Changeset 294736 in webkit

Timestamp:

May 23, 2022, 11:00:48 PM (4 years ago)

Author:

Antti Koivisto

Message:

REGRESSION (r294291): Another nullptr crash with ::first-letter
​https://bugs.webkit.org/show_bug.cgi?id=240795
<rdar://93645746>

Reviewed by Alan Bujtas.

• LayoutTests/fast/css/first-letter-remove-crash-expected.txt: Added.
• LayoutTests/fast/css/first-letter-remove-crash.html: Added.
• LayoutTests/fast/css/first-letter-removed-added-expected.txt:

• Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp:

(WebCore::RenderTreeBuilder::FirstLetter::updateStyle):

We should always find :first-letter style when we get here.

• Source/WebCore/style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::resolveElement):

Rebuild the renderer subtree if ::first-letter pseudo-class stops applying.

Canonical link: ​https://commits.webkit.org/250908@main

Location:

trunk

Files:

• LayoutTests/fast/css/first-letter-remove-crash-expected.txt (added)
• LayoutTests/fast/css/first-letter-remove-crash.html (added)
• LayoutTests/fast/css/first-letter-removed-added-expected.txt (modified) (1 diff)
• Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp (modified) (1 diff)
• Source/WebCore/style/StyleTreeResolver.cpp (modified) (1 diff)

trunk/LayoutTests/fast/css/first-letter-removed-added-expected.txt

@@ -35 +35 @@
 PASS document.getElementById('test5').offsetWidth == document.getElementById('ref5').offsetWidth is true
 PASS document.getElementById('test6').offsetWidth == document.getElementById('ref6').offsetWidth is true
-FAIL document.getElementById('test7').offsetWidth == document.getElementById('ref7').offsetWidth should be true. Was false.
+PASS document.getElementById('test7').offsetWidth == document.getElementById('ref7').offsetWidth is true
 PASS document.getElementById('test8').offsetWidth == document.getElementById('ref8').offsetWidth is true
 PASS successfullyParsed is true

trunk/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp

@@ -176 +176 @@
     auto pseudoStyle = styleForFirstLetter(firstLetterContainer);
     if (!pseudoStyle) {
-        m_builder.destroy(*firstLetter, CanCollapseAnonymousBlock::No);
+        ASSERT_NOT_REACHED();
         return;
     }

trunk/Source/WebCore/style/StyleTreeResolver.cpp

@@ -262 +262 @@
     auto resolveAndAddPseudoElementStyle = [&](PseudoId pseudoId) {
         auto pseudoElementUpdate = resolvePseudoElement(element, pseudoId, update);
+        auto pseudoElementChange = [&] {
+            if (pseudoElementUpdate)
+                return pseudoElementUpdate->change == Change::None ? Change::None : Change::NonInherited;
+            if (!existingStyle || !existingStyle->getCachedPseudoStyle(pseudoId))
+                return Change::None;
+            // If ::first-letter goes aways rebuild the renderers.
+            return pseudoId == PseudoId::FirstLetter ? Change::Renderer : Change::NonInherited;
+        }();
+        update.change = std::max(update.change, pseudoElementChange);
         if (!pseudoElementUpdate)
-            return Change::None;
-        if (pseudoElementUpdate->change != Change::None)
-            update.change = std::max(update.change, Change::NonInherited);
+            return pseudoElementChange;
         if (pseudoElementUpdate->recompositeLayer)
             update.recompositeLayer = true;