Block the HTML parser on external stylesheets

third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 13 matching lines @@
  */
 
 #include "core/html/parser/HTMLDocumentParser.h"
 
 #include "core/HTMLNames.h"
 #include "core/css/MediaValuesCached.h"
 #include "core/css/resolver/StyleResolver.h"
 #include "core/dom/DocumentFragment.h"
 #include "core/dom/DocumentLifecycleObserver.h"
 #include "core/dom/Element.h"
+#include "core/dom/StyleEngine.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/parser/AtomicHTMLToken.h"
 #include "core/html/parser/BackgroundHTMLParser.h"
 #include "core/html/parser/HTMLParserScheduler.h"
 #include "core/html/parser/HTMLParserThread.h"
 #include "core/html/parser/HTMLScriptRunner.h"
 #include "core/html/parser/HTMLTreeBuilder.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/NavigationScheduler.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "platform/SharedBuffer.h"
 #include "platform/ThreadSafeFunctional.h"
 #include "platform/TraceEvent.h"
 #include "platform/heap/Handle.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebFrameScheduler.h"
 #include "public/platform/WebScheduler.h"
 #include "public/platform/WebThread.h"
 #include "wtf/RefCounted.h"
 #include "wtf/TemporaryChange.h"
@@ skipping 202 matching lines @@
     return m_treeBuilder->isParsingFragment();
 }
 
 bool HTMLDocumentParser::processingData() const
 {
     return isScheduledForResume() || inPumpSession() || m_haveBackgroundParser;
 }
 
 void HTMLDocumentParser::pumpTokenizerIfPossible()
 {
-    if (isStopped() || isWaitingForScripts())
+    if (isStopped() || isWaitingForBlockingResource())
         return;
 
     pumpTokenizer();
 }
 
 bool HTMLDocumentParser::isScheduledForResume() const
 {
     return m_parserScheduler && m_parserScheduler->isScheduledForResume();
 }
 
@@ skipping 27 matching lines @@
 
     if (isWaitingForScripts()) {
         // If we're paused waiting for a script, we try to execute scripts before continuing.
         runScriptsForPausedTreeBuilder();
         if (isStopped())
             return false;
         if (isWaitingForScripts())
             return false;
     }
 
+    if (isWaitingForStyles() || isWaitingForImports())
+        return false;
+
     // FIXME: It's wrong for the HTMLDocumentParser to reach back to the
     //        LocalFrame, but this approach is how the old parser handled
     //        stopping when the page assigns window.location.  What really
     //        should happen is that assigning window.location causes the
     //        parser to stop parsing cleanly.  The problem is we're not
     //        perpared to do that at every point where we run JavaScript.
     if (!isParsingFragment()
         && document()->frame() && document()->frame()->navigationScheduler().locationChangePending())
         return false;
 
@@ skipping 24 matching lines @@
         // the document element is available, as we empty the queue immediately
         // after the document element is created in pumpPendingSpeculations().
         ASSERT(m_queuedPreloads.isEmpty());
         for (auto& chunk : pendingChunks)
             m_preloader->takeAndPreload(chunk->preloads);
     }
 
     for (auto& chunk : pendingChunks)
         m_speculations.append(chunk.release());
 
-    if (!isWaitingForScripts() && !isScheduledForResume()) {
+    if (!isWaitingForBlockingResource() && !isScheduledForResume()) {
         if (m_tasksWereSuspended)
             m_parserScheduler->forceResumeAfterYield();
         else
             m_parserScheduler->scheduleForResume();
     }
 }
 
 void HTMLDocumentParser::didReceiveEncodingDataFromBackgroundParser(const DocumentEncodingData& data)
 {
     document()->setEncodingData(data);
 }
 
 void HTMLDocumentParser::validateSpeculations(PassOwnPtr<ParsedChunk> chunk)
 {
     ASSERT(chunk);
-    if (isWaitingForScripts()) {
-        // We're waiting on a network script, just save the chunk, we'll get
-        // a second validateSpeculations call after the script completes.
+    if (isWaitingForBlockingResource()) {
+        // We're waiting on a blocking resource, just save the chunk, we'll get
+        // a second validateSpeculations call after the resource completes.
         // This call should have been made immediately after runScriptsForPausedTreeBuilder
-        // which may have started a network load and left us waiting.
-        ASSERT(!m_lastChunkBeforeScript);
-        m_lastChunkBeforeScript = chunk;
+        // in the case of a script which may have started a network load and left us waiting.
+        ASSERT(!m_lastChunkBeforeBlockingResource);
+        m_lastChunkBeforeBlockingResource = chunk;
         return;
     }
 
-    ASSERT(!m_lastChunkBeforeScript);
+    ASSERT(!m_lastChunkBeforeBlockingResource);
     OwnPtr<HTMLTokenizer> tokenizer = m_tokenizer.release();
     OwnPtr<HTMLToken> token = m_token.release();
 
     if (!tokenizer) {
         // There must not have been any changes to the HTMLTokenizer state on
         // the main thread, which means the speculation buffer is correct.
         return;
     }
 
     // Currently we're only smart enough to reuse the speculation buffer if the tokenizer
@@ skipping 31 matching lines @@
     HTMLParserThread::shared()->postTask(threadSafeBind(&BackgroundHTMLParser::resumeFrom, AllowCrossThreadAccess(m_backgroundParser), checkpoint.release()));
 }
 
 size_t HTMLDocumentParser::processParsedChunkFromBackgroundParser(PassOwnPtr<ParsedChunk> popChunk)
 {
     TRACE_EVENT0("blink", "HTMLDocumentParser::processParsedChunkFromBackgroundParser");
     TemporaryChange<bool> hasLineNumber(m_isParsingAtLineNumber, true);
 
     ASSERT_WITH_SECURITY_IMPLICATION(document()->activeParserCount() == 1);
     ASSERT(!isParsingFragment());
-    ASSERT(!isWaitingForScripts());
+    ASSERT(!isWaitingForBlockingResource());
     ASSERT(!isStopped());
 #if !ENABLE(OILPAN)
     // ASSERT that this object is both attached to the Document and protected.
     ASSERT(refCount() >= 2);
 #endif
     ASSERT(shouldUseThreading());
     ASSERT(!m_tokenizer);
     ASSERT(!m_token);
-    ASSERT(!m_lastChunkBeforeScript);
+    ASSERT(!m_lastChunkBeforeBlockingResource);
 
     OwnPtr<ParsedChunk> chunk(popChunk);
     OwnPtr<CompactHTMLTokenStream> tokens = chunk->tokens.release();
     size_t elementTokenCount = 0;
 
     HTMLParserThread::shared()->postTask(threadSafeBind(&BackgroundHTMLParser::startedChunkWithCheckpoint, AllowCrossThreadAccess(m_backgroundParser), chunk->inputCheckpoint));
 
     for (const auto& xssInfo : chunk->xssInfos) {
         m_textPosition = xssInfo->m_textPosition;
         m_xssAuditorDelegate.didBlockScript(*xssInfo);
         if (isStopped())
             break;
     }
     // XSSAuditorDelegate can detach the parser if it decides to block the entire current document.
     if (isDetached())
         return elementTokenCount;
 
     for (Vector<CompactHTMLToken>::const_iterator it = tokens->begin(); it != tokens->end(); ++it) {
-        ASSERT(!isWaitingForScripts());
+        ASSERT(!isWaitingForBlockingResource());
 
         if (!chunk->startingScript && (it->type() == HTMLToken::StartTag || it->type() == HTMLToken::EndTag))
             elementTokenCount++;
 
         if (document()->frame() && document()->frame()->navigationScheduler().locationChangePending()) {
 
             // To match main-thread parser behavior (which never checks locationChangePending on the EOF path)
             // we peek to see if this chunk has an EOF and process it anyway.
             if (tokens->last().type() == HTMLToken::EndOfFile) {
                 ASSERT(m_speculations.isEmpty()); // There should never be any chunks after the EOF.
@@ skipping 12 matching lines @@
         if (!m_queuedPreloads.isEmpty() && document()->documentElement())
             m_preloader->takeAndPreload(m_queuedPreloads);
 
         if (isWaitingForScripts()) {
             ASSERT(it + 1 == tokens->end()); // The </script> is assumed to be the last token of this bunch.
             runScriptsForPausedTreeBuilder();
             validateSpeculations(chunk.release());
             break;
         }
 
+        if (isWaitingForStyles() || isWaitingForImports()) {
+            ASSERT(it + 1 == tokens->end()); // The token is assumed to be the last token of this bunch.
+            validateSpeculations(chunk.release());
+            break;
+        }
+
         if (it->type() == HTMLToken::EndOfFile) {
             ASSERT(it + 1 == tokens->end()); // The EOF is assumed to be the last token of this bunch.
             ASSERT(m_speculations.isEmpty()); // There should never be any chunks after the EOF.
             prepareToStopParsing();
             break;
         }
 
         ASSERT(!m_tokenizer);
         ASSERT(!m_token);
     }
@@ skipping 11 matching lines @@
 void HTMLDocumentParser::pumpPendingSpeculations()
 {
 #if !ENABLE(OILPAN)
     // ASSERT that this object is both attached to the Document and protected.
     ASSERT(refCount() >= 2);
 #endif
     // If this assert fails, you need to call validateSpeculations to make sure
     // m_tokenizer and m_token don't have state that invalidates m_speculations.
     ASSERT(!m_tokenizer);
     ASSERT(!m_token);
-    ASSERT(!m_lastChunkBeforeScript);
-    ASSERT(!isWaitingForScripts());
+    ASSERT(!m_lastChunkBeforeBlockingResource);
+    ASSERT(!isWaitingForBlockingResource());
     ASSERT(!isStopped());
     ASSERT(!isScheduledForResume());
     ASSERT(!inPumpSession());
 
     // FIXME: Here should never be reached when there is a blocking script,
     // but it happens in unknown scenarios. See https://crbug.com/440901
-    if (isWaitingForScripts()) {
+    if (isWaitingForBlockingResource()) {
         m_parserScheduler->scheduleForResume();
         return;
     }
 
     // Do not allow pumping speculations in nested event loops.
     if (m_pumpSpeculationsSessionNestingLevel) {
         m_parserScheduler->scheduleForResume();
         return;
     }
 
     // FIXME: Pass in current input length.
     TRACE_EVENT_BEGIN1("devtools.timeline", "ParseHTML", "beginData", InspectorParseHtmlEvent::beginData(document(), lineNumber().zeroBasedInt()));
 
     SpeculationsPumpSession session(m_pumpSpeculationsSessionNestingLevel, contextForParsingSession());
     while (!m_speculations.isEmpty()) {
         ASSERT(!isScheduledForResume());
         size_t elementTokenCount = processParsedChunkFromBackgroundParser(m_speculations.takeFirst().release());
         session.addedElementTokens(elementTokenCount);
 
         // Always check isParsing first as m_document may be null.
         // Surprisingly, isScheduledForResume() may be set here as a result of
         // processParsedChunkFromBackgroundParser running arbitrary javascript
         // which invokes nested event loops. (e.g. inspector breakpoints)
-        if (!isParsing() || isWaitingForScripts() || isScheduledForResume())
+        if (!isParsing() || isWaitingForBlockingResource() || isScheduledForResume())
             break;
 
         if (m_speculations.isEmpty() || m_parserScheduler->yieldIfNeeded(session, m_speculations.first()->startingScript))
             break;
     }
 
     TRACE_EVENT_END1("devtools.timeline", "ParseHTML", "endData", InspectorParseHtmlEvent::endData(lineNumber().zeroBasedInt() - 1));
     TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "UpdateCounters", TRACE_EVENT_SCOPE_THREAD, "data", InspectorUpdateCountersEvent::data());
 }
 
@@ skipping 68 matching lines @@
 #endif
 
     if (isStopped())
         return;
 
     // There should only be PendingText left since the tree-builder always flushes
     // the task queue before returning. In case that ever changes, crash.
     m_treeBuilder->flush(FlushAlways);
     RELEASE_ASSERT(!isStopped());
 
-    if (isWaitingForScripts()) {
+    if (isWaitingForBlockingResource()) {
         ASSERT(m_tokenizer->getState() == HTMLTokenizer::DataState);
 
         ASSERT(m_preloader);
         // TODO(kouhei): m_preloader should be always available for synchronous parsing case,
         // adding paranoia if for speculative crash fix for crbug.com/465478
         if (m_preloader) {
             if (!m_preloadScanner) {
                 m_preloadScanner = HTMLPreloadScanner::create(
                     m_options,
                     document()->url(),
@@ skipping 69 matching lines @@
         ASSERT(m_haveBackgroundParser || wasCreatedByScript());
         m_token = adoptPtr(new HTMLToken);
         m_tokenizer = HTMLTokenizer::create(m_options);
     }
 
     SegmentedString excludedLineNumberSource(source);
     excludedLineNumberSource.setExcludeLineNumbers();
     m_input.insertAtCurrentInsertionPoint(excludedLineNumberSource);
     pumpTokenizerIfPossible();
 
-    if (isWaitingForScripts()) {
+    if (isWaitingForBlockingResource()) {
         // Check the document.write() output with a separate preload scanner as
         // the main scanner can't deal with insertions.
         if (!m_insertionPreloadScanner) {
             m_insertionPreloadScanner = HTMLPreloadScanner::create(
                 m_options,
                 document()->url(),
                 CachedDocumentParameters::create(document()),
                 MediaValuesCached::MediaValuesCachedData(*document()));
         }
 
@@ skipping 64 matching lines @@
     // as appendBytes() will directly ship the data to the thread.
     ASSERT(!shouldUseThreading());
 
     // pumpTokenizer can cause this parser to be detached from the Document,
     // but we need to ensure it isn't deleted yet.
     RefPtrWillBeRawPtr<HTMLDocumentParser> protect(this);
     TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("blink.debug"), "HTMLDocumentParser::append", "size", inputSource.length());
     const SegmentedString source(inputSource);
 
     if (m_preloadScanner) {
-        if (m_input.current().isEmpty() && !isWaitingForScripts()) {
+        if (m_input.current().isEmpty() && !isWaitingForBlockingResource()) {
             // We have parsed until the end of the current input and so are now moving ahead of the preload scanner.
             // Clear the scanner so we know to scan starting from the current input point if we block again.
             m_preloadScanner.clear();
         } else {
             m_preloadScanner->appendToEnd(source);
-            if (isWaitingForScripts())
+            if (isWaitingForBlockingResource())
                 m_preloadScanner->scan(m_preloader.get(), document()->baseElementURL());
         }
     }
 
     m_input.appendToEnd(source);
 
     if (inPumpSession()) {
         // We've gotten data off the network in a nested write.
         // We don't want to consume any more of the input stream now.  Do
         // not worry.  We'll consume this data in a less-nested write().
@@ skipping 136 matching lines @@
     // run the preload scanner, as well as delay completion of parsing.
     bool treeBuilderHasBlockingScript = m_treeBuilder->hasParserBlockingScript();
     bool scriptRunnerHasBlockingScript = m_scriptRunner && m_scriptRunner->hasParserBlockingScript();
     // Since the parser is paused while a script runner has a blocking script, it should
     // never be possible to end up with both objects holding a blocking script.
     ASSERT(!(treeBuilderHasBlockingScript && scriptRunnerHasBlockingScript));
     // If either object has a blocking script, the parser should be paused.
     return treeBuilderHasBlockingScript || scriptRunnerHasBlockingScript;
 }
 
-void HTMLDocumentParser::resumeParsingAfterScriptExecution()
+bool HTMLDocumentParser::isWaitingForStyles() const
+{
+    return RuntimeEnabledFeatures::htmlParserBlocksOnCSSEnabled() && document() && document()->styleEngine().hasPendingSheets();
+}
+
+bool HTMLDocumentParser::isWaitingForImports() const
+{
+    return RuntimeEnabledFeatures::htmlParserBlocksOnCSSEnabled() && document() && !document()->haveImportsLoaded();
+}
+
+bool HTMLDocumentParser::isWaitingForBlockingResource() const
+{
+    return isWaitingForScripts() || isWaitingForStyles() || isWaitingForImports();
+}
+
+void HTMLDocumentParser::resumeParsingAfterBlock()
 {
     ASSERT(!isExecutingScript());
-    ASSERT(!isWaitingForScripts());
+    ASSERT(!isWaitingForBlockingResource());
 
     if (m_haveBackgroundParser) {
-        validateSpeculations(m_lastChunkBeforeScript.release());
-        ASSERT(!m_lastChunkBeforeScript);
+        validateSpeculations(m_lastChunkBeforeBlockingResource.release());
+        ASSERT(!m_lastChunkBeforeBlockingResource);
         // processParsedChunkFromBackgroundParser can cause this parser to be detached from the Document,
         // but we need to ensure it isn't deleted yet.
         RefPtrWillBeRawPtr<HTMLDocumentParser> protect(this);
         pumpPendingSpeculations();
         return;
     }
 
     m_insertionPreloadScanner.clear();
     pumpTokenizerIfPossible();
     endIfDelayed();
@@ skipping 18 matching lines @@
     if (isStopped()) {
         return;
     }
 
     if (isStopping()) {
         attemptToRunDeferredScriptsAndEnd();
         return;
     }
 
     m_scriptRunner->executeScriptsWaitingForLoad(cachedResource);
-    if (!isWaitingForScripts())
-        resumeParsingAfterScriptExecution();
+    if (!isWaitingForBlockingResource())
+        resumeParsingAfterBlock();
 }
 
 void HTMLDocumentParser::executeScriptsWaitingForResources()
 {
     // Document only calls this when the Document owns the DocumentParser
     // so this will not be called in the DocumentFragment case.
     ASSERT(m_scriptRunner);
-    // Ignore calls unless we have a script blocking the parser waiting on a
-    // stylesheet load.  Otherwise we are currently parsing and this
-    // is a re-entrant call from encountering a </ style> tag.
-    if (!m_scriptRunner->hasScriptsWaitingForResources())
-        return;
 
-    // pumpTokenizer can cause this parser to be detached from the Document,
-    // but we need to ensure it isn't deleted yet.
-    RefPtrWillBeRawPtr<HTMLDocumentParser> protect(this);
-    m_scriptRunner->executeScriptsWaitingForResources();
-    if (!isWaitingForScripts())
-        resumeParsingAfterScriptExecution();
+    if (m_scriptRunner->hasScriptsWaitingForResources()) {
+        // pumpTokenizer can cause this parser to be detached from the Document,
+        // but we need to ensure it isn't deleted yet.
+        RefPtrWillBeRawPtr<HTMLDocumentParser> protect(this);
+        m_scriptRunner->executeScriptsWaitingForResources();
+        if (!isWaitingForBlockingResource())
+            resumeParsingAfterBlock();
+    } else if (RuntimeEnabledFeatures::htmlParserBlocksOnCSSEnabled() && !inPumpSession() && !isWaitingForBlockingResource()) {
+        resumeParsingAfterBlock();
+    }
 }
 
 void HTMLDocumentParser::parseDocumentFragment(const String& source, DocumentFragment* fragment, Element* contextElement, ParserContentPolicy parserContentPolicy)
 {
     RefPtrWillBeRawPtr<HTMLDocumentParser> parser = HTMLDocumentParser::create(fragment, contextElement, parserContentPolicy);
     parser->append(source);
     parser->finish();
     ASSERT(!parser->processingData()); // Make sure we're done. <rdar://problem/3963151>
     parser->detach(); // Allows ~DocumentParser to assert it was detached before destruction.
 }
@@ skipping 60 matching lines @@
 void HTMLDocumentParser::setDecoder(PassOwnPtr<TextResourceDecoder> decoder)
 {
     ASSERT(decoder);
     DecodedDataDocumentParser::setDecoder(decoder);
 
     if (m_haveBackgroundParser)
         HTMLParserThread::shared()->postTask(threadSafeBind(&BackgroundHTMLParser::setDecoder, AllowCrossThreadAccess(m_backgroundParser), takeDecoder()));
 }
 
 } // namespace blink