Changeset 276547 in webkit

Timestamp:

Apr 24, 2021, 12:41:54 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Move selectedOptions cache invalidation timing
​https://bugs.webkit.org/show_bug.cgi?id=224894

Patch by Rob Buis <​rbuis@igalia.com> on 2021-04-24
Reviewed by Ryosuke Niwa.

Source/WebCore:

Move selectedOptions cache invalidation timing out
of setSelectedState, having it in setSelectedState
can cause selectedOptions cache invalidation while
determining the cache.

Test: fast/dom/HTMLSelectElement/selected-options-item-crash.html

• html/HTMLOptionElement.cpp:

(WebCore::HTMLOptionElement::setSelectedState):

• html/HTMLSelectElement.cpp:

(WebCore::HTMLSelectElement::updateListBoxSelection):
(WebCore::HTMLSelectElement::selectOption):
(WebCore::HTMLSelectElement::deselectItemsWithoutValidation):
(WebCore::HTMLSelectElement::restoreFormControlState):
(WebCore::HTMLSelectElement::reset):
(WebCore::HTMLSelectElement::updateSelectedState):

LayoutTests:

Add test for this.

• fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt: Added.
• fast/dom/HTMLSelectElement/selected-options-item-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt (added)
• LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLOptionElement.cpp (modified) (1 diff)
• Source/WebCore/html/HTMLSelectElement.cpp (modified) (6 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-24  Rob Buis  <rbuis@igalia.com>
+
+        Move selectedOptions cache invalidation timing
+        https://bugs.webkit.org/show_bug.cgi?id=224894
+
+        Reviewed by Ryosuke Niwa.
+
+        Add test for this.
+
+        * fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt: Added.
+        * fast/dom/HTMLSelectElement/selected-options-item-crash.html: Added.
+
 2021-04-23  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-24  Rob Buis  <rbuis@igalia.com>
+
+        Move selectedOptions cache invalidation timing
+        https://bugs.webkit.org/show_bug.cgi?id=224894
+
+        Reviewed by Ryosuke Niwa.
+
+        Move selectedOptions cache invalidation timing out
+        of setSelectedState, having it in setSelectedState
+        can cause selectedOptions cache invalidation while
+        determining the cache.
+
+        Test: fast/dom/HTMLSelectElement/selected-options-item-crash.html
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setSelectedState):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::selectOption):
+        (WebCore::HTMLSelectElement::deselectItemsWithoutValidation):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::updateSelectedState):
+
 2021-04-23  Ian Gilbert  <iang@apple.com>
 

trunk/Source/WebCore/html/HTMLOptionElement.cpp

@@ -235 +235 @@
     m_isSelected = selected;
     invalidateStyleForSubtree();
-
-    if (RefPtr<HTMLSelectElement> select = ownerSelectElement())
-        select->invalidateSelectedItems();
 }
 

trunk/Source/WebCore/html/HTMLSelectElement.cpp

@@ -656 +656 @@
     }
 
+    invalidateSelectedItems();
     scrollToSelection();
     updateValidity();
@@ -882 +883 @@
     }
 
+    invalidateSelectedItems();
     updateValidity();
 
@@ -963 +965 @@
             downcast<HTMLOptionElement>(*element).setSelectedState(false);
     }
+    invalidateSelectedItems();
 }
 
@@ -1028 +1031 @@
     }
 
+    invalidateSelectedItems();
     setOptionsChangedOnRenderer();
     updateValidity();
@@ -1086 +1090 @@
         firstOption->setSelectedState(true);
 
+    invalidateSelectedItems();
     setOptionsChangedOnRenderer();
     invalidateStyleForSubtree();
@@ -1322 +1327 @@
         setActiveSelectionAnchorIndex(listIndex);
 
+    invalidateSelectedItems();
     setActiveSelectionEndIndex(listIndex);
     updateListBoxSelection(!multiSelect);