Changeset 123426 in webkit for trunk/Source/WebCore/css/CSSGradientValue.h

Timestamp:

Jul 23, 2012, 10:34:42 PM (13 years ago)

Author:

[email protected]

Message:

Null-pointer crash when a derived color like -webkit-activelink is set in a gradient stop
​https://bugs.webkit.org/show_bug.cgi?id=89148

Patch by Douglas Stockwell <​[email protected]> on 2012-07-23
Reviewed by Simon Fraser.

Source/WebCore:

CSSGradientValue attempted to resolve colors during paint, this crashed
when a derived color like -webkit-activelink was encountered because the
corresponding element was no longer available in the StyleResolver.
Instead, by adding a field to CSSGradientColorStop we can resolve and
then cache the resolved colors at the correct time. To avoid sharing
cached derived colors between elements we clone the gradient values when
needed.

Test: fast/css/crash-on-gradient-with-derived-color.html

• css/CSSGradientValue.cpp:

(WebCore::CSSGradientValue::gradientWithStylesResolved): Added. Resolve and cache
resolved colors, clone if colors are derived from the element.
(WebCore):
(WebCore::CSSGradientValue::addStops):
(WebCore::CSSGradientValue::isCacheable): Defer to new logic in
StyleResolver.

• css/CSSGradientValue.h:

(CSSGradientColorStop): Added cache of resolved color.
(CSSGradientValue):
(CSSLinearGradientValue):
(CSSRadialGradientValue):

• css/CSSImageGeneratorValue.h:

(WebCore):

• css/CSSValue.h:

(WebCore::CSSValue::isGradientValue):

• css/StyleResolver.cpp:

(WebCore::StyleResolver::collectMatchingRulesForList):

• css/StyleResolver.h:

(StyleResolver):

• rendering/style/StyleGeneratedImage.cpp:

(WebCore::StyleGeneratedImage::image): Revert change from r96449. This
is no longer necessary as the gradient colors are now resolved at a
time when the style is set on StyleResolver.

LayoutTests:

• fast/css/crash-on-gradient-with-derived-color-expected.txt: Added.
• fast/css/crash-on-gradient-with-derived-color.html: Added.

File:

• trunk/Source/WebCore/css/CSSGradientValue.h (modified) (7 diffs)

trunk/Source/WebCore/css/CSSGradientValue.h

@@ -41 +41 @@
 
 struct CSSGradientColorStop {
+    CSSGradientColorStop() : m_colorIsDerivedFromElement(false) { };
     RefPtr<CSSPrimitiveValue> m_position; // percentage or length
     RefPtr<CSSPrimitiveValue> m_color;
+    Color m_resolvedColor;
+    bool m_colorIsDerivedFromElement;
 };
 
@@ -72 +75 @@
     bool isPending() const { return false; }
     void loadSubimages(CachedResourceLoader*) { }
+    PassRefPtr<CSSGradientValue> gradientWithStylesResolved(StyleResolver*);
 
 protected:
@@ -82 +86 @@
     }
 
+    CSSGradientValue(const CSSGradientValue& other, ClassType classType, bool deprecatedType = false)
+        : CSSImageGeneratorValue(classType)
+        , m_firstX(other.m_firstX)
+        , m_firstY(other.m_firstY)
+        , m_secondX(other.m_secondX)
+        , m_secondY(other.m_secondY)
+        , m_stops(other.m_stops)
+        , m_stopsSorted(other.m_stopsSorted)
+        , m_deprecatedType(deprecatedType)
+        , m_repeating(other.isRepeating() ? Repeating : NonRepeating)
+    {
+    }
+
     void addStops(Gradient*, RenderObject*, RenderStyle* rootStyle, float maxLengthForRepeat = 0);
 
@@ -118 +135 @@
     PassRefPtr<Gradient> createGradient(RenderObject*, const IntSize&);
 
+    PassRefPtr<CSSLinearGradientValue> clone() const
+    {
+        return adoptRef(new CSSLinearGradientValue(*this));
+    }
+
 private:
     CSSLinearGradientValue(CSSGradientRepeat repeat, bool deprecatedType = false)
@@ -124 +146 @@
     }
 
+    CSSLinearGradientValue(const CSSLinearGradientValue& other)
+        : CSSGradientValue(other, LinearGradientClass, other.deprecatedType())
+        , m_angle(other.m_angle)
+    {
+    }
+
     RefPtr<CSSPrimitiveValue> m_angle; // may be null.
 };
@@ -134 +162 @@
     }
 
+    PassRefPtr<CSSRadialGradientValue> clone() const
+    {
+        return adoptRef(new CSSRadialGradientValue(*this));
+    }
+
     String customCssText() const;
 
@@ -154 +187 @@
     }
 
+    CSSRadialGradientValue(const CSSRadialGradientValue& other)
+        : CSSGradientValue(other, RadialGradientClass, other.deprecatedType())
+        , m_firstRadius(other.m_firstRadius)
+        , m_secondRadius(other.m_secondRadius)
+        , m_shape(other.m_shape)
+        , m_sizingBehavior(other.m_sizingBehavior)
+        , m_endHorizontalSize(other.m_endHorizontalSize)
+        , m_endVerticalSize(other.m_endVerticalSize)
+    {
+    }
+
+
     // Resolve points/radii to front end values.
     float resolveRadius(CSSPrimitiveValue*, RenderStyle*, RenderStyle* rootStyle, float* widthOrHeight = 0);