[webkit-changes] [WebKit/WebKit] 1a09d8: Assertion failure in StyleGeneratedImage::removeCl...

[Antti Koivisto]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 1a09d8d95ba6085df4ef44306c4bfc9fc86fdbc7
      https://github.com/WebKit/WebKit/commit/1a09d8d95ba6085df4ef44306c4bfc9fc86fdbc7
  Author: Antti Koivisto <antti at apple.com>
  Date:   2023-05-16 (Tue, 16 May 2023)

  Changed paths:
    A LayoutTests/fast/css/custom-property-deduplication-cross-fade-crash-expected.txt
    A LayoutTests/fast/css/custom-property-deduplication-cross-fade-crash.html
    M Source/WebCore/rendering/style/RenderStyle.cpp
    M Source/WebCore/rendering/style/StyleCrossfadeImage.cpp

  Log Message:
  -----------
  Assertion failure in StyleGeneratedImage::removeClient
https://bugs.webkit.org/show_bug.cgi?id=256840
rdar://107311467

Reviewed by Alan Baradlay.

* LayoutTests/fast/css/custom-property-deduplication-cross-fade-crash-expected.txt: Added.
* LayoutTests/fast/css/custom-property-deduplication-cross-fade-crash.html: Added.
* Source/WebCore/rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::deduplicateCustomProperties):

Remove an optimization where we would after successfully deduplicating custom properties also
try to deduplicate the whole rare data struct. This is dangerous since it will mutate style
in all renderers that are using the rare data instance. Images in style need to be registered per-renderer
and that happens via RenderElement::setStyle. If style changes silently we fail to do this
registration.

This was also probably not super valuable. The main goal here was deduplicating large custom property data
which is still happening.

* Source/WebCore/rendering/style/StyleCrossfadeImage.cpp:
(WebCore::StyleCrossfadeImage::load):

Ensure we only trigger load for to/from image if it has not already been loaded.
We may end up in this case because only one of the images needs loading.

Canonical link: https://commits.webkit.org/264116@main