Changeset 212737 in webkit

Timestamp:

Feb 21, 2017 12:06:48 PM (7 years ago)

Author:

Antti Koivisto

Message:

REGRESSION(r207669): Crash after mutating selector text
​https://bugs.webkit.org/show_bug.cgi?id=168655
<rdar://problem/30632111>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: fast/css/selector-text-mutation-crash.html

• style/StyleScope.cpp:

(WebCore::Style::Scope::scheduleUpdate):

Clear the style resolver immediately if style sheet content changes. The resolver may
have data structures that point to the old sheet contents.

The resolver would get wiped anyway when the scheduled update actually occurs.

LayoutTests:

• fast/css/selector-text-mutation-crash-expected.txt: Added.
• fast/css/selector-text-mutation-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/selector-text-mutation-crash-expected.txt (added)
• LayoutTests/fast/css/selector-text-mutation-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/style/StyleScope.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-02-21  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION(r207669): Crash after mutating selector text
+        https://bugs.webkit.org/show_bug.cgi?id=168655
+        <rdar://problem/30632111>
+
+        Reviewed by Brent Fulgham.
+
+        * fast/css/selector-text-mutation-crash-expected.txt: Added.
+        * fast/css/selector-text-mutation-crash.html: Added.
+
 2017-02-21  Jiewen Tan  <jiewen_tan@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-02-21  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION(r207669): Crash after mutating selector text
+        https://bugs.webkit.org/show_bug.cgi?id=168655
+        <rdar://problem/30632111>
+
+        Reviewed by Brent Fulgham.
+
+        Test: fast/css/selector-text-mutation-crash.html
+
+        * style/StyleScope.cpp:
+        (WebCore::Style::Scope::scheduleUpdate):
+
+        Clear the style resolver immediately if style sheet content changes. The resolver may
+        have data structures that point to the old sheet contents.
+
+        The resolver would get wiped anyway when the scheduled update actually occurs.
+
 2017-02-21  Jiewen Tan  <jiewen_tan@apple.com>
 

trunk/Source/WebCore/style/StyleScope.cpp

@@ -522 +522 @@
 void Scope::scheduleUpdate(UpdateType update)
 {
+    if (update == UpdateType::ContentsOrInterpretation)
+        clearResolver();
+
     if (!m_pendingUpdate || *m_pendingUpdate < update) {
         m_pendingUpdate = update;