⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 235729 in webkit


Ignore:
Timestamp:
Sep 6, 2018, 1:11:54 AM (8 years ago)
Author:
bshafiei@apple.com
Message:

Cherry-pick r235537. rdar://problem/44169516

CounterMaps should hold a unique_ptr of CounterMap.
​https://bugs.webkit.org/show_bug.cgi?id=189174
<rdar://problem/43686458>

Reviewed by Ryosuke Niwa.

Source/WebCore:

In certain cases calls to CounterMaps might lead to unexpected deletion of the CounterMap object.

Test: fast/css/counters/crash-when-cloning-body.html

  • rendering/RenderCounter.cpp: (WebCore::makeCounterNode): (WebCore::destroyCounterNodeWithoutMapRemoval): (WebCore::RenderCounter::destroyCounterNodes): (WebCore::RenderCounter::destroyCounterNode): (WebCore::updateCounters): (showCounterRendererTree):

LayoutTests:

  • fast/css/counters/crash-when-cloning-body-expected.txt: Added.
  • fast/css/counters/crash-when-cloning-body.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@235537 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-606-branch
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-606-branch/LayoutTests/ChangeLog

    r235727 r235729  
     12018-09-06  Babak Shafiei  <bshafiei@apple.com>
     2
     3        Cherry-pick r235537. rdar://problem/44169516
     4
     5    CounterMaps should hold a unique_ptr of CounterMap.
     6    https://bugs.webkit.org/show_bug.cgi?id=189174
     7    <rdar://problem/43686458>
     8   
     9    Reviewed by Ryosuke Niwa.
     10   
     11    Source/WebCore:
     12   
     13    In certain cases calls to CounterMaps might lead to unexpected deletion of the CounterMap object.
     14   
     15    Test: fast/css/counters/crash-when-cloning-body.html
     16   
     17    * rendering/RenderCounter.cpp:
     18    (WebCore::makeCounterNode):
     19    (WebCore::destroyCounterNodeWithoutMapRemoval):
     20    (WebCore::RenderCounter::destroyCounterNodes):
     21    (WebCore::RenderCounter::destroyCounterNode):
     22    (WebCore::updateCounters):
     23    (showCounterRendererTree):
     24   
     25    LayoutTests:
     26   
     27    * fast/css/counters/crash-when-cloning-body-expected.txt: Added.
     28    * fast/css/counters/crash-when-cloning-body.html: Added.
     29   
     30    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235537 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     31
     32    2018-08-30  Zalan Bujtas  <zalan@apple.com>
     33
     34            CounterMaps should hold a unique_ptr of CounterMap.
     35            https://bugs.webkit.org/show_bug.cgi?id=189174
     36            <rdar://problem/43686458>
     37
     38            Reviewed by Ryosuke Niwa.
     39
     40            * fast/css/counters/crash-when-cloning-body-expected.txt: Added.
     41            * fast/css/counters/crash-when-cloning-body.html: Added.
     42
    1432018-09-06  Babak Shafiei  <bshafiei@apple.com>
    244

  • branches/safari-606-branch/Source/WebCore/ChangeLog

    r235725 r235729  
     12018-09-06  Babak Shafiei  <bshafiei@apple.com>
     2
     3        Cherry-pick r235537. rdar://problem/44169516
     4
     5    CounterMaps should hold a unique_ptr of CounterMap.
     6    https://bugs.webkit.org/show_bug.cgi?id=189174
     7    <rdar://problem/43686458>
     8   
     9    Reviewed by Ryosuke Niwa.
     10   
     11    Source/WebCore:
     12   
     13    In certain cases calls to CounterMaps might lead to unexpected deletion of the CounterMap object.
     14   
     15    Test: fast/css/counters/crash-when-cloning-body.html
     16   
     17    * rendering/RenderCounter.cpp:
     18    (WebCore::makeCounterNode):
     19    (WebCore::destroyCounterNodeWithoutMapRemoval):
     20    (WebCore::RenderCounter::destroyCounterNodes):
     21    (WebCore::RenderCounter::destroyCounterNode):
     22    (WebCore::updateCounters):
     23    (showCounterRendererTree):
     24   
     25    LayoutTests:
     26   
     27    * fast/css/counters/crash-when-cloning-body-expected.txt: Added.
     28    * fast/css/counters/crash-when-cloning-body.html: Added.
     29   
     30    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235537 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     31
     32    2018-08-30  Zalan Bujtas  <zalan@apple.com>
     33
     34            CounterMaps should hold a unique_ptr of CounterMap.
     35            https://bugs.webkit.org/show_bug.cgi?id=189174
     36            <rdar://problem/43686458>
     37
     38            Reviewed by Ryosuke Niwa.
     39
     40            In certain cases calls to CounterMaps might lead to unexpected deletion of the CounterMap object.
     41
     42            Test: fast/css/counters/crash-when-cloning-body.html
     43
     44            * rendering/RenderCounter.cpp:
     45            (WebCore::makeCounterNode):
     46            (WebCore::destroyCounterNodeWithoutMapRemoval):
     47            (WebCore::RenderCounter::destroyCounterNodes):
     48            (WebCore::RenderCounter::destroyCounterNode):
     49            (WebCore::updateCounters):
     50            (showCounterRendererTree):
     51
    1522018-09-06  Babak Shafiei  <bshafiei@apple.com>
    253

  • branches/safari-606-branch/Source/WebCore/rendering/RenderCounter.cpp

    r232178 r235729  
    4848
    4949using CounterMap = HashMap<AtomicString, Ref<CounterNode>>;
    50 using CounterMaps = HashMap<const RenderElement*, CounterMap>;
     50using CounterMaps = HashMap<const RenderElement*, std::unique_ptr<CounterMap>>;
    5151
    5252static CounterNode* makeCounterNode(RenderElement&, const AtomicString& identifier, bool alwaysCreateCounter);
    … …  
    297297    if (renderer.hasCounterNodeMap()) {
    298298        ASSERT(counterMaps().contains(&renderer));
    299         if (auto* node = counterMaps().find(&renderer)->value.get(identifier))
     299        if (auto* node = counterMaps().find(&renderer)->value->get(identifier))
    300300            return node;
    301301    }
    … …  
    313313        place.parent->insertAfter(newNode, place.previousSibling.get(), identifier);
    314314
    315     maps.add(&renderer, CounterMap { }).iterator->value.add(identifier, newNode.copyRef());
     315    maps.add(&renderer, std::make_unique<CounterMap>()).iterator->value->add(identifier, newNode.copyRef());
    316316    renderer.setHasCounterNodeMap(true);
    317317
    … …  
    327327        if (!currentRenderer->hasCounterNodeMap())
    328328            continue;
    329         auto* currentCounter = maps.find(currentRenderer)->value.get(identifier);
     329        auto* currentCounter = maps.find(currentRenderer)->value->get(identifier);
    330330        if (!currentCounter)
    331331            continue;
    … …  
    437437        previous = child->previousInPreOrder();
    438438        child->parent()->removeChild(*child);
    439         ASSERT(counterMaps().find(&child->owner())->value.get(identifier) == child);
    440         counterMaps().find(&child->owner())->value.remove(identifier);
     439        ASSERT(counterMaps().find(&child->owner())->value->get(identifier) == child);
     440        counterMaps().find(&child->owner())->value->remove(identifier);
    441441    }
    442442    if (auto* parent = node.parent())
    … …  
    449449    auto& maps = counterMaps();
    450450    ASSERT(maps.contains(&owner));
    451     for (auto& keyValue : maps.take(&owner))
    452         destroyCounterNodeWithoutMapRemoval(keyValue.key, keyValue.value);
     451    auto counterMap = maps.take(&owner);
     452    for (auto& counterMapEntry : *counterMap)
     453        destroyCounterNodeWithoutMapRemoval(counterMapEntry.key, counterMapEntry.value);
    453454    owner.setHasCounterNodeMap(false);
    454455}
    … …  
    459460    if (map == counterMaps().end())
    460461        return;
    461     auto node = map->value.take(identifier);
     462    auto node = map->value->take(identifier);
    462463    if (!node)
    463464        return;
    … …  
    500501    }
    501502    ASSERT(counterMaps().contains(&renderer));
    502     auto& counterMap = counterMaps().find(&renderer)->value;
     503    auto* counterMap = counterMaps().find(&renderer)->value.get();
    503504    for (auto& key : directiveMap->keys()) {
    504         RefPtr<CounterNode> node = counterMap.get(key);
     505        RefPtr<CounterNode> node = counterMap->get(key);
    505506        if (!node) {
    506507            makeCounterNode(renderer, key, false);
    … …  
    508509        }
    509510        auto place = findPlaceForCounter(renderer, key, node->hasResetType());
    510         if (node != counterMap.get(key))
     511        if (node != counterMap->get(key))
    511512            continue;
    512513        CounterNode* parent = node->parent();
    … …  
    602603            current, current->node(), current->parent(), current->previousSibling(),
    603604            current->nextSibling(), downcast<WebCore::RenderElement>(*current).hasCounterNodeMap() ?
    604             counterName ? WebCore::counterMaps().find(downcast<WebCore::RenderElement>(current))->value.get(identifier) : (WebCore::CounterNode*)1 : (WebCore::CounterNode*)0);
     605            counterName ? WebCore::counterMaps().find(downcast<WebCore::RenderElement>(current))->value->get(identifier) : (WebCore::CounterNode*)1 : (WebCore::CounterNode*)0);
    605606    }
    606607    fflush(stderr);
Note: See TracChangeset for help on using the changeset viewer.