Changeset 148965 in webkit

Timestamp:

Apr 23, 2013 7:55:17 AM (11 years ago)

Author:

akling@apple.com

Message:

Clear StyleResolver state before returning from styleForElement().
<​http://webkit.org/b/115035>

Reviewed by Antti Koivisto.

From Blink r148687 by <​inferno@chromium.org>.

Source/WebCore:

A cached element pointer in the resolver state was causing confusion because
in some cases a subsequent call to styleForElement() would use a pointer to
a different object that is at the same memory address as the previous one.

Test: fast/css/reload-non-styled-element-crash.html

• css/StyleResolver.cpp:

(WebCore::StyleResolver::styleForElement):

LayoutTests:

• fast/css/reload-non-styled-element-crash-expected.txt: Added.
• fast/css/reload-non-styled-element-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/reload-non-styled-element-crash-expected.txt (added)
• LayoutTests/fast/css/reload-non-styled-element-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/StyleResolver.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-04-23  Andreas Kling  <akling@apple.com>
+
+        Clear StyleResolver state before returning from styleForElement().
+        <http://webkit.org/b/115035>
+
+        Reviewed by Antti Koivisto.
+
+        From Blink r148687 by <inferno@chromium.org>.
+
+        * fast/css/reload-non-styled-element-crash-expected.txt: Added.
+        * fast/css/reload-non-styled-element-crash.html: Added.
+
 2013-04-23  Allan Sandfeld Jensen  <allan.jensen@digia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-04-23  Andreas Kling  <akling@apple.com>
+
+        Clear StyleResolver state before returning from styleForElement().
+        <http://webkit.org/b/115035>
+
+        Reviewed by Antti Koivisto.
+
+        From Blink r148687 by <inferno@chromium.org>.
+
+        A cached element pointer in the resolver state was causing confusion because
+        in some cases a subsequent call to styleForElement() would use a pointer to
+        a different object that is at the same memory address as the previous one.
+
+        Test: fast/css/reload-non-styled-element-crash.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::styleForElement):
+
 2013-04-23  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebCore/css/StyleResolver.cpp

@@ -972 +972 @@
     if (sharingBehavior == AllowStyleSharing && !state.distributedToInsertionPoint()) {
         RenderStyle* sharedStyle = locateSharedStyle();
-        if (sharedStyle)
+        if (sharedStyle) {
+            state.clear();
             return sharedStyle;
+        }
     }