Attachment 193251 Details for Bug 112322 – Patch

[patch] Patch

bug-112322-20130315163547.patch (text/plain), 7.29 KB, created by Takashi Sakamoto on 2013-03-15 00:39:52 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Takashi Sakamoto

Created: 2013-03-15 00:39:52 PDT

Size: 7.29 KB

patch

obsolete

>Subversion Revision: 145876
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 2f1a8e7b3a02c501f6fcaee8fe8e548a4868fb8c..e073420344f395dfb14215f967fc73c53213042d 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,31 @@
>+2013-03-15  Takashi Sakamoto  <tasak@google.com>
>+
>+        Crash at RenderStyle::inheritFrom reported by fuzzer
>+        https://bugs.webkit.org/show_bug.cgi?id=112322
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        pseudoStyleForElement should check whether a parent style of a given
>+        element is available or not. If a given element's parent is
>+        an insertion point whose reset-style-inheritance is true, the parent
>+        style is not available. Need to use defaultStyleForElement.
>+
>+        Test: fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash.html
>+
>+        * css/StyleResolver.cpp:
>+        (WebCore::StyleResolver::styleForElement):
>+        Removed cloneForParent. Instead, made m_state own parentStyle, i.e.
>+        changed m_parentStyle in class State from RenderStyle* to
>+        RefPtr<RenderStyle>.
>+        (WebCore::StyleResolver::pseudoStyleForElement):
>+        If an actual parent style of a given element is not available, use
>+        defaultStyleForElement. This is the same logic as styleForElement.
>+        * css/StyleResolver.h:
>+        (WebCore::StyleResolver::State::setParentStyle):
>+        Modified the parameter to use PassRefPtr<RenderStyle>.
>+        (WebCore::StyleResolver::State::parentStyle):
>+        (State):
>+
> 2013-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
> 
>         Unreviewed, rolling out r145864.
>diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
>index 8937cb60987583752b64a7a1f8b09ab64487ae0d..b2cbfc7536811769f79dc303506b04117707aa4f 100644
>--- a/Source/WebCore/css/StyleResolver.cpp
>+++ b/Source/WebCore/css/StyleResolver.cpp
>@@ -990,15 +990,12 @@ PassRefPtr<RenderStyle> StyleResolver::styleForElement(Element* element, RenderS
>             return sharedStyle;
>     }
> 
>-    RefPtr<RenderStyle> cloneForParent;
>-
>     if (state.parentStyle()) {
>         state.setStyle(RenderStyle::create());
>         state.style()->inheritFrom(state.parentStyle(), isAtShadowBoundary(element) ? RenderStyle::AtShadowBoundary : RenderStyle::NotAtShadowBoundary);
>     } else {
>         state.setStyle(defaultStyleForElement());
>-        cloneForParent = RenderStyle::clone(state.style());
>-        state.setParentStyle(cloneForParent.get());
>+        state.setParentStyle(RenderStyle::clone(state.style()));
>     }
>     // contenteditable attribute (implemented by -webkit-user-modify) should
>     // be propagated from shadow host to distributed node.
>@@ -1176,8 +1173,14 @@ PassRefPtr<RenderStyle> StyleResolver::pseudoStyleForElement(Element* e, const P
>     initElement(e);
> 
>     state.initForStyleResolve(document(), e, parentStyle);
>-    state.setStyle(RenderStyle::create());
>-    state.style()->inheritFrom(m_state.parentStyle());
>+
>+    if (m_state.parentStyle()) {
>+        state.setStyle(RenderStyle::create());
>+        state.style()->inheritFrom(m_state.parentStyle());
>+    } else {
>+        state.setStyle(defaultStyleForElement());
>+        state.setParentStyle(RenderStyle::clone(state.style()));
>+    }
> 
>     // Since we don't use pseudo-elements in any of our quirk/print user agent rules, don't waste time walking
>     // those rules.
>diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
>index c465bb2740fe5cde53684fb0852833e8a30580d9..634e6e46ff62c4ca8d8f5950c1aff5e20976d426 100644
>--- a/Source/WebCore/css/StyleResolver.h
>+++ b/Source/WebCore/css/StyleResolver.h
>@@ -455,8 +455,8 @@ public:
>         PassRefPtr<RenderStyle> takeStyle() { return m_style.release(); }
> 
>         const ContainerNode* parentNode() const { return m_parentNode; }
>-        void setParentStyle(RenderStyle* parentStyle) { m_parentStyle = parentStyle; }
>-        RenderStyle* parentStyle() const { return m_parentStyle; }
>+        void setParentStyle(PassRefPtr<RenderStyle> parentStyle) { m_parentStyle = parentStyle; }
>+        RenderStyle* parentStyle() const { return m_parentStyle.get(); }
>         RenderStyle* rootElementStyle() const { return m_rootElementStyle; }
> 
>         const RenderRegion* regionForStyling() const { return m_regionForStyling; }
>@@ -507,7 +507,7 @@ public:
>         RefPtr<RenderStyle> m_style;
>         StyledElement* m_styledElement;
>         ContainerNode* m_parentNode;
>-        RenderStyle* m_parentStyle;
>+        RefPtr<RenderStyle> m_parentStyle;
>         RenderStyle* m_rootElementStyle;
> 
>         // Required to ASSERT in applyProperties.
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 8a7a060d1b29505725c0fe181b798ce6135242cb..295c38a71bddb3ff88c21e26e7659daf2cfe1541 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2013-03-15  Takashi Sakamoto  <tasak@google.com>
>+
>+        Crash at RenderStyle::inheritFrom reported by fuzzer
>+        https://bugs.webkit.org/show_bug.cgi?id=112322
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash-expected.txt: Added.
>+        * fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash.html: Added.
>+
> 2013-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
> 
>         Unreviewed, rolling out r145864.
>diff --git a/LayoutTests/fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash-expected.txt b/LayoutTests/fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..37305fb8803d75a2f5224db73c3dc81fa5c14865
>--- /dev/null
>+++ b/LayoutTests/fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash-expected.txt
>@@ -0,0 +1,3 @@
>+[bug 112322] https://bugs.webkit.org/show_bug.cgi?id=112322 This test ensures WebKit does not crash when checking whether distributed nodes have any pseudo element or not. If there is no crash, the test passes.
>+
>+PASS
>diff --git a/LayoutTests/fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash.html b/LayoutTests/fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..c6d321d8a8fc91b6bfd8b5de84294f12217314f9
>--- /dev/null
>+++ b/LayoutTests/fast/dom/shadow/insertion-point-resetStyleInheritance-with-pseudo-element-crash.html
>@@ -0,0 +1,26 @@
>+<!doctyle html>
>+<head>
>+<style>
>+span::after {
>+    -webkit-mask-box-image-source: url(does-not-exist.gif)
>+}
>+</style>
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+
>+function runTests() {
>+    var host = document.getElementById("host");
>+    var shadowRoot = host.webkitCreateShadowRoot();
>+    shadowRoot.innerHTML = "<content id='content'>"
>+    shadowRoot.getElementById("content").resetStyleInheritance = true;
>+}
>+</script>
>+</head>
>+<body onload="runTests()">
>+  <p>[bug 112322] <a href="https://bugs.webkit.org/show_bug.cgi?id=112322">https://bugs.webkit.org/show_bug.cgi?id=112322</a> This test ensures WebKit does not crash when checking whether distributed nodes have any pseudo element or not. If there is no crash, the test passes.</p>
>+  <div id='host'>
>+    <span>PASS</span>
>+  </div>
>+</body>
>+

Actions: View | Formatted Diff | Diff

Attachments on bug 112322: 193080 | 193251