Pause HTML parser for external stylesheets in the body

third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 133 matching lines @@
       m_tokenizedChunkQueue(TokenizedChunkQueue::create()),
       m_evaluator(DocumentWriteEvaluator::create(document)),
       m_pendingCSPMetaToken(nullptr),
       m_shouldUseThreading(syncPolicy == AllowAsynchronousParsing),
       m_endWasDelayed(false),
       m_haveBackgroundParser(false),
       m_tasksWereSuspended(false),
       m_pumpSessionNestingLevel(0),
       m_pumpSpeculationsSessionNestingLevel(0),
       m_isParsingAtLineNumber(false),
-      m_triedLoadingLinkHeaders(false) {
+      m_triedLoadingLinkHeaders(false),
+      m_addedPendingStylesheetInBody(false),
+      m_isWaitingForStylesheets(false) {
   ASSERT(shouldUseThreading() || (m_token && m_tokenizer));
   // Threading is not allowed in prefetch mode.
   DCHECK(!document.isPrefetchOnly() || !shouldUseThreading());
 }
 
 HTMLDocumentParser::~HTMLDocumentParser() {}
 
 void HTMLDocumentParser::dispose() {
   // In Oilpan, HTMLDocumentParser can die together with Document, and detach()
   // is not called in this case.
@@ skipping 84 matching lines @@
     return;
 
   attemptToRunDeferredScriptsAndEnd();
 }
 
 bool HTMLDocumentParser::isParsingFragment() const {
   return m_treeBuilder->isParsingFragment();
 }
 
 void HTMLDocumentParser::pumpTokenizerIfPossible() {
-  if (isStopped() || isWaitingForScripts())
+  if (isStopped() || isPaused())
     return;
 
   pumpTokenizer();
 }
 
 bool HTMLDocumentParser::isScheduledForResume() const {
   return m_parserScheduler && m_parserScheduler->isScheduledForResume();
 }
 
 // Used by HTMLParserScheduler
@@ skipping 16 matching lines @@
 }
 
 bool HTMLDocumentParser::canTakeNextToken() {
   if (isStopped())
     return false;
 
   // If we're paused waiting for a script, we try to execute scripts before
   // continuing.
   if (m_treeBuilder->hasParserBlockingScript())
     runScriptsForPausedTreeBuilder();
-  if (isStopped() || isWaitingForScripts())
+  if (isStopped() || isPaused())
     return false;
 
   // FIXME: It's wrong for the HTMLDocumentParser to reach back to the
   // LocalFrame, but this approach is how the old parser handled stopping when
   // the page assigns window.location.  What really should happen is that
   // assigning window.location causes the parser to stop parsing cleanly.  The
   // problem is we're not perpared to do that at every point where we run
   // JavaScript.
   if (!isParsingFragment() && document()->frame() &&
       document()->frame()->navigationScheduler().locationChangePending())
@@ skipping 67 matching lines @@
         const CompactHTMLToken& token = chunk->tokens->at(index);
         ASSERT(token.type() == HTMLToken::TokenType::Character);
         evaluateAndPreloadScriptForDocumentWrite(token.data());
       }
     }
   }
 
   for (auto& chunk : pendingChunks)
     m_speculations.append(std::move(chunk));
 
-  if (!isWaitingForScripts() && !isScheduledForResume()) {
+  if (!isPaused() && !isScheduledForResume()) {
     if (m_tasksWereSuspended)
       m_parserScheduler->forceResumeAfterYield();
     else
       m_parserScheduler->scheduleForResume();
   }
 }
 
 void HTMLDocumentParser::didReceiveEncodingDataFromBackgroundParser(
     const DocumentEncodingData& data) {
   document()->setEncodingData(data);
 }
 
 void HTMLDocumentParser::validateSpeculations(
     std::unique_ptr<TokenizedChunk> chunk) {
   ASSERT(chunk);
   // TODO(kouhei): We should simplify codepath here by disallowing
   // validateSpeculations
-  // while isWaitingForScripts, and m_lastChunkBeforeScript can simply be
+  // while isPaused, and m_lastChunkBeforePause can simply be
   // pushed to m_speculations.
-  if (isWaitingForScripts()) {
-    // We're waiting on a network script, just save the chunk, we'll get a
-    // second validateSpeculations call after the script completes. This call
-    // should have been made immediately after runScriptsForPausedTreeBuilder
-    // which may have started a network load and left us waiting.
-    ASSERT(!m_lastChunkBeforeScript);
-    m_lastChunkBeforeScript = std::move(chunk);
+  if (isPaused()) {
+    // We're waiting on a network script or stylesheet, just save the chunk,
+    // we'll get a second validateSpeculations call after the script or
+    // stylesheet completes. This call should have been made immediately after
+    // runScriptsForPausedTreeBuilder in the script case which may have started
+    // a network load and left us waiting.
+    DCHECK(!m_lastChunkBeforePause);
+    m_lastChunkBeforePause = std::move(chunk);
     return;
   }
 
-  ASSERT(!m_lastChunkBeforeScript);
+  DCHECK(!m_lastChunkBeforePause);
   std::unique_ptr<HTMLTokenizer> tokenizer = std::move(m_tokenizer);
   std::unique_ptr<HTMLToken> token = std::move(m_token);
 
   if (!tokenizer) {
     // There must not have been any changes to the HTMLTokenizer state on the
     // main thread, which means the speculation buffer is correct.
     return;
   }
 
   // Currently we're only smart enough to reuse the speculation buffer if the
@@ skipping 56 matching lines @@
     std::unique_ptr<TokenizedChunk> popChunk) {
   TRACE_EVENT_WITH_FLOW0(
       "blink,loading",
       "HTMLDocumentParser::processTokenizedChunkFromBackgroundParser",
       popChunk.get(), TRACE_EVENT_FLAG_FLOW_IN);
   AutoReset<bool> hasLineNumber(&m_isParsingAtLineNumber, true);
 
   SECURITY_DCHECK(m_pumpSpeculationsSessionNestingLevel == 1);
   SECURITY_DCHECK(!inPumpSession());
   ASSERT(!isParsingFragment());
-  ASSERT(!isWaitingForScripts());
+  DCHECK(!isPaused());
   ASSERT(!isStopped());
   ASSERT(shouldUseThreading());
   ASSERT(!m_tokenizer);
   ASSERT(!m_token);
-  ASSERT(!m_lastChunkBeforeScript);
+  DCHECK(!m_lastChunkBeforePause);
 
   std::unique_ptr<TokenizedChunk> chunk(std::move(popChunk));
   std::unique_ptr<CompactHTMLTokenStream> tokens = std::move(chunk->tokens);
   size_t elementTokenCount = 0;
 
   postTaskToLookaheadParser(Asynchronous,
                             &BackgroundHTMLParser::startedChunkWithCheckpoint,
                             m_backgroundParser, chunk->inputCheckpoint);
 
   for (const auto& xssInfo : chunk->xssInfos) {
@@ skipping 44 matching lines @@
     }
 
     if (isWaitingForScripts()) {
       // The </script> is assumed to be the last token of this bunch.
       ASSERT(it + 1 == tokens->end());
       runScriptsForPausedTreeBuilder();
       validateSpeculations(std::move(chunk));
       break;
     }
 
+    if (m_isWaitingForStylesheets && it + 1 == tokens->end()) {

[kouhei (in TOK), 2017/01/12 11:58:13]

Can we merge this to the if condition above?
It is guaranteed to have the <link> tag at the end by the BG parser.

[Pat Meenan, 2017/01/12 13:26:46]

I'm not 100% sure that there aren't any conditions where a blocking stylesheet
will get applied when we are in the body that aren't from a link tag and pausing
the parser at the end of whatever the current chunk is felt like a much safer
failure path than stopping mid-chunk (is it safe to stop mid-chunk or
catastrophic?).

The only possible case that comes to mind is something like an html import in
the head of the document that imports a stylesheet.  I don't know the import
processing flow well enough to know if the pending sheet is attached to the main
document or if it is kept within the import.  If it doesn't leak out of the
import then there probably aren't any non-link cases and it would be safe to
move.

+      validateSpeculations(std::move(chunk));
+      break;
+    }
+
     if (it->type() == HTMLToken::EndOfFile) {
       // The EOF is assumed to be the last token of this bunch.
       ASSERT(it + 1 == tokens->end());
       // There should never be any chunks after the EOF.
       ASSERT(m_speculations.isEmpty());
       prepareToStopParsing();
       break;
     }
 
     ASSERT(!m_tokenizer);
     ASSERT(!m_token);
   }
 
   // Make sure all required pending text nodes are emitted before returning.
   // This leaves "script", "style" and "svg" nodes text nodes intact.
   if (!isStopped())
     m_treeBuilder->flush(FlushIfAtTextLimit);
 
   m_isParsingAtLineNumber = false;
 
   return elementTokenCount;
 }
 
 void HTMLDocumentParser::pumpPendingSpeculations() {
   // If this assert fails, you need to call validateSpeculations to make sure
   // m_tokenizer and m_token don't have state that invalidates m_speculations.
   ASSERT(!m_tokenizer);
   ASSERT(!m_token);
-  ASSERT(!m_lastChunkBeforeScript);
-  ASSERT(!isWaitingForScripts());
+  DCHECK(!m_lastChunkBeforePause);
+  DCHECK(!isPaused());
   ASSERT(!isStopped());
   ASSERT(!isScheduledForResume());
   ASSERT(!inPumpSession());
 
   // FIXME: Here should never be reached when there is a blocking script,
   // but it happens in unknown scenarios. See https://crbug.com/440901
   if (isWaitingForScripts()) {
     m_parserScheduler->scheduleForResume();
     return;
   }
@@ skipping 13 matching lines @@
   while (!m_speculations.isEmpty()) {
     ASSERT(!isScheduledForResume());
     size_t elementTokenCount =
         processTokenizedChunkFromBackgroundParser(m_speculations.takeFirst());
     session.addedElementTokens(elementTokenCount);
 
     // Always check isParsing first as m_document may be null. Surprisingly,
     // isScheduledForResume() may be set here as a result of
     // processTokenizedChunkFromBackgroundParser running arbitrary javascript
     // which invokes nested event loops. (e.g. inspector breakpoints)
-    if (!isParsing() || isWaitingForScripts() || isScheduledForResume())
+    if (!isParsing() || isPaused() || isScheduledForResume())
       break;
 
     if (m_speculations.isEmpty() ||
         m_parserScheduler->yieldIfNeeded(
             session, m_speculations.first()->startingScript))
       break;
   }
 
   TRACE_EVENT_END1(
       "devtools.timeline", "ParseHTML", "endData",
@@ skipping 67 matching lines @@
   }
 
   if (isStopped())
     return;
 
   // There should only be PendingText left since the tree-builder always flushes
   // the task queue before returning. In case that ever changes, crash.
   m_treeBuilder->flush(FlushAlways);
   RELEASE_ASSERT(!isStopped());
 
-  if (isWaitingForScripts()) {
+  if (isPaused()) {
     ASSERT(m_tokenizer->getState() == HTMLTokenizer::DataState);
 
     ASSERT(m_preloader);
     // TODO(kouhei): m_preloader should be always available for synchronous
     // parsing case, adding paranoia if for speculative crash fix for
     // crbug.com/465478
     if (m_preloader) {
       if (!m_preloadScanner) {
         m_preloadScanner = createPreloadScanner();
         m_preloadScanner->appendToEnd(m_input.current());
@@ skipping 18 matching lines @@
   // the parser.
   //
   // FIXME: Stop clearing the m_token once we start running the parser off
   // the main thread or once we stop allowing synchronous JavaScript
   // execution from parseAttribute.
   if (token().type() != HTMLToken::Character)
     token().clear();
 
   m_treeBuilder->constructTree(&atomicToken);
 
+  if (m_addedPendingStylesheetInBody)
+    m_isWaitingForStylesheets = true;
+
   // FIXME: constructTree may synchronously cause Document to be detached.
   if (!m_token)
     return;
 
   if (!token().isUninitialized()) {
     ASSERT(token().type() == HTMLToken::Character);
     token().clear();
   }
 }
 
 void HTMLDocumentParser::constructTreeFromCompactHTMLToken(
     const CompactHTMLToken& compactToken) {
   AtomicHTMLToken token(compactToken);
   m_treeBuilder->constructTree(&token);
+  if (m_addedPendingStylesheetInBody)
+    m_isWaitingForStylesheets = true;
 }
 
 bool HTMLDocumentParser::hasInsertionPoint() {
   // FIXME: The wasCreatedByScript() branch here might not be fully correct. Our
   // model of the EOF character differs slightly from the one in the spec
   // because our treatment is uniform between network-sourced and script-sourced
   // input streams whereas the spec treats them differently.
   return m_input.hasInsertionPoint() ||
          (wasCreatedByScript() && !m_input.haveSeenEndOfFile());
 }
@@ skipping 10 matching lines @@
     ASSERT(m_haveBackgroundParser || wasCreatedByScript());
     m_token = WTF::wrapUnique(new HTMLToken);
     m_tokenizer = HTMLTokenizer::create(m_options);
   }
 
   SegmentedString excludedLineNumberSource(source);
   excludedLineNumberSource.setExcludeLineNumbers();
   m_input.insertAtCurrentInsertionPoint(excludedLineNumberSource);
   pumpTokenizerIfPossible();
 
-  if (isWaitingForScripts()) {
+  if (isPaused()) {
     // Check the document.write() output with a separate preload scanner as
     // the main scanner can't deal with insertions.
     if (!m_insertionPreloadScanner)
       m_insertionPreloadScanner = createPreloadScanner();
     m_insertionPreloadScanner->appendToEnd(source);
     scanAndPreload(m_insertionPreloadScanner.get());
   }
 
   endIfDelayed();
 }
@@ skipping 92 matching lines @@
       m_preloadScanner = createPreloadScanner();
 
     m_preloadScanner->appendToEnd(source);
     scanAndPreload(m_preloadScanner.get());
 
     // Return after the preload scanner, do not actually parse the document.
     return;
   }
 
   if (m_preloadScanner) {
-    if (m_input.current().isEmpty() && !isWaitingForScripts()) {
+    if (m_input.current().isEmpty() && !isPaused()) {
       // We have parsed until the end of the current input and so are now moving
       // ahead of the preload scanner. Clear the scanner so we know to scan
       // starting from the current input point if we block again.
       m_preloadScanner.reset();
     } else {
       m_preloadScanner->appendToEnd(source);
-      if (isWaitingForScripts())
+      if (isPaused())
         scanAndPreload(m_preloadScanner.get());
     }
   }
 
   m_input.appendToEnd(source);
 
   if (inPumpSession()) {
     // We've gotten data off the network in a nested write. We don't want to
     // consume any more of the input stream now.  Do not worry.  We'll consume
     // this data in a less-nested write().
@@ skipping 130 matching lines @@
       m_scriptRunner && m_scriptRunner->hasParserBlockingScript();
   // Since the parser is paused while a script runner has a blocking script, it
   // should never be possible to end up with both objects holding a blocking
   // script.
   ASSERT(!(treeBuilderHasBlockingScript && scriptRunnerHasBlockingScript));
   // If either object has a blocking script, the parser should be paused.
   return treeBuilderHasBlockingScript || scriptRunnerHasBlockingScript ||
          m_reentryPermit->parserPauseFlag();
 }
 
-void HTMLDocumentParser::resumeParsingAfterScriptExecution() {
+void HTMLDocumentParser::resumeParsingAfterPause() {
   ASSERT(!isExecutingScript());
-  ASSERT(!isWaitingForScripts());
+  DCHECK(!isPaused());
 
   if (m_haveBackgroundParser) {
-    if (m_lastChunkBeforeScript) {
-      validateSpeculations(std::move(m_lastChunkBeforeScript));
-      DCHECK(!m_lastChunkBeforeScript);
+    if (m_lastChunkBeforePause) {
+      validateSpeculations(std::move(m_lastChunkBeforePause));
+      DCHECK(!m_lastChunkBeforePause);
       pumpPendingSpeculations();
     }
     return;
   }
 
   m_insertionPreloadScanner.reset();
   if (m_tokenizer) {
     pumpTokenizerIfPossible();
   }
   endIfDelayed();
@@ skipping 12 matching lines @@
   if (isStopped()) {
     return;
   }
 
   if (isStopping()) {
     attemptToRunDeferredScriptsAndEnd();
     return;
   }
 
   m_scriptRunner->executeScriptsWaitingForLoad(pendingScript);
-  if (!isWaitingForScripts())
-    resumeParsingAfterScriptExecution();
+  if (!isPaused())
+    resumeParsingAfterPause();
 }
 
 void HTMLDocumentParser::executeScriptsWaitingForResources() {
   DCHECK(document()->isScriptExecutionReady());
 
+  if (m_isWaitingForStylesheets)
+    m_isWaitingForStylesheets = false;
+
   // Document only calls this when the Document owns the DocumentParser so this
   // will not be called in the DocumentFragment case.
   DCHECK(m_scriptRunner);
   m_scriptRunner->executeScriptsWaitingForResources();
-  if (!isWaitingForScripts())
-    resumeParsingAfterScriptExecution();
+  if (!isPaused())
+    resumeParsingAfterPause();
+}
+
+void HTMLDocumentParser::didAddPendingStylesheetInBody() {
+  // When in-body CSS doesn't block painting, the parser needs to pause so that
+  // the DOM doesn't include any elements that may depend on the CSS for style.
+  // The stylesheet can be added and removed during the parsing of a single
+  // token so don't actually set the bit to block parsing here, just track
+  // the state of the added sheet in case it does persist beyond a single
+  // token.
+  if (RuntimeEnabledFeatures::cssInBodyDoesNotBlockPaintEnabled())
+    m_addedPendingStylesheetInBody = true;
+}
+
+void HTMLDocumentParser::didLoadAllStylesheets() {
+  // Just toggle the stylesheet flag here (mostly for synchronous sheets).
+  // The document will also call into executeScriptsWaitingForResources
+  // which is when the parser will re-start, otherwise it will attempt to
+  // resume twice which could cause state machine issues.
+  m_addedPendingStylesheetInBody = false;
 }
 
 void HTMLDocumentParser::parseDocumentFragment(
     const String& source,
     DocumentFragment* fragment,
     Element* contextElement,
     ParserContentPolicy parserContentPolicy) {
   HTMLDocumentParser* parser =
       HTMLDocumentParser::create(fragment, contextElement, parserContentPolicy);
   parser->append(source);
@@ skipping 187 matching lines @@
     case Asynchronous:
       m_loadingTaskRunner->postTask(
           BLINK_FROM_HERE,
           WTF::bind(function, std::forward<Ps>(parameters)...));
       return;
   }
   NOTREACHED();
 }
 
 }  // namespace blink