Fix crash when removing stylesheets from shadow tree.

Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp

 /*
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 14 matching lines @@
 
 #include "config.h"
 #include "core/css/invalidation/StyleSheetInvalidationAnalysis.h"
 
 #include "core/css/CSSSelectorList.h"
 #include "core/css/StyleRuleImport.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/dom/ContainerNode.h"
 #include "core/dom/Document.h"
 #include "core/dom/ElementTraversal.h"
+#include "core/dom/TreeScope.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/html/HTMLStyleElement.h"
 
 namespace blink {
 
-StyleSheetInvalidationAnalysis::StyleSheetInvalidationAnalysis(const WillBeHeapVector<RawPtrWillBeMember<StyleSheetContents>>& sheets)
-    : m_dirtiesAllStyle(false)
+StyleSheetInvalidationAnalysis::StyleSheetInvalidationAnalysis(const TreeScope& treeScope, const WillBeHeapVector<RawPtrWillBeMember<StyleSheetContents>>& sheets)
+    : m_treeScope(treeScope)
 {
     for (unsigned i = 0; i < sheets.size() && !m_dirtiesAllStyle; ++i)
         analyzeStyleSheet(sheets[i]);
 }
 
 static bool determineSelectorScopes(const CSSSelectorList& selectorList, HashSet<StringImpl*>& idScopes, HashSet<StringImpl*>& classScopes)
 {
     for (const CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(*selector)) {
         const CSSSelector* scopeSelector = 0;
         // This picks the widest scope, not the narrowest, to minimize the number of found scopes.
@@ skipping 33 matching lines @@
         const StyleRule* styleRule = toStyleRule(rule);
         const CSSSelectorList& selectorList = styleRule->selectorList();
         for (size_t selectorIndex = 0; selectorIndex != kNotFound; selectorIndex = selectorList.indexOfNextSelectorAfter(selectorIndex)) {
             if (selectorList.hasShadowDistributedAt(selectorIndex))
                 return true;
         }
     }
     return false;
 }
 
-static Node* determineScopingNodeForStyleInShadow(HTMLStyleElement* ownerElement, StyleSheetContents* styleSheetContents)
-{
-    ASSERT(ownerElement && ownerElement->isInShadowTree());
-
-    if (hasDistributedRule(styleSheetContents)) {
-        ContainerNode* scope = ownerElement;
-        do {
-            scope = scope->containingShadowRoot()->shadowHost();
-        } while (scope->isInShadowTree());
-        return scope;
-    }
-
-    return ownerElement->containingShadowRoot()->shadowHost();
-}
-
 static bool ruleAdditionMightRequireDocumentStyleRecalc(StyleRuleBase* rule)
 {
     // This funciton is conservative. We only return false when we know that
     // the added @rule can't require style recalcs.
     switch (rule->type()) {
     case StyleRule::Import: // Whatever we import should do its own analysis, we don't need to invalidate the document here!
     case StyleRule::Page: // Page rules apply only during printing, we force a full-recalc before printing.
         return false;
 
     case StyleRule::Media: // If the media rule doesn't apply, we could avoid recalc.
@@ skipping 25 matching lines @@
     // See if all rules on the sheet are scoped to some specific ids or classes.
     // Then test if we actually have any of those in the tree at the moment.
     const WillBeHeapVector<RefPtrWillBeMember<StyleRuleImport>>& importRules = styleSheetContents->importRules();
     for (unsigned i = 0; i < importRules.size(); ++i) {
         if (!importRules[i]->styleSheet())
             continue;
         analyzeStyleSheet(importRules[i]->styleSheet());
         if (m_dirtiesAllStyle)
             return;
     }
-    if (styleSheetContents->hasSingleOwnerNode()) {
-        Node* ownerNode = styleSheetContents->singleOwnerNode();
-        if (isHTMLStyleElement(ownerNode) && toHTMLStyleElement(*ownerNode).isInShadowTree()) {
-            m_scopingNodes.append(determineScopingNodeForStyleInShadow(toHTMLStyleElement(ownerNode), styleSheetContents));
-            return;
-        }
+
+    if (m_treeScope.rootNode().isShadowRoot()) {
+        if (hasDistributedRule(styleSheetContents))
+            m_hasDistributedRules = true;
+        return;
     }
 
     const WillBeHeapVector<RefPtrWillBeMember<StyleRuleBase>>& rules = styleSheetContents->childRules();
     for (unsigned i = 0; i < rules.size(); i++) {
         StyleRuleBase* rule = rules[i].get();
         if (!rule->isStyleRule()) {
             if (ruleAdditionMightRequireDocumentStyleRecalc(rule)) {
                 m_dirtiesAllStyle = true;
                 return;
             }
@@ skipping 14 matching lines @@
     if (classScopes.isEmpty() || !element->hasClass())
         return false;
     const SpaceSplitString& classNames = element->classNames();
     for (unsigned i = 0; i < classNames.size(); ++i) {
         if (classScopes.contains(classNames[i].impl()))
             return true;
     }
     return false;
 }
 
-void StyleSheetInvalidationAnalysis::invalidateStyle(Document& document)
+static ContainerNode* outermostShadowHost(const ShadowRoot& root)
+{
+    ContainerNode* host = root.host();
+    while (host->isInShadowTree())
+        host = host->containingShadowRoot()->host();
+    return host;
+}
+
+void StyleSheetInvalidationAnalysis::invalidateStyle()
 {
     ASSERT(!m_dirtiesAllStyle);
 
-    if (!m_scopingNodes.isEmpty()) {
-        for (unsigned i = 0; i < m_scopingNodes.size(); ++i)
-            m_scopingNodes.at(i)->setNeedsStyleRecalc(SubtreeStyleChange, StyleChangeReasonForTracing::create(StyleChangeReason::StyleSheetChange));
+    if (m_treeScope.rootNode().isShadowRoot()) {
+        ContainerNode* invalidationRoot = &m_treeScope.rootNode();
+        if (m_hasDistributedRules)
+            invalidationRoot = outermostShadowHost(*toShadowRoot(invalidationRoot));
+        invalidationRoot->setNeedsStyleRecalc(SubtreeStyleChange, StyleChangeReasonForTracing::create(StyleChangeReason::StyleSheetChange));
+        return;
     }
 
     if (m_idScopes.isEmpty() && m_classScopes.isEmpty())
         return;
-    Element* element = ElementTraversal::firstWithin(document);
+    Element* element = ElementTraversal::firstWithin(m_treeScope.document());
     while (element) {
         if (elementMatchesSelectorScopes(element, m_idScopes, m_classScopes)) {
             element->setNeedsStyleRecalc(SubtreeStyleChange, StyleChangeReasonForTracing::create(StyleChangeReason::StyleSheetChange));
             // The whole subtree is now invalidated, we can skip to the next sibling.
             element = ElementTraversal::nextSkippingChildren(*element);
             continue;
         }
         element = ElementTraversal::next(*element);
     }
 }
 
 }