cpp:
     23    (WebCore::Document::updateLayoutIfDimensionsOutOfDate):
     24   
     25    LayoutTests:
     26   
     27    * fast/forms/scrollheight-with-mutation-crash-expected.txt: Added.
     28    * fast/forms/scrollheight-with-mutation-crash.html: Added.
     29   
     30    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229505 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     31
     32    2018-03-09  Zalan Bujtas  <zalan@apple.com>
     33
     34            Turn off offset*/scroll* optimization for input elements with shadow content
     35            https://bugs.webkit.org/show_bug.cgi?id=182383
     36            <rdar://problem/37114190>
     37
     38            Reviewed by Antti Koivisto.
     39
     40            * fast/forms/scrollheight-with-mutation-crash-expected.txt: Added.
     41            * fast/forms/scrollheight-with-mutation-crash.html: Added.
     42
    1432018-02-28  Jason Marcell  <jmarcell@apple.com>
    244

  • branches/safari-605.1.33.1-branch/Source/WebCore/ChangeLog

    r229105 r230607  
     12018-04-12  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r229505. rdar://problem/39371567
     4
     5    Turn off offset*/scroll* optimization for input elements with shadow content
     6    https://bugs.webkit.org/show_bug.cgi?id=182383
     7    <rdar://problem/37114190>
     8   
     9    Reviewed by Antti Koivisto.
     10   
     11    Source/WebCore:
     12   
     13    We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
     14    In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
     15    the previously computed values even when some part of the tree is dirty.
     16    In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
     17    for the root, while true (needs layout) for the shadow content.
     18    This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.
     19   
     20    Test: fast/forms/scrollheight-with-mutation-crash.html
     21   
     22    * dom/Document.cpp:
     23    (WebCore::Document::updateLayoutIfDimensionsOutOfDate):
     24   
     25    LayoutTests:
     26   
     27    * fast/forms/scrollheight-with-mutation-crash-expected.txt: Added.
     28    * fast/forms/scrollheight-with-mutation-crash.html: Added.
     29   
     30    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229505 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     31
     32    2018-03-09  Zalan Bujtas  <zalan@apple.com>
     33
     34            Turn off offset*/scroll* optimization for input elements with shadow content
     35            https://bugs.webkit.org/show_bug.cgi?id=182383
     36            <rdar://problem/37114190>
     37
     38            Reviewed by Antti Koivisto.
     39
     40            We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
     41            In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
     42            the previously computed values even when some part of the tree is dirty.
     43            In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
     44            for the root, while true (needs layout) for the shadow content.
     45            This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.
     46
     47            Test: fast/forms/scrollheight-with-mutation-crash.html
     48
     49            * dom/Document.cpp:
     50            (WebCore::Document::updateLayoutIfDimensionsOutOfDate):
     51
    1522018-02-28  Jason Marcell  <jmarcell@apple.com>
    253

  • branches/safari-605.1.33.1-branch/Source/WebCore/dom/Document.cpp

    r228705 r230607  
    20802080    }
    20812081
     2082    // Turn off this optimization for input elements with shadow content.
     2083    if (is<HTMLInputElement>(element))
     2084        requireFullLayout = true;
     2085
    20822086    bool isVertical = renderer && !renderer->isHorizontalWritingMode();
    20832087    bool checkingLogicalWidth = ((dimensionsCheck & WidthDimensionsCheck) && !isVertical) || ((dimensionsCheck & HeightDimensionsCheck) && isVertical);
Note: See TracChangeset for help on using the changeset viewer.