Title: [148965] trunk
- Revision
- 148965
- Author
- [email protected]
- Date
- 2013-04-23 07:55:17 -0700 (Tue, 23 Apr 2013)
Log Message
Clear StyleResolver state before returning from styleForElement().
<http://webkit.org/b/115035>
Reviewed by Antti Koivisto.
>From Blink r148687 by <[email protected]>.
Source/WebCore:
A cached element pointer in the resolver state was causing confusion because
in some cases a subsequent call to styleForElement() would use a pointer to
a different object that is at the same memory address as the previous one.
Test: fast/css/reload-non-styled-element-crash.html
* css/StyleResolver.cpp:
(WebCore::StyleResolver::styleForElement):
LayoutTests:
* fast/css/reload-non-styled-element-crash-expected.txt: Added.
* fast/css/reload-non-styled-element-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (148964 => 148965)
--- trunk/LayoutTests/ChangeLog 2013-04-23 14:54:29 UTC (rev 148964)
+++ trunk/LayoutTests/ChangeLog 2013-04-23 14:55:17 UTC (rev 148965)
@@ -1,3 +1,15 @@
+2013-04-23 Andreas Kling <[email protected]>
+
+ Clear StyleResolver state before returning from styleForElement().
+ <http://webkit.org/b/115035>
+
+ Reviewed by Antti Koivisto.
+
+ From Blink r148687 by <[email protected]>.
+
+ * fast/css/reload-non-styled-element-crash-expected.txt: Added.
+ * fast/css/reload-non-styled-element-crash.html: Added.
+
2013-04-23 Allan Sandfeld Jensen <[email protected]>
Baselines for fast/css/image-rendering.html
Added: trunk/LayoutTests/fast/css/reload-non-styled-element-crash-expected.txt (0 => 148965)
--- trunk/LayoutTests/fast/css/reload-non-styled-element-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/reload-non-styled-element-crash-expected.txt 2013-04-23 14:55:17 UTC (rev 148965)
@@ -0,0 +1 @@
+PASS if no crash or assert in debug
Added: trunk/LayoutTests/fast/css/reload-non-styled-element-crash.html (0 => 148965)
--- trunk/LayoutTests/fast/css/reload-non-styled-element-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/reload-non-styled-element-crash.html 2013-04-23 14:55:17 UTC (rev 148965)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+ function start() {
+ document.body.innerHTML='<p>laserator<p>#f'
+ document.body.innerHTML = ''
+ var m = document.createElementNS('http://www.w3.org/1998/Math/MathML','free');
+ document.body.appendChild(m);
+ location.reload();
+ document.body.offsetTop;
+ document.body.innerHTML='PASS if no crash or assert in debug';
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ }
+</script>
+</head>
+<body _onload_='start()'></body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (148964 => 148965)
--- trunk/Source/WebCore/ChangeLog 2013-04-23 14:54:29 UTC (rev 148964)
+++ trunk/Source/WebCore/ChangeLog 2013-04-23 14:55:17 UTC (rev 148965)
@@ -1,5 +1,23 @@
2013-04-23 Andreas Kling <[email protected]>
+ Clear StyleResolver state before returning from styleForElement().
+ <http://webkit.org/b/115035>
+
+ Reviewed by Antti Koivisto.
+
+ From Blink r148687 by <[email protected]>.
+
+ A cached element pointer in the resolver state was causing confusion because
+ in some cases a subsequent call to styleForElement() would use a pointer to
+ a different object that is at the same memory address as the previous one.
+
+ Test: fast/css/reload-non-styled-element-crash.html
+
+ * css/StyleResolver.cpp:
+ (WebCore::StyleResolver::styleForElement):
+
+2013-04-23 Andreas Kling <[email protected]>
+
XSSAuditor performance regression due to threaded parser changes.
<http://webkit.org/b/115037>
<rdar://problem/13716069>
Modified: trunk/Source/WebCore/css/StyleResolver.cpp (148964 => 148965)
--- trunk/Source/WebCore/css/StyleResolver.cpp 2013-04-23 14:54:29 UTC (rev 148964)
+++ trunk/Source/WebCore/css/StyleResolver.cpp 2013-04-23 14:55:17 UTC (rev 148965)
@@ -971,8 +971,10 @@
state.initForStyleResolve(document(), element, defaultParent, regionForStyling);
if (sharingBehavior == AllowStyleSharing && !state.distributedToInsertionPoint()) {
RenderStyle* sharedStyle = locateSharedStyle();
- if (sharedStyle)
+ if (sharedStyle) {
+ state.clear();
return sharedStyle;
+ }
}
if (state.parentStyle()) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
