Changeset 45612 in webkit

Timestamp:

Jul 7, 2009, 4:45:45 PM (16 years ago)

Author:

mitz@apple.com

Message:

WebCore:

Reviewed by Dave Hyatt and Darin Adler.

• fix ​https://bugs.webkit.org/show_bug.cgi?id=26963 <rdar://problem/7030998> Reproducible crash at FontCache::getFontData() when a custom font is used in a pseudo-style

Test: fast/css/pseudo-cache-stale.html

• dom/Element.cpp: (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old style and the new style, goes over cached pseudo-styles in the old style and re-resolves the same style types off the new style. If any of the new pseudo-styles is different from the currently cached corresponding style, returns true. Otherwise, returns false. (WebCore::Element::recalcStyle): Validate the pseudo-style cache before deciding to keep the existing style.
• dom/Element.h:
• rendering/RenderObject.cpp: (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that returns an uncached first-line style based off the given style. (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle' parameter.
• rendering/RenderObject.h:
• rendering/style/RenderStyle.cpp: (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached pseudo-styles in the passed-in vector.
• rendering/style/RenderStyle.h:

LayoutTests:

Reviewed by Dave Hyatt and Darin Adler.

• test for ​https://bugs.webkit.org/show_bug.cgi?id=26963 <rdar://problem/7030998> Reproducible crash at FontCache::getFontData() when a custom font is used in a pseudo-style

• fast/css/pseudo-cache-stale.html: Added.
• platform/mac/fast/css/pseudo-cache-stale-expected.checksum: Added.
• platform/mac/fast/css/pseudo-cache-stale-expected.png: Added.
• platform/mac/fast/css/pseudo-cache-stale-expected.txt: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/pseudo-cache-stale.html (added)
• LayoutTests/platform/mac/fast/css/pseudo-cache-stale-expected.checksum (added)
• LayoutTests/platform/mac/fast/css/pseudo-cache-stale-expected.png (added)
• LayoutTests/platform/mac/fast/css/pseudo-cache-stale-expected.txt (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/Element.cpp (modified) (2 diffs)
• WebCore/dom/Element.h (modified) (1 diff)
• WebCore/rendering/RenderObject.cpp (modified) (2 diffs)
• WebCore/rendering/RenderObject.h (modified) (2 diffs)
• WebCore/rendering/style/RenderStyle.cpp (modified) (1 diff)
• WebCore/rendering/style/RenderStyle.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Darin Adler.
+
+        - test for https://bugs.webkit.org/show_bug.cgi?id=26963
+          <rdar://problem/7030998> Reproducible crash at
+          FontCache::getFontData() when a custom font is used in a pseudo-style
+
+        * fast/css/pseudo-cache-stale.html: Added.
+        * platform/mac/fast/css/pseudo-cache-stale-expected.checksum: Added.
+        * platform/mac/fast/css/pseudo-cache-stale-expected.png: Added.
+        * platform/mac/fast/css/pseudo-cache-stale-expected.txt: Added.
+
 2009-07-07  Dirk Pranke  <dpranke@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26963
+          <rdar://problem/7030998> Reproducible crash at
+          FontCache::getFontData() when a custom font is used in a pseudo-style
+
+        Test: fast/css/pseudo-cache-stale.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old
+        style and the new style, goes over cached pseudo-styles in the old
+        style and re-resolves the same style types off the new style. If any of
+        the new pseudo-styles is different from the currently cached
+        corresponding style, returns true. Otherwise, returns false.
+        (WebCore::Element::recalcStyle): Validate the pseudo-style cache before
+        deciding to keep the existing style.
+        * dom/Element.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that
+        returns an uncached first-line style based off the given style.
+        (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle'
+        parameter.
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached
+        pseudo-styles in the passed-in vector.
+        * rendering/style/RenderStyle.h:
+
 2009-07-07  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/dom/Element.cpp

@@ -762 +762 @@
 }
 
+bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle)
+{
+    ASSERT(currentStyle = renderStyle());
+
+    if (!renderer() || !currentStyle)
+        return false;
+
+    RenderStyle::PseudoStyleCache pseudoStyleCache;
+    currentStyle->getPseudoStyleCache(pseudoStyleCache);
+    size_t cacheSize = pseudoStyleCache.size();
+    for (size_t i = 0; i < cacheSize; ++i) {
+        RefPtr<RenderStyle> newPseudoStyle;
+        PseudoId pseudoId = pseudoStyleCache[i]->styleType();
+        if (pseudoId == FIRST_LINE || pseudoId == FIRST_LINE_INHERITED)
+            newPseudoStyle = renderer()->uncachedFirstLineStyle(newStyle);
+        else
+            newPseudoStyle = renderer()->getUncachedPseudoStyle(pseudoId, newStyle, newStyle);
+
+        if (*newPseudoStyle != *pseudoStyleCache[i]) {
+            if (pseudoId < FIRST_INTERNAL_PSEUDOID)
+                newStyle->setHasPseudoStyle(pseudoId);
+            newStyle->addCachedPseudoStyle(newPseudoStyle);
+            return true;
+        }
+    }
+    return false;
+}
+
 void Element::recalcStyle(StyleChange change)
 {
@@ -812 +840 @@
         }
 
-        if (ch != NoChange) {
+        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle, newStyle.get())) {
             setRenderStyle(newStyle);
         } else if (needsStyleRecalc() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {

trunk/WebCore/dom/Element.h

@@ -171 +171 @@
 #endif
 
+    bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
+
     String innerText() const;
     String outerText() const;

trunk/WebCore/rendering/RenderObject.cpp

@@ -1981 +1981 @@
 }
 
+PassRefPtr<RenderStyle> RenderObject::uncachedFirstLineStyle(RenderStyle* style) const
+{
+    if (!document()->usesFirstLineRules())
+        return 0;
+
+    ASSERT(!isText());
+
+    RefPtr<RenderStyle> result;
+
+    if (isBlockFlow()) {
+        if (RenderBlock* firstLineBlock = this->firstLineBlock())
+            result = firstLineBlock->getUncachedPseudoStyle(FIRST_LINE, style, firstLineBlock == this ? style : 0);
+    } else if (!isAnonymous() && isRenderInline()) {
+        RenderStyle* parentStyle = parent()->firstLineStyle();
+        if (parentStyle != parent()->style())
+            result = getUncachedPseudoStyle(FIRST_LINE_INHERITED, parentStyle, style);
+    }
+
+    return result.release();
+}
+
 RenderStyle* RenderObject::firstLineStyleSlowCase() const
 {
@@ -2017 +2038 @@
 }
 
-PassRefPtr<RenderStyle> RenderObject::getUncachedPseudoStyle(PseudoId pseudo, RenderStyle* parentStyle) const
-{
-    if (pseudo < FIRST_INTERNAL_PSEUDOID && !style()->hasPseudoStyle(pseudo))
+PassRefPtr<RenderStyle> RenderObject::getUncachedPseudoStyle(PseudoId pseudo, RenderStyle* parentStyle, RenderStyle* ownStyle) const
+{
+    if (pseudo < FIRST_INTERNAL_PSEUDOID && !ownStyle && !style()->hasPseudoStyle(pseudo))
         return 0;
     
-    if (!parentStyle)
+    if (!parentStyle) {
+        ASSERT(!ownStyle);
         parentStyle = style();
+    }
 
     Node* n = node();

trunk/WebCore/rendering/RenderObject.h

@@ -383 +383 @@
     // any pseudo classes (and therefore has no concept of changing state).
     RenderStyle* getCachedPseudoStyle(PseudoId, RenderStyle* parentStyle = 0) const;
-    PassRefPtr<RenderStyle> getUncachedPseudoStyle(PseudoId, RenderStyle* parentStyle = 0) const;
+    PassRefPtr<RenderStyle> getUncachedPseudoStyle(PseudoId, RenderStyle* parentStyle = 0, RenderStyle* ownStyle = 0) const;
     
     virtual void updateDragState(bool dragOn);
@@ -554 +554 @@
     RenderStyle* firstLineStyle() const { return document()->usesFirstLineRules() ? firstLineStyleSlowCase() : style(); }
     RenderStyle* style(bool firstLine) const { return firstLine ? firstLineStyle() : style(); }
-    
+
+    // Used only by Element::pseudoStyleCacheIsInvalid to get a first line style based off of a
+    // given new style, without accessing the cache.
+    PassRefPtr<RenderStyle> uncachedFirstLineStyle(RenderStyle*) const;
+
     // Anonymous blocks that are part of of a continuation chain will return their inline continuation's outline style instead.
     // This is typically only relevant when repainting.

trunk/WebCore/rendering/style/RenderStyle.cpp

@@ -224 +224 @@
     m_cachedPseudoStyle = pseudo;
     return m_cachedPseudoStyle.get();
+}
+
+void RenderStyle::getPseudoStyleCache(PseudoStyleCache& cache) const
+{
+    ASSERT(cache.isEmpty());
+    for (RenderStyle* pseudoStyle = m_cachedPseudoStyle.get(); pseudoStyle; pseudoStyle = pseudoStyle->m_cachedPseudoStyle.get())
+        cache.append(pseudoStyle);
 }
 

trunk/WebCore/rendering/style/RenderStyle.h

@@ -307 +307 @@
     RenderStyle* getCachedPseudoStyle(PseudoId) const;
     RenderStyle* addCachedPseudoStyle(PassRefPtr<RenderStyle>);
+
+    typedef Vector<RenderStyle*, 10> PseudoStyleCache;
+    void getPseudoStyleCache(PseudoStyleCache&) const;
 
     bool affectedByHoverRules() const { return noninherited_flags._affectedByHover; }