Fix readonly and type attribute selector incorrect style sharing

Source/core/css/resolver/SharedStyleFinder.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 50 matching lines @@
     return parentElement->hasFlagsSetDuringStylingOfChildren();
 }
 
 bool SharedStyleFinder::canShareStyleWithControl(const ElementResolveContext& context, Element* element) const
 {
     if (!element->hasTagName(inputTag) || !context.element()->hasTagName(inputTag))
         return false;
 
     HTMLInputElement* thisInputElement = toHTMLInputElement(element);
     HTMLInputElement* otherInputElement = toHTMLInputElement(context.element());
-    if (thisInputElement->elementData() != otherInputElement->elementData()) {
-        if (thisInputElement->fastGetAttribute(typeAttr) != otherInputElement->fastGetAttribute(typeAttr))
-            return false;
-        if (thisInputElement->fastGetAttribute(readonlyAttr) != otherInputElement->fastGetAttribute(readonlyAttr))
-            return false;
-    }
 
     if (thisInputElement->isAutofilled() != otherInputElement->isAutofilled())
         return false;
     if (thisInputElement->shouldAppearChecked() != otherInputElement->shouldAppearChecked())
         return false;
     if (thisInputElement->shouldAppearIndeterminate() != otherInputElement->shouldAppearIndeterminate())
         return false;
     if (thisInputElement->isRequired() != otherInputElement->isRequired())
         return false;
 
@@ skipping 30 matching lines @@
     }
     return false;
 }
 
 static inline bool elementHasDirectionAuto(Element* element)
 {
     // FIXME: This line is surprisingly hot, we may wish to inline hasDirectionAuto into StyleResolver.
     return element->isHTMLElement() && toHTMLElement(element)->hasDirectionAuto();
 }
 
+static inline const AtomicString& typeAttributeValue(const Element* element)
+{
+    // type is animatable in SVG so we need to go down the slow path here.
+    return element->isSVGElement() ? element->getAttribute(typeAttr) : element->fastGetAttribute(typeAttr);
+}
+
 bool SharedStyleFinder::sharingCandidateHasIdenticalStyleAffectingAttributes(const ElementResolveContext& context, Element* sharingCandidate) const
 {
     if (context.element()->elementData() == sharingCandidate->elementData())
         return true;
     if (context.element()->fastGetAttribute(XMLNames::langAttr) != sharingCandidate->fastGetAttribute(XMLNames::langAttr))
         return false;
     if (context.element()->fastGetAttribute(langAttr) != sharingCandidate->fastGetAttribute(langAttr))
         return false;
 
+    // These two checks must be here since RuleSet has a specail case to allow style sharing between elements
+    // with type and readonly attributes whereas other attribute selectors prevent sharing.
+    if (typeAttributeValue(context.element()) != typeAttributeValue(sharingCandidate))
+        return false;
+    if (context.element()->fastGetAttribute(readonlyAttr) != sharingCandidate->fastGetAttribute(readonlyAttr))
+        return false;
+
     if (!m_elementAffectedByClassRules) {
         if (sharingCandidate->hasClass() && classNamesAffectedByRules(sharingCandidate->classNames()))
             return false;
     } else if (sharingCandidate->hasClass()) {
         // SVG elements require a (slow!) getAttribute comparision because "class" is an animatable attribute for SVG.
         if (context.element()->isSVGElement()) {
             if (context.element()->getAttribute(classAttr) != sharingCandidate->getAttribute(classAttr))
                 return false;
         } else if (context.element()->classNames() != sharingCandidate->classNames()) {
             return false;
@@ skipping 195 matching lines @@
     if (matchesRuleSet(context, m_siblingRuleSet) || matchesRuleSet(context, m_uncommonAttributeRuleSet))
         return 0;
     // Tracking child index requires unique style for each node. This may get set by the sibling rule match above.
     if (parentElementPreventsSharing(context.element()->parentElement()))
         return 0;
     STYLE_STATS_ADD_STYLE_SHARED();
     return shareElement->renderStyle();
 }
 
 }