From 1a6d4d1d9187a936ba02a8b952c6245886fb085d Mon Sep 17 00:00:00 2001
From: "commit-queue@webkit.org"
 <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri, 6 Mar 2015 18:44:33 +0000
Subject: [PATCH] Setting any of the <object> element plugin controlling
 attributes does not have any affect.
 https://bugs.webkit.org/show_bug.cgi?id=141936.

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2015-03-06
Reviewed by Simon Fraser.
Source/WebCore:

When setting any of the <object> element plugin controlling attributes
dynamically we need to mark the the element to be dirty by calling
setNeedsStyleRecalc(), so it has to recreate its renderer when needed.

Tests: fast/css/image-object-hover-inherit.html
       svg/as-object/svg-in-object-dynamic-attribute-change.html

* dom/Element.h: Delete unimplemented function.

* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::parseAttribute): Mark the element dirty by
calling setNeedsStyleRecalc() when one of the plugin controlling attributes
gets changed. We have to clear m_useFallbackContent because the attribute's
new value might fix the object rendering.

* html/HTMLObjectElement.h: Add a function to clear m_useFallbackContent.

LayoutTests:

* fast/css/image-object-hover-inherit-expected.html: Added.
* fast/css/image-object-hover-inherit.html: Added.
A guarding test to catch the case of reconstructing the image <object>
renderer while performing a synchronous resolveTree() followed by page
rendering or dump render tree.

* svg/as-object/resources/lime100x100.html: Added.
* svg/as-object/resources/lime100x100.png: Added.
* svg/as-object/resources/lime100x100.svg: Added.
* svg/as-object/resources/red100x100.svg: Added.
* svg/as-object/svg-in-object-dynamic-attribute-change-expected.html: Added.
* svg/as-object/svg-in-object-dynamic-attribute-change.html: Added.
Ensure that changing the 'type' and the 'data' attributes of the <object>
element will have the expected outcome. Also make sure that the <object>
element renderer falls back correctly when setting any of the attributes
to some unexpected value.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@181168 268f45cc-cd09-0410-ab3c-d52691b4dbfc
---
 LayoutTests/ChangeLog                              |  24 +++++++
 .../css/image-object-hover-inherit-expected.html   |  15 +++++
 .../fast/css/image-object-hover-inherit.html       |  41 ++++++++++++
 .../svg/as-object/resources/lime100x100.html       |  14 +++++
 .../svg/as-object/resources/lime100x100.png        | Bin 0 -> 649 bytes
 .../svg/as-object/resources/lime100x100.svg        |   3 +
 LayoutTests/svg/as-object/resources/red100x100.svg |   3 +
 ...n-object-dynamic-attribute-change-expected.html |  21 +++++++
 .../svg-in-object-dynamic-attribute-change.html    |  70 +++++++++++++++++++++
 Source/WebCore/ChangeLog                           |  24 +++++++
 Source/WebCore/dom/Element.h                       |   2 -
 Source/WebCore/html/HTMLObjectElement.cpp          |  27 +++++---
 Source/WebCore/html/HTMLObjectElement.h            |   1 +
 13 files changed, 234 insertions(+), 11 deletions(-)
 create mode 100644 LayoutTests/fast/css/image-object-hover-inherit-expected.html
 create mode 100644 LayoutTests/fast/css/image-object-hover-inherit.html
 create mode 100644 LayoutTests/svg/as-object/resources/lime100x100.html
 create mode 100644 LayoutTests/svg/as-object/resources/lime100x100.png
 create mode 100644 LayoutTests/svg/as-object/resources/lime100x100.svg
 create mode 100644 LayoutTests/svg/as-object/resources/red100x100.svg
 create mode 100644 LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change-expected.html
 create mode 100644 LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change.html

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 90ae106..51804b7 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,27 @@
+2015-03-06  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Setting any of the <object> element plugin controlling attributes does not have any affect.
+        https://bugs.webkit.org/show_bug.cgi?id=141936.
+
+        Reviewed by Simon Fraser.
+
+        * fast/css/image-object-hover-inherit-expected.html: Added.
+        * fast/css/image-object-hover-inherit.html: Added.
+        A guarding test to catch the case of reconstructing the image <object>
+        renderer while performing a synchronous resolveTree() followed by page
+        rendering or dump render tree.
+        
+        * svg/as-object/resources/lime100x100.html: Added.
+        * svg/as-object/resources/lime100x100.png: Added.
+        * svg/as-object/resources/lime100x100.svg: Added.
+        * svg/as-object/resources/red100x100.svg: Added.
+        * svg/as-object/svg-in-object-dynamic-attribute-change-expected.html: Added.
+        * svg/as-object/svg-in-object-dynamic-attribute-change.html: Added.
+        Ensure that changing the 'type' and the 'data' attributes of the <object>
+        element will have the expected outcome. Also make sure that the <object>
+        element renderer falls back correctly when setting any of the attributes
+        to some unexpected value.
+
 2015-03-06  Myles C. Maxfield  <mmaxfield@apple.com>
 
         Test horiz-origin-x and horiz-origin-y in SVG fonts
diff --git a/LayoutTests/fast/css/image-object-hover-inherit-expected.html b/LayoutTests/fast/css/image-object-hover-inherit-expected.html
new file mode 100644
index 0000000..64b2f66
--- /dev/null
+++ b/LayoutTests/fast/css/image-object-hover-inherit-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <style>
+    div {
+      width: 100px;
+      height: 100px;
+      background-color:lime;
+    }
+  </style>
+</head>
+<body>
+  <div></div>
+</body>
+</html>
diff --git a/LayoutTests/fast/css/image-object-hover-inherit.html b/LayoutTests/fast/css/image-object-hover-inherit.html
new file mode 100644
index 0000000..6b93f82
--- /dev/null
+++ b/LayoutTests/fast/css/image-object-hover-inherit.html
@@ -0,0 +1,41 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <style>
+    div {
+      width: 100px;
+      height: 100px;
+      background-color:red;
+    }
+    div:hover {
+      border-bottom-color: inherit;
+    }
+  </style>
+</head>
+<body>
+  <div>
+    <object id="image" data="data:image/png;base64,
+      iVBORw0KGgoAAAANSUhEUgAAAGQAAABkCAYAAABw4pVUAAAAAXNSR0IArs4c6QAAAARnQU1BAACx
+      jwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAABh0RVh0
+      U29mdHdhcmUAUGFpbnQuTkVUIHYzLjA4ZXKc4QAAAeNJREFUeF7t0sERgDAQw0DSf9FAqvA+lBRw
+      Gsnnef/fgwzcIH3HQDEwAxiOs9QVSUEwAxjOapfO3YJgBjAcZ6krkoJgBjCc1S6duwXBDGA4zlJX
+      JAXBDGA4q106dwuCGcBwnKWuSAqCGcBwVrt07hYEM4DhOEtdkRQEM4DhrHbp3C0IZgDDcZa6IikI
+      ZgDDWe3SuVsQzACG4yx1RVIQzACGs9qlc7cgmAEMx1nqiqQgmAEMZ7VL525BMAMYjrPUFUlBMAMY
+      zmqXzt2CYAYwHGepK5KCYAYwnNUunbsFwQxgOM5SVyQFwQxgOKtdOncLghnAcJylrkgKghnAcFa7
+      dO4WBDOA4ThLXZEUBDOA4ax26dwtCGYAw3GWuiIpCGYAw1nt0rlbEMwAhuMsdUVSEMwAhrPapXO3
+      IJgBDMdZ6oqkIJgBDGe1S+duQTADGI6z1BVJQTADGM5ql87dgmAGMBxnqSuSgmAGMJzVLp27BcEM
+      YDjOUlckBcEMYDirXTp3C4IZwHCcpa5ICoIZwHBWu3TuFgQzgOE4S12RFAQzgOGsduncLQhmAMNx
+      lroiKQhmAMNZ7dK5WxDMAIbjLHVFUhDMAIaz2qVztyCYAQzHWeqKpCCYAQxntUvnbkEwAxiOs9QR
+      yQemSBErQhZ+LAAAAABJRU5ErkJggg==">
+    </object>
+  </div>
+  <script>
+  window.onload = function() {
+    if (window.eventSender) {
+      image = document.getElementById('image');
+      window.eventSender.mouseMoveTo(image.offsetLeft + 10, image.offsetTop + 10);
+    }
+  }
+  </script>
+</body>
+</html>
diff --git a/LayoutTests/svg/as-object/resources/lime100x100.html b/LayoutTests/svg/as-object/resources/lime100x100.html
new file mode 100644
index 0000000..ff2e9ba
--- /dev/null
+++ b/LayoutTests/svg/as-object/resources/lime100x100.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    html, body {
+      margin: 0 0 0 0;
+      overflow:hidden;
+    }
+  </style>
+</head>
+<body>
+  <img src="lime100x100.svg">
+</body>
+</html>
diff --git a/LayoutTests/svg/as-object/resources/lime100x100.png b/LayoutTests/svg/as-object/resources/lime100x100.png
new file mode 100644
index 0000000000000000000000000000000000000000..1b947700808585e8c224cee096247eb5d30a1ded
GIT binary patch
literal 649
zcmeAS@N?(olHy`uVBq!ia0vp^DIm<j1|$m}O$`B3jKx9jP7LeL$-D$|SkfJR9T^xl
z_H+M9WCijSl0AZa85pY67#JE_7#My5g&JNkFq9fFFuY1&V6d9Oz#v{QXIG#NP(q@_
zHKHUqKdq!Zu_%=xATcwqM9<GPM4`-B&%h$JXwE~RU5`Co978JN-d;K=*kB-V*x^$B
zMTb=%?52nmNS%CM`Tu@1&mD!@;|_)f%o2T@uZVg&0vYGBrk}gpl)z>nlfF`W5{NP9
zs@~k)tOt1#EY1amtAH7+W39@$n<Nhu%vrk5gA2q6+g<WbjK#R&p@nzsL=g~UP1(yk
zx*TZ?hYP3eQqlx5BHv!x87**zq3y9wscR63vH8~0;_V7E7<rCIzUo>6Vx({Nex3(%
h$Ebsd2qD3f?8`g^wVlN3bbv{M!PC{xWt~$(696*j^LqdQ

literal 0
HcmV?d00001

diff --git a/LayoutTests/svg/as-object/resources/lime100x100.svg b/LayoutTests/svg/as-object/resources/lime100x100.svg
new file mode 100644
index 0000000..0ae9d15
--- /dev/null
+++ b/LayoutTests/svg/as-object/resources/lime100x100.svg
@@ -0,0 +1,3 @@
+<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'>
+  <rect width='100%' height='100%' fill='lime'/>
+</svg>
diff --git a/LayoutTests/svg/as-object/resources/red100x100.svg b/LayoutTests/svg/as-object/resources/red100x100.svg
new file mode 100644
index 0000000..7fab9c2
--- /dev/null
+++ b/LayoutTests/svg/as-object/resources/red100x100.svg
@@ -0,0 +1,3 @@
+<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'>
+  <rect width='100%' height='100%' fill='red'/>
+</svg>
\ No newline at end of file
diff --git a/LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change-expected.html b/LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change-expected.html
new file mode 100644
index 0000000..724a818
--- /dev/null
+++ b/LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    div {
+        width: 100px;
+        height: 100px;
+        background-color: lime;
+        display: inline-block;
+    }
+  </style>
+</head>
+<body>
+  <div></div>
+  <div></div>
+  <div></div>
+  <div></div>
+  <div></div>
+  <div></div>
+</body>
+</html>
diff --git a/LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change.html b/LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change.html
new file mode 100644
index 0000000..4d5f664
--- /dev/null
+++ b/LayoutTests/svg/as-object/svg-in-object-dynamic-attribute-change.html
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <object id="object1" data="resources/lime100x100.svg">
+    <img src="resources/red100x100.svg">
+  </object>
+  <object id="object2" type="image/svg+xml" data="resources/red100x100.svg">
+    <img src="resources/red100x100.svg">
+  </object>
+  <object width="100px" height="100px" id="object3">
+    <img src="resources/red100x100.svg">
+  </object>
+  <object id="object4" type="dummy">
+    <img src="resources/red100x100.svg">
+  </object>
+  <object id="object5" type="dummy">
+    <img src="resources/red100x100.svg">
+  </object>
+  <object id="object6" type="image/svg+xml" data="resources/red100x100.svg">
+    <img src="resources/lime100x100.svg">
+  </object>
+  <script>
+    function onObjectLoad() {
+      if (!window.testRunner)
+        return;
+        
+      if (typeof onObjectLoad.counter == 'undefined')
+        onObjectLoad.counter = 0;
+    
+      if (++onObjectLoad.counter == 4)
+        testRunner.notifyDone();
+    }
+ 
+    window.addEventListener("load", function() {
+      if (window.testRunner)
+        testRunner.waitUntilDone();
+
+      // change the 'type' attribute
+      var object1 = document.getElementById("object1");
+      object1.setAttribute("type", "image/svg+xml");
+
+      // change the 'data' attribute
+      var object2 = document.getElementById("object2");
+      object2.onload = onObjectLoad;
+      object2.setAttribute("data", "resources/lime100x100.svg");
+
+      // change the 'data' attribute
+      var object3 = document.getElementById("object3");
+      object3.onload = onObjectLoad;
+      object3.setAttribute("data", "resources/lime100x100.html");
+
+      // change the 'type' then the 'data' attributes of an image object
+      var object4 = document.getElementById("object4");
+      object4.onload = onObjectLoad;
+      object4.setAttribute("type", "image/png");
+      object4.setAttribute("data", "resources/lime100x100.png");
+
+      // change the 'data' then the 'type' attributes of an image object
+      var object5 = document.getElementById("object5");
+      object5.onload = onObjectLoad;
+      object5.setAttribute("data", "resources/lime100x100.png");
+      object5.setAttribute("type", "image/png");
+
+      // object rederer fallback
+      var object6 = document.getElementById("object6");
+      object6.setAttribute("type", "dummy");
+    });
+  </script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 07c2d5f..6a31f55 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,27 @@
+2015-03-06  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Setting any of the <object> element plugin controlling attributes does not have any affect.
+        https://bugs.webkit.org/show_bug.cgi?id=141936.
+
+        Reviewed by Simon Fraser.
+        
+        When setting any of the <object> element plugin controlling attributes
+        dynamically we need to mark the the element to be dirty by calling
+        setNeedsStyleRecalc(), so it has to recreate its renderer when needed.
+
+        Tests: fast/css/image-object-hover-inherit.html
+               svg/as-object/svg-in-object-dynamic-attribute-change.html
+
+        * dom/Element.h: Delete unimplemented function.
+        
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseAttribute): Mark the element dirty by
+        calling setNeedsStyleRecalc() when one of the plugin controlling attributes
+        gets changed. We have to clear m_useFallbackContent because the attribute's
+        new value might fix the object rendering.
+        
+        * html/HTMLObjectElement.h: Add a function to clear m_useFallbackContent.
+
 2015-03-06  Myles C. Maxfield  <mmaxfield@apple.com>
 
         Test horiz-origin-x and horiz-origin-y in SVG fonts
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index e36605b..91ea643 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -310,8 +310,6 @@ public:
 
     virtual void copyNonAttributePropertiesFromElement(const Element&) { }
 
-    void lazyReattach();
-
     virtual RenderPtr<RenderElement> createElementRenderer(Ref<RenderStyle>&&);
     virtual bool rendererIsNeeded(const RenderStyle&);
 
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index 67129a3..cbd458b 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -107,28 +107,37 @@ void HTMLObjectElement::collectStyleForPresentationAttribute(const QualifiedName
 
 void HTMLObjectElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
+    bool invalidateRenderer = false;
+
     if (name == formAttr)
         formAttributeChanged();
     else if (name == typeAttr) {
         m_serviceType = value.string().left(value.find(';')).lower();
+        invalidateRenderer = !fastHasAttribute(classidAttr);
         setNeedsWidgetUpdate(true);
     } else if (name == dataAttr) {
         m_url = stripLeadingAndTrailingHTMLSpaces(value);
-        setNeedsWidgetUpdate(true);
         document().updateStyleIfNeeded();
-        if (renderer()) {
-            if (isImageType()) {
-                if (!m_imageLoader)
-                    m_imageLoader = std::make_unique<HTMLImageLoader>(*this);
-                m_imageLoader->updateFromElementIgnoringPreviousError();
-            }
+        if (isImageType() && renderer()) {
+            if (!m_imageLoader)
+                m_imageLoader = std::make_unique<HTMLImageLoader>(*this);
+            m_imageLoader->updateFromElementIgnoringPreviousError();
         }
-    } else if (name == classidAttr)
+        invalidateRenderer = !fastHasAttribute(classidAttr);
+        setNeedsWidgetUpdate(true);
+    } else if (name == classidAttr) {
+        invalidateRenderer = true;
         setNeedsWidgetUpdate(true);
-    else if (name == onbeforeloadAttr)
+    } else if (name == onbeforeloadAttr)
         setAttributeEventListener(eventNames().beforeloadEvent, name, value);
     else
         HTMLPlugInImageElement::parseAttribute(name, value);
+
+    if (!invalidateRenderer || !inDocument() || !renderer())
+        return;
+
+    clearUseFallbackContent();
+    setNeedsStyleRecalc(ReconstructRenderTree);
 }
 
 static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index a36aae9..840ecb1 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -85,6 +85,7 @@ private:
     
     bool shouldAllowQuickTimeClassIdQuirk();
     bool hasValidClassId();
+    void clearUseFallbackContent() { m_useFallbackContent = false; }
 
     virtual void refFormAssociatedElement() override { ref(); }
     virtual void derefFormAssociatedElement() override { deref(); }
-- 
1.8.3.1