webkitgtk-2.16.5HEADwebkitgtk-2.16.5master

1 files changed, 74 insertions, 63 deletions

diff --git a/Source/WebCore/dom/ProcessingInstruction.cpp b/Source/WebCore/dom/ProcessingInstruction.cpp
index 249bba8a4..da405428c 100644
--- a/Source/WebCore/dom/ProcessingInstruction.cpp
+++ b/Source/WebCore/dom/ProcessingInstruction.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Samsung Electronics. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -28,33 +28,26 @@
 #include "CachedResourceRequest.h"
 #include "CachedXSLStyleSheet.h"
 #include "Document.h"
-#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
-#include "XSLStyleSheet.h"
-#include "XMLDocumentParser.h" // for parseAttributes()
 #include "MediaList.h"
+#include "StyleScope.h"
 #include "StyleSheetContents.h"
+#include "XMLDocumentParser.h"
+#include "XSLStyleSheet.h"
+#include <wtf/SetForScope.h>
 
 namespace WebCore {
 
 inline ProcessingInstruction::ProcessingInstruction(Document& document, const String& target, const String& data)
     : CharacterData(document, data, CreateOther)
     , m_target(target)
-    , m_cachedSheet(0)
-    , m_loading(false)
-    , m_alternate(false)
-    , m_createdByParser(false)
-    , m_isCSS(false)
-#if ENABLE(XSLT)
-    , m_isXSL(false)
-#endif
 {
 }
 
-PassRefPtr<ProcessingInstruction> ProcessingInstruction::create(Document& document, const String& target, const String& data)
+Ref<ProcessingInstruction> ProcessingInstruction::create(Document& document, const String& target, const String& data)
 {
-    return adoptRef(new ProcessingInstruction(document, target, data));
+    return adoptRef(*new ProcessingInstruction(document, target, data));
 }
 
 ProcessingInstruction::~ProcessingInstruction()
@@ -63,10 +56,10 @@ ProcessingInstruction::~ProcessingInstruction()
         m_sheet->clearOwnerNode();
 
     if (m_cachedSheet)
-        m_cachedSheet->removeClient(this);
+        m_cachedSheet->removeClient(*this);
 
-    if (inDocument())
-        document().styleSheetCollection().removeStyleSheetCandidateNode(*this);
+    if (isConnected())
+        document().styleScope().removeStyleSheetCandidateNode(*this);
 }
 
 String ProcessingInstruction::nodeName() const
@@ -79,15 +72,19 @@ Node::NodeType ProcessingInstruction::nodeType() const
     return PROCESSING_INSTRUCTION_NODE;
 }
 
-PassRefPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
+Ref<Node> ProcessingInstruction::cloneNodeInternal(Document& targetDocument, CloningOperation)
 {
     // FIXME: Is it a problem that this does not copy m_localHref?
     // What about other data members?
-    return create(document(), m_target, data());
+    return create(targetDocument, m_target, data());
 }
 
 void ProcessingInstruction::checkStyleSheet()
 {
+    // Prevent recursive loading of stylesheet.
+    if (m_isHandlingBeforeLoad)
+        return;
+
     if (m_target == "xml-stylesheet" && document().frame() && parentNode() == &document()) {
         // see http://www.w3.org/TR/xml-stylesheet/
         // ### support stylesheet included in a fragment of this (or another) document
@@ -133,37 +130,52 @@ void ProcessingInstruction::checkStyleSheet()
 #endif
         } else {
             if (m_cachedSheet) {
-                m_cachedSheet->removeClient(this);
-                m_cachedSheet = 0;
+                m_cachedSheet->removeClient(*this);
+                m_cachedSheet = nullptr;
             }
-            
+
             String url = document().completeURL(href).string();
+
+            Ref<Document> originalDocument = document();
+
+            {
+            SetForScope<bool> change(m_isHandlingBeforeLoad, true);
             if (!dispatchBeforeLoadEvent(url))
                 return;
-            
+            }
+
+            bool didEventListenerDisconnectThisElement = !isConnected() || &document() != originalDocument.ptr();
+            if (didEventListenerDisconnectThisElement)
+                return;
+
             m_loading = true;
-            document().styleSheetCollection().addPendingSheet();
-            
-            CachedResourceRequest request(ResourceRequest(document().completeURL(href)));
+            document().styleScope().addPendingSheet();
+
+            ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
+
 #if ENABLE(XSLT)
-            if (m_isXSL)
-                m_cachedSheet = document().cachedResourceLoader()->requestXSLStyleSheet(request);
-            else
+            if (m_isXSL) {
+                auto options = CachedResourceLoader::defaultCachedResourceOptions();
+                options.mode = FetchOptions::Mode::SameOrigin;
+                m_cachedSheet = document().cachedResourceLoader().requestXSLStyleSheet({ResourceRequest(document().completeURL(href)), options});
+            } else
 #endif
             {
                 String charset = attrs.get("charset");
-                if (charset.isEmpty())
-                    charset = document().charset();
-                request.setCharset(charset);
+                CachedResourceRequest request(document().completeURL(href), CachedResourceLoader::defaultCachedResourceOptions(), std::nullopt, charset.isEmpty() ? document().charset() : WTFMove(charset));
 
-                m_cachedSheet = document().cachedResourceLoader()->requestCSSStyleSheet(request);
+                m_cachedSheet = document().cachedResourceLoader().requestCSSStyleSheet(WTFMove(request));
             }
             if (m_cachedSheet)
-                m_cachedSheet->addClient(this);
+                m_cachedSheet->addClient(*this);
             else {
                 // The request may have been denied if (for example) the stylesheet is local and the document is remote.
                 m_loading = false;
-                document().styleSheetCollection().removePendingSheet();
+                document().styleScope().removePendingSheet();
+#if ENABLE(XSLT)
+                if (m_isXSL)
+                    document().styleScope().flushPendingUpdate();
+#endif
             }
         }
     }
@@ -181,7 +193,11 @@ bool ProcessingInstruction::isLoading() const
 bool ProcessingInstruction::sheetLoaded()
 {
     if (!isLoading()) {
-        document().styleSheetCollection().removePendingSheet();
+        document().styleScope().removePendingSheet();
+#if ENABLE(XSLT)
+        if (m_isXSL)
+            document().styleScope().flushPendingUpdate();
+#endif
         return true;
     }
     return false;
@@ -189,7 +205,7 @@ bool ProcessingInstruction::sheetLoaded()
 
 void ProcessingInstruction::setCSSStyleSheet(const String& href, const URL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet)
 {
-    if (!inDocument()) {
+    if (!isConnected()) {
         ASSERT(!m_sheet);
         return;
     }
@@ -197,17 +213,18 @@ void ProcessingInstruction::setCSSStyleSheet(const String& href, const URL& base
     ASSERT(m_isCSS);
     CSSParserContext parserContext(document(), baseURL, charset);
 
-    auto cssSheet = CSSStyleSheet::create(StyleSheetContents::create(href, parserContext), this);
+    auto cssSheet = CSSStyleSheet::create(StyleSheetContents::create(href, parserContext), *this);
     cssSheet.get().setDisabled(m_alternate);
     cssSheet.get().setTitle(m_title);
     cssSheet.get().setMediaQueries(MediaQuerySet::create(m_media));
 
-    m_sheet = std::move(cssSheet);
+    m_sheet = WTFMove(cssSheet);
 
     // We don't need the cross-origin security check here because we are
     // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
     // type.
-    parseStyleSheet(sheet->sheetText(true));
+    Ref<Document> protect(document());
+    parseStyleSheet(sheet->sheetText());
 }
 
 #if ENABLE(XSLT)
@@ -223,35 +240,26 @@ void ProcessingInstruction::setXSLStyleSheet(const String& href, const URL& base
 void ProcessingInstruction::parseStyleSheet(const String& sheet)
 {
     if (m_isCSS)
-        static_cast<CSSStyleSheet*>(m_sheet.get())->contents().parseString(sheet);
+        downcast<CSSStyleSheet>(*m_sheet).contents().parseString(sheet);
 #if ENABLE(XSLT)
     else if (m_isXSL)
-        static_cast<XSLStyleSheet*>(m_sheet.get())->parseString(sheet);
+        downcast<XSLStyleSheet>(*m_sheet).parseString(sheet);
 #endif
 
     if (m_cachedSheet)
-        m_cachedSheet->removeClient(this);
-    m_cachedSheet = 0;
+        m_cachedSheet->removeClient(*this);
+    m_cachedSheet = nullptr;
 
     m_loading = false;
 
     if (m_isCSS)
-        static_cast<CSSStyleSheet*>(m_sheet.get())->contents().checkLoaded();
+        downcast<CSSStyleSheet>(*m_sheet).contents().checkLoaded();
 #if ENABLE(XSLT)
     else if (m_isXSL)
-        static_cast<XSLStyleSheet*>(m_sheet.get())->checkLoaded();
+        downcast<XSLStyleSheet>(*m_sheet).checkLoaded();
 #endif
 }
 
-void ProcessingInstruction::setCSSStyleSheet(PassRefPtr<CSSStyleSheet> sheet)
-{
-    ASSERT(!m_cachedSheet);
-    ASSERT(!m_loading);
-    m_sheet = sheet;
-    sheet->setTitle(m_title);
-    sheet->setDisabled(m_alternate);
-}
-
 void ProcessingInstruction::addSubresourceAttributeURLs(ListHashSet<URL>& urls) const
 {
     if (!sheet())
@@ -263,9 +271,9 @@ void ProcessingInstruction::addSubresourceAttributeURLs(ListHashSet<URL>& urls)
 Node::InsertionNotificationRequest ProcessingInstruction::insertedInto(ContainerNode& insertionPoint)
 {
     CharacterData::insertedInto(insertionPoint);
-    if (!insertionPoint.inDocument())
+    if (!insertionPoint.isConnected())
         return InsertionDone;
-    document().styleSheetCollection().addStyleSheetCandidateNode(*this, m_createdByParser);
+    document().styleScope().addStyleSheetCandidateNode(*this, m_createdByParser);
     checkStyleSheet();
     return InsertionDone;
 }
@@ -273,20 +281,23 @@ Node::InsertionNotificationRequest ProcessingInstruction::insertedInto(Container
 void ProcessingInstruction::removedFrom(ContainerNode& insertionPoint)
 {
     CharacterData::removedFrom(insertionPoint);
-    if (!insertionPoint.inDocument())
+    if (!insertionPoint.isConnected())
         return;
     
-    document().styleSheetCollection().removeStyleSheetCandidateNode(*this);
+    document().styleScope().removeStyleSheetCandidateNode(*this);
 
     if (m_sheet) {
         ASSERT(m_sheet->ownerNode() == this);
         m_sheet->clearOwnerNode();
-        m_sheet = 0;
+        m_sheet = nullptr;
+    }
+
+    if (m_loading) {
+        m_loading = false;
+        document().styleScope().removePendingSheet();
     }
 
-    // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
-    if (document().hasLivingRenderTree())
-        document().styleResolverChanged(DeferRecalcStyle);
+    document().styleScope().didChangeActiveStyleSheetCandidates();
 }
 
 void ProcessingInstruction::finishParsingChildren()