Do not use Node in FocusController, 2nd

third_party/WebKit/Source/core/page/FocusController.cpp

 /*
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 56 matching lines @@
 inline bool isShadowInsertionPointFocusScopeOwner(Element& element)
 {
     return isActiveShadowInsertionPoint(element) && toHTMLShadowElement(element).olderShadowRoot();
 }
 
 class FocusNavigationScope {
     STACK_ALLOCATED();
 public:
     Node* rootNode() const;
     Element* owner() const;
-    static FocusNavigationScope focusNavigationScopeOf(const Node&);
+    static FocusNavigationScope focusNavigationScopeOf(const Element&);
     static FocusNavigationScope ownedByNonFocusableFocusScopeOwner(Element&);
     static FocusNavigationScope ownedByShadowHost(const Element&);
     static FocusNavigationScope ownedByShadowInsertionPoint(HTMLShadowElement&);
     static FocusNavigationScope ownedByIFrame(const HTMLFrameOwnerElement&);
 
 private:
     explicit FocusNavigationScope(TreeScope*);
     RawPtrWillBeMember<TreeScope> m_rootTreeScope;
 };
 
@@ skipping 14 matching lines @@
     if (root->isShadowRoot()) {
         ShadowRoot* shadowRoot = toShadowRoot(root);
         return shadowRoot->isYoungest() ? shadowRoot->host() : shadowRoot->shadowInsertionPointOfYoungerShadowRoot();
     }
     // FIXME: Figure out the right thing for OOPI here.
     if (Frame* frame = root->document().frame())
         return frame->deprecatedLocalOwner();
     return nullptr;
 }
 
-FocusNavigationScope FocusNavigationScope::focusNavigationScopeOf(const Node& node)
+FocusNavigationScope FocusNavigationScope::focusNavigationScopeOf(const Element& element)
 {
-    return FocusNavigationScope(&node.treeScope());
+    return FocusNavigationScope(&element.treeScope());
 }
 
 FocusNavigationScope FocusNavigationScope::ownedByNonFocusableFocusScopeOwner(Element& element)
 {
     if (isShadowHost(element))
         return FocusNavigationScope::ownedByShadowHost(element);
     ASSERT(isShadowInsertionPointFocusScopeOwner(element));
     return FocusNavigationScope::ownedByShadowInsertionPoint(toHTMLShadowElement(element));
 }
 
@@ skipping 397 matching lines @@
     return findFocusableElementDescendingDownIntoFrameDocument(WebFocusTypeBackward, found);
 }
 
 Element* findFocusableElementAcrossFocusScopes(WebFocusType type, const FocusNavigationScope& scope, Node* currentNode)
 {
     return (type == WebFocusTypeForward) ?
         findFocusableElementAcrossFocusScopesForward(scope, currentNode) :
         findFocusableElementAcrossFocusScopesBackward(scope, currentNode);
 }
 
+inline Element* adjustToElement(Node* node, WebFocusType type)
+{
+    ASSERT(type == WebFocusTypeForward || type == WebFocusTypeBackward);
+    if (!node)
+        return nullptr;
+    if (node->isElementNode())
+        return toElement(node);
+    return (type == WebFocusTypeForward) ? ElementTraversal::next(*node) : ElementTraversal::previous(*node);

[tkent, 2016/02/22 06:07:07]

If ElementTraversal::next(*node) is focusable, the element is not focused by TAB
key, right?
It's a behavior change.

+}
+
 } // anonymous namespace
 
 FocusController::FocusController(Page* page)
     : m_page(page)
     , m_isActive(false)
     , m_isFocused(false)
     , m_isChangingFocusedFrame(false)
 {
 }
 
@@ skipping 165 matching lines @@
 
     return false;
 }
 
 bool FocusController::advanceFocusAcrossFrames(WebFocusType type, RemoteFrame* from, LocalFrame* to, InputDeviceCapabilities* sourceCapabilities)
 {
     // If we are shifting focus from a child frame to its parent, the
     // child frame has no more focusable elements, and we should continue
     // looking for focusable elements in the parent, starting from the <iframe>
     // element of the child frame.
-    Node* startingNode = nullptr;
+    Element* start = nullptr;
     if (from->tree().parent() == to) {
         ASSERT(from->owner()->isLocal());
-        startingNode = toHTMLFrameOwnerElement(from->owner());
+        start = toHTMLFrameOwnerElement(from->owner());
     }
 
-    return advanceFocusInDocumentOrder(to, startingNode, type, false, sourceCapabilities);
+    return advanceFocusInDocumentOrder(to, start, type, false, sourceCapabilities);
 }
 
-bool FocusController::advanceFocusInDocumentOrder(LocalFrame* frame, Node* startingNode, WebFocusType type, bool initialFocus, InputDeviceCapabilities* sourceCapabilities)
+bool FocusController::advanceFocusInDocumentOrder(LocalFrame* frame, Element* start, WebFocusType type, bool initialFocus, InputDeviceCapabilities* sourceCapabilities)
 {
     ASSERT(frame);
     Document* document = frame->document();
+    ASSERT(document->documentElement());

[hayato, 2016/03/15 07:08:16]

I guess this assertion is not always true and this is the cause of the crash.
See https://bugs.chromium.org/p/chromium/issues/detail?id=594841

 
-    Node* currentNode = startingNode;
-    if (!currentNode)
-        currentNode = document->focusedElement();
+    Element* current = start;
+    if (!current)
+        current = document->focusedElement();
 
     // FIXME: Not quite correct when it comes to focus transitions leaving/entering the WebView itself
     bool caretBrowsing = frame->settings() && frame->settings()->caretBrowsingEnabled();
 
-    if (caretBrowsing && !currentNode)
-        currentNode = frame->selection().start().anchorNode();
+    if (caretBrowsing && !current)
+        current = adjustToElement(frame->selection().start().anchorNode(), type);
 
     document->updateLayoutIgnorePendingStylesheets();
 
-    RefPtrWillBeRawPtr<Element> element = findFocusableElementAcrossFocusScopes(type, FocusNavigationScope::focusNavigationScopeOf(currentNode ? *currentNode : *document), currentNode);
+    RefPtrWillBeRawPtr<Element> element = findFocusableElementAcrossFocusScopes(type, FocusNavigationScope::focusNavigationScopeOf(current ? *current : *document->documentElement()), current);
 
     if (!element) {
         // If there's a RemoteFrame on the ancestor chain, we need to continue
         // searching for focusable elements there.
         if (frame->localFrameRoot() != frame->tree().top()) {
             document->clearFocusedElement();
             toRemoteFrame(frame->localFrameRoot()->tree().parent())->advanceFocus(type, frame->localFrameRoot());
             return true;
         }
 
         // We didn't find an element to focus, so we should try to pass focus to Chrome.
         if (!initialFocus && m_page->chromeClient().canTakeFocus(type)) {
             document->clearFocusedElement();
             setFocusedFrame(nullptr);
             m_page->chromeClient().takeFocus(type);
             return true;
         }
 
         // Chrome doesn't want focus, so we should wrap focus.
-        element = findFocusableElementRecursively(type, FocusNavigationScope::focusNavigationScopeOf(*toLocalFrame(m_page->mainFrame())->document()), nullptr);
+        element = findFocusableElementRecursively(type, FocusNavigationScope::focusNavigationScopeOf(*toLocalFrame(m_page->mainFrame())->document()->documentElement()), nullptr);
         element = findFocusableElementDescendingDownIntoFrameDocument(type, element.get());
 
         if (!element)
             return false;
     }
 
     ASSERT(element);
 
     if (element == document->focusedElement()) {
         // Focus wrapped around to the same node.
@@ skipping 348 matching lines @@
     return consumed;
 }
 
 DEFINE_TRACE(FocusController)
 {
     visitor->trace(m_page);
     visitor->trace(m_focusedFrame);
 }
 
 } // namespace blink