Pause HTML parser for external stylesheets in the body

third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 133 matching lines @@
       m_tokenizedChunkQueue(TokenizedChunkQueue::create()),
       m_evaluator(DocumentWriteEvaluator::create(document)),
       m_pendingCSPMetaToken(nullptr),
       m_shouldUseThreading(syncPolicy == AllowAsynchronousParsing),
       m_endWasDelayed(false),
       m_haveBackgroundParser(false),
       m_tasksWereSuspended(false),
       m_pumpSessionNestingLevel(0),
       m_pumpSpeculationsSessionNestingLevel(0),
       m_isParsingAtLineNumber(false),
-      m_triedLoadingLinkHeaders(false) {
+      m_triedLoadingLinkHeaders(false),
+      m_addedPendingStylesheetInBody(false),
+      m_isWaitingForStylesheets(false) {
   ASSERT(shouldUseThreading() || (m_token && m_tokenizer));
   // Threading is not allowed in prefetch mode.
   DCHECK(!document.isPrefetchOnly() || !shouldUseThreading());
 }
 
 HTMLDocumentParser::~HTMLDocumentParser() {}
 
 void HTMLDocumentParser::dispose() {
   // In Oilpan, HTMLDocumentParser can die together with Document, and detach()
   // is not called in this case.
@@ skipping 84 matching lines @@
     return;
 
   attemptToRunDeferredScriptsAndEnd();
 }
 
 bool HTMLDocumentParser::isParsingFragment() const {
   return m_treeBuilder->isParsingFragment();
 }
 
 void HTMLDocumentParser::pumpTokenizerIfPossible() {
-  if (isStopped() || isWaitingForScripts())
+  checkIfBodyStlyesheetAdded();
+  if (isStopped() || isPaused())
     return;
 
   pumpTokenizer();
 }
 
 bool HTMLDocumentParser::isScheduledForResume() const {
   return m_parserScheduler && m_parserScheduler->isScheduledForResume();
 }
 
 // Used by HTMLParserScheduler
 void HTMLDocumentParser::resumeParsingAfterYield() {
   ASSERT(shouldUseThreading());
   ASSERT(m_haveBackgroundParser);
 
+  checkIfBodyStlyesheetAdded();
+  if (isStopped() || isPaused())
+    return;
+
   pumpPendingSpeculations();
 }
 
 void HTMLDocumentParser::runScriptsForPausedTreeBuilder() {
   ASSERT(scriptingContentIsAllowed(getParserContentPolicy()));
 
   TextPosition scriptStartPosition = TextPosition::belowRangePosition();
   Element* scriptElement =
       m_treeBuilder->takeScriptToProcess(scriptStartPosition);
   // We will not have a scriptRunner when parsing a DocumentFragment.
   if (m_scriptRunner)
     m_scriptRunner->processScriptElement(scriptElement, scriptStartPosition);
+  checkIfBodyStlyesheetAdded();
 }
 
 bool HTMLDocumentParser::canTakeNextToken() {
   if (isStopped())
     return false;
 
   // If we're paused waiting for a script, we try to execute scripts before
   // continuing.
   if (m_treeBuilder->hasParserBlockingScript())
     runScriptsForPausedTreeBuilder();
-  if (isStopped() || isWaitingForScripts())
+  if (isStopped() || isPaused())
     return false;
 
   // FIXME: It's wrong for the HTMLDocumentParser to reach back to the
   // LocalFrame, but this approach is how the old parser handled stopping when
   // the page assigns window.location.  What really should happen is that
   // assigning window.location causes the parser to stop parsing cleanly.  The
   // problem is we're not perpared to do that at every point where we run
   // JavaScript.
   if (!isParsingFragment() && document()->frame() &&
       document()->frame()->navigationScheduler().locationChangePending())
@@ skipping 67 matching lines @@
         const CompactHTMLToken& token = chunk->tokens->at(index);
         ASSERT(token.type() == HTMLToken::TokenType::Character);
         evaluateAndPreloadScriptForDocumentWrite(token.data());
       }
     }
   }
 
   for (auto& chunk : pendingChunks)
     m_speculations.append(std::move(chunk));
 
-  if (!isWaitingForScripts() && !isScheduledForResume()) {
+  if (!isPaused() && !isScheduledForResume()) {
     if (m_tasksWereSuspended)
       m_parserScheduler->forceResumeAfterYield();
     else
       m_parserScheduler->scheduleForResume();
   }
 }
 
 void HTMLDocumentParser::didReceiveEncodingDataFromBackgroundParser(
     const DocumentEncodingData& data) {
   document()->setEncodingData(data);
 }
 
 void HTMLDocumentParser::validateSpeculations(
     std::unique_ptr<TokenizedChunk> chunk) {
   ASSERT(chunk);
   // TODO(kouhei): We should simplify codepath here by disallowing
   // validateSpeculations
-  // while isWaitingForScripts, and m_lastChunkBeforeScript can simply be
+  // while isPaused, and m_lastChunkBeforePause can simply be
   // pushed to m_speculations.
-  if (isWaitingForScripts()) {
-    // We're waiting on a network script, just save the chunk, we'll get a
-    // second validateSpeculations call after the script completes. This call
-    // should have been made immediately after runScriptsForPausedTreeBuilder
-    // which may have started a network load and left us waiting.
-    ASSERT(!m_lastChunkBeforeScript);
-    m_lastChunkBeforeScript = std::move(chunk);
+  if (isPaused()) {
+    // We're waiting on a network script or stylesheet, just save the chunk,
+    // we'll get a second validateSpeculations call after the script or
+    // stylesheet completes. This call should have been made immediately after
+    // runScriptsForPausedTreeBuilder in the script case which may have started
+    // a network load and left us waiting.
+    DCHECK(!m_lastChunkBeforePause);
+    m_lastChunkBeforePause = std::move(chunk);
     return;
   }
 
-  ASSERT(!m_lastChunkBeforeScript);
+  DCHECK(!m_lastChunkBeforePause);
   std::unique_ptr<HTMLTokenizer> tokenizer = std::move(m_tokenizer);
   std::unique_ptr<HTMLToken> token = std::move(m_token);
 
   if (!tokenizer) {
     // There must not have been any changes to the HTMLTokenizer state on the
     // main thread, which means the speculation buffer is correct.
     return;
   }
 
   // Currently we're only smart enough to reuse the speculation buffer if the
@@ skipping 56 matching lines @@
     std::unique_ptr<TokenizedChunk> popChunk) {
   TRACE_EVENT_WITH_FLOW0(
       "blink,loading",
       "HTMLDocumentParser::processTokenizedChunkFromBackgroundParser",
       popChunk.get(), TRACE_EVENT_FLAG_FLOW_IN);
   AutoReset<bool> hasLineNumber(&m_isParsingAtLineNumber, true);
 
   SECURITY_DCHECK(m_pumpSpeculationsSessionNestingLevel == 1);
   SECURITY_DCHECK(!inPumpSession());
   ASSERT(!isParsingFragment());
-  ASSERT(!isWaitingForScripts());
+  DCHECK(!isPaused());
   ASSERT(!isStopped());
   ASSERT(shouldUseThreading());
   ASSERT(!m_tokenizer);
   ASSERT(!m_token);
-  ASSERT(!m_lastChunkBeforeScript);
+  DCHECK(!m_lastChunkBeforePause);
 
   std::unique_ptr<TokenizedChunk> chunk(std::move(popChunk));
   std::unique_ptr<CompactHTMLTokenStream> tokens = std::move(chunk->tokens);
   size_t elementTokenCount = 0;
 
   postTaskToLookaheadParser(Asynchronous,
                             &BackgroundHTMLParser::startedChunkWithCheckpoint,
                             m_backgroundParser, chunk->inputCheckpoint);
 
   for (const auto& xssInfo : chunk->xssInfos) {
@@ skipping 36 matching lines @@
     if (isStopped())
       break;
 
     // Preloads were queued if there was a <meta> csp token in a tokenized
     // chunk.
     if (m_pendingCSPMetaToken && it == m_pendingCSPMetaToken) {
       m_pendingCSPMetaToken = nullptr;
       fetchQueuedPreloads();
     }
 
-    if (isWaitingForScripts()) {
-      // The </script> is assumed to be the last token of this bunch.
+    if (isPaused()) {
+      // The script or stylesheet should be the last token of this bunch.
       ASSERT(it + 1 == tokens->end());
-      runScriptsForPausedTreeBuilder();
+      if (isWaitingForScripts())
+        runScriptsForPausedTreeBuilder();
       validateSpeculations(std::move(chunk));
       break;
     }
 
     if (it->type() == HTMLToken::EndOfFile) {
       // The EOF is assumed to be the last token of this bunch.
       ASSERT(it + 1 == tokens->end());
       // There should never be any chunks after the EOF.
       ASSERT(m_speculations.isEmpty());
       prepareToStopParsing();
@@ skipping 12 matching lines @@
   m_isParsingAtLineNumber = false;
 
   return elementTokenCount;
 }
 
 void HTMLDocumentParser::pumpPendingSpeculations() {
   // If this assert fails, you need to call validateSpeculations to make sure
   // m_tokenizer and m_token don't have state that invalidates m_speculations.
   ASSERT(!m_tokenizer);
   ASSERT(!m_token);
-  ASSERT(!m_lastChunkBeforeScript);
-  ASSERT(!isWaitingForScripts());
+  DCHECK(!m_lastChunkBeforePause);
+  DCHECK(!isPaused());
   ASSERT(!isStopped());
   ASSERT(!isScheduledForResume());
   ASSERT(!inPumpSession());
 
   // FIXME: Here should never be reached when there is a blocking script,
   // but it happens in unknown scenarios. See https://crbug.com/440901
   if (isWaitingForScripts()) {
     m_parserScheduler->scheduleForResume();
     return;
   }
@@ skipping 13 matching lines @@
   while (!m_speculations.isEmpty()) {
     ASSERT(!isScheduledForResume());
     size_t elementTokenCount =
         processTokenizedChunkFromBackgroundParser(m_speculations.takeFirst());
     session.addedElementTokens(elementTokenCount);
 
     // Always check isParsing first as m_document may be null. Surprisingly,
     // isScheduledForResume() may be set here as a result of
     // processTokenizedChunkFromBackgroundParser running arbitrary javascript
     // which invokes nested event loops. (e.g. inspector breakpoints)
-    if (!isParsing() || isWaitingForScripts() || isScheduledForResume())
+    checkIfBodyStlyesheetAdded();
+    if (!isParsing() || isPaused() || isScheduledForResume())
       break;
 
     if (m_speculations.isEmpty() ||
         m_parserScheduler->yieldIfNeeded(
             session, m_speculations.first()->startingScript))
       break;
   }
 
   TRACE_EVENT_END1(
       "devtools.timeline", "ParseHTML", "endData",
@@ skipping 67 matching lines @@
   }
 
   if (isStopped())
     return;
 
   // There should only be PendingText left since the tree-builder always flushes
   // the task queue before returning. In case that ever changes, crash.
   m_treeBuilder->flush(FlushAlways);
   RELEASE_ASSERT(!isStopped());
 
-  if (isWaitingForScripts()) {
+  if (isPaused()) {
     ASSERT(m_tokenizer->getState() == HTMLTokenizer::DataState);
 
     ASSERT(m_preloader);
     // TODO(kouhei): m_preloader should be always available for synchronous
     // parsing case, adding paranoia if for speculative crash fix for
     // crbug.com/465478
     if (m_preloader) {
       if (!m_preloadScanner) {
         m_preloadScanner = createPreloadScanner();
         m_preloadScanner->appendToEnd(m_input.current());
@@ skipping 17 matching lines @@
   // HTMLToken. Fortunately, Character tokens can't cause us to re-enter
   // the parser.
   //
   // FIXME: Stop clearing the m_token once we start running the parser off
   // the main thread or once we stop allowing synchronous JavaScript
   // execution from parseAttribute.
   if (token().type() != HTMLToken::Character)
     token().clear();
 
   m_treeBuilder->constructTree(&atomicToken);
+  checkIfBodyStlyesheetAdded();
 
   // FIXME: constructTree may synchronously cause Document to be detached.
   if (!m_token)
     return;
 
   if (!token().isUninitialized()) {
     ASSERT(token().type() == HTMLToken::Character);
     token().clear();
   }
 }
 
 void HTMLDocumentParser::constructTreeFromCompactHTMLToken(
     const CompactHTMLToken& compactToken) {
   AtomicHTMLToken token(compactToken);
   m_treeBuilder->constructTree(&token);
+  checkIfBodyStlyesheetAdded();
 }
 
 bool HTMLDocumentParser::hasInsertionPoint() {
   // FIXME: The wasCreatedByScript() branch here might not be fully correct. Our
   // model of the EOF character differs slightly from the one in the spec
   // because our treatment is uniform between network-sourced and script-sourced
   // input streams whereas the spec treats them differently.
   return m_input.hasInsertionPoint() ||
          (wasCreatedByScript() && !m_input.haveSeenEndOfFile());
 }
@@ skipping 10 matching lines @@
     ASSERT(m_haveBackgroundParser || wasCreatedByScript());
     m_token = WTF::wrapUnique(new HTMLToken);
     m_tokenizer = HTMLTokenizer::create(m_options);
   }
 
   SegmentedString excludedLineNumberSource(source);
   excludedLineNumberSource.setExcludeLineNumbers();
   m_input.insertAtCurrentInsertionPoint(excludedLineNumberSource);
   pumpTokenizerIfPossible();
 
-  if (isWaitingForScripts()) {
+  if (isPaused()) {
     // Check the document.write() output with a separate preload scanner as
     // the main scanner can't deal with insertions.
     if (!m_insertionPreloadScanner)
       m_insertionPreloadScanner = createPreloadScanner();
     m_insertionPreloadScanner->appendToEnd(source);
     scanAndPreload(m_insertionPreloadScanner.get());
   }
 
   endIfDelayed();
 }
@@ skipping 92 matching lines @@
       m_preloadScanner = createPreloadScanner();
 
     m_preloadScanner->appendToEnd(source);
     scanAndPreload(m_preloadScanner.get());
 
     // Return after the preload scanner, do not actually parse the document.
     return;
   }
 
   if (m_preloadScanner) {
-    if (m_input.current().isEmpty() && !isWaitingForScripts()) {
+    if (m_input.current().isEmpty() && !isPaused()) {
       // We have parsed until the end of the current input and so are now moving
       // ahead of the preload scanner. Clear the scanner so we know to scan
       // starting from the current input point if we block again.
       m_preloadScanner.reset();
     } else {
       m_preloadScanner->appendToEnd(source);
-      if (isWaitingForScripts())
+      if (isPaused())
         scanAndPreload(m_preloadScanner.get());
     }
   }
 
   m_input.appendToEnd(source);
 
   if (inPumpSession()) {
     // We've gotten data off the network in a nested write. We don't want to
     // consume any more of the input stream now.  Do not worry.  We'll consume
     // this data in a less-nested write().
@@ skipping 130 matching lines @@
       m_scriptRunner && m_scriptRunner->hasParserBlockingScript();
   // Since the parser is paused while a script runner has a blocking script, it
   // should never be possible to end up with both objects holding a blocking
   // script.
   ASSERT(!(treeBuilderHasBlockingScript && scriptRunnerHasBlockingScript));
   // If either object has a blocking script, the parser should be paused.
   return treeBuilderHasBlockingScript || scriptRunnerHasBlockingScript ||
          m_reentryPermit->parserPauseFlag();
 }
 
-void HTMLDocumentParser::resumeParsingAfterScriptExecution() {
+void HTMLDocumentParser::resumeParsingAfterPause() {
   ASSERT(!isExecutingScript());
-  ASSERT(!isWaitingForScripts());
+  DCHECK(!isPaused());
+
+  checkIfBodyStlyesheetAdded();
+  if (isPaused())
+    return;
 
   if (m_haveBackgroundParser) {
-    if (m_lastChunkBeforeScript) {
-      validateSpeculations(std::move(m_lastChunkBeforeScript));
-      DCHECK(!m_lastChunkBeforeScript);
+    if (m_lastChunkBeforePause) {
+      validateSpeculations(std::move(m_lastChunkBeforePause));
+      DCHECK(!m_lastChunkBeforePause);
       pumpPendingSpeculations();
     }
     return;
   }
 
   m_insertionPreloadScanner.reset();
   if (m_tokenizer) {
     pumpTokenizerIfPossible();
   }
   endIfDelayed();
@@ skipping 12 matching lines @@
   if (isStopped()) {
     return;
   }
 
   if (isStopping()) {
     attemptToRunDeferredScriptsAndEnd();
     return;
   }
 
   m_scriptRunner->executeScriptsWaitingForLoad(pendingScript);
-  if (!isWaitingForScripts())
-    resumeParsingAfterScriptExecution();
+  if (!isPaused())
+    resumeParsingAfterPause();
 }
 
 void HTMLDocumentParser::executeScriptsWaitingForResources() {
   DCHECK(document()->isScriptExecutionReady());
 
+  if (m_isWaitingForStylesheets)
+    m_isWaitingForStylesheets = false;
+
   // Document only calls this when the Document owns the DocumentParser so this
   // will not be called in the DocumentFragment case.
   DCHECK(m_scriptRunner);
   m_scriptRunner->executeScriptsWaitingForResources();
-  if (!isWaitingForScripts())
-    resumeParsingAfterScriptExecution();
+  if (!isPaused())
+    resumeParsingAfterPause();
+}
+
+void HTMLDocumentParser::didAddPendingStylesheetInBody() {
+  // When in-body CSS doesn't block painting, the parser needs to pause so that
+  // the DOM doesn't include any elements that may depend on the CSS for style.
+  // The stylesheet can be added and removed during the parsing of a single
+  // token so don't actually set the bit to block parsing here, just track
+  // the state of the added sheet in case it does persist beyond a single
+  // token.
+  if (RuntimeEnabledFeatures::cssInBodyDoesNotBlockPaintEnabled())
+    m_addedPendingStylesheetInBody = true;
+}
+
+void HTMLDocumentParser::didLoadAllBodyStylesheets() {
+  // Just toggle the stylesheet flag here (mostly for synchronous sheets).
+  // The document will also call into executeScriptsWaitingForResources
+  // which is when the parser will re-start, otherwise it will attempt to
+  // resume twice which could cause state machine issues.
+  m_addedPendingStylesheetInBody = false;
+}
+
+void HTMLDocumentParser::checkIfBodyStlyesheetAdded() {
+  if (m_addedPendingStylesheetInBody) {
+    m_addedPendingStylesheetInBody = false;
+    m_isWaitingForStylesheets = true;
+  }
 }
 
 void HTMLDocumentParser::parseDocumentFragment(
     const String& source,
     DocumentFragment* fragment,
     Element* contextElement,
     ParserContentPolicy parserContentPolicy) {
   HTMLDocumentParser* parser =
       HTMLDocumentParser::create(fragment, contextElement, parserContentPolicy);
   parser->append(source);
@@ skipping 187 matching lines @@
     case Asynchronous:
       m_loadingTaskRunner->postTask(
           BLINK_FROM_HERE,
           WTF::bind(function, std::forward<Ps>(parameters)...));
       return;
   }
   NOTREACHED();
 }
 
 }  // namespace blink