Title: [255792] releases/WebKitGTK/webkit-2.28
- Revision
- 255792
- Author
- [email protected]
- Date
- 2020-02-05 02:49:53 -0800 (Wed, 05 Feb 2020)
Log Message
Merge r255671 - CSS Rules with the same selector from several large stylesheets are applied in the wrong order
https://bugs.webkit.org/show_bug.cgi?id=204687
<rdar://problem/57522566>
Reviewed by Zalan Bujtas.
Source/WebCore:
Original test by Anton Khlynovskiy.
Test: fast/css/many-rules.html
* style/RuleData.h:
We overflow the 18 bit m_position field with > 256k CSS rules, confusing the rule order.
Since we have unused bits it costs nothing to increase the field size to 22 bits.
4M rules should be enough for anybody.
LayoutTests:
* TestExpectations:
* fast/css/many-rules-expected.html: Added.
* fast/css/many-rules.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.28/LayoutTests/ChangeLog (255791 => 255792)
--- releases/WebKitGTK/webkit-2.28/LayoutTests/ChangeLog 2020-02-05 10:49:45 UTC (rev 255791)
+++ releases/WebKitGTK/webkit-2.28/LayoutTests/ChangeLog 2020-02-05 10:49:53 UTC (rev 255792)
@@ -1,3 +1,15 @@
+2020-02-04 Antti Koivisto <[email protected]>
+
+ CSS Rules with the same selector from several large stylesheets are applied in the wrong order
+ https://bugs.webkit.org/show_bug.cgi?id=204687
+ <rdar://problem/57522566>
+
+ Reviewed by Zalan Bujtas.
+
+ * TestExpectations:
+ * fast/css/many-rules-expected.html: Added.
+ * fast/css/many-rules.html: Added.
+
2020-02-04 youenn fablet <[email protected]>
MediaDevices should handle changes of iframe allow attribute value
Modified: releases/WebKitGTK/webkit-2.28/LayoutTests/TestExpectations (255791 => 255792)
--- releases/WebKitGTK/webkit-2.28/LayoutTests/TestExpectations 2020-02-05 10:49:45 UTC (rev 255791)
+++ releases/WebKitGTK/webkit-2.28/LayoutTests/TestExpectations 2020-02-05 10:49:53 UTC (rev 255792)
@@ -870,6 +870,9 @@
# This test will run slowly in debug mode, but is plenty fast in release.
[ Debug ] js/slow-stress/emscripten-memops.html [ Skip ]
+# This test is somewhat heavy and better skipped for debug
+[ Debug ] fast/css/many-rules.html [ Skip ]
+
webkit.org/b/112521 [ Release ] webaudio/_javascript_audionode.html [ Pass Failure ]
webkit.org/b/112521 [ Debug ] webaudio/_javascript_audionode.html [ Skip ]
webkit.org/b/112521 [ Release ] webaudio/_javascript_audionode-upmix2-8channel-input.html [ Pass Failure ]
@@ -3497,4 +3500,4 @@
webkit.org/b/206578 [ Debug ] imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-image-width-interpolation.html [ Crash ]
webkit.org/b/206579 [ Debug ] imported/w3c/web-platform-tests/css/css-backgrounds/background-size/vector/zero-height-ratio-auto-5px.html [ Crash ]
-webkit.org/b/206579 [ Debug ] imported/w3c/web-platform-tests/css/css-backgrounds/background-size/vector/zero-width-ratio-auto-5px.html [ Crash ]
\ No newline at end of file
+webkit.org/b/206579 [ Debug ] imported/w3c/web-platform-tests/css/css-backgrounds/background-size/vector/zero-width-ratio-auto-5px.html [ Crash ]
Added: releases/WebKitGTK/webkit-2.28/LayoutTests/fast/css/many-rules-expected.html (0 => 255792)
--- releases/WebKitGTK/webkit-2.28/LayoutTests/fast/css/many-rules-expected.html (rev 0)
+++ releases/WebKitGTK/webkit-2.28/LayoutTests/fast/css/many-rules-expected.html 2020-02-05 10:49:53 UTC (rev 255792)
@@ -0,0 +1,2 @@
+<div>Expecting match from sheet 20</div>
+<div>Matched rule from sheet 20</div>
Added: releases/WebKitGTK/webkit-2.28/LayoutTests/fast/css/many-rules.html (0 => 255792)
--- releases/WebKitGTK/webkit-2.28/LayoutTests/fast/css/many-rules.html (rev 0)
+++ releases/WebKitGTK/webkit-2.28/LayoutTests/fast/css/many-rules.html 2020-02-05 10:49:53 UTC (rev 255792)
@@ -0,0 +1,23 @@
+<body>
+<div id=info></div>
+<div id=test></div>
+<script>
+function makeSheet(index) {
+ let sheet;
+ sheet = `#test:after { content: "Matched rule from sheet ${index}" }`;
+ for (let i = 1; i < 32768; ++i)
+ sheet += ".dummy-rule { color: red }";
+ return sheet;
+}
+function makeSheets(count) {
+ for (let i = 0; i < count; ++i) {
+ const style = document.createElement("style");
+ style.textContent = makeSheet(i + 1);
+ document.head.appendChild(style);
+ }
+
+ info.textContent = `Expecting match from sheet ${count}`;
+}
+makeSheets(20);
+</script>
+</body>
Modified: releases/WebKitGTK/webkit-2.28/Source/WebCore/ChangeLog (255791 => 255792)
--- releases/WebKitGTK/webkit-2.28/Source/WebCore/ChangeLog 2020-02-05 10:49:45 UTC (rev 255791)
+++ releases/WebKitGTK/webkit-2.28/Source/WebCore/ChangeLog 2020-02-05 10:49:53 UTC (rev 255792)
@@ -1,3 +1,22 @@
+2020-02-04 Antti Koivisto <[email protected]>
+
+ CSS Rules with the same selector from several large stylesheets are applied in the wrong order
+ https://bugs.webkit.org/show_bug.cgi?id=204687
+ <rdar://problem/57522566>
+
+ Reviewed by Zalan Bujtas.
+
+ Original test by Anton Khlynovskiy.
+
+ Test: fast/css/many-rules.html
+
+ * style/RuleData.h:
+
+ We overflow the 18 bit m_position field with > 256k CSS rules, confusing the rule order.
+ Since we have unused bits it costs nothing to increase the field size to 22 bits.
+
+ 4M rules should be enough for anybody.
+
2020-02-04 youenn fablet <[email protected]>
MediaDevices should handle changes of iframe allow attribute value
Modified: releases/WebKitGTK/webkit-2.28/Source/WebCore/style/RuleData.h (255791 => 255792)
--- releases/WebKitGTK/webkit-2.28/Source/WebCore/style/RuleData.h 2020-02-05 10:49:45 UTC (rev 255791)
+++ releases/WebKitGTK/webkit-2.28/Source/WebCore/style/RuleData.h 2020-02-05 10:49:53 UTC (rev 255792)
@@ -78,9 +78,8 @@
// Keep in sync with RuleFeature's selectorIndex and selectorListIndex size.
unsigned m_selectorIndex : 16;
unsigned m_selectorListIndex : 16;
- // This number was picked fairly arbitrarily. We can probably lower it if we need to.
- // Some simple testing showed <100,000 RuleData's on large sites.
- unsigned m_position : 18;
+ // If we have more rules than 2^bitcount here we'll get confused about rule order.
+ unsigned m_position : 22;
unsigned m_matchBasedOnRuleHash : 3;
unsigned m_canMatchPseudoElement : 1;
unsigned m_containsUncommonAttributeSelector : 1;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
