diff options
16 files changed, 133 insertions, 71 deletions
diff --git a/LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt b/LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt new file mode 100644 index 0000000..848712a --- /dev/null +++ b/LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt @@ -0,0 +1,19 @@ +This test ensures that WebKit doesn't crash when the document.createTouchList API is called with non-Touch parameters + +On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". + + +PASS document.createTouchList(document).item(0) is null +PASS document.createTouchList({"a":1}).item(0) is null +PASS document.createTouchList(new Array(5)).item(0) is null +PASS document.createTouchList("string").item(0) is null +PASS document.createTouchList(null).item(0) is null +PASS document.createTouchList(undefined).item(0) is null +PASS tl.length is 3 +PASS tl.item(0) is non-null. +PASS tl.item(1) is null +PASS tl.item(2) is non-null. +PASS successfullyParsed is true + +TEST COMPLETE + diff --git a/LayoutTests/fast/events/touch/document-create-touch-list-crash.html b/LayoutTests/fast/events/touch/document-create-touch-list-crash.html new file mode 100644 index 0000000..9204abb --- /dev/null +++ b/LayoutTests/fast/events/touch/document-create-touch-list-crash.html @@ -0,0 +1,18 @@ +<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> +<html> +<head> +<link rel="stylesheet" href="../../js/resources/js-test-style.css"> +<script src="../../js/resources/js-test-pre.js"></script> +<script src="../../js/resources/js-test-post-function.js"></script> +<!-- + Touch tests that involve the ontouchstart, ontouchmove, ontouchend or ontouchcancel callbacks + should be written in an asynchronous fashion so they can be run on mobile platforms like Android. + You will need to invoke isSuccessfullyParsed() in your test script when the test completes. +--> +</head> +<body> +<p id="description"></p> +<div id="console"></div> +<script src="script-tests/document-create-touch-list-crash.js"></script> +</body> +</html> diff --git a/LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js b/LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js new file mode 100644 index 0000000..19cf913 --- /dev/null +++ b/LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js @@ -0,0 +1,20 @@ +description("This test ensures that WebKit doesn't crash when the document.createTouchList API is called with non-Touch parameters"); + +shouldBeNull('document.createTouchList(document).item(0)'); +shouldBeNull('document.createTouchList({"a":1}).item(0)'); +shouldBeNull('document.createTouchList(new Array(5)).item(0)'); +shouldBeNull('document.createTouchList("string").item(0)'); +shouldBeNull('document.createTouchList(null).item(0)'); +shouldBeNull('document.createTouchList(undefined).item(0)'); + +var t = document.createTouch(window, document.body, 12341, 60, 65, 100, 105); +var t2 = document.createTouch(window, document.body, 12342, 50, 55, 115, 120); +var tl = document.createTouchList(t, document, t2); + +shouldBe('tl.length', '3'); +shouldBeNonNull('tl.item(0)'); +shouldBeNull('tl.item(1)'); +shouldBeNonNull('tl.item(2)'); + +successfullyParsed = true; +isSuccessfullyParsed(); diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp index 7cad58e..d142a9f 100644 --- a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp +++ b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp @@ -43,6 +43,7 @@ #include "V8CanvasRenderingContext2D.h" #include "V8CustomXPathNSResolver.h" #include "V8DOMImplementation.h" +#include "V8DOMWrapper.h" #include "V8HTMLDocument.h" #include "V8IsolatedContext.h" #include "V8Node.h" @@ -144,9 +145,8 @@ v8::Handle<v8::Value> V8Document::createTouchListCallback(const v8::Arguments& a RefPtr<TouchList> touchList = TouchList::create(); for (int i = 0; i < args.Length(); i++) { - if (!args[i]->IsObject()) - return v8::Undefined(); - touchList->append(V8Touch::toNative(args[i]->ToObject())); + Touch* touch = V8DOMWrapper::isWrapperOfType(args[i], &V8Touch::info) ? V8Touch::toNative(args[i]->ToObject()) : 0; + touchList->append(touch); } return toV8(touchList.release()); diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp index ff50390..b6a1393 100644 --- a/Source/WebCore/dom/Document.cpp +++ b/Source/WebCore/dom/Document.cpp @@ -5064,15 +5064,9 @@ PassRefPtr<Touch> Document::createTouch(DOMWindow* window, EventTarget* target, // http://developer.apple.com/library/safari/#documentation/UserExperience/Reference/DocumentAdditionsReference/DocumentAdditions/DocumentAdditions.html // when this method should throw and nor is it by inspection of iOS behavior. It would be nice to verify any cases where it throws under iOS // and implement them here. See https://bugs.webkit.org/show_bug.cgi?id=47819 - // Ditto for the createTouchList method below. Frame* frame = window ? window->frame() : this->frame(); return Touch::create(frame, target, identifier, screenX, screenY, pageX, pageY); } - -PassRefPtr<TouchList> Document::createTouchList(ExceptionCode&) const -{ - return TouchList::create(); -} #endif DocumentLoader* Document::loader() const diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h index a4fc266..ce82b2e 100644 --- a/Source/WebCore/dom/Document.h +++ b/Source/WebCore/dom/Document.h @@ -1085,7 +1085,6 @@ public: #if ENABLE(TOUCH_EVENTS) PassRefPtr<Touch> createTouch(DOMWindow*, EventTarget*, int identifier, int pageX, int pageY, int screenX, int screenY, ExceptionCode&) const; - PassRefPtr<TouchList> createTouchList(ExceptionCode&) const; #endif const DocumentTiming* timing() const { return &m_documentTiming; } diff --git a/Source/WebCore/platform/graphics/android/fonts/FontAndroid.cpp b/Source/WebCore/platform/graphics/android/fonts/FontAndroid.cpp index e26fa9e..7bed5bb 100644 --- a/Source/WebCore/platform/graphics/android/fonts/FontAndroid.cpp +++ b/Source/WebCore/platform/graphics/android/fonts/FontAndroid.cpp @@ -63,6 +63,7 @@ using namespace android; namespace WebCore { typedef std::pair<int, float> FallbackFontKey; + typedef HashMap<FallbackFontKey, FontPlatformData*> FallbackHash; static void updateForFont(SkPaint* paint, const SimpleFontData* font) { @@ -696,7 +697,17 @@ const FontPlatformData* TextRunWalker::setupComplexFont( { static FallbackHash fallbackPlatformData; - FallbackFontKey key(script, platformData.size()); + // generate scriptStyleIndex - we need unique hash IDs for each style + // of each script - normal, bold, italic, bolditalic. the first set of + // NUM_SCRIPTS are the normal style version, followed by bold, then + // italic, then bold italic. additional fake style bits can be added. + int scriptStyleIndex = script; + if (platformData.isFakeBold()) + scriptStyleIndex += NUM_SCRIPTS; + if (platformData.isFakeItalic()) + scriptStyleIndex += NUM_SCRIPTS << 1; + + FallbackFontKey key(scriptStyleIndex, platformData.size()); FontPlatformData* newPlatformData = 0; if (!fallbackPlatformData.contains(key)) { diff --git a/Source/WebCore/platform/graphics/android/fonts/FontCacheAndroid.cpp b/Source/WebCore/platform/graphics/android/fonts/FontCacheAndroid.cpp index 5696a46..4bb388c 100644 --- a/Source/WebCore/platform/graphics/android/fonts/FontCacheAndroid.cpp +++ b/Source/WebCore/platform/graphics/android/fonts/FontCacheAndroid.cpp @@ -175,7 +175,7 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD } result = new FontPlatformData(tf, fontDescription.computedSize(), - (style & SkTypeface::kBold) && !tf->isBold(), + (style & SkTypeface::kBold), (style & SkTypeface::kItalic) && !tf->isItalic(), fontDescription.orientation(), fontDescription.textOrientation()); diff --git a/Source/WebCore/platform/graphics/android/fonts/FontPlatformData.h b/Source/WebCore/platform/graphics/android/fonts/FontPlatformData.h index 1e46971..02a0cea 100644 --- a/Source/WebCore/platform/graphics/android/fonts/FontPlatformData.h +++ b/Source/WebCore/platform/graphics/android/fonts/FontPlatformData.h @@ -92,6 +92,9 @@ public: HB_FaceRec_* harfbuzzFace() const; SkTypeface* typeface() const { return mTypeface; } + bool isFakeBold() const { return mFakeBold; } + bool isFakeItalic() const { return mFakeItalic; } + private: class RefCountedHarfbuzzFace : public RefCounted<RefCountedHarfbuzzFace> { public: diff --git a/Source/WebCore/platform/graphics/android/layers/BaseLayerAndroid.cpp b/Source/WebCore/platform/graphics/android/layers/BaseLayerAndroid.cpp index 82af3bf..9ee97ac 100644 --- a/Source/WebCore/platform/graphics/android/layers/BaseLayerAndroid.cpp +++ b/Source/WebCore/platform/graphics/android/layers/BaseLayerAndroid.cpp @@ -84,7 +84,13 @@ void BaseLayerAndroid::updatePositionsRecursive(const SkRect& visibleContentRect updateLayerPositions(visibleContentRect); TransformationMatrix ident; - FloatRect clip(0, 0, getWidth(), getHeight()); + + // Start with an unnecessarily large clip, since the base layer can + // dynamically increase in size to cover the viewport, and we cache its draw + // clip. This way the base layer will never have it's visible area clipped + // by its m_clippingRect, only the viewport. + // Note: values larger than this suffer from floating point rounding issues + FloatRect clip(0, 0, 1e7, 1e7); bool forcePositionCalculation = !m_positionsCalculated; float scale = 1.0f; diff --git a/Source/WebCore/platform/graphics/android/layers/LayerAndroid.cpp b/Source/WebCore/platform/graphics/android/layers/LayerAndroid.cpp index 293bbbc..d709a9c 100644 --- a/Source/WebCore/platform/graphics/android/layers/LayerAndroid.cpp +++ b/Source/WebCore/platform/graphics/android/layers/LayerAndroid.cpp @@ -122,6 +122,7 @@ LayerAndroid::LayerAndroid(const LayerAndroid& layer) : Layer(layer), m_transform = layer.m_transform; m_drawTransform = layer.m_drawTransform; + m_drawTransformUnfudged = layer.m_drawTransformUnfudged; m_childrenTransform = layer.m_childrenTransform; m_dirtyRegion = layer.m_dirtyRegion; @@ -272,6 +273,9 @@ void LayerAndroid::addDirtyArea() return; } + // TODO: rewrite this to handle partial invalidate, and to handle base + // layer's large clip correctly + IntSize layerSize(getSize().width(), getSize().height()); FloatRect area = @@ -283,6 +287,7 @@ void LayerAndroid::addDirtyArea() area.intersect(clip); IntRect dirtyArea(area.x(), area.y(), area.width(), area.height()); + state()->addDirtyArea(dirtyArea); } @@ -407,6 +412,7 @@ void LayerAndroid::updateLocalTransformAndClip(const TransformationMatrix& paren -originY, -anchorPointZ()); + m_drawTransformUnfudged = m_drawTransform; if (m_drawTransform.isIdentityOrTranslation() && surface() && surface()->allowTransformFudging()) { // adjust the translation coordinates of the draw transform matrix so @@ -455,9 +461,8 @@ void LayerAndroid::updateGLPositionsAndScale(const TransformationMatrix& parentM setDrawOpacity(opacity); // constantly recalculate the draw transform of layers that may require it (and their children) - forceCalculation |= isPositionFixed() - || contentIsScrollable() - || (m_animations.size() != 0); + forceCalculation |= hasDynamicTransform(); + forceCalculation &= !(disableFixedElemUpdate && isPositionFixed()); if (forceCalculation) updateLocalTransformAndClip(parentMatrix, clipping); @@ -465,7 +470,7 @@ void LayerAndroid::updateGLPositionsAndScale(const TransformationMatrix& parentM if (!countChildren() || !m_visible) return; - TransformationMatrix localMatrix = m_drawTransform; + TransformationMatrix localMatrix = m_drawTransformUnfudged; // Flatten to 2D if the layer doesn't preserve 3D. if (!preserves3D()) { @@ -682,7 +687,7 @@ void LayerAndroid::assignSurfaces(LayerMergeState* mergeState) mergeState->currentSurface->addLayer(this, m_drawTransform); m_surface = mergeState->currentSurface; - if (contentIsScrollable() || isPositionFixed()) { + if (hasDynamicTransform()) { // disable layer merging within the children of these layer types mergeState->nonMergeNestedLevel++; } @@ -704,7 +709,7 @@ void LayerAndroid::assignSurfaces(LayerMergeState* mergeState) mergeState->depth--; } - if (contentIsScrollable() || isPositionFixed()) { + if (hasDynamicTransform()) { // re-enable joining mergeState->nonMergeNestedLevel--; diff --git a/Source/WebCore/platform/graphics/android/layers/LayerAndroid.h b/Source/WebCore/platform/graphics/android/layers/LayerAndroid.h index c56d50a..f821d89 100644 --- a/Source/WebCore/platform/graphics/android/layers/LayerAndroid.h +++ b/Source/WebCore/platform/graphics/android/layers/LayerAndroid.h @@ -166,7 +166,7 @@ public: void setPreserves3D(bool value) { m_preserves3D = value; } void setAnchorPointZ(float z) { m_anchorPointZ = z; } float anchorPointZ() { return m_anchorPointZ; } - void setDrawTransform(const TransformationMatrix& transform) { m_drawTransform = transform; } + void setDrawTransform(const TransformationMatrix& transform) { m_drawTransform = m_drawTransformUnfudged = transform; } virtual const TransformationMatrix* drawTransform() const { return &m_drawTransform; } void setChildrenTransform(const TransformationMatrix& t) { m_childrenTransform = t; } void setDrawClip(const FloatRect& rect) { m_clippingRect = rect; } @@ -300,11 +300,15 @@ protected: virtual void onDraw(SkCanvas*, SkScalar opacity, android::DrawExtra* extra, PaintStyle style); virtual InvalidateFlags onSetHwAccelerated(bool hwAccelerated) { return InvalidateNone; } TransformationMatrix m_drawTransform; + TransformationMatrix m_drawTransformUnfudged; int m_uniqueId; private: void updateLocalTransformAndClip(const TransformationMatrix& parentMatrix, const FloatRect& clip); + bool hasDynamicTransform() { + return contentIsScrollable() || isPositionFixed() || (m_animations.size() != 0); + } #if DUMP_NAV_CACHE friend class CachedLayer::Debug; // debugging access only diff --git a/Source/WebCore/platform/graphics/android/rendering/Surface.cpp b/Source/WebCore/platform/graphics/android/rendering/Surface.cpp index 9df1a7a..73466d3 100644 --- a/Source/WebCore/platform/graphics/android/rendering/Surface.cpp +++ b/Source/WebCore/platform/graphics/android/rendering/Surface.cpp @@ -90,13 +90,24 @@ bool Surface::tryUpdateSurface(Surface* oldSurface) return true; } + SkRegion invalRegion; + bool fullInval = false; if (singleLayer() && oldSurface->singleLayer()) { // both are single matching layers, simply apply inval SkRegion* layerInval = getFirstLayer()->getInvalRegion(); - m_surfaceBacking->markAsDirty(*layerInval); + invalRegion = *layerInval; + + if (isBase()) { + // the base layer paints outside it's content area to ensure the + // viewport is convered, so fully invalidate all tiles if its size + // changes to ensure no stale content remains + LayerContent* newContent = getFirstLayer()->content(); + LayerContent* oldContent = oldSurface->getFirstLayer()->content(); + fullInval = newContent->width() != oldContent->width() + || newContent->height() != oldContent->height(); + } } else { - SkRegion invalRegion; - bool fullInval = m_layers.size() != oldSurface->m_layers.size(); + fullInval = m_layers.size() != oldSurface->m_layers.size(); if (!fullInval) { for (unsigned int i = 0; i < m_layers.size(); i++) { if ((m_layers[i]->uniqueId() != oldSurface->m_layers[i]->uniqueId()) @@ -111,16 +122,15 @@ bool Surface::tryUpdateSurface(Surface* oldSurface) FloatRect layerPos = m_layers[i]->fullContentAreaMapped(); m_layers[i]->getInvalRegion()->translate(layerPos.x(), layerPos.y()); invalRegion.op(*(m_layers[i]->getInvalRegion()), SkRegion::kUnion_Op); - break; } } } + } - if (fullInval) - invalRegion.setRect(-1e8, -1e8, 2e8, 2e8); + if (fullInval) + invalRegion.setRect(-1e8, -1e8, 2e8, 2e8); - m_surfaceBacking->markAsDirty(invalRegion); - } + m_surfaceBacking->markAsDirty(invalRegion); return true; } @@ -230,17 +240,15 @@ bool Surface::drawGL(bool layerTilesDisabled) if (singleLayer() && !getFirstLayer()->visible()) return false; - bool isBaseLayer = isBase() - || getFirstLayer()->subclassType() == LayerAndroid::FixedBackgroundImageLayer - || getFirstLayer()->subclassType() == LayerAndroid::ForegroundBaseLayer; - - FloatRect drawClip = getFirstLayer()->drawClip(); - if (!singleLayer()) { - for (unsigned int i = 1; i < m_layers.size(); i++) - drawClip.unite(m_layers[i]->drawClip()); + if (!isBase()) { + FloatRect drawClip = getFirstLayer()->drawClip(); + if (!singleLayer()) { + for (unsigned int i = 1; i < m_layers.size(); i++) + drawClip.unite(m_layers[i]->drawClip()); + } + FloatRect clippingRect = TilesManager::instance()->shader()->rectInInvViewCoord(drawClip); + TilesManager::instance()->shader()->clip(clippingRect); } - FloatRect clippingRect = TilesManager::instance()->shader()->rectInInvViewCoord(drawClip); - TilesManager::instance()->shader()->clip(clippingRect); bool askRedraw = false; if (m_surfaceBacking && !tilesDisabled) { diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp index 1ffa0de..bad0668 100644 --- a/Source/WebCore/rendering/RenderLayer.cpp +++ b/Source/WebCore/rendering/RenderLayer.cpp @@ -3152,14 +3152,6 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont candidateLayer = hitLayer; } -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - if (hasOverflowParent()) { - ClipRects clipRects; - calculateClipRects(rootLayer, clipRects, useTemporaryClipRects); - fgRect.intersect(clipRects.hitTestClip()); - bgRect.intersect(clipRects.hitTestClip()); - } -#endif // Next we want to see if the mouse pos is inside the child RenderObjects of the layer. if (fgRect.intersects(hitTestArea) && isSelfPaintingLayer()) { // Hit test with a temporary HitTestResult, because we only want to commit to 'result' if we know we're frontmost. @@ -3451,8 +3443,6 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& cl if (renderer()->hasOverflowClip()) { IntRect newOverflowClip = toRenderBox(renderer())->overflowClipRect(x, y, relevancy); #if ENABLE(ANDROID_OVERFLOW_SCROLL) - clipRects.setHitTestClip(intersection(clipRects.fixed() ? clipRects.fixedClipRect() - : newOverflowClip, clipRects.hitTestClip())); if (hasOverflowScroll()) { RenderBox* box = toRenderBox(renderer()); newOverflowClip = diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h index 5e421f0..ceb9026 100644 --- a/Source/WebCore/rendering/RenderLayer.h +++ b/Source/WebCore/rendering/RenderLayer.h @@ -80,9 +80,6 @@ public: : m_overflowClipRect(r) , m_fixedClipRect(r) , m_posClipRect(r) -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - , m_hitTestClip(r) -#endif , m_refCnt(0) , m_fixed(false) { @@ -92,9 +89,6 @@ public: : m_overflowClipRect(other.overflowClipRect()) , m_fixedClipRect(other.fixedClipRect()) , m_posClipRect(other.posClipRect()) -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - , m_hitTestClip(other.hitTestClip()) -#endif , m_refCnt(0) , m_fixed(other.fixed()) { @@ -105,9 +99,6 @@ public: m_overflowClipRect = r; m_fixedClipRect = r; m_posClipRect = r; -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - m_hitTestClip = r; -#endif m_fixed = false; } @@ -119,10 +110,6 @@ public: const IntRect& posClipRect() const { return m_posClipRect; } void setPosClipRect(const IntRect& r) { m_posClipRect = r; } -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - const IntRect& hitTestClip() const { return m_hitTestClip; } - void setHitTestClip(const IntRect& r) { m_hitTestClip = r; } -#endif bool fixed() const { return m_fixed; } void setFixed(bool fixed) { m_fixed = fixed; } @@ -143,9 +130,6 @@ public: return m_overflowClipRect == other.overflowClipRect() && m_fixedClipRect == other.fixedClipRect() && m_posClipRect == other.posClipRect() && -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - m_hitTestClip == other.hitTestClip() && -#endif m_fixed == other.fixed(); } @@ -154,9 +138,6 @@ public: m_overflowClipRect = other.overflowClipRect(); m_fixedClipRect = other.fixedClipRect(); m_posClipRect = other.posClipRect(); -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - m_hitTestClip = other.hitTestClip(); -#endif m_fixed = other.fixed(); return *this; } @@ -169,9 +150,6 @@ private: IntRect m_overflowClipRect; IntRect m_fixedClipRect; IntRect m_posClipRect; -#if ENABLE(ANDROID_OVERFLOW_SCROLL) - IntRect m_hitTestClip; -#endif unsigned m_refCnt : 31; bool m_fixed : 1; }; diff --git a/Source/WebKit/android/jni/WebViewCore.cpp b/Source/WebKit/android/jni/WebViewCore.cpp index 81c080d..5e0969f 100644 --- a/Source/WebKit/android/jni/WebViewCore.cpp +++ b/Source/WebKit/android/jni/WebViewCore.cpp @@ -3413,7 +3413,7 @@ jobject WebViewCore::createTextFieldInitData(Node* node) env->SetObjectField(initData, classDef->m_name, fieldName.get()); ScopedLocalRef<jstring> label(env, wtfStringToJstring(env, requestLabel(document->frame(), node), false)); - env->SetObjectField(initData, classDef->m_name, label.get()); + env->SetObjectField(initData, classDef->m_label, label.get()); env->SetIntField(initData, classDef->m_maxLength, getMaxLength(node)); LayerAndroid* layer = 0; int layerId = platformLayerIdFromNode(node, &layer); @@ -3888,11 +3888,18 @@ void WebViewCore::setBackgroundColor(SkColor c) // need (int) cast to find the right constructor WebCore::Color bcolor((int)SkColorGetR(c), (int)SkColorGetG(c), (int)SkColorGetB(c), (int)SkColorGetA(c)); + + if (view->baseBackgroundColor() == bcolor) + return; + view->setBaseBackgroundColor(bcolor); // Background color of 0 indicates we want a transparent background if (c == 0) view->setTransparent(true); + + //invalidate so the new color is shown + contentInvalidateAll(); } jclass WebViewCore::getPluginClass(const WTF::String& libName, const char* className) |