Postpone mutation event dispatch in Selection.deleteFromDocument

Source/core/page/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 24 matching lines @@
 #include "bindings/v8/ExceptionState.h"
 #include "bindings/v8/ExceptionStatePlaceholder.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/Node.h"
 #include "core/dom/Range.h"
 #include "core/dom/TreeScope.h"
 #include "core/editing/FrameSelection.h"
 #include "core/editing/TextIterator.h"
 #include "core/editing/htmlediting.h"
+#include "core/events/ScopedEventQueue.h"
 #include "core/frame/LocalFrame.h"
 #include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
 static Node* selectionShadowAncestor(LocalFrame* frame)
 {
     Node* node = frame->selection().selection().base().anchorNode();
     if (!node)
         return 0;
@@ skipping 394 matching lines @@
     if (selection.isNone())
         return;
 
     if (isCollapsed())
         selection.modify(FrameSelection::AlterationExtend, DirectionBackward, CharacterGranularity);
 
     RefPtr<Range> selectedRange = selection.selection().toNormalizedRange();
     if (!selectedRange)
         return;
 
-    selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
+    {
+        EventQueueScope eventQueueScope;

[Yuta Kitamura, 2014/03/19 06:57:52]

I think this should be done within Range::deleteContents().

[yosin_UTC9, 2014/03/19 07:33:35]

I agree with yutak@. |Range::deleteContents()| is also fragile against DOM
mutation event attack. I hope changing |Range::deleteContents()| doesn't make
failure on layout tests. Although, if some tests are failed, please update
tests.

+        selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
+    }
 
     setBaseAndExtent(selectedRange->startContainer(ASSERT_NO_EXCEPTION), selectedRange->startOffset(), selectedRange->startContainer(), selectedRange->startOffset(), ASSERT_NO_EXCEPTION);
 }
 
 bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
 {
     if (!m_frame)
         return false;
 
     FrameSelection& selection = m_frame->selection();
@@ skipping 84 matching lines @@
     return node->document() == m_frame->document();
 }
 
 void DOMSelection::addConsoleError(const String& message)
 {
     if (m_treeScope)
         m_treeScope->document().addConsoleMessage(JSMessageSource, ErrorMessageLevel, message);
 }
 
 } // namespace WebCore