Sporadic crash in HashTableAddResult following CSSValuePool::createFontFamilyValue
authormmaxfield@apple.com <mmaxfield@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 16 Jun 2016 17:10:38 +0000 (17:10 +0000)
committermmaxfield@apple.com <mmaxfield@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 16 Jun 2016 17:10:38 +0000 (17:10 +0000)
https://bugs.webkit.org/show_bug.cgi?id=158297

Reviewed by Darin Adler.

Source/WebCore:

In an effort to reduce the flash of unstyled content, we force all elements
to have display: none during an external stylesheet load. We do this by
ignoring the CSS cascade and forcing all elements to have a placeholder style
which hardcodes display: none. (This is necessary to make elements created by
script during the stylesheet load not flash.)

This style is exposed to web content via getComputedStyle(), which means it
needs to maintain the invariant that font-families can never be null strings.
We enforce this by forcing the font-family to be the standard font name.

Test: fast/text/placeholder-renderstyle-null-font.html

* style/StyleTreeResolver.cpp:
(WebCore::Style::ensurePlaceholderStyle):

LayoutTests:

* fast/text/placeholder-renderstyle-null-font-expected.txt: Added.
* fast/text/placeholder-renderstyle-null-font.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@202127 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/text/placeholder-renderstyle-null-font-expected.txt [new file with mode: 0644]
LayoutTests/fast/text/placeholder-renderstyle-null-font.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/style/StyleTreeResolver.cpp

index 4a7b5db..1c26182 100644 (file)
@@ -1,3 +1,13 @@
+2016-06-16  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Sporadic crash in HashTableAddResult following CSSValuePool::createFontFamilyValue
+        https://bugs.webkit.org/show_bug.cgi?id=158297
+
+        Reviewed by Darin Adler.
+
+        * fast/text/placeholder-renderstyle-null-font-expected.txt: Added.
+        * fast/text/placeholder-renderstyle-null-font.html: Added.
+
 2016-06-15  Keith Miller  <keith_miller@apple.com>
 
         Add support for Symbol.isConcatSpreadable (round 2)
diff --git a/LayoutTests/fast/text/placeholder-renderstyle-null-font-expected.txt b/LayoutTests/fast/text/placeholder-renderstyle-null-font-expected.txt
new file mode 100644 (file)
index 0000000..4e6f9f0
--- /dev/null
@@ -0,0 +1 @@
+This test makes sure that placeholder RenderStyles that we use during external stylesheet loads have a non-null font family. The test passes if there is no crash. 
diff --git a/LayoutTests/fast/text/placeholder-renderstyle-null-font.html b/LayoutTests/fast/text/placeholder-renderstyle-null-font.html
new file mode 100644 (file)
index 0000000..854bc63
--- /dev/null
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html id="htmlElement">
+<head>
+<script>
+</script>
+</head>
+<body>
+This test makes sure that placeholder RenderStyles that we use during external stylesheet loads have a non-null font family. The test passes if there is no crash.
+<svg id="target"></svg>
+<script>
+if (window.testRunner)
+       testRunner.dumpAsText();
+
+document.getElementById("htmlElement").offsetTop;
+
+var link = document.createElement("link");
+link.rel = "stylesheet";
+link.href = "test.css";
+document.head.appendChild(link);
+
+var groupNode = document.createElementNS("http://www.w3.org/2000/svg", "g");
+groupNode.style.display = "none";
+var target = document.getElementById("target");
+target.appendChild(groupNode);
+window.getComputedStyle(groupNode).fontFamily;
+</script>
+</body>
+</html>
index 9b3121b..85d73f1 100644 (file)
@@ -1,3 +1,25 @@
+2016-06-16  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Sporadic crash in HashTableAddResult following CSSValuePool::createFontFamilyValue
+        https://bugs.webkit.org/show_bug.cgi?id=158297
+
+        Reviewed by Darin Adler.
+
+        In an effort to reduce the flash of unstyled content, we force all elements
+        to have display: none during an external stylesheet load. We do this by
+        ignoring the CSS cascade and forcing all elements to have a placeholder style
+        which hardcodes display: none. (This is necessary to make elements created by
+        script during the stylesheet load not flash.)
+
+        This style is exposed to web content via getComputedStyle(), which means it
+        needs to maintain the invariant that font-families can never be null strings.
+        We enforce this by forcing the font-family to be the standard font name.
+
+        Test: fast/text/placeholder-renderstyle-null-font.html
+
+        * style/StyleTreeResolver.cpp:
+        (WebCore::Style::ensurePlaceholderStyle):
+
 2016-06-16  Chris Dumez  <cdumez@apple.com>
 
         Avoid some temporary String allocations for common HTTP headers in ResourceResponse::platformLazyInit()
index f3bcf90..70a1fae 100644 (file)
@@ -43,6 +43,7 @@
 #include "PlatformStrategies.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "StyleFontSizeFunctions.h"
 #include "StyleResolver.h"
 #include "Text.h"
 
@@ -63,6 +64,15 @@ static void ensurePlaceholderStyle(Document& document)
     placeholderStyle = RenderStyle::createPtr().release();
     placeholderStyle->setDisplay(NONE);
     placeholderStyle->setIsPlaceholderStyle();
+
+    FontCascadeDescription fontDescription;
+    fontDescription.setOneFamily(standardFamily);
+    fontDescription.setKeywordSizeFromIdentifier(CSSValueMedium);
+    float size = Style::fontSizeForKeyword(CSSValueMedium, false, document);
+    fontDescription.setSpecifiedSize(size);
+    fontDescription.setComputedSize(size);
+    placeholderStyle->setFontDescription(fontDescription);
+
     placeholderStyle->fontCascade().update(&document.fontSelector());
 }