Attachment #85235 for bug #53316

View Details Raw Unified Return to Bug 53316

| Differences between



2011-03-08  Alice Boxhall  <aboxhall@chromium.org>

        Reviewed by NOBODY (OOPS!).

        NULL pointer crash when using :empty and :first-line pseudoclass selectors together
        https://bugs.webkit.org/show_bug.cgi?id=53316

        * fast/css/empty-first-line-crash-expected.txt: Added.
        * fast/css/empty-first-line-crash.html: Added.

2011-03-07  Adam Barth  <abarth@webkit.org>

        Reviewed by Dimitri Glazkov.

Line 0 a/LayoutTests/fast/css/empty-first-line-crash-expected.txt_sec1
- a/LayoutTests/fast/css/empty-first-line-crash-expected.txt +1 lines
		1	Tests that the :empty pseudo-class doesn't cause a crash when the empty status changes during parsing.



<!DOCTYPE html>
<script>
if (window.layoutTestController)
    layoutTestController.dumpAsText();
</script>
<style>
*:empty:first-line { background: red; }
</style>
<div>
Tests that the :empty pseudo-class doesn't cause a crash when the empty status changes during parsing.
<button autofocus></button>
</div>



2011-03-08  Alice Boxhall  <aboxhall@chromium.org>

        Reviewed by NOBODY (OOPS!).

        NULL pointer crash when using :empty and :first-line pseudoclass selectors together
        https://bugs.webkit.org/show_bug.cgi?id=53316

        :empty is calculated for each element during parsing, but then not 
        recalculated after any child elements are attached. Force style 
        re-calculation on elements which have :empty in their style when
        their children are changed.

        Test: fast/css/empty-first-line-crash.html

        * dom/Element.cpp:
        (WebCore::checkForEmptyStyleChange): Pull out empty style checking
        logic from checkForSiblingStyleChanges().
        (WebCore::checkForSiblingStyleChanges): Use new checkForEmptyStyleChanges()
        method.
        (WebCore::Element::childrenChanged):  Call checkForEmptyStyleChanges() when
        called with changedByParser = true.

2011-03-07  Adam Barth  <abarth@webkit.org>

        Reviewed by Dimitri Glazkov.



    return false;
}

static void checkForEmptyStyleChange(Element* element, RenderStyle* style)
{
    if (!style)
        return;

    if (style->affectedByEmpty() && (!style->emptyState() || element->hasChildNodes()))
        element->setNeedsStyleRecalc();
}

static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                        Node* beforeChange, Node* afterChange, int childCountDelta)
{

        e->setNeedsStyleRecalc();
    
    // :empty selector.
    checkForEmptyStyleChange(e, style);
        e->setNeedsStyleRecalc();
}

void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
{
    ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
    if (changedByParser)
        checkForEmptyStyleChange(this, renderStyle());
    else
        checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
}

void Element::beginParsingChildren()
{
    clearIsParsingChildrenFinished();

Return to Bug 53316

Lines 1183-1188 bool Element::childTypeAllowed(NodeType type) a/Source/WebCore/dom/Element.cpp_sec1
- a/Source/WebCore/dom/Element.cpp -4 / +14 lines
1183	return false;	1183	return false;
1184	}	1184	}
1185		1185
		1186	static void checkForEmptyStyleChange(Element* element, RenderStyle* style)
		1187	{
		1188	if (!style)
		1189	return;
		1190
		1191	if (style->affectedByEmpty() && (!style->emptyState() \|\| element->hasChildNodes()))
		1192	element->setNeedsStyleRecalc();
		1193	}
		1194
1186	static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,	1195	static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
1187	Node* beforeChange, Node* afterChange, int childCountDelta)	1196	Node* beforeChange, Node* afterChange, int childCountDelta)
1188	{	1197	{
Lines 1259-1275 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin a/Source/WebCore/dom/Element.cpp_sec2
1259	e->setNeedsStyleRecalc();	1268	e->setNeedsStyleRecalc();
1260		1269
1261	// :empty selector.	1270	// :empty selector.
1262	if (style->affectedByEmpty() && (!style->emptyState() \|\| e->hasChildNodes()))	1271	checkForEmptyStyleChange(e, style);
1263	e->setNeedsStyleRecalc();
1264	}	1272	}
1265		1273
1266	void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)	1274	void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
1267	{	1275	{
1268	ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);	1276	ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
1269	if (!changedByParser)	1277	if (changedByParser)
		1278	checkForEmptyStyleChange(this, renderStyle());
		1279	else
1270	checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);	1280	checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
1271	}	1281	}
1272		1282
1273	void Element::beginParsingChildren()	1283	void Element::beginParsingChildren()
1274	{	1284	{
1275	clearIsParsingChildrenFinished();	1285	clearIsParsingChildrenFinished();

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +10 lines
		1	2011-03-08 Alice Boxhall <aboxhall@chromium.org>
		2
		3	Reviewed by NOBODY (OOPS!).
		4
		5	NULL pointer crash when using :empty and :first-line pseudoclass selectors together
		6	https://bugs.webkit.org/show_bug.cgi?id=53316
		7
		8	* fast/css/empty-first-line-crash-expected.txt: Added.
		9	* fast/css/empty-first-line-crash.html: Added.
		10
1	2011-03-07 Adam Barth <abarth@webkit.org>	11	2011-03-07 Adam Barth <abarth@webkit.org>
2		12
3	Reviewed by Dimitri Glazkov.	13	Reviewed by Dimitri Glazkov.

Line 0 a/LayoutTests/fast/css/empty-first-line-crash.html_sec1
- a/LayoutTests/fast/css/empty-first-line-crash.html +12 lines
	1	<!DOCTYPE html>
	2	<script>
	3	if (window.layoutTestController)
	4	layoutTestController.dumpAsText();
	5	</script>
	6	<style>
	7	*:empty:first-line { background: red; }
	8	</style>
	9	<div>
	10	Tests that the :empty pseudo-class doesn't cause a crash when the empty status changes during parsing.
	11	<button autofocus></button>
	12	</div>

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +22 lines
		1	2011-03-08 Alice Boxhall <aboxhall@chromium.org>
		2
		3	Reviewed by NOBODY (OOPS!).
		4
		5	NULL pointer crash when using :empty and :first-line pseudoclass selectors together
		6	https://bugs.webkit.org/show_bug.cgi?id=53316
		7
		8	:empty is calculated for each element during parsing, but then not
		9	recalculated after any child elements are attached. Force style
		10	re-calculation on elements which have :empty in their style when
		11	their children are changed.
		12
		13	Test: fast/css/empty-first-line-crash.html
		14
		15	* dom/Element.cpp:
		16	(WebCore::checkForEmptyStyleChange): Pull out empty style checking
		17	logic from checkForSiblingStyleChanges().
		18	(WebCore::checkForSiblingStyleChanges): Use new checkForEmptyStyleChanges()
		19	method.
		20	(WebCore::Element::childrenChanged): Call checkForEmptyStyleChanges() when
		21	called with changedByParser = true.
		22
1	2011-03-07 Adam Barth <abarth@webkit.org>	23	2011-03-07 Adam Barth <abarth@webkit.org>
2		24
3	Reviewed by Dimitri Glazkov.	25	Reviewed by Dimitri Glazkov.