Changeset 74995 in webkit

Timestamp:

Jan 4, 2011 12:46:01 PM (13 years ago)

Author:

Antti Koivisto

Message:

WebCore: Scripts should not be executed before preceding stylesheets are loaded
​https://bugs.webkit.org/show_bug.cgi?id=8852

Reviewed by Dave Hyatt.

Block inline script execution on pending stylesheet loads. This matches
other browsers and HTML5.

Tests: fast/tokenizer/inline-script-stylesheet-write.html

fast/tokenizer/inline-script-stylesheet.html

• dom/PendingScript.cpp:

(WebCore::PendingScript::releaseElementAndClear):

• dom/PendingScript.h:

(WebCore::PendingScript::PendingScript):
(WebCore::PendingScript::operator=):
(WebCore::PendingScript::startingPosition):
(WebCore::PendingScript::setStartingPosition):

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::process):

This fixes an unrelated bug with beforeload events that was exposed by the other
changes (fast/dom/beforeload/remove-link-in-beforeload-listener.html).

• html/parser/HTMLScriptRunner.cpp:

(WebCore::HTMLScriptRunner::sourceFromPendingScript):
(WebCore::HTMLScriptRunner::runScript):

LayoutTests: Scripts should not be executed before preceding stylesheets are loaded
​https://bugs.webkit.org/show_bug.cgi?id=8852

Reviewed by Dave Hyatt.

New tests plus a few test with slightly changed output due to different load serialization behavior.

• fast/tokenizer/inline-script-stylesheet-expected.txt: Added.
• fast/tokenizer/inline-script-stylesheet-write-expected.txt: Added.
• fast/tokenizer/inline-script-stylesheet-write.html: Added.
• fast/tokenizer/inline-script-stylesheet.html: Added.
• http/tests/security/mixedContent/insecure-css-in-main-frame-expected.txt:
• platform/mac/fast/repaint/renderer-destruction-by-invalidateSelection-crash-expected.txt:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/tokenizer/inline-script-stylesheet-expected.txt (added)
• LayoutTests/fast/tokenizer/inline-script-stylesheet-write-expected.txt (added)
• LayoutTests/fast/tokenizer/inline-script-stylesheet-write.html (added)
• LayoutTests/fast/tokenizer/inline-script-stylesheet.html (added)
• LayoutTests/http/tests/security/mixedContent/insecure-css-in-main-frame-expected.txt (modified) (1 diff)
• LayoutTests/platform/mac/fast/repaint/renderer-destruction-by-invalidateSelection-crash-expected.txt (modified) (1 diff)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/PendingScript.cpp (modified) (1 diff)
• WebCore/dom/PendingScript.h (modified) (4 diffs)
• WebCore/html/HTMLLinkElement.cpp (modified) (1 diff)
• WebCore/html/parser/HTMLScriptRunner.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-12-31  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Scripts should not be executed before preceding stylesheets are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=8852
+        
+        New tests plus a few test with slightly changed output due to different load serialization behavior.
+
+        * fast/tokenizer/inline-script-stylesheet-expected.txt: Added.
+        * fast/tokenizer/inline-script-stylesheet-write-expected.txt: Added.
+        * fast/tokenizer/inline-script-stylesheet-write.html: Added.
+        * fast/tokenizer/inline-script-stylesheet.html: Added.
+        * http/tests/security/mixedContent/insecure-css-in-main-frame-expected.txt:
+        * platform/mac/fast/repaint/renderer-destruction-by-invalidateSelection-crash-expected.txt:
+
 2011-01-04  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/LayoutTests/http/tests/security/mixedContent/insecure-css-in-main-frame-expected.txt

@@ -6 +6 @@
 didDisplayInsecureContent
 main frame - didFinishDocumentLoadForFrame
+main frame - didHandleOnloadEventsForFrame
+main frame - didFinishLoadForFrame
 This test opens a window that loads an insecure style sheet. We should trigger a mixed content callback because the main frame in the window is HTTPS but is displaying insecure content.

trunk/LayoutTests/platform/mac/fast/repaint/renderer-destruction-by-invalidateSelection-crash-expected.txt

@@ -12 +12 @@
         RenderText {#text} at (0,0) size 0x0
       RenderBlock {DIV} at (0,41) size 784x0
-      RenderBlock (anonymous) at (0,41) size 784x0
-        RenderText {#text} at (0,0) size 0x0
-        RenderText {#text} at (0,0) size 0x0
 layer at (13,13) size 119x13
   RenderBlock {DIV} at (3,3) size 119x13

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-12-31  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Scripts should not be executed before preceding stylesheets are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=8852
+
+        Block inline script execution on pending stylesheet loads. This matches
+        other browsers and HTML5.
+
+        Tests: fast/tokenizer/inline-script-stylesheet-write.html
+               fast/tokenizer/inline-script-stylesheet.html
+
+        * dom/PendingScript.cpp:
+        (WebCore::PendingScript::releaseElementAndClear):
+        * dom/PendingScript.h:
+        (WebCore::PendingScript::PendingScript):
+        (WebCore::PendingScript::operator=):
+        (WebCore::PendingScript::startingPosition):
+        (WebCore::PendingScript::setStartingPosition):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        
+        This fixes an unrelated bug with beforeload events that was exposed by the other
+        changes (fast/dom/beforeload/remove-link-in-beforeload-listener.html).
+        
+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::sourceFromPendingScript):
+        (WebCore::HTMLScriptRunner::runScript):
+
 2011-01-04  Xianzhu Wang  <wangxianzhu@google.com>
 

trunk/WebCore/dom/PendingScript.cpp

@@ -42 +42 @@
     setCachedScript(0);
     m_watchingForLoad = false;
+    m_startingPosition = TextPosition1::belowRangePosition();
     return m_element.release();
 }

trunk/WebCore/dom/PendingScript.h

@@ -46 +46 @@
     PendingScript()
         : m_watchingForLoad(false)
+        , m_startingPosition(TextPosition1::belowRangePosition())
     {
     }
@@ -53 +54 @@
         , m_watchingForLoad(other.m_watchingForLoad)
         , m_element(other.m_element)
+        , m_startingPosition(other.m_startingPosition)
     {
         setCachedScript(other.cachedScript());
@@ -66 +68 @@
         m_watchingForLoad = other.m_watchingForLoad;
         m_element = other.m_element;
+        m_startingPosition = other.m_startingPosition;
         setCachedScript(other.cachedScript());
 
         return *this;
     }
+
+    TextPosition1 startingPosition() const { return m_startingPosition; }
+    void setStartingPosition(const TextPosition1& position) { m_startingPosition = position; }
 
     bool watchingForLoad() const { return m_watchingForLoad; }
@@ -86 +92 @@
     bool m_watchingForLoad;
     RefPtr<Element> m_element;
-    CachedResourceHandle<CachedScript> m_cachedScript;
+    TextPosition1 m_startingPosition; // Only used for inline script tags.
+    CachedResourceHandle<CachedScript> m_cachedScript; 
 };
 

trunk/WebCore/html/HTMLLinkElement.cpp

@@ -238 +238 @@
         }
 
+        RefPtr<Document> originalDocument = document();
         if (!dispatchBeforeLoadEvent(m_url))
             return;
-        
+        // A beforeload handler might have removed us from the document or changed the document.
+        if (!inDocument() || document() != originalDocument)
+            return;
+
         m_loading = true;
 

trunk/WebCore/html/parser/HTMLScriptRunner.cpp

@@ -100 +100 @@
     }
     errorOccurred = false;
-    return ScriptSourceCode(script.element()->textContent(), documentURLForScriptExecution(m_document));
+    return ScriptSourceCode(script.element()->textContent(), documentURLForScriptExecution(m_document), script.startingPosition());
 }
 
@@ -304 +304 @@
             else
                 requestParsingBlockingScript(script);
+        } else if (!m_document->haveStylesheetsLoaded() && m_scriptNestingLevel == 1) {
+            // Block inline script execution on stylesheet load, unless we are in document.write().
+            // The latter case can only happen if a script both triggers a stylesheet load
+            // and writes an inline script. Since write is blocking we have to execute the
+            // written script immediately, ignoring the pending sheets.
+            m_parsingBlockingScript.adoptElement(script);
+            m_parsingBlockingScript.setStartingPosition(scriptStartPosition);
         } else {
-            // FIXME: We do not block inline <script> tags on stylesheets to match the
-            // old parser for now.  When we do, the ASSERT below should be added.
-            // See https://bugs.webkit.org/show_bug.cgi?id=40047
-            // ASSERT(document()->haveStylesheetsLoaded());
             ASSERT(isExecutingScript());
             ScriptSourceCode sourceCode(script->textContent(), documentURLForScriptExecution(m_document), scriptStartPosition);