REGRESSION: ChildrenAffectedBy flags lost between siblings which have child elements sharing style

https://bugs.webkit.org/show_bug.cgi?id=105672

Reviewed by Andreas Kling.

Change in how childrenAffectedBy bits were stored made it easier to trigger an issue where childrenAffectedBy bits
were not set due to sharing of styles between cousin elements.

This patch fixes the issue by not sharing styles from children with parents who prevent sharing.

Tests: fast/selectors/cousin-stylesharing-adjacent-selector.html
        fast/selectors/cousin-stylesharing-last-child-selector.html

* css/StyleResolver.cpp:
(WebCore::parentElementPreventsSharing):
(WebCore::StyleResolver::locateCousinList):
* dom/Element.cpp:
(WebCore::Element::hasFlagsSetDuringStylingOfChildren):
* dom/Element.h:
(Element):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141093 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: I333eb08622790a1be96287abca38e0d1efb49de6
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>

4 files changed, 48 insertions, 11 deletions

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 6e3cec05e..3f5a0a762 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -12,6 +12,29 @@
         * platform/graphics/qt/GraphicsContextQt.cpp:
         (WebCore::GraphicsContext::clipBounds):
 
+2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        REGRESSION: ChildrenAffectedBy flags lost between siblings which have child elements sharing style
+        https://bugs.webkit.org/show_bug.cgi?id=105672
+
+        Reviewed by Andreas Kling.
+
+        Change in how childrenAffectedBy bits were stored made it easier to trigger an issue where childrenAffectedBy bits
+        were not set due to sharing of styles between cousin elements.
+
+        This patch fixes the issue by not sharing styles from children with parents who prevent sharing.
+
+        Tests: fast/selectors/cousin-stylesharing-adjacent-selector.html
+               fast/selectors/cousin-stylesharing-last-child-selector.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::parentElementPreventsSharing):
+        (WebCore::StyleResolver::locateCousinList):
+        * dom/Element.cpp:
+        (WebCore::Element::hasFlagsSetDuringStylingOfChildren):
+        * dom/Element.h:
+        (Element):
+
 2013-01-04  John Mellor  <johnme@chromium.org>
 
         Early out from FontCache::releaseFontData if cached font data not found.
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index 95a975779..b14800b31 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -1005,6 +1005,13 @@ inline void StyleResolver::initForStyleResolve(Element* e, RenderStyle* parentSt
 static const unsigned cStyleSearchThreshold = 10;
 static const unsigned cStyleSearchLevelThreshold = 10;
 
+static inline bool parentElementPreventsSharing(const Element* parentElement)
+{
+    if (!parentElement)
+        return false;
+    return parentElement->hasFlagsSetDuringStylingOfChildren();
+}
+
 Node* StyleResolver::locateCousinList(Element* parent, unsigned& visitedNodeCount) const
 {
     if (visitedNodeCount >= cStyleSearchThreshold * cStyleSearchLevelThreshold)
@@ -1034,7 +1041,8 @@ Node* StyleResolver::locateCousinList(Element* parent, unsigned& visitedNodeCoun
     while (thisCousin) {
         while (currentNode) {
             ++subcount;
-            if (currentNode->renderStyle() == parentStyle && currentNode->lastChild()) {
+            if (currentNode->renderStyle() == parentStyle && currentNode->lastChild()
+                && currentNode->isElementNode() && !parentElementPreventsSharing(toElement(currentNode))) {
                 // Adjust for unused reserved tries.
                 visitedNodeCount -= cStyleSearchThreshold - subcount;
                 return currentNode->lastChild();
@@ -1247,16 +1255,6 @@ inline StyledElement* StyleResolver::findSiblingForStyleSharing(Node* node, unsi
     return static_cast<StyledElement*>(node);
 }
 
-static inline bool parentElementPreventsSharing(const Element* parentElement)
-{
-    if (!parentElement)
-        return false;
-    return parentElement->childrenAffectedByPositionalRules()
-        || parentElement->childrenAffectedByFirstChildRules()
-        || parentElement->childrenAffectedByLastChildRules()
-        || parentElement->childrenAffectedByDirectAdjacentRules();
-}
-
 RenderStyle* StyleResolver::locateSharedStyle()
 {
     if (!m_styledElement || !m_parentStyle)
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index b7d0e5993..18bf57289 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -1952,6 +1952,20 @@ void Element::setChildIndex(unsigned index)
     rareData->setChildIndex(index);
 }
 
+bool Element::hasFlagsSetDuringStylingOfChildren() const
+{
+    if (!hasRareData())
+        return false;
+    return rareDataChildrenAffectedByHover()
+        || rareDataChildrenAffectedByActive()
+        || rareDataChildrenAffectedByDrag()
+        || rareDataChildrenAffectedByFirstChildRules()
+        || rareDataChildrenAffectedByLastChildRules()
+        || rareDataChildrenAffectedByDirectAdjacentRules()
+        || rareDataChildrenAffectedByForwardPositionalRules()
+        || rareDataChildrenAffectedByBackwardPositionalRules();
+}
+
 bool Element::rareDataStyleAffectedByEmpty() const
 {
     ASSERT(hasRareData());
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index a24594f5e..b729e1db7 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -299,6 +299,8 @@ public:
     bool childrenAffectedByBackwardPositionalRules() const { return hasRareData() && rareDataChildrenAffectedByBackwardPositionalRules(); }
     unsigned childIndex() const { return hasRareData() ? rareDataChildIndex() : 0; }
 
+    bool hasFlagsSetDuringStylingOfChildren() const;
+
     void setStyleAffectedByEmpty();
     void setChildrenAffectedByHover(bool);
     void setChildrenAffectedByActive(bool);