<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[214360] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/214360">214360</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2017-03-24 11:39:28 -0700 (Fri, 24 Mar 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>Handle recursive calls to ProcessingInstruction::checkStyleSheet
https://bugs.webkit.org/show_bug.cgi?id=169982
<rdar://problem/31083051>
Reviewed by Antti Koivisto.
Source/WebCore:
See if we triggered a recursive load of the stylesheet during the 'beforeload'
event handler. If so, reset to a valid state before completing the load.
We should also check after 'beforeload' that we were not disconnected from (or
moved to a new) document.
I also looked for other cases of this pattern and fixed them.
Tests: fast/dom/beforeload/image-removed-during-before-load.html
fast/dom/beforeload/recursive-css-pi-before-load.html
fast/dom/beforeload/recursive-link-before-load.html
fast/dom/beforeload/recursive-xsl-pi-before-load.html
* dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::clearExistingCachedSheet): Added.
(WebCore::ProcessingInstruction::checkStyleSheet): Reset to valid state
if necessary after the 'beforeload' handler. Also, safely handle the case where
the element was disconnected in the 'beforeload' handler (similar to what
we do in HTMLLinkElement).
(WebCore::ProcessingInstruction::setCSSStyleSheet): Drive-by Fix: Protect the
current document to match what we do in setXSLStyleSheet.
* dom/ProcessingInstruction.h:
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::selectMediaResource): Safely handle the case where
the element was disconnected in the 'beforeload' handler.
(WebCore::HTMLMediaElement::selectNextSourceChild): Ditto.
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::dispatchPendingBeforeLoadEvent): Ditto.
LayoutTests:
* fast/dom/beforeload/image-removed-during-before-load-expected.txt: Added.
* fast/dom/beforeload/image-removed-during-before-load.html: Added.
* fast/dom/beforeload/recursive-css-pi-before-load-expected.txt: Added.
* fast/dom/beforeload/recursive-css-pi-before-load.html: Added.
* fast/dom/beforeload/recursive-link-before-load-expected.txt: Added.
* fast/dom/beforeload/recursive-link-before-load.html: Added.
* fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt: Added.
* fast/dom/beforeload/recursive-xsl-pi-before-load.html: Added.
* fast/dom/beforeload/resources/content.xhtml: Added.
* fast/dom/beforeload/resources/pass.css: Added.
* fast/dom/beforeload/resources/test.xsl: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomProcessingInstructioncpp">trunk/Source/WebCore/dom/ProcessingInstruction.cpp</a></li>
<li><a href="#trunkSourceWebCoredomProcessingInstructionh">trunk/Source/WebCore/dom/ProcessingInstruction.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLLinkElementcpp">trunk/Source/WebCore/html/HTMLLinkElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLLinkElementh">trunk/Source/WebCore/html/HTMLLinkElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementcpp">trunk/Source/WebCore/html/HTMLMediaElement.cpp</a></li>
<li><a href="#trunkSourceWebCoreloaderImageLoadercpp">trunk/Source/WebCore/loader/ImageLoader.cpp</a></li>
<li><a href="#trunkSourceWebCorestyleStyleScopecpp">trunk/Source/WebCore/style/StyleScope.cpp</a></li>
<li><a href="#trunkSourceWebCorestyleStyleScopeh">trunk/Source/WebCore/style/StyleScope.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadresourcescontentxhtml">trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadresourcespasscss">trunk/LayoutTests/fast/dom/beforeload/resources/pass.css</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadresourcestestxsl">trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/LayoutTests/ChangeLog 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2017-03-24 Brent Fulgham <bfulgham@apple.com>
+
+ Handle recursive calls to ProcessingInstruction::checkStyleSheet
+ https://bugs.webkit.org/show_bug.cgi?id=169982
+ <rdar://problem/31083051>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/dom/beforeload/image-removed-during-before-load-expected.txt: Added.
+ * fast/dom/beforeload/image-removed-during-before-load.html: Added.
+ * fast/dom/beforeload/recursive-css-pi-before-load-expected.txt: Added.
+ * fast/dom/beforeload/recursive-css-pi-before-load.html: Added.
+ * fast/dom/beforeload/recursive-link-before-load-expected.txt: Added.
+ * fast/dom/beforeload/recursive-link-before-load.html: Added.
+ * fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt: Added.
+ * fast/dom/beforeload/recursive-xsl-pi-before-load.html: Added.
+ * fast/dom/beforeload/resources/content.xhtml: Added.
+ * fast/dom/beforeload/resources/pass.css: Added.
+ * fast/dom/beforeload/resources/test.xsl: Added.
+
</ins><span class="cx"> 2017-03-24 Myles C. Maxfield <mmaxfield@apple.com>
</span><span class="cx">
</span><span class="cx"> font-style needs a new CSSValue to make CSSRule.cssText work correctly
</span></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+This test confirms that image loading properly handles a 'beforeload' events that removes the image from the document. It passes if no debug assertions are fired.
+
+PASS: Hit the beforeload handler
+PASS
+PASS: No assertions hit.
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,42 @@
</span><ins>+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ image = document.createElement("img");
+ image.setAttribute("style", "display:none");
+ image.addEventListener("load", function() {
+ print('PASS', 'green');
+ }, { once: true });
+ image.addEventListener("beforeload", function() {
+ print('PASS: Hit the beforeload handler', 'green');
+ document.body.removeChild(image);
+ image = null;
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(image);
+
+ image.setAttribute("src", "../../images/resources/test-load.jpg");
+}
+
+function step2()
+{
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that image loading properly handles a 'beforeload' events that removes the image from the document. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+This test confirms that CSS stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.
+
+PASS: No assertions hit.
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,45 @@
</span><ins>+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta http-equiv="pragma" content="no-cache"/>
+<meta http-equiv="expires" content="0"/>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ frame = document.createElement("iframe");
+ frame.setAttribute("src", "resources/content.xhtml");
+ frame.addEventListener("load", function(){
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(frame);
+
+ function step2(){
+ ins = 'href="pass.css" type="text/css"';
+ pi = frame.contentDocument.createProcessingInstruction('xml-stylesheet', ins);
+ pi.addEventListener("beforeload", function(){ pi.data = 'href="fail.css" type="text/css"'; }, { once: true });
+ frame.contentDocument.insertBefore(pi, frame.contentDocument.firstChild);
+
+ frame.contentDocument.removeChild(pi);
+ pi = null;
+
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that CSS stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+This test confirms that link elements properly handled changes during 'beforeload' events. It passes if no debug assertions are fired.
+
+PASS: Beforeload handled.
+PASS: No assertions hit.
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,61 @@
</span><ins>+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta http-equiv="pragma" content="no-cache"/>
+<meta http-equiv="expires" content="0"/>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ frame = document.createElement("iframe");
+ frame.setAttribute("src", "resources/content.xhtml");
+ frame.addEventListener("load", function(){
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(frame);
+
+ var link;
+ var head;
+
+ function step2() {
+ head = frame.contentDocument.getElementsByTagName('head')[0];
+
+ link = frame.contentDocument.createElement('link');
+ link.type = 'text/css';
+ link.rel = 'stylesheet';
+
+ link.addEventListener("beforeload", function() {
+ print("PASS: Beforeload handled.", "green");
+ link.href = 'fail.css';
+ setTimeout(step3, 0);
+ }, { once: true });
+
+ link.href = 'pass.css';
+
+ head.appendChild(link);
+ }
+
+ function step3() {
+ head.removeChild(link);
+ link = null;
+
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that link elements properly handled changes during 'beforeload' events. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+This test confirms that XSL stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.
+
+PASS: No assertions hit.
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,45 @@
</span><ins>+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta http-equiv="pragma" content="no-cache"/>
+<meta http-equiv="expires" content="0"/>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ frame = document.createElement("iframe");
+ frame.setAttribute("src", "resources/content.xhtml");
+ frame.addEventListener("load", function(){
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(frame);
+
+ function step2(){
+ ins = 'href="test.xsl?a=1" type="text/xsl"';
+ pi = frame.contentDocument.createProcessingInstruction('xml-stylesheet', ins);
+ pi.addEventListener("beforeload", function(){ pi.data = 'href="test.xsl?b=1" type="text/xsl"'; }, { once: true });
+ frame.contentDocument.insertBefore(pi, frame.contentDocument.firstChild);
+
+ frame.contentDocument.removeChild(pi);
+ pi = null;
+
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that XSL stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadresourcescontentxhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,8 @@
</span><ins>+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+hi
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadresourcespasscss"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/resources/pass.css (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/resources/pass.css (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/resources/pass.css 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+.block {
+ width: 100px;
+ height: 100px;
+ background-color: green;
+}
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadresourcestestxsl"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl (0 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:output method="html"/>
+ <xsl:template match="/">
+ <html>
+ <head>
+ </head>
+ <body>
+ Test
+ </body>
+ </html>
+ </xsl:template>
+</xsl:stylesheet>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/ChangeLog 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -1,3 +1,40 @@
</span><ins>+2017-03-24 Brent Fulgham <bfulgham@apple.com>
+
+ Handle recursive calls to ProcessingInstruction::checkStyleSheet
+ https://bugs.webkit.org/show_bug.cgi?id=169982
+ <rdar://problem/31083051>
+
+ Reviewed by Antti Koivisto.
+
+ See if we triggered a recursive load of the stylesheet during the 'beforeload'
+ event handler. If so, reset to a valid state before completing the load.
+
+ We should also check after 'beforeload' that we were not disconnected from (or
+ moved to a new) document.
+
+ I also looked for other cases of this pattern and fixed them.
+
+ Tests: fast/dom/beforeload/image-removed-during-before-load.html
+ fast/dom/beforeload/recursive-css-pi-before-load.html
+ fast/dom/beforeload/recursive-link-before-load.html
+ fast/dom/beforeload/recursive-xsl-pi-before-load.html
+
+ * dom/ProcessingInstruction.cpp:
+ (WebCore::ProcessingInstruction::clearExistingCachedSheet): Added.
+ (WebCore::ProcessingInstruction::checkStyleSheet): Reset to valid state
+ if necessary after the 'beforeload' handler. Also, safely handle the case where
+ the element was disconnected in the 'beforeload' handler (similar to what
+ we do in HTMLLinkElement).
+ (WebCore::ProcessingInstruction::setCSSStyleSheet): Drive-by Fix: Protect the
+ current document to match what we do in setXSLStyleSheet.
+ * dom/ProcessingInstruction.h:
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::selectMediaResource): Safely handle the case where
+ the element was disconnected in the 'beforeload' handler.
+ (WebCore::HTMLMediaElement::selectNextSourceChild): Ditto.
+ * loader/ImageLoader.cpp:
+ (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent): Ditto.
+
</ins><span class="cx"> 2017-03-24 Myles C. Maxfield <mmaxfield@apple.com>
</span><span class="cx">
</span><span class="cx"> font-style needs a new CSSValue to make CSSRule.cssText work correctly
</span></span></pre></div>
<a id="trunkSourceWebCoredomProcessingInstructioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ProcessingInstruction.cpp (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ProcessingInstruction.cpp 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.cpp 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 2000 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2013 Samsung Electronics. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include "StyleSheetContents.h"
</span><span class="cx"> #include "XMLDocumentParser.h"
</span><span class="cx"> #include "XSLStyleSheet.h"
</span><ins>+#include <wtf/SetForScope.h>
</ins><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="lines">@@ -80,6 +81,10 @@
</span><span class="cx">
</span><span class="cx"> void ProcessingInstruction::checkStyleSheet()
</span><span class="cx"> {
</span><ins>+ // Prevent recursive loading of stylesheet.
+ if (m_isHandlingBeforeLoad)
+ return;
+
</ins><span class="cx"> if (m_target == "xml-stylesheet" && document().frame() && parentNode() == &document()) {
</span><span class="cx"> // see http://www.w3.org/TR/xml-stylesheet/
</span><span class="cx"> // ### support stylesheet included in a fragment of this (or another) document
</span><span class="lines">@@ -134,13 +139,25 @@
</span><span class="cx"> document().styleScope().removePendingSheet(*this);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ Ref<Document> originalDocument = document();
+
</ins><span class="cx"> String url = document().completeURL(href).string();
</span><ins>+
+ {
+ SetForScope<bool> change(m_isHandlingBeforeLoad, true);
</ins><span class="cx"> if (!dispatchBeforeLoadEvent(url))
</span><span class="cx"> return;
</span><ins>+ }
</ins><span class="cx">
</span><ins>+ bool didEventListenerDisconnectThisElement = !isConnected() || &document() != originalDocument.ptr();
+ if (didEventListenerDisconnectThisElement)
+ return;
+
</ins><span class="cx"> m_loading = true;
</span><span class="cx"> document().styleScope().addPendingSheet(*this);
</span><span class="cx">
</span><ins>+ ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
+
</ins><span class="cx"> #if ENABLE(XSLT)
</span><span class="cx"> if (m_isXSL) {
</span><span class="cx"> auto options = CachedResourceLoader::defaultCachedResourceOptions();
</span><span class="lines">@@ -181,7 +198,8 @@
</span><span class="cx"> bool ProcessingInstruction::sheetLoaded()
</span><span class="cx"> {
</span><span class="cx"> if (!isLoading()) {
</span><del>- document().styleScope().removePendingSheet(*this);
</del><ins>+ if (document().styleScope().hasPendingSheet(*this))
+ document().styleScope().removePendingSheet(*this);
</ins><span class="cx"> #if ENABLE(XSLT)
</span><span class="cx"> if (m_isXSL)
</span><span class="cx"> document().styleScope().flushPendingUpdate();
</span><span class="lines">@@ -211,6 +229,7 @@
</span><span class="cx"> // We don't need the cross-origin security check here because we are
</span><span class="cx"> // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
</span><span class="cx"> // type.
</span><ins>+ Ref<Document> protect(document());
</ins><span class="cx"> parseStyleSheet(sheet->sheetText());
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoredomProcessingInstructionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ProcessingInstruction.h (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ProcessingInstruction.h 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.h 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 2000 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2006 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2013 Samsung Electronics. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -74,6 +74,8 @@
</span><span class="cx">
</span><span class="cx"> void parseStyleSheet(const String& sheet);
</span><span class="cx">
</span><ins>+ void clearExistingCachedSheet();
+
</ins><span class="cx"> String m_target;
</span><span class="cx"> String m_localHref;
</span><span class="cx"> String m_title;
</span><span class="lines">@@ -87,6 +89,7 @@
</span><span class="cx"> #if ENABLE(XSLT)
</span><span class="cx"> bool m_isXSL { false };
</span><span class="cx"> #endif
</span><ins>+ bool m_isHandlingBeforeLoad { false };
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLLinkElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLLinkElement.cpp (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLLinkElement.cpp 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/html/HTMLLinkElement.cpp 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -2,7 +2,7 @@
</span><span class="cx"> * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><span class="cx"> * (C) 2001 Dirk Mueller (mueller@kde.org)
</span><del>- * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010, 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
</span><span class="cx"> * Copyright (C) 2011 Google Inc. All rights reserved.
</span><span class="cx"> *
</span><span class="lines">@@ -55,6 +55,7 @@
</span><span class="cx"> #include "StyleScope.h"
</span><span class="cx"> #include "StyleSheetContents.h"
</span><span class="cx"> #include <wtf/Ref.h>
</span><ins>+#include <wtf/SetForScope.h>
</ins><span class="cx"> #include <wtf/StdLibExtras.h>
</span><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="lines">@@ -224,6 +225,10 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // Prevent recursive loading of link.
+ if (m_isHandlingBeforeLoad)
+ return;
+
</ins><span class="cx"> URL url = getNonEmptyURLAttribute(hrefAttr);
</span><span class="cx">
</span><span class="cx"> if (!m_linkLoader.loadLink(m_relAttribute, url, attributeWithoutSynchronization(asAttr), attributeWithoutSynchronization(crossoriginAttr), document()))
</span><span class="lines">@@ -243,8 +248,11 @@
</span><span class="cx"> m_cachedSheet = nullptr;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ {
+ SetForScope<bool> change(m_isHandlingBeforeLoad, true);
</ins><span class="cx"> if (!shouldLoadLink())
</span><span class="cx"> return;
</span><ins>+ }
</ins><span class="cx">
</span><span class="cx"> m_loading = true;
</span><span class="cx">
</span><span class="lines">@@ -277,6 +285,7 @@
</span><span class="cx">
</span><span class="cx"> request.setAsPotentiallyCrossOrigin(crossOrigin(), document());
</span><span class="cx">
</span><ins>+ ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
</ins><span class="cx"> m_cachedSheet = document().cachedResourceLoader().requestCSSStyleSheet(WTFMove(request));
</span><span class="cx">
</span><span class="cx"> if (m_cachedSheet)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLLinkElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLLinkElement.h (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLLinkElement.h 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/html/HTMLLinkElement.h 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><del>- * Copyright (C) 2003, 2008, 2010 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2011 Google Inc. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -132,6 +132,7 @@
</span><span class="cx"> bool m_createdByParser;
</span><span class="cx"> bool m_firedLoad;
</span><span class="cx"> bool m_loadedResource;
</span><ins>+ bool m_isHandlingBeforeLoad { false };
</ins><span class="cx">
</span><span class="cx"> PendingSheetType m_pendingSheetType;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -1325,6 +1325,8 @@
</span><span class="cx">
</span><span class="cx"> enum Mode { None, Object, Attribute, Children };
</span><span class="cx"> Mode mode = None;
</span><ins>+ Ref<Document> originalDocument = document();
+ bool didEventListenerDisconnectThisElement = false;
</ins><span class="cx">
</span><span class="cx"> if (m_mediaProvider) {
</span><span class="cx"> // 6. If the media element has an assigned media provider object, then let mode be object.
</span><span class="lines">@@ -1408,6 +1410,13 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ didEventListenerDisconnectThisElement = !isConnected() || &document() != originalDocument.ptr();
+ if (didEventListenerDisconnectThisElement) {
+ mediaLoadingFailed(MediaPlayer::FormatError);
+ LOG(Media, "HTMLMediaElement::selectMediaResource(%p) - document changed during load.", this);
+ return;
+ }
+
</ins><span class="cx"> // 3. If absolute URL was obtained successfully, set the currentSrc attribute to absolute URL.
</span><span class="cx"> m_currentSrc = absoluteURL;
</span><span class="cx">
</span><span class="lines">@@ -4215,10 +4224,12 @@
</span><span class="cx">
</span><span class="cx"> URL mediaURL;
</span><span class="cx"> HTMLSourceElement* source = nullptr;
</span><ins>+ Ref<Document> originalDocument = document();
</ins><span class="cx"> String type;
</span><span class="cx"> bool lookingForStartNode = m_nextChildNodeToConsider;
</span><span class="cx"> bool canUseSourceElement = false;
</span><del>- bool okToLoadSourceURL;
</del><ins>+ bool okToLoadSourceURL = false;
+ bool didEventListenerDisconnectThisElement = false;
</ins><span class="cx">
</span><span class="cx"> NodeVector potentialSourceNodes;
</span><span class="cx"> getChildNodes(*this, potentialSourceNodes);
</span><span class="lines">@@ -4291,6 +4302,13 @@
</span><span class="cx"> goto CheckAgain;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ didEventListenerDisconnectThisElement = !isConnected() || &document() != originalDocument.ptr();
+ if (didEventListenerDisconnectThisElement) {
+ LOG(Media, "HTMLMediaElement::selectNextSourceChild(%p) - 'beforeload' changed document during load.", this);
+ source = nullptr;
+ goto CheckAgain;
+ }
+
</ins><span class="cx"> if (!okToLoadSourceURL)
</span><span class="cx"> goto CheckAgain;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderImageLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/ImageLoader.cpp (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/ImageLoader.cpp 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/loader/ImageLoader.cpp 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -394,7 +394,12 @@
</span><span class="cx"> if (!element().document().hasLivingRenderTree())
</span><span class="cx"> return;
</span><span class="cx"> m_hasPendingBeforeLoadEvent = false;
</span><ins>+ Ref<Document> originalDocument = element().document();
</ins><span class="cx"> if (element().dispatchBeforeLoadEvent(m_image->url())) {
</span><ins>+ bool didEventListenerDisconnectThisElement = !element().isConnected() || &element().document() != originalDocument.ptr();
+ if (didEventListenerDisconnectThisElement)
+ return;
+
</ins><span class="cx"> updateRenderer();
</span><span class="cx"> return;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorestyleStyleScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/style/StyleScope.cpp (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/style/StyleScope.cpp 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/style/StyleScope.cpp 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><span class="cx"> * (C) 2001 Dirk Mueller (mueller@kde.org)
</span><span class="cx"> * (C) 2006 Alexey Proskuryakov (ap@webkit.org)
</span><del>- * Copyright (C) 2004-2009, 2011-2012, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004-2009, 2011-2012, 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
</span><span class="cx"> * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
</span><span class="cx"> * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
</span><span class="lines">@@ -233,6 +233,11 @@
</span><span class="cx"> return m_elementsInBodyWithPendingSheets.contains(&element);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+bool Scope::hasPendingSheet(const ProcessingInstruction& processingInstruction) const
+{
+ return m_processingInstructionsWithPendingSheets.contains(&processingInstruction);
+}
+
</ins><span class="cx"> void Scope::addStyleSheetCandidateNode(Node& node, bool createdByParser)
</span><span class="cx"> {
</span><span class="cx"> if (!node.isConnected())
</span></span></pre></div>
<a id="trunkSourceWebCorestyleStyleScopeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/style/StyleScope.h (214359 => 214360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/style/StyleScope.h 2017-03-24 18:23:48 UTC (rev 214359)
+++ trunk/Source/WebCore/style/StyleScope.h 2017-03-24 18:39:28 UTC (rev 214360)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><span class="cx"> * (C) 2001 Dirk Mueller (mueller@kde.org)
</span><span class="cx"> * (C) 2006 Alexey Proskuryakov (ap@webkit.org)
</span><del>- * Copyright (C) 2004-2010, 2012-2013, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004-2010, 2012-2013, 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
</span><span class="cx"> * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
</span><span class="cx"> * Copyright (C) 2011 Google Inc. All rights reserved.
</span><span class="lines">@@ -92,6 +92,7 @@
</span><span class="cx"> bool hasPendingSheetsInBody() const;
</span><span class="cx"> bool hasPendingSheet(const Element&) const;
</span><span class="cx"> bool hasPendingSheetInBody(const Element&) const;
</span><ins>+ bool hasPendingSheet(const ProcessingInstruction&) const;
</ins><span class="cx">
</span><span class="cx"> bool usesStyleBasedEditability() { return m_usesStyleBasedEditability; }
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>