ChangeLog

2017-12-12  Ryosuke Niwa  <rniwa@webkit.org>

        Update the SVG use element's shadow trees explicitly before the style recall

        https://bugs.webkit.org/show_bug.cgi?id=180729

        <rdar://problem/36009806>

        Reviewed by NOBODY (OOPS!).

        Update the SVG use element's shadow trees before start resolving styles. Document now has a hash set of all

        connected SVG use elements with invalidated shadow trees. SVGUseElement adds itself to this set when its

        shadow tree gets invalidated, or it gets newly connected to a document with the invalidated shadow tree.

        SVGUseElement removes itself from this set when it updates its shadow tree or it gets disconnected from

        a document with the invalidated shadow tree.

        No new tests. Covered by existing tests.

        * dom/Document.cpp:

        (WebCore::Document::~Document): Assert that m_svgUseElements has been cleared.

        (WebCore::Document::resolveStyle): Update the shadow trees of SVG use elements with invalidated shadow trees.

        (WebCore::Document::addSVGUseElement): Added.

        (WebCore::Document::removeSVGUseElement): Added.

        * dom/Document.h:

        (WebCore::Document::svgUseElements const): Added.

        * dom/Element.cpp:

        (WebCore::Element::cloneElementWithChildren): Removed EventAllowedScope since the SVG use element's shadow

        tree is no longer updated when there is a NoEventDispatchAssertion in the stack.

        (WebCore::Element::cloneElementWithoutChildren): Ditto.

        * svg/SVGUseElement.cpp:

        (WebCore::SVGUseElement::insertedIntoAncestor): Add the element to the document's hash set if this use element's

        shadow tree needs to be updated (m_shadowTreeNeedsUpdate is set), and it got newly connected.

        (WebCore::SVGUseElement::removedFromAncestor): Ditto for removal. We have to check m_shadowTreeNeedsUpdate before

        calling SVGGraphicsElement::removedFromAncestor or updateExternalDocument since either function can invoke

        m_shadowTreeNeedsUpdate to true.

        (WebCore::SVGUseElement::willRecalcStyle): Removed the call to updateShadowTree.

        (WebCore::SVGUseElement::updateShadowTree): Remove this element from the document's hah set. We can't clear all

        the entries in the map at once in Document::resolveStyle because updating the shadow trees of a SVG use element

        can result in a sync IPC in ImageLoader::updateFromElement, which end up executing arbitrary author scripts.

        (WebCore::SVGUseElement::cloneTarget const): Removed EventAllowedScope since the SVG use element's shadow tree

        is no longer updated when there is a NoEventDispatchAssertion in the stack.

        (WebCore::SVGUseElement::expandUseElementsInShadowTree const): Ditto.

        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree const): Ditto.

        (WebCore::SVGUseElement::invalidateShadowTree): Add the element to the document's hash set if it's connected.

        * svg/SVGUseElement.h:

2017-12-07  Jer Noble  <jer.noble@apple.com>

        [EME] Support the 'encrypted' event for FPS encrypted streams

Source/WebCore/dom/Document.cpp

#include "SVGNames.h"

#include "SVGSVGElement.h"

#include "SVGTitleElement.h"

162#include "SVGUseElement.h"

#include "SVGZoomEvent.h"

#include "SWClientConnection.h"

#include "SchemeRegistry.h"

@@Document::~Document()

    if (hasRareData())

        clearRareData();

631 ASSERT(m_listsInvalidatedAtDocument.isEmpty());

632 ASSERT(m_collectionsInvalidatedAtDocument.isEmpty());

    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_listsInvalidatedAtDocument.isEmpty());

    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_collectionsInvalidatedAtDocument.isEmpty());

    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(m_svgUseElements.isEmpty());

    for (unsigned count : m_nodeListAndCollectionCounts)

        ASSERT_UNUSED(count, !count);

@@void Document::resolveStyle(ResolveStyleType type)

    RenderView::RepaintRegionAccumulator repaintRegionAccumulator(renderView());

    AnimationUpdateBlock animationUpdateBlock(&m_frame->animation());

    // FIXME: Do this update per tree scope.

    {

        auto elements = copyToVectorOf<RefPtr<SVGUseElement>>(m_svgUseElements);

        // We can't clear m_svgUseElements here because updateShadowTree may end up executing arbitrary scripts

        // which may insert new SVG use elements or remove existing ones inside sync IPC via ImageLoader::updateFromElement.

        for (auto& element : elements)

            element->updateShadowTree();

    }

    // FIXME: We should update style on our ancestor chain before proceeding (especially for seamless),

    // however doing so currently causes several tests to crash, as Frame::setDocument calls Document::attach

    // before setting the DOMWindow on the Frame, or the SecurityOrigin on the document. The attach, in turn

@@SVGDocumentExtensions& Document::accessSVGExtensions()

    return *m_svgExtensions;

}

void Document::addSVGUseElement(SVGUseElement& element)

{

    auto result = m_svgUseElements.add(&element);

    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(result.isNewEntry);

}

void Document::removeSVGUseElement(SVGUseElement& element)

{

    bool didRemove = m_svgUseElements.remove(&element);

    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(didRemove);

}

bool Document::hasSVGRootNode() const

{

    return documentElement() && documentElement()->hasTagName(SVGNames::svgTag);

Source/WebCore/dom/Document.h

@@class RenderView;

class RequestAnimationFrameCallback;

class SVGDocumentExtensions;

class SVGSVGElement;

157class SVGUseElement;

class SWClientConnection;

class ScriptElementData;

class ScriptModuleLoader;

@@public:

    WEBCORE_EXPORT const SVGDocumentExtensions* svgExtensions();

    WEBCORE_EXPORT SVGDocumentExtensions& accessSVGExtensions();

    void addSVGUseElement(SVGUseElement&);

    void removeSVGUseElement(SVGUseElement&);

    HashSet<SVGUseElement*> const svgUseElements() const { return m_svgUseElements; }

    void initSecurityContext();

    void initContentSecurityPolicy();

@@private:

    RefPtr<XPathEvaluator> m_xpathEvaluator;

    std::unique_ptr<SVGDocumentExtensions> m_svgExtensions;

1620 HashSet<SVGUseElement*> m_svgUseElements;

#if ENABLE(DASHBOARD_SUPPORT)

    Vector<AnnotatedRegionValue> m_annotatedRegions;

Source/WebCore/dom/Element.cpp

@@Ref<Node> Element::cloneNodeInternal(Document& targetDocument, CloningOperation

Ref<Element> Element::cloneElementWithChildren(Document& targetDocument)

{

    Ref<Element> clone = cloneElementWithoutChildren(targetDocument);

    // It's safe to dispatch events on the cloned node since author scripts have no access to it yet.

    // This is needed for SVGUseElement::cloneTarget.

    NoEventDispatchAssertion::EventAllowedScope allowedScope(clone.get());

    cloneChildNodes(clone);

    return clone;

}

@@Ref<Element> Element::cloneElementWithoutChildren(Document& targetDocument)

{

    Ref<Element> clone = cloneElementWithoutAttributesAndChildren(targetDocument);

    // It's safe to dispatch events on the cloned node since author scripts have no access to it yet.

    // This is needed for SVGUseElement::cloneTarget.

    NoEventDispatchAssertion::EventAllowedScope allowedScope(clone.get());

    // This will catch HTML elements in the wrong namespace that are not correctly copied.

    // This is a sanity check as HTML overloads some of the DOM methods.

    ASSERT(isHTMLElement() == clone->isHTMLElement());

Source/WebCore/svg/SVGUseElement.cpp

@@Node::InsertedIntoAncestorResult SVGUseElement::insertedIntoAncestor(InsertionTy

{

    SVGGraphicsElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);

    if (insertionType.connectedToDocument) {

111 if (m_shadowTreeNeedsUpdate)

112 document().addSVGUseElement(*this);

        SVGExternalResourcesRequired::insertedIntoDocument(this);

        invalidateShadowTree();

        updateExternalDocument();

@@Node::InsertedIntoAncestorResult SVGUseElement::insertedIntoAncestor(InsertionTy

void SVGUseElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)

{

    // Check m_shadowTreeNeedsUpdate before calling SVGElement::removedFromAncestor which calls SVGElement::invalidateInstances

    // and SVGUseElement::updateExternalDocument which calls invalidateShadowTree().

    if (removalType.disconnectedFromDocument) {

        if (m_shadowTreeNeedsUpdate)

            document().removeSVGUseElement(*this);

    }

120128 SVGGraphicsElement::removedFromAncestor(removalType, oldParentOfRemovedTree);

121 clearShadowTree();

122 updateExternalDocument();

    if (removalType.disconnectedFromDocument) {

        clearShadowTree();

        updateExternalDocument();

    }

}

inline Document* SVGUseElement::externalDocument() const

@@void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)

void SVGUseElement::willRecalcStyle(Style::Change change)

{

    // FIXME: Shadow tree should be updated before style recalc.

    if (m_shadowTreeNeedsUpdate)

        updateShadowTree();

    SVGGraphicsElement::willRecalcStyle(change);

}

@@void SVGUseElement::updateShadowTree()

    // FIXME: It's expensive to re-clone the entire tree every time. We should find a more efficient way to handle this.

    clearShadowTree();

237 if (isInShadowTree() || !isConnected())

    if (!isConnected())

        return;

    document().removeSVGUseElement(*this);

    // FIXME: Enable SVG use elements in shadow trees.

    if (isInShadowTree())

        return;

    String targetID;

@@void SVGUseElement::updateShadowTree()

    }

    {

248 // Safe because the cloned shadow tree has never been exposed to author scripts.

249260 auto& shadowRoot = ensureUserAgentShadowRoot();

250 NoEventDispatchAssertion::EventAllowedScope scope(shadowRoot);

        cloneTarget(shadowRoot, *target);

        expandUseElementsInShadowTree();

        expandSymbolElementsInShadowTree();

@@SVGElement* SVGUseElement::findTarget(String* targetID) const

void SVGUseElement::cloneTarget(ContainerNode& container, SVGElement& target) const

{

    Ref<SVGElement> targetClone = static_cast<SVGElement&>(target.cloneElementWithChildren(document()).get());

439 // Safe because the newy cloned nodes in the shadow tree has not been exposed to author scripts yet.

440 NoEventDispatchAssertion::EventAllowedScope scope(targetClone);

    associateClonesWithOriginals(targetClone.get(), target);

    removeDisallowedElementsFromSubtree(targetClone.get());

    removeSymbolElementsFromSubtree(targetClone.get());

@@void SVGUseElement::expandUseElementsInShadowTree() const

        // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.

        auto replacementClone = SVGGElement::create(document());

473 // Safe because the use element's shadow tree is not exposed to author scripts, and we don't fire synchronous events during layout & DOM layout.

474 NoEventDispatchAssertion::EventAllowedScope scope(replacementClone);

        cloneDataAndChildren(replacementClone.get(), originalClone);

@@void SVGUseElement::expandSymbolElementsInShadowTree() const

        // 'svg' element will use values of 100% for these attributes.

        auto replacementClone = SVGSVGElement::create(document());

509 // Safe because the newly created SVG element and the newly created shadow tree has not been exposed to author scripts yet.

510 NoEventDispatchAssertion::EventAllowedScope scope(replacementClone);

        cloneDataAndChildren(replacementClone.get(), originalClone);

        originalClone.parentNode()->replaceChild(replacementClone, originalClone);

@@void SVGUseElement::invalidateShadowTree()

    m_shadowTreeNeedsUpdate = true;

    invalidateStyleAndRenderersForSubtree();

    invalidateDependentShadowTrees();

540 if (isConnected())

541 document().addSVGUseElement(*this);

}

void SVGUseElement::invalidateDependentShadowTrees()

Source/WebCore/ChangeLog

Source/WebCore/dom/Document.cpp

Source/WebCore/dom/Document.h

Source/WebCore/dom/Element.cpp

Source/WebCore/svg/SVGUseElement.cpp

Source/WebCore/svg/SVGUseElement.h