Changeset 285713 in webkit

Timestamp:

Nov 12, 2021, 4:28:01 AM (5 years ago)

Author:

Antti Koivisto

Message:

Stack overflow with revert and revert-layer
​https://bugs.webkit.org/show_bug.cgi?id=233033
rdar://85336439

Reviewed by Antoine Quint.

Source/WebCore:

Test: fast/css/revert-layer-stack-overflow.html

We end up using a rollback cascade made for revert-layer to do revert and that leads to eternal recursion.

• style/StyleBuilder.cpp:

(WebCore::Style::Builder::ensureRollbackCascadeForRevert):
(WebCore::Style::Builder::ensureRollbackCascadeForRevertLayer):

Key the rollback cascade map with the reverted values instead of the original ones since the same
original keys produce different rollbacks depending on whether it is made for revert or revert-layer.

LayoutTests:

• fast/css/revert-layer-stack-overflow-expected.txt: Added.
• fast/css/revert-layer-stack-overflow.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/revert-layer-stack-overflow-expected.txt (added)
• LayoutTests/fast/css/revert-layer-stack-overflow.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/style/StyleBuilder.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-12  Antti Koivisto  <antti@apple.com>
+
+        Stack overflow with revert and revert-layer
+        https://bugs.webkit.org/show_bug.cgi?id=233033
+        rdar://85336439
+
+        Reviewed by Antoine Quint.
+
+        * fast/css/revert-layer-stack-overflow-expected.txt: Added.
+        * fast/css/revert-layer-stack-overflow.html: Added.
+
 2021-11-12  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-12  Antti Koivisto  <antti@apple.com>
+
+        Stack overflow with revert and revert-layer
+        https://bugs.webkit.org/show_bug.cgi?id=233033
+        rdar://85336439
+
+        Reviewed by Antoine Quint.
+
+        Test: fast/css/revert-layer-stack-overflow.html
+
+        We end up using a rollback cascade made for revert-layer to do revert and that leads to eternal recursion.
+
+        * style/StyleBuilder.cpp:
+        (WebCore::Style::Builder::ensureRollbackCascadeForRevert):
+        (WebCore::Style::Builder::ensureRollbackCascadeForRevertLayer):
+
+        Key the rollback cascade map with the reverted values instead of the original ones since the same
+        original keys produce different rollbacks depending on whether it is made for revert or revert-layer.
+
 2021-11-12  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/style/StyleBuilder.cpp

@@ -376 +376 @@
         return nullptr;
 
+    --rollbackCascadeLevel;
+
     auto key = makeRollbackCascadeKey(rollbackCascadeLevel, RuleSet::cascadeLayerPriorityForUnlayered);
     return m_rollbackCascades.ensure(key, [&] {
-        return makeUnique<const PropertyCascade>(m_cascade, --rollbackCascadeLevel, RuleSet::cascadeLayerPriorityForUnlayered);
+        return makeUnique<const PropertyCascade>(m_cascade, rollbackCascadeLevel, RuleSet::cascadeLayerPriorityForUnlayered);
     }).iterator->value.get();
 }
@@ -387 +389 @@
         return nullptr;
 
+    --rollbackLayerPriority;
+
     auto key = makeRollbackCascadeKey(cascadeLevel, rollbackLayerPriority);
     return m_rollbackCascades.ensure(key, [&] {
-        return makeUnique<const PropertyCascade>(m_cascade, cascadeLevel, rollbackLayerPriority - 1);
+        return makeUnique<const PropertyCascade>(m_cascade, cascadeLevel, rollbackLayerPriority);
     }).iterator->value.get();
 }