<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197553] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197553">197553</a></dd>
<dt>Author</dt> <dd>antti@apple.com</dd>
<dt>Date</dt> <dd>2016-03-04 01:29:12 -0800 (Fri, 04 Mar 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>ComposedTreeIterator may traverse slotted nodes multiple times
https://bugs.webkit.org/show_bug.cgi?id=154983
Reviewed by Ryosuke Niwa.
Source/WebCore:
Traversal of slotted nodes can escape to real siblings. Those siblings are then traversed again as slotted nodes.
Test: fast/shadow-dom/composed-tree-slots.html
* dom/ComposedTreeIterator.cpp:
(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::traverseNextInShadowTree):
(WebCore::ComposedTreeIterator::traverseNextLeavingContext):
(WebCore::ComposedTreeIterator::advanceInSlot):
* dom/ComposedTreeIterator.h:
(WebCore::ComposedTreeIterator::Context::Context):
Include end iterator to the context.
For slotted nodes set it up to point to the next sibling of the node.
(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::traverseNextSkippingChildren):
LayoutTests:
* fast/shadow-dom/composed-tree-slots-expected.txt: Added.
* fast/shadow-dom/composed-tree-slots.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomComposedTreeIteratorcpp">trunk/Source/WebCore/dom/ComposedTreeIterator.cpp</a></li>
<li><a href="#trunkSourceWebCoredomComposedTreeIteratorh">trunk/Source/WebCore/dom/ComposedTreeIterator.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastshadowdomcomposedtreeslotsexpectedtxt">trunk/LayoutTests/fast/shadow-dom/composed-tree-slots-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastshadowdomcomposedtreeslotshtml">trunk/LayoutTests/fast/shadow-dom/composed-tree-slots.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (197552 => 197553)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-03-04 09:03:00 UTC (rev 197552)
+++ trunk/LayoutTests/ChangeLog 2016-03-04 09:29:12 UTC (rev 197553)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2016-03-03 Antti Koivisto <antti@apple.com>
+
+ ComposedTreeIterator may traverse slotted nodes multiple times
+ https://bugs.webkit.org/show_bug.cgi?id=154983
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/shadow-dom/composed-tree-slots-expected.txt: Added.
+ * fast/shadow-dom/composed-tree-slots.html: Added.
+
</ins><span class="cx"> 2016-03-03 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> DFG/FTL should inline accesses to RegExpObject::m_lastIndex
</span></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomcomposedtreeslotsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/shadow-dom/composed-tree-slots-expected.txt (0 => 197553)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/composed-tree-slots-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/composed-tree-slots-expected.txt 2016-03-04 09:29:12 UTC (rev 197553)
</span><span class="lines">@@ -0,0 +1,123 @@
</span><ins>+
+Test 1
+ div (shadow root)
+ slot
+
+Test 2
+ div (shadow root)
+ slot
+ #text
+
+Test 3
+ div (shadow root)
+ slot
+ #text
+ div
+
+Test 4
+ div (shadow root)
+ slot
+ div
+ #text
+ div
+ #text
+
+Test 5
+ div (shadow root)
+ div
+ slot
+ #text
+
+Test 6
+ div (shadow root)
+ div
+ slot
+ #text
+ #text
+
+Test 7
+ div (shadow root)
+ div
+ slot
+ #text
+ div
+ #text
+
+Test 8
+ div (shadow root)
+ div
+ slot
+ div
+ #text
+ div
+ #text
+ #text
+
+Test 9
+ div (shadow root)
+ slot
+ slot-default
+ #text
+
+Test 10
+ div (shadow root)
+ slot
+ #text
+
+Test 11
+ div (shadow root)
+ slot
+ #text
+ div
+
+Test 12
+ div (shadow root)
+ slot
+ div
+ #text
+ div
+ #text
+
+Test 13
+ div (shadow root)
+ div (shadow root)
+ div
+ slot
+ #text
+ slot
+ #text
+
+Test 14
+ div (shadow root)
+ div (shadow root)
+ div
+ slot
+ #text
+ slot
+ #text
+ #text
+
+Test 15
+ div (shadow root)
+ div (shadow root)
+ div
+ slot
+ #text
+ slot
+ #text
+ div
+ #text
+
+Test 16
+ div (shadow root)
+ div (shadow root)
+ div
+ slot
+ #text
+ slot
+ div
+ #text
+ div
+ #text
+ #text
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomcomposedtreeslotshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/shadow-dom/composed-tree-slots.html (0 => 197553)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/composed-tree-slots.html (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/composed-tree-slots.html 2016-03-04 09:29:12 UTC (rev 197553)
</span><span class="lines">@@ -0,0 +1,60 @@
</span><ins>+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+
+<template id=shadow1><slot></slot></template>
+<template id=shadow2><div><slot></slot></div>text</template>
+<template id=shadow3><slot><slot-default>text</slot-default></slot></div></template>
+<template id=shadow4><div shadow=shadow41>text<slot></slot>text</div></template>
+<template id=shadow41><div><slot></slot></div></template>
+
+<template test=1><div shadow=shadow1></div></template>
+<template test=2><div shadow=shadow1>text</div></template>
+<template test=3><div shadow=shadow1>text<div></div></div></template>
+<template test=4><div shadow=shadow1><div>text</div><div>text</div></div></template>
+
+<template test=5><div shadow=shadow2></div></template>
+<template test=6><div shadow=shadow2>text</div></template>
+<template test=7><div shadow=shadow2>text<div></div></div></template>
+<template test=8><div shadow=shadow2><div>text</div><div>text</div></div></template>
+
+<template test=9><div shadow=shadow3></div></template>
+<template test=10><div shadow=shadow3>text</div></template>
+<template test=11><div shadow=shadow3>text<div></div></div></template>
+<template test=12><div shadow=shadow3><div>text</div><div>text</div></div></template>
+
+<template test=13><div shadow=shadow4></div></template>
+<template test=14><div shadow=shadow4>text</div></template>
+<template test=15><div shadow=shadow4>text<div></div></div></template>
+<template test=16><div shadow=shadow4><div>text</div><div>text</div></div></template>
+
+<body>
+<pre id=console></pre>
+<script>
+function installShadows(tree)
+{
+ var shadowHosts = tree.querySelectorAll("[shadow]");
+ for (var i = 0; i < shadowHosts.length; ++i) {
+ var shadowId = shadowHosts[i].getAttribute("shadow");
+ var shadowContents = document.querySelector("#"+shadowId).content.cloneNode(true);
+
+ installShadows(shadowContents);
+
+ var shadowRoot = shadowHosts[i].attachShadow({ mode: "open" });
+ shadowRoot.appendChild(shadowContents);
+ }
+}
+
+var console = document.querySelector("#console");
+
+var tests = document.querySelectorAll("[test]");
+for (var i = 0; i < tests.length; ++i) {
+ var test = tests[i].content.cloneNode(true);
+ installShadows(test);
+ console.innerText += "\nTest " + tests[i].getAttribute("test") + "\n";
+ console.innerText += internals.composedTreeAsText(test);
+}
+
+</script>
+</body>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (197552 => 197553)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-03-04 09:03:00 UTC (rev 197552)
+++ trunk/Source/WebCore/ChangeLog 2016-03-04 09:29:12 UTC (rev 197553)
</span><span class="lines">@@ -1,3 +1,28 @@
</span><ins>+2016-03-03 Antti Koivisto <antti@apple.com>
+
+ ComposedTreeIterator may traverse slotted nodes multiple times
+ https://bugs.webkit.org/show_bug.cgi?id=154983
+
+ Reviewed by Ryosuke Niwa.
+
+ Traversal of slotted nodes can escape to real siblings. Those siblings are then traversed again as slotted nodes.
+
+ Test: fast/shadow-dom/composed-tree-slots.html
+
+ * dom/ComposedTreeIterator.cpp:
+ (WebCore::ComposedTreeIterator::initializeContextStack):
+ (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+ (WebCore::ComposedTreeIterator::traverseNextLeavingContext):
+ (WebCore::ComposedTreeIterator::advanceInSlot):
+ * dom/ComposedTreeIterator.h:
+ (WebCore::ComposedTreeIterator::Context::Context):
+
+ Include end iterator to the context.
+ For slotted nodes set it up to point to the next sibling of the node.
+
+ (WebCore::ComposedTreeIterator::context):
+ (WebCore::ComposedTreeIterator::traverseNextSkippingChildren):
+
</ins><span class="cx"> 2016-03-04 Andreas Kling <akling@apple.com>
</span><span class="cx">
</span><span class="cx"> Drop DocumentSharedObjectPool immediately when going into PageCache.
</span></span></pre></div>
<a id="trunkSourceWebCoredomComposedTreeIteratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ComposedTreeIterator.cpp (197552 => 197553)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ComposedTreeIterator.cpp 2016-03-04 09:03:00 UTC (rev 197552)
+++ trunk/Source/WebCore/dom/ComposedTreeIterator.cpp 2016-03-04 09:29:12 UTC (rev 197553)
</span><span class="lines">@@ -31,6 +31,29 @@
</span><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><ins>+ComposedTreeIterator::Context::Context()
+{
+}
+
+ComposedTreeIterator::Context::Context(ContainerNode& root)
+ : iterator(root)
+{
+}
+
+ComposedTreeIterator::Context::Context(ContainerNode& root, Node& node)
+ : iterator(root, &node)
+{
+}
+
+#if ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)
+ComposedTreeIterator::Context::Context(ContainerNode& root, Node& node, SlottedTag)
+ : iterator(root, &node)
+ , end(iterator)
+{
+ end.traverseNextSibling();
+}
+#endif
+
</ins><span class="cx"> ComposedTreeIterator::ComposedTreeIterator(ContainerNode& root)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!is<ShadowRoot>(root));
</span><span class="lines">@@ -75,7 +98,9 @@
</span><span class="cx"> }
</span><span class="cx"> if (is<ShadowRoot>(*parent)) {
</span><span class="cx"> auto& shadowRoot = downcast<ShadowRoot>(*parent);
</span><del>- m_contextStack.append(Context(shadowRoot, *contextCurrent, currentSlotNodeIndex));
</del><ins>+ m_contextStack.append(Context(shadowRoot, *contextCurrent));
+ m_contextStack.last().slotNodeIndex = currentSlotNodeIndex;
+
</ins><span class="cx"> node = shadowRoot.host();
</span><span class="cx"> contextCurrent = node;
</span><span class="cx"> currentSlotNodeIndex = notFound;
</span><span class="lines">@@ -83,7 +108,9 @@
</span><span class="cx"> }
</span><span class="cx"> if (auto* shadowRoot = parent->shadowRoot()) {
</span><span class="cx"> #if ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)
</span><del>- m_contextStack.append(Context(*parent, *contextCurrent, currentSlotNodeIndex));
</del><ins>+ m_contextStack.append(Context(*parent, *contextCurrent, Context::Slotted));
+ m_contextStack.last().slotNodeIndex = currentSlotNodeIndex;
+
</ins><span class="cx"> auto* assignedSlot = shadowRoot->findAssignedSlot(*node);
</span><span class="cx"> if (assignedSlot) {
</span><span class="cx"> currentSlotNodeIndex = assignedSlot->assignedNodes()->find(node);
</span><span class="lines">@@ -101,7 +128,8 @@
</span><span class="cx"> }
</span><span class="cx"> node = parent;
</span><span class="cx"> }
</span><del>- m_contextStack.append(Context(root, *contextCurrent, currentSlotNodeIndex));
</del><ins>+ m_contextStack.append(Context(root, *contextCurrent));
+ m_contextStack.last().slotNodeIndex = currentSlotNodeIndex;
</ins><span class="cx">
</span><span class="cx"> m_contextStack.reverse();
</span><span class="cx"> }
</span><span class="lines">@@ -138,7 +166,7 @@
</span><span class="cx"> if (auto* assignedNodes = slot.assignedNodes()) {
</span><span class="cx"> context().slotNodeIndex = 0;
</span><span class="cx"> auto* assignedNode = assignedNodes->at(0);
</span><del>- m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode));
</del><ins>+ m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -146,7 +174,7 @@
</span><span class="cx">
</span><span class="cx"> context().iterator.traverseNext();
</span><span class="cx">
</span><del>- if (!context().iterator)
</del><ins>+ if (context().iterator == context().end)
</ins><span class="cx"> traverseNextLeavingContext();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -154,9 +182,9 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_contextStack.size() > 1);
</span><span class="cx">
</span><del>- while (!context().iterator && m_contextStack.size() > 1) {
</del><ins>+ while (context().iterator == context().end && m_contextStack.size() > 1) {
</ins><span class="cx"> m_contextStack.removeLast();
</span><del>- if (!context().iterator)
</del><ins>+ if (context().iterator == context().end)
</ins><span class="cx"> return;
</span><span class="cx"> #if ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)
</span><span class="cx"> if (is<HTMLSlotElement>(current()) && advanceInSlot(1))
</span><span class="lines">@@ -178,7 +206,7 @@
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="cx"> auto* slotNode = assignedNodes.at(context().slotNodeIndex);
</span><del>- m_contextStack.append(Context(*slotNode->parentElement(), *slotNode));
</del><ins>+ m_contextStack.append(Context(*slotNode->parentElement(), *slotNode, Context::Slotted));
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoredomComposedTreeIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ComposedTreeIterator.h (197552 => 197553)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ComposedTreeIterator.h 2016-03-04 09:03:00 UTC (rev 197552)
+++ trunk/Source/WebCore/dom/ComposedTreeIterator.h 2016-03-04 09:29:12 UTC (rev 197553)
</span><span class="lines">@@ -67,16 +67,16 @@
</span><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> struct Context {
</span><del>- Context() { }
- explicit Context(ContainerNode& root)
- : iterator(root)
- { }
- Context(ContainerNode& root, Node& node, size_t slotNodeIndex = notFound)
- : iterator(root, &node)
- , slotNodeIndex(slotNodeIndex)
- { }
</del><ins>+ Context();
+ explicit Context(ContainerNode& root);
+ Context(ContainerNode& root, Node& node);
</ins><span class="cx">
</span><ins>+#if ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)
+ enum SlottedTag { Slotted };
+ Context(ContainerNode& root, Node& node, SlottedTag);
+#endif
</ins><span class="cx"> ElementAndTextDescendantIterator iterator;
</span><ins>+ ElementAndTextDescendantIterator end;
</ins><span class="cx"> size_t slotNodeIndex { notFound };
</span><span class="cx"> };
</span><span class="cx"> Context& context() { return m_contextStack.last(); }
</span><span class="lines">@@ -84,7 +84,7 @@
</span><span class="cx"> Node& current() { return *context().iterator; }
</span><span class="cx">
</span><span class="cx"> bool m_didDropAssertions { false };
</span><del>- Vector<Context, 4> m_contextStack;
</del><ins>+ Vector<Context, 8> m_contextStack;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> inline ComposedTreeIterator::ComposedTreeIterator()
</span><span class="lines">@@ -112,7 +112,7 @@
</span><span class="cx"> {
</span><span class="cx"> context().iterator.traverseNextSkippingChildren();
</span><span class="cx">
</span><del>- if (!context().iterator && m_contextStack.size() > 1)
</del><ins>+ if (context().iterator == context().end && m_contextStack.size() > 1)
</ins><span class="cx"> traverseNextLeavingContext();
</span><span class="cx">
</span><span class="cx"> return *this;
</span></span></pre>
</div>
</div>
</body>
</html>