Diff
Modified: branches/safari-612.1.5-branch/Source/WebCore/ChangeLog (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/ChangeLog 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/ChangeLog 2021-03-05 19:51:26 UTC (rev 273991)
@@ -1,5 +1,94 @@
2021-03-05 Ruben Turcios <[email protected]>
+ Cherry-pick r273935. rdar://problem/75101642
+
+ "precustomized" state of custom elements can become HTMLUnknownElement
+ https://bugs.webkit.org/show_bug.cgi?id=221652
+
+ Reviewed by Darin Adler.
+
+ The bug was caused by createJSHTMLWrapper in JSHTMLElementWrapperFactory.cpp relying on
+ !isCustomElementUpgradeCandidate() to create HTMLUnknownElement as JS wrapper of the element.
+
+ This is problematic after r266269 since that change re-purposes CustomElementState::Failed
+ on a custom element as "precustomized" state instead of introducing another enum value in
+ CustomElementState as RareDataBitFields has no more bits available.
+
+ This patch fixes the problem by introducing a new NodeFlag::IsUnknownElement and using that
+ to check whether JSHTMLUnknownElement should be created for a given element or not. Note that
+ HTMLElement had a virtual function, isHTMLUnknownElement, to check this condition but invoking
+ a virtual function proved to incur too much runtime cost.
+
+ * dom/Node.h:
+ (WebCore::Node::isUnknownElement const): Added.
+ (WebCore::Node::isHTMLUnknownElement const): Added.
+ (WebCore::Node::isSVGUnknownElement const): Added.
+ (WebCore::Node::isMathMLUnknownElement const): Added.
+ (WebCore::Node::NodeFlag): Added NodeFlag::IsUnknownElement.
+ * dom/make_names.pl:
+ (printWrapperFactoryCppFile): Treat the element as HTMLUnknownElement only if isUnknownElement
+ returns true instead of isCustomElementUpgradeCandidate returning false.
+ * html/HTMLElement.h:
+ (WebCore::HTMLElement::isHTMLUnknownElement const): Deleted.
+ * html/HTMLUnknownElement.h:
+ * mathml/MathMLElement.cpp:
+ (WebCore::MathMLElement::MathMLElement): Added ConstructionType as an argument.
+ * mathml/MathMLElement.h:
+ * mathml/MathMLUnknownElement.h:
+ (WebCore::MathMLUnknownElement::MathMLUnknownElement): Set NodeFlag::IsUnknownElement.
+ * svg/SVGElement.cpp:
+ (WebCore::SVGElement::SVGElement): Added ConstructionType as an argument.
+ * svg/SVGElement.h:
+ * svg/SVGUnknownElement.h:
+ (WebCore::SVGUnknownElement::SVGUnknownElement): Set NodeFlag::IsUnknownElement.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@273935 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-03-04 Ryosuke Niwa <[email protected]>
+
+ "precustomized" state of custom elements can become HTMLUnknownElement
+ https://bugs.webkit.org/show_bug.cgi?id=221652
+
+ Reviewed by Darin Adler.
+
+ The bug was caused by createJSHTMLWrapper in JSHTMLElementWrapperFactory.cpp relying on
+ !isCustomElementUpgradeCandidate() to create HTMLUnknownElement as JS wrapper of the element.
+
+ This is problematic after r266269 since that change re-purposes CustomElementState::Failed
+ on a custom element as "precustomized" state instead of introducing another enum value in
+ CustomElementState as RareDataBitFields has no more bits available.
+
+ This patch fixes the problem by introducing a new NodeFlag::IsUnknownElement and using that
+ to check whether JSHTMLUnknownElement should be created for a given element or not. Note that
+ HTMLElement had a virtual function, isHTMLUnknownElement, to check this condition but invoking
+ a virtual function proved to incur too much runtime cost.
+
+ * dom/Node.h:
+ (WebCore::Node::isUnknownElement const): Added.
+ (WebCore::Node::isHTMLUnknownElement const): Added.
+ (WebCore::Node::isSVGUnknownElement const): Added.
+ (WebCore::Node::isMathMLUnknownElement const): Added.
+ (WebCore::Node::NodeFlag): Added NodeFlag::IsUnknownElement.
+ * dom/make_names.pl:
+ (printWrapperFactoryCppFile): Treat the element as HTMLUnknownElement only if isUnknownElement
+ returns true instead of isCustomElementUpgradeCandidate returning false.
+ * html/HTMLElement.h:
+ (WebCore::HTMLElement::isHTMLUnknownElement const): Deleted.
+ * html/HTMLUnknownElement.h:
+ * mathml/MathMLElement.cpp:
+ (WebCore::MathMLElement::MathMLElement): Added ConstructionType as an argument.
+ * mathml/MathMLElement.h:
+ * mathml/MathMLUnknownElement.h:
+ (WebCore::MathMLUnknownElement::MathMLUnknownElement): Set NodeFlag::IsUnknownElement.
+ * svg/SVGElement.cpp:
+ (WebCore::SVGElement::SVGElement): Added ConstructionType as an argument.
+ * svg/SVGElement.h:
+ * svg/SVGUnknownElement.h:
+ (WebCore::SVGUnknownElement::SVGUnknownElement): Set NodeFlag::IsUnknownElement.
+
+2021-03-05 Ruben Turcios <[email protected]>
+
Cherry-pick r273498. rdar://problem/75101801
[iOS] Crash when playing Dolby Atmos audio tracks with AVAudioTimePitchAlgorithmTimeDomain
Modified: branches/safari-612.1.5-branch/Source/WebCore/dom/Node.h (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/dom/Node.h 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/dom/Node.h 2021-03-05 19:51:26 UTC (rev 273991)
@@ -193,6 +193,11 @@
bool isSVGElement() const { return hasNodeFlag(NodeFlag::IsSVGElement); }
bool isMathMLElement() const { return hasNodeFlag(NodeFlag::IsMathMLElement); }
+ bool isUnknownElement() const { return hasNodeFlag(NodeFlag::IsUnknownElement); }
+ bool isHTMLUnknownElement() const { return isHTMLElement() && isUnknownElement(); }
+ bool isSVGUnknownElement() const { return isSVGElement() && isUnknownElement(); }
+ bool isMathMLUnknownElement() const { return isMathMLElement() && isUnknownElement(); }
+
bool isPseudoElement() const { return pseudoId() != PseudoId::None; }
bool isBeforePseudoElement() const { return pseudoId() == PseudoId::Before; }
bool isAfterPseudoElement() const { return pseudoId() == PseudoId::After; }
@@ -526,8 +531,8 @@
IsShadowRoot = 1 << 9,
IsConnected = 1 << 10,
IsInShadowTree = 1 << 11,
- HasEventTargetData = 1 << 12,
- // UnusedFlag = 1 << 13,
+ IsUnknownElement = 1 << 12,
+ HasEventTargetData = 1 << 13,
// These bits are used by derived classes, pulled up here so they can
// be stored in the same memory word as the Node bits above.
Modified: branches/safari-612.1.5-branch/Source/WebCore/dom/make_names.pl (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/dom/make_names.pl 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/dom/make_names.pl 2021-03-05 19:51:26 UTC (rev 273991)
@@ -1277,12 +1277,19 @@
if ($parameters{customElementInterfaceName}) {
print F <<END
- if (element->isCustomElementUpgradeCandidate())
+ if (!element->isUnknownElement())
return createWrapper<$parameters{customElementInterfaceName}>(globalObject, WTFMove(element));
END
;
}
+ if ("$parameters{namespace}Element" eq $parameters{fallbackJSInterfaceName}) {
+ print F <<END
+ ASSERT(element->is$parameters{fallbackJSInterfaceName}());
+END
+;
+ }
+
print F <<END
return createWrapper<$parameters{fallbackJSInterfaceName}>(globalObject, WTFMove(element));
}
Modified: branches/safari-612.1.5-branch/Source/WebCore/html/HTMLElement.h (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/html/HTMLElement.h 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/html/HTMLElement.h 2021-03-05 19:51:26 UTC (rev 273991)
@@ -86,7 +86,6 @@
bool hasDirectionAuto() const;
TextDirection directionalityIfhasDirAutoAttribute(bool& isAuto) const;
- virtual bool isHTMLUnknownElement() const { return false; }
virtual bool isTextControlInnerTextElement() const { return false; }
bool willRespondToMouseMoveEvents() override;
Modified: branches/safari-612.1.5-branch/Source/WebCore/html/HTMLUnknownElement.h (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/html/HTMLUnknownElement.h 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/html/HTMLUnknownElement.h 2021-03-05 19:51:26 UTC (rev 273991)
@@ -43,11 +43,9 @@
private:
HTMLUnknownElement(const QualifiedName& tagName, Document& document)
- : HTMLElement(tagName, document, CreateHTMLElement)
+ : HTMLElement(tagName, document, CreateHTMLElement | NodeFlag::IsUnknownElement)
{
}
-
- bool isHTMLUnknownElement() const final { return true; }
};
} // namespace WebCore
Modified: branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLElement.cpp (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLElement.cpp 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLElement.cpp 2021-03-05 19:51:26 UTC (rev 273991)
@@ -50,8 +50,8 @@
using namespace MathMLNames;
-MathMLElement::MathMLElement(const QualifiedName& tagName, Document& document)
- : StyledElement(tagName, document, CreateMathMLElement)
+MathMLElement::MathMLElement(const QualifiedName& tagName, Document& document, ConstructionType constructionType)
+ : StyledElement(tagName, document, constructionType)
{
}
Modified: branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLElement.h (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLElement.h 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLElement.h 2021-03-05 19:51:26 UTC (rev 273991)
@@ -90,7 +90,7 @@
virtual void updateSelectedChild() { }
protected:
- MathMLElement(const QualifiedName& tagName, Document&);
+ MathMLElement(const QualifiedName& tagName, Document&, ConstructionType = CreateMathMLElement);
void parseAttribute(const QualifiedName&, const AtomString&) override;
bool childShouldCreateRenderer(const Node&) const override;
Modified: branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLUnknownElement.h (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLUnknownElement.h 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/mathml/MathMLUnknownElement.h 2021-03-05 19:51:26 UTC (rev 273991)
@@ -41,7 +41,7 @@
private:
MathMLUnknownElement(const QualifiedName& tagName, Document& document)
- : MathMLElement(tagName, document)
+ : MathMLElement(tagName, document, CreateMathMLElement | NodeFlag::IsUnknownElement)
{
}
Modified: branches/safari-612.1.5-branch/Source/WebCore/svg/SVGElement.cpp (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/svg/SVGElement.cpp 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/svg/SVGElement.cpp 2021-03-05 19:51:26 UTC (rev 273991)
@@ -155,8 +155,8 @@
return map;
}
-SVGElement::SVGElement(const QualifiedName& tagName, Document& document)
- : StyledElement(tagName, document, CreateSVGElement)
+SVGElement::SVGElement(const QualifiedName& tagName, Document& document, ConstructionType constructionType)
+ : StyledElement(tagName, document, constructionType)
, m_propertyAnimatorFactory(makeUnique<SVGPropertyAnimatorFactory>())
{
static std::once_flag onceFlag;
Modified: branches/safari-612.1.5-branch/Source/WebCore/svg/SVGElement.h (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/svg/SVGElement.h 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/svg/SVGElement.h 2021-03-05 19:51:26 UTC (rev 273991)
@@ -147,7 +147,7 @@
SVGAnimatedString& classNameAnimated() { return m_className; }
protected:
- SVGElement(const QualifiedName&, Document&);
+ SVGElement(const QualifiedName&, Document&, ConstructionType = CreateSVGElement);
virtual ~SVGElement();
bool rendererIsNeeded(const RenderStyle&) override;
Modified: branches/safari-612.1.5-branch/Source/WebCore/svg/SVGUnknownElement.h (273990 => 273991)
--- branches/safari-612.1.5-branch/Source/WebCore/svg/SVGUnknownElement.h 2021-03-05 19:51:22 UTC (rev 273990)
+++ branches/safari-612.1.5-branch/Source/WebCore/svg/SVGUnknownElement.h 2021-03-05 19:51:26 UTC (rev 273991)
@@ -45,7 +45,7 @@
private:
SVGUnknownElement(const QualifiedName& tagName, Document& document)
- : SVGElement(tagName, document)
+ : SVGElement(tagName, document, CreateSVGElement | NodeFlag::IsUnknownElement)
{
}
