Branch: refs/heads/main Home: https://github.com/WebKit/WebKit Commit: fe1e4812260edf0b2117c1f78ddecd7c3d584f86 https://github.com/WebKit/WebKit/commit/fe1e4812260edf0b2117c1f78ddecd7c3d584f86 Author: Cameron McCormack <hey...@apple.com> Date: 2024-01-22 (Mon, 22 Jan 2024)
Changed paths: M Source/WebCore/Headers.cmake M Source/WebCore/Sources.txt M Source/WebCore/WebCore.xcodeproj/project.pbxproj M Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayBox.h M Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContent.cpp M Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.cpp M Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.h M Source/WebCore/rendering/GlyphDisplayListCache.cpp M Source/WebCore/rendering/GlyphDisplayListCache.h A Source/WebCore/rendering/GlyphDisplayListCacheRemoval.cpp A Source/WebCore/rendering/GlyphDisplayListCacheRemoval.h M Source/WebCore/rendering/LegacyInlineBox.h M Source/WebCore/rendering/LegacyInlineTextBox.cpp M Source/WebCore/rendering/LegacyInlineTextBox.h M Source/WebCore/rendering/ReferencedSVGResources.cpp M Source/WebCore/rendering/TextPainter.h Log Message: ----------- Invalidate GlyphDisplayListCache entries in more places https://bugs.webkit.org/show_bug.cgi?id=267843 rdar://119833765 Reviewed by Simon Fraser. With IFC, we currently remove entries from the GlyphDisplayListCache in the InlineDisplay::Content destructor, and in some of the LayoutIntegration::InlineContent mutation methods. But we are not removing enough entries, since we use InlineDisplay::Box pointers as the GlyphDisplayListCache::m_entriesForLayoutRun keys, but we store InlineDisplay::Box objects in vectors, so they can move around in memory. This can cause us to replay the wrong display list, if we're unlucky enough to place an InlineDisplay::Box at the same address as one of the stale pointers. (This is not a security issue, since we only use the InlineDisplay::Box pointer as an opaque key, and we always hold a strong reference to the display list stored in the map.) Change to remove entries from the GlyphDisplayListCache in the destructor of InlineDisplay::Box instead. Store a bit on InlineDisplay::Box and LegacyInlineTextBox to record whether the box is present in the GlyphDisplayListCache, and only attempt to remove it if the bit is set. This avoids the overhead of hashing the pointer and looking up the GlyphDisplayListCache map in the common case of the cache not being engaged (and, for InlineDisplay::Box, if it's not a text box). (This does add an explicit destructor to InlineDisplay::Box, but the class already has a non-trivial destructor due to the CheckedPtr it stores.) * Source/WebCore/Headers.cmake: * Source/WebCore/Sources.txt: * Source/WebCore/WebCore.xcodeproj/project.pbxproj: * Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayBox.h: (WebCore::InlineDisplay::Box::setIsInGlyphDisplayListCache): (WebCore::InlineDisplay::Box::Box): (WebCore::InlineDisplay::Box::~Box): (WebCore::InlineDisplay::Box::removeFromGlyphDisplayListCache): * Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContent.cpp: (WebCore::InlineDisplay::Content::clear): (WebCore::InlineDisplay::Content::set): (WebCore::InlineDisplay::Content::remove): (WebCore::InlineDisplay::invalidateGlyphCache): Deleted. * Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.cpp: (WebCore::LayoutIntegration::InlineContent::~InlineContent): Deleted. * Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.h: * Source/WebCore/rendering/GlyphDisplayListCache.cpp: (WebCore::GlyphDisplayListCache::getDisplayList): (WebCore::GlyphDisplayListCache::get): * Source/WebCore/rendering/GlyphDisplayListCache.h: (WebCore::GlyphDisplayListCache::get): Deleted. * Source/WebCore/rendering/GlyphDisplayListCacheRemoval.cpp: Added. (WebCore::removeBoxFromGlyphDisplayListCache): * Source/WebCore/rendering/GlyphDisplayListCacheRemoval.h: Added. * Source/WebCore/rendering/LegacyInlineBox.h: (WebCore::LegacyInlineBox::isInGlyphDisplayListCache const): (WebCore::LegacyInlineBox::setIsInGlyphDisplayListCache): * Source/WebCore/rendering/LegacyInlineTextBox.cpp: (WebCore::LegacyInlineTextBox::~LegacyInlineTextBox): * Source/WebCore/rendering/LegacyInlineTextBox.h: (WebCore::LegacyInlineTextBox::removeFromGlyphDisplayListCache): * Source/WebCore/rendering/TextPainter.h: (WebCore::TextPainter::setGlyphDisplayListIfNeeded): (WebCore::TextPainter::removeGlyphDisplayList): Deleted. Canonical link: https://commits.webkit.org/273320@main _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes