Variables can resolve to the wrong value when elements differ in nothing but inherite...
authortimothy_horton@apple.com <timothy_horton@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 28 Feb 2016 20:42:55 +0000 (20:42 +0000)
committertimothy_horton@apple.com <timothy_horton@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 28 Feb 2016 20:42:55 +0000 (20:42 +0000)
commit2f211eb77ac30bce362e59f0ab07ed681a3c61e0
tree65b93209f019ca4bbcd80d7343ad953f5ff0bbea
parent94bc8eaade604aff3bbc5e6cdc4eed7c2dd64a28
Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
https://bugs.webkit.org/show_bug.cgi?id=154785

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/css/variables/avoid-matched-property-cache.html

* css/StyleResolver.cpp:
(WebCore::StyleResolver::MatchResult::addMatchedProperties):
Disable the matched property cache when a value is variable-dependent, because
they can resolve to inherited values, and the matched property cache could
end up copying the wrong value from another similarly-styled element.

LayoutTests:

* fast/css/variables/avoid-matched-property-cache-expected.html: Added.
* fast/css/variables/avoid-matched-property-cache.html: Added.
Add a test. The non-standard element is necessary because the resolved property
cache is already disabled when using the "simple" default style sheet, and
it seems better to use a totally non-standard element than one that might
end up in the "simple" default style sheet in the future and would silently
invalidate the test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@197300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/css/variables/avoid-matched-property-cache-expected.html [new file with mode: 0644]
LayoutTests/fast/css/variables/avoid-matched-property-cache.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/css/StyleResolver.cpp