Bug 51493 - Cache snapshots of plugins before painting, to avoid script running during painting
Summary: Cache snapshots of plugins before painting, to avoid script running during pa...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Plug-ins (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Simon Fraser (smfr)
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2010-12-22 13:56 PST by Simon Fraser (smfr)
Modified: 2010-12-22 17:18 PST (History)
3 users (show)

See Also:


Attachments
Patch (19.92 KB, patch)
2010-12-22 16:04 PST, Simon Fraser (smfr)
no flags Details | Formatted Diff | Diff
Patch (19.94 KB, patch)
2010-12-22 16:23 PST, Simon Fraser (smfr)
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Simon Fraser (smfr) 2010-12-22 13:56:16 PST
We need to avoid plugins running script when being painted. Currently this can happen when Safari takes a snapshot, which involves a flattening paint. In that situation, we ask plugins to draw via a draw event, and they sometimes run script in this callback (or as a result of processing pending requests at this time).
Comment 1 Simon Fraser (smfr) 2010-12-22 13:56:39 PST
<rdar://problem/8093653>
Comment 2 Simon Fraser (smfr) 2010-12-22 16:04:05 PST
Created attachment 77269 [details]
Patch
Comment 3 Darin Adler 2010-12-22 16:21:05 PST
Comment on attachment 77269 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77269&action=review

> WebCore/page/FrameView.cpp:2140
> +    if (flatteningPaint && !document->ownerElement())
> +        notifyWidgetsInAllFrames(BeforeFlatteningPaint);

This says !ownerElement.

> WebCore/page/FrameView.cpp:2153
> +    if (flatteningPaint && document->ownerElement())
> +        notifyWidgetsInAllFrames(AfterFlatteningPaint);

This says ownerElement.

One of them must be wrong!
Comment 4 Simon Fraser (smfr) 2010-12-22 16:23:13 PST
Created attachment 77273 [details]
Patch
Comment 5 mitz 2010-12-22 16:27:36 PST
Comment on attachment 77269 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77269&action=review

> WebCore/platform/Widget.h:113
> +enum WidgetNotification { BeforeFlatteningPaint, AfterFlatteningPaint };

How about WillPaintFlattened and DidPaintFlattened?

> WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:584
> +    NSImage* snapshot = [[NSImage alloc] initWithSize: [self bounds].size];

Misplaced *

> WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:1587
> +        switch (notification) {
> +            case BeforeFlatteningPaint: {
> +                BEGIN_BLOCK_OBJC_EXCEPTIONS;
> +                [(WebBaseNetscapePluginView *)platformWidget() cacheSnapshot];
> +                END_BLOCK_OBJC_EXCEPTIONS;
> +                break;
> +            }
> +            case AfterFlatteningPaint: {
> +                BEGIN_BLOCK_OBJC_EXCEPTIONS;
> +                [(WebBaseNetscapePluginView *)platformWidget() clearCachedSnapshot];
> +                END_BLOCK_OBJC_EXCEPTIONS;
> +                break;
> +            }

Current WebKit style is to give the case labels the same indentation as the switch statement.
Comment 6 Darin Adler 2010-12-22 16:32:04 PST
Comment on attachment 77273 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77273&action=review

This looks good. I didn’t spot any obvious problems.

I do worry that the guarantees of no plug-in calls during the drawing process here are indirect. I’d prefer a design that made a firmer guarantee that we will draw without calling the plug-in.

> WebCore/rendering/RenderView.cpp:569
> +size_t RenderView::getRetainedWidgets(Vector<RenderWidget*>& renderWidgets)

Doesn’t seem all that useful to return the size. Why not just call size on the vector?

> WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:1576
> +        switch (notification) {
> +            case BeforeFlatteningPaint: {

WebKit coding style says to line the case up with the switch rather than indenting.
Comment 7 Simon Fraser (smfr) 2010-12-22 17:18:17 PST
http://trac.webkit.org/changeset/74524