Don't mutate a NinePieceImage to create a mask default image
https://bugs.webkit.org/show_bug.cgi?id=202967

Reviewed by Dean Jackson.

For every StyleRareNonInheritedData, the maskBoxImage undergoes copy-on-write
via maskBoxImage.setMaskDefaults(). Fix by giving NinePieceImage a constructor
argument that cna make the mask flavor of image.

* css/StyleBuilderConverter.h:
(WebCore::StyleBuilderConverter::convertBorderMask):
(WebCore::StyleBuilderConverter::convertReflection):
* rendering/style/NinePieceImage.cpp:
(WebCore::NinePieceImage::defaultMaskData):
(WebCore::NinePieceImage::NinePieceImage):
* rendering/style/NinePieceImage.h:
(WebCore::NinePieceImage::setMaskDefaults): Deleted.
* rendering/style/StyleRareNonInheritedData.cpp:
(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
* rendering/style/StyleReflection.h:
(WebCore::StyleReflection::StyleReflection):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251156 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 09b7d80..b85da97 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,27 @@
+2019-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Don't mutate a NinePieceImage to create a mask default image
+        https://bugs.webkit.org/show_bug.cgi?id=202967
+
+        Reviewed by Dean Jackson.
+
+        For every StyleRareNonInheritedData, the maskBoxImage undergoes copy-on-write
+        via maskBoxImage.setMaskDefaults(). Fix by giving NinePieceImage a constructor
+        argument that cna make the mask flavor of image.
+
+        * css/StyleBuilderConverter.h:
+        (WebCore::StyleBuilderConverter::convertBorderMask):
+        (WebCore::StyleBuilderConverter::convertReflection):
+        * rendering/style/NinePieceImage.cpp:
+        (WebCore::NinePieceImage::defaultMaskData):
+        (WebCore::NinePieceImage::NinePieceImage):
+        * rendering/style/NinePieceImage.h:
+        (WebCore::NinePieceImage::setMaskDefaults): Deleted.
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        * rendering/style/StyleReflection.h:
+        (WebCore::StyleReflection::StyleReflection):
+
 2019-10-15  youenn fablet  <youenn@apple.com>
 
         Move headers to keep from a HTTPHeaderNameSet to an OptionSet
diff --git a/Source/WebCore/css/StyleBuilderConverter.h b/Source/WebCore/css/StyleBuilderConverter.h
index fd44a9b..82b46fe 100644
--- a/Source/WebCore/css/StyleBuilderConverter.h
+++ b/Source/WebCore/css/StyleBuilderConverter.h
@@ -456,8 +456,7 @@
 template<CSSPropertyID property>
 inline NinePieceImage StyleBuilderConverter::convertBorderMask(StyleResolver& styleResolver, CSSValue& value)
 {
-    NinePieceImage image;
-    image.setMaskDefaults();
+    NinePieceImage image(NinePieceImage::Type::Mask);
     styleResolver.styleMap()->mapNinePieceImage(property, &value, image);
     return image;
 }
@@ -752,8 +751,7 @@
     reflection->setDirection(reflectValue.direction());
     reflection->setOffset(reflectValue.offset().convertToLength<FixedIntegerConversion | PercentConversion | CalculatedConversion>(styleResolver.state().cssToLengthConversionData()));
 
-    NinePieceImage mask;
-    mask.setMaskDefaults();
+    NinePieceImage mask(NinePieceImage::Type::Mask);
     styleResolver.styleMap()->mapNinePieceImage(CSSPropertyWebkitBoxReflect, reflectValue.mask(), mask);
     reflection->setMask(mask);
 
diff --git a/Source/WebCore/rendering/style/NinePieceImage.cpp b/Source/WebCore/rendering/style/NinePieceImage.cpp
index bc54197..ae54449 100644
--- a/Source/WebCore/rendering/style/NinePieceImage.cpp
+++ b/Source/WebCore/rendering/style/NinePieceImage.cpp
@@ -40,8 +40,18 @@
     return data.get();
 }
 
-NinePieceImage::NinePieceImage()
-    : m_data(defaultData())
+inline DataRef<NinePieceImage::Data>& NinePieceImage::defaultMaskData()
+{
+    static NeverDestroyed<DataRef<Data>> maskData { Data::create() };
+    auto& data = maskData.get().access();
+    data.imageSlices = LengthBox(0);
+    data.fill = true;
+    data.borderSlices = LengthBox();
+    return maskData.get();
+}
+
+NinePieceImage::NinePieceImage(Type imageType)
+    : m_data(imageType == Type::Normal ? defaultData() : defaultMaskData())
 {
 }
 
diff --git a/Source/WebCore/rendering/style/NinePieceImage.h b/Source/WebCore/rendering/style/NinePieceImage.h
index 133b9a1..ff2b2f4 100644
--- a/Source/WebCore/rendering/style/NinePieceImage.h
+++ b/Source/WebCore/rendering/style/NinePieceImage.h
@@ -106,7 +106,12 @@
 
 class NinePieceImage {
 public:
-    NinePieceImage();
+    enum class Type {
+        Normal,
+        Mask
+    };
+
+    NinePieceImage(Type = Type::Normal);
     NinePieceImage(RefPtr<StyleImage>&&, LengthBox imageSlices, bool fill, LengthBox borderSlices, LengthBox outset, NinePieceImageRule horizontalRule, NinePieceImageRule verticalRule);
 
     bool operator==(const NinePieceImage& other) const { return m_data == other.m_data; }
@@ -156,13 +161,6 @@
         m_data.access().verticalRule = other.m_data->verticalRule;
     }
 
-    void setMaskDefaults()
-    {
-        m_data.access().imageSlices = LengthBox(0);
-        m_data.access().fill = true;
-        m_data.access().borderSlices = LengthBox();
-    }
-
     static LayoutUnit computeOutset(const Length& outsetSide, LayoutUnit borderSide)
     {
         if (outsetSide.isRelative())
@@ -211,6 +209,7 @@
     };
 
     static DataRef<Data>& defaultData();
+    static DataRef<Data>& defaultMaskData();
 
     DataRef<Data> m_data;
 };
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
index bdd0191..fb32082 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
@@ -34,6 +34,7 @@
 #include "StyleScrollSnapPoints.h"
 #include <wtf/PointerComparison.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/TextStream.h>
 
 namespace WebCore {
 
@@ -63,6 +64,7 @@
 #endif
     , willChange(RenderStyle::initialWillChange())
     , mask(FillLayerType::Mask)
+    , maskBoxImage(NinePieceImage::Type::Mask)
     , objectPosition(RenderStyle::initialObjectPosition())
     , shapeOutside(RenderStyle::initialShapeOutside())
     , shapeMargin(RenderStyle::initialShapeMargin())
@@ -110,7 +112,6 @@
     , columnGap(RenderStyle::initialColumnGap())
     , rowGap(RenderStyle::initialRowGap())
 {
-    maskBoxImage.setMaskDefaults();
 }
 
 inline StyleRareNonInheritedData::StyleRareNonInheritedData(const StyleRareNonInheritedData& o)
diff --git a/Source/WebCore/rendering/style/StyleReflection.h b/Source/WebCore/rendering/style/StyleReflection.h
index 1b88ca4..96e3e3b 100644
--- a/Source/WebCore/rendering/style/StyleReflection.h
+++ b/Source/WebCore/rendering/style/StyleReflection.h
@@ -55,8 +55,8 @@
 private:
     StyleReflection()
         : m_offset(0, Fixed)
+        , m_mask(NinePieceImage::Type::Mask)
     {
-         m_mask.setMaskDefaults();
     }
     
     ReflectionDirection m_direction { ReflectionDirection::Below };