Diff
Modified: branches/safari-613-branch/LayoutTests/ChangeLog (295307 => 295308)
--- branches/safari-613-branch/LayoutTests/ChangeLog 2022-06-07 00:35:49 UTC (rev 295307)
+++ branches/safari-613-branch/LayoutTests/ChangeLog 2022-06-07 00:35:54 UTC (rev 295308)
@@ -1,3 +1,14 @@
+2022-05-03 Antti Koivisto <an...@apple.com>
+
+ [CSS Cascade Layers] Endless recursion with revert-layer in other tree context
+ https://bugs.webkit.org/show_bug.cgi?id=239967
+ <rdar://92449950>
+
+ Reviewed by Alan Bujtas.
+
+ * fast/css/revert-layer-tree-context-stack-overflow-expected.html: Added.
+ * fast/css/revert-layer-tree-context-stack-overflow.html: Added.
+
2022-03-15 Gabriel Nava Marino <gnavamar...@apple.com>
Crash in KeyframeList.cpp:183 in WebCore::KeyframeList::fillImplicitKeyframes
Added: branches/safari-613-branch/LayoutTests/fast/css/revert-layer-tree-context-stack-overflow-expected.html (0 => 295308)
--- branches/safari-613-branch/LayoutTests/fast/css/revert-layer-tree-context-stack-overflow-expected.html (rev 0)
+++ branches/safari-613-branch/LayoutTests/fast/css/revert-layer-tree-context-stack-overflow-expected.html 2022-06-07 00:35:54 UTC (rev 295308)
@@ -0,0 +1 @@
+<input placeholder="a">
Added: branches/safari-613-branch/LayoutTests/fast/css/revert-layer-tree-context-stack-overflow.html (0 => 295308)
--- branches/safari-613-branch/LayoutTests/fast/css/revert-layer-tree-context-stack-overflow.html (rev 0)
+++ branches/safari-613-branch/LayoutTests/fast/css/revert-layer-tree-context-stack-overflow.html 2022-06-07 00:35:54 UTC (rev 295308)
@@ -0,0 +1,6 @@
+<style>
+ ::-webkit-input-placeholder {
+ display: revert-layer;
+ }
+</style>
+<input placeholder="a">
Modified: branches/safari-613-branch/Source/WebCore/ChangeLog (295307 => 295308)
--- branches/safari-613-branch/Source/WebCore/ChangeLog 2022-06-07 00:35:49 UTC (rev 295307)
+++ branches/safari-613-branch/Source/WebCore/ChangeLog 2022-06-07 00:35:54 UTC (rev 295308)
@@ -1,3 +1,38 @@
+2022-05-03 Antti Koivisto <an...@apple.com>
+
+ [CSS Cascade Layers] Endless recursion with revert-layer in other tree context
+ https://bugs.webkit.org/show_bug.cgi?id=239967
+ <rdar://92449950>
+
+ Reviewed by Alan Bujtas.
+
+ We should only revert within a tree context (scope).
+
+ Adding more comprehensive WPTs separately.
+
+ Test: fast/css/revert-layer-tree-context-stack-overflow.html
+
+ * style/PropertyCascade.cpp:
+ (WebCore::Style::PropertyCascade::PropertyCascade):
+
+ Pass the property tree scope to the rollback cascade.
+
+ (WebCore::Style::PropertyCascade::addMatch):
+
+ Don't include properties from lower priority tree scopes to rollback cascade.
+ Reverse the logic for clarity.
+
+ * style/PropertyCascade.h:
+ (WebCore::Style::PropertyCascade::PropertyCascade):
+ * style/StyleBuilder.cpp:
+ (WebCore::Style::Builder::ensureRollbackCascadeForRevert):
+ (WebCore::Style::Builder::ensureRollbackCascadeForRevertLayer):
+ (WebCore::Style::Builder::makeRollbackCascadeKey):
+
+ Include tree scope to the key.
+
+ * style/StyleBuilder.h:
+
2022-04-22 Brandon Stewart <brandonstew...@apple.com>
Store StyleScope during CSSStyleSheet Creation
Modified: branches/safari-613-branch/Source/WebCore/style/PropertyCascade.cpp (295307 => 295308)
--- branches/safari-613-branch/Source/WebCore/style/PropertyCascade.cpp 2022-06-07 00:35:49 UTC (rev 295307)
+++ branches/safari-613-branch/Source/WebCore/style/PropertyCascade.cpp 2022-06-07 00:35:54 UTC (rev 295308)
@@ -81,10 +81,11 @@
buildCascade();
}
-PropertyCascade::PropertyCascade(const PropertyCascade& parent, CascadeLevel maximumCascadeLevel, std::optional<CascadeLayerPriority> maximumCascadeLayerPriorityForRollback)
+PropertyCascade::PropertyCascade(const PropertyCascade& parent, CascadeLevel maximumCascadeLevel, std::optional<ScopeOrdinal> rollbackScope, std::optional<CascadeLayerPriority> maximumCascadeLayerPriorityForRollback)
: m_matchResult(parent.m_matchResult)
, m_includedProperties(parent.m_includedProperties)
, m_maximumCascadeLevel(maximumCascadeLevel)
+ , m_rollbackScope(rollbackScope)
, m_maximumCascadeLayerPriorityForRollback(maximumCascadeLayerPriorityForRollback)
, m_direction(parent.direction())
, m_directionIsUnresolved(false)
@@ -179,18 +180,16 @@
bool PropertyCascade::addMatch(const MatchedProperties& matchedProperties, CascadeLevel cascadeLevel, bool important)
{
- auto skipForRollback = [&] {
- if (!m_maximumCascadeLayerPriorityForRollback)
- return false;
- if (matchedProperties.styleScopeOrdinal != ScopeOrdinal::Element)
- return false;
+ auto includePropertiesForRollback = [&] {
+ if (m_rollbackScope && matchedProperties.styleScopeOrdinal > *m_rollbackScope)
+ return true;
if (cascadeLevel < m_maximumCascadeLevel)
+ return true;
+ if (matchedProperties.fromStyleAttribute == FromStyleAttribute::Yes)
return false;
- if (matchedProperties.fromStyleAttribute == FromStyleAttribute::Yes)
- return true;
- return matchedProperties.cascadeLayerPriority > *m_maximumCascadeLayerPriorityForRollback;
+ return matchedProperties.cascadeLayerPriority <= *m_maximumCascadeLayerPriorityForRollback;
};
- if (skipForRollback())
+ if (m_maximumCascadeLayerPriorityForRollback && !includePropertiesForRollback())
return false;
auto& styleProperties = *matchedProperties.properties;
Modified: branches/safari-613-branch/Source/WebCore/style/PropertyCascade.h (295307 => 295308)
--- branches/safari-613-branch/Source/WebCore/style/PropertyCascade.h 2022-06-07 00:35:49 UTC (rev 295307)
+++ branches/safari-613-branch/Source/WebCore/style/PropertyCascade.h 2022-06-07 00:35:54 UTC (rev 295308)
@@ -46,7 +46,7 @@
};
PropertyCascade(const MatchResult&, CascadeLevel, IncludedProperties, Direction);
- PropertyCascade(const PropertyCascade&, CascadeLevel, std::optional<CascadeLayerPriority> maximumCascadeLayerPriorityForRollback = { });
+ PropertyCascade(const PropertyCascade&, CascadeLevel, std::optional<ScopeOrdinal> rollbackScope = { }, std::optional<CascadeLayerPriority> maximumCascadeLayerPriorityForRollback = { });
~PropertyCascade();
@@ -85,6 +85,7 @@
const MatchResult& m_matchResult;
const IncludedProperties m_includedProperties;
const CascadeLevel m_maximumCascadeLevel;
+ const std::optional<ScopeOrdinal> m_rollbackScope;
const std::optional<CascadeLayerPriority> m_maximumCascadeLayerPriorityForRollback;
mutable Direction m_direction;
mutable bool m_directionIsUnresolved { true };
Modified: branches/safari-613-branch/Source/WebCore/style/StyleBuilder.cpp (295307 => 295308)
--- branches/safari-613-branch/Source/WebCore/style/StyleBuilder.cpp 2022-06-07 00:35:49 UTC (rev 295307)
+++ branches/safari-613-branch/Source/WebCore/style/StyleBuilder.cpp 2022-06-07 00:35:54 UTC (rev 295308)
@@ -383,7 +383,7 @@
--rollbackCascadeLevel;
- auto key = makeRollbackCascadeKey(rollbackCascadeLevel, 0);
+ auto key = makeRollbackCascadeKey(rollbackCascadeLevel);
return m_rollbackCascades.ensure(key, [&] {
return makeUnique<const PropertyCascade>(m_cascade, rollbackCascadeLevel);
}).iterator->value.get();
@@ -402,15 +402,15 @@
if (property.fromStyleAttribute == FromStyleAttribute::No)
--rollbackLayerPriority;
- auto key = makeRollbackCascadeKey(property.cascadeLevel, rollbackLayerPriority);
+ auto key = makeRollbackCascadeKey(property.cascadeLevel, property.styleScopeOrdinal, rollbackLayerPriority);
return m_rollbackCascades.ensure(key, [&] {
- return makeUnique<const PropertyCascade>(m_cascade, property.cascadeLevel, rollbackLayerPriority);
+ return makeUnique<const PropertyCascade>(m_cascade, property.cascadeLevel, property.styleScopeOrdinal, rollbackLayerPriority);
}).iterator->value.get();
}
-auto Builder::makeRollbackCascadeKey(CascadeLevel cascadeLevel, CascadeLayerPriority cascadeLayerPriority) -> RollbackCascadeKey
+auto Builder::makeRollbackCascadeKey(CascadeLevel cascadeLevel, ScopeOrdinal scopeOrdinal, CascadeLayerPriority cascadeLayerPriority) -> RollbackCascadeKey
{
- return { static_cast<unsigned>(cascadeLevel), static_cast<unsigned>(cascadeLayerPriority) };
+ return { static_cast<unsigned>(cascadeLevel), static_cast<unsigned>(scopeOrdinal), static_cast<unsigned>(cascadeLayerPriority) };
}
}
Modified: branches/safari-613-branch/Source/WebCore/style/StyleBuilder.h (295307 => 295308)
--- branches/safari-613-branch/Source/WebCore/style/StyleBuilder.h 2022-06-07 00:35:49 UTC (rev 295307)
+++ branches/safari-613-branch/Source/WebCore/style/StyleBuilder.h 2022-06-07 00:35:54 UTC (rev 295308)
@@ -65,8 +65,8 @@
const PropertyCascade* ensureRollbackCascadeForRevert();
const PropertyCascade* ensureRollbackCascadeForRevertLayer();
- using RollbackCascadeKey = std::pair<unsigned, unsigned>;
- RollbackCascadeKey makeRollbackCascadeKey(CascadeLevel, CascadeLayerPriority);
+ using RollbackCascadeKey = std::tuple<unsigned, unsigned, unsigned>;
+ RollbackCascadeKey makeRollbackCascadeKey(CascadeLevel, ScopeOrdinal = ScopeOrdinal::Element, CascadeLayerPriority = 0);
const PropertyCascade m_cascade;
// Rollback cascades are build on demand to resolve 'revert' and 'revert-layer' keywords.
