Commit dbd778e6 authored by Rune Lillesveen's avatar Rune Lillesveen Committed by Commit Bot

Avoid scheduling invalidation sets from style recalc.

Sadly, we do SetInlineStyleProperty() for UA shadow DOM during style
recalc in some cases. Make sure that we don't schedule any invalidation
while in style reacalc as that would leave use with a dirty tree for
style invalidations after UpdateStyle().

This fixes a regression introduced in [1] where we unified the
invalidation code for the various ways of changing the inline style.

[1] https://crrev.com/2faf55836255e6762141712d943c47f3208c8ac4

Bug: 1057210
Change-Id: I0edab4acc03baefe0fb386c15dce78e0f8e041ff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2082382
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: default avatarAnders Hartvoll Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/master@{#746434}
parent c580d0af
......@@ -26,6 +26,7 @@ void PendingInvalidations::ScheduleInvalidationSetsForNode(
const InvalidationLists& invalidation_lists,
ContainerNode& node) {
DCHECK(node.InActiveDocument());
DCHECK(!node.GetDocument().InStyleRecalc());
bool requires_descendant_invalidation = false;
if (node.GetStyleChangeType() < kSubtreeStyleChange) {
......
......@@ -894,6 +894,26 @@ void StyleEngine::PlatformColorsChanged() {
bool StyleEngine::ShouldSkipInvalidationFor(const Element& element) const {
if (!element.InActiveDocument())
return true;
if (GetDocument().InStyleRecalc()) {
#if DCHECK_IS_ON()
// TODO(futhark): The InStyleRecalc() if-guard above should have been a
// DCHECK(!InStyleRecalc()), but there are a couple of cases where we try to
// invalidate style from style recalc:
//
// 1. We may animate the class attribute of an SVG element and change it
// during style recalc when applying the animation effect.
// 2. We may call SetInlineStyle on elements in a UA shadow tree as part of
// style recalc. For instance from HTMLImageFallbackHelper.
//
// If there are more cases, we need to adjust the DCHECKs below, but ideally
// The origin of these invalidations should be fixed.
if (!element.IsSVGElement()) {
DCHECK(element.ContainingShadowRoot());
DCHECK(element.ContainingShadowRoot()->IsUserAgent());
}
#endif // DCHECK_IS_ON()
return true;
}
if (GetDocument().GetStyleChangeType() == kSubtreeStyleChange)
return true;
Element* root = GetDocument().documentElement();
......
<!doctype html>
<title>Crash test: img alt rendering in combination with style attribute selector</title>
<link rel="help" href="https://crbug.com/1057210">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<style>
img { display: block; width: 100px; }
[style] + * {}
</style>
<img id="img" alt="alternative text">
<script>
test(() => {
assert_equals(getComputedStyle(img).width, "100px");
}, "Should not crash.");
</script>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment