Limit ScrollAnchor to 20 adjustments between user scrolls.

third_party/WebKit/Source/core/layout/ScrollAnchor.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/UseCounter.h"
 #include "core/layout/line/InlineTextBox.h"
 #include "core/paint/PaintLayerScrollableArea.h"
 #include "platform/Histogram.h"
 
 namespace blink {
 
 using Corner = ScrollAnchor::Corner;
 
+static const int kMaxAdjustments = 20;
+
 ScrollAnchor::ScrollAnchor(ScrollableArea* scroller)
     : m_scroller(scroller)
     , m_hasBounced(false)
+    , m_adjustmentCount(0)
 {
     ASSERT(m_scroller);
     ASSERT(m_scroller->isFrameView() || m_scroller->isPaintLayerScrollableArea());
 }
 
 ScrollAnchor::~ScrollAnchor()
 {
 }
 
 // TODO(pilgrim) replace all instances of scrollerLayoutBox with scrollerLayoutBoxItem
@@ skipping 214 matching lines @@
     if (adjustment.isZero())
         return;
     if (adjustment == -m_lastAdjustment && m_hasBounced) {
         // Don't bounce more than once.
         clear();
         m_hasBounced = false;
         m_lastAdjustment = IntSize();
         m_lastAdjusted.clear();
         return;
     }
-    adjust(adjustment);
+    // We impose a limit on the number of adjustments between user scrolls, to
+    // mitigate the impact of pathological feedback loops with event handlers.
+    if (++m_adjustmentCount <= kMaxAdjustments)
+        adjust(adjustment);
 }
 
 void ScrollAnchor::adjust(IntSize adjustment)
 {
     m_scroller->scrollAnimator().adjustAnimationAndSetScrollPosition(adjustment, AnchoringScroll);
 
     if (m_current && m_lastAdjusted.m_anchorObject != m_current.m_anchorObject) {
         m_lastAdjusted.clear();
         m_lastAdjusted = m_current;
     }
     m_hasBounced = (m_lastAdjustment == -adjustment);
     m_lastAdjustment = adjustment;
 
     // Update UMA metric.
     DEFINE_STATIC_LOCAL(EnumerationHistogram, adjustedOffsetHistogram,
         ("Layout.ScrollAnchor.AdjustedScrollOffset", 2));
     adjustedOffsetHistogram.count(1);
     UseCounter::count(scrollerLayoutBox(m_scroller)->document(), UseCounter::ScrollAnchored);
 }
 
 void ScrollAnchor::clear()
 {
+    m_adjustmentCount = 0;
     m_current.clear();
 }
 
 void ScrollAnchor::AnchorPoint::clear()
 {
     LayoutObject* anchorObject = m_anchorObject;
     m_anchorObject = nullptr;
 
     if (anchorObject)
         anchorObject->maybeClearIsScrollAnchorObject();
 }
 
 bool ScrollAnchor::refersTo(const LayoutObject* layoutObject) const
 {
     return m_current.m_anchorObject == layoutObject
         || m_lastAdjusted.m_anchorObject == layoutObject;
 }
 
 void ScrollAnchor::notifyRemoved(LayoutObject* layoutObject)
 {
     if (m_current.m_anchorObject == layoutObject)
         m_current.clear();
     if (m_lastAdjusted.m_anchorObject == layoutObject)
         m_lastAdjusted.clear();
 }
 
 } // namespace blink