Explicit management of FrameSelection availability

third_party/WebKit/Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 83 matching lines @@
 FrameSelection::FrameSelection(LocalFrame* frame)
     : m_frame(frame)
     , m_pendingSelection(PendingSelection::create(*this))
     , m_selectionEditor(SelectionEditor::create(*this))
     , m_granularity(CharacterGranularity)
     , m_xPosForVerticalArrowNavigation(NoXPosForVerticalArrowNavigation())
     , m_focused(frame->page() && frame->page()->focusController().focusedFrame() == frame)
     , m_frameCaret(new FrameCaret(frame))
 {
     DCHECK(frame);
-    if (shouldAlwaysUseDirectionalSelection(m_frame))

[tkent, 2016/06/07 23:41:59]

Why can we remove this code block?

[yosin_UTC9, 2016/06/08 04:06:10]

Setting |VisibleSelection.isDirectional| done in
|SelectionEditor::documentAttached()| rather than here.
We should set |VisibleSelection.isDirectional| each time |FrameSelection|
associated to |Document| for fresh selection.

-        m_selectionEditor->setIsDirectional(true);
 }
 
 FrameSelection::~FrameSelection()
 {
 }
 
+const Document& FrameSelection::document() const
+{
+    DCHECK(m_document);
+    return *m_document;
+}
+
+Document& FrameSelection::document()
+{
+    DCHECK(m_document);
+    return *m_document;
+}
+
 template <>
 VisiblePosition FrameSelection::originalBase<EditingStrategy>() const
 {
     return m_originalBase;
 }
 
 template <>
 VisiblePositionInFlatTree FrameSelection::originalBase<EditingInFlatTreeStrategy>() const
 {
     return m_originalBaseInFlatTree;
@@ skipping 10 matching lines @@
 
 template <>
 const VisibleSelectionInFlatTree& FrameSelection::visibleSelection<EditingInFlatTreeStrategy>() const
 {
     return m_selectionEditor->visibleSelection<EditingInFlatTreeStrategy>();
 }
 
 Element* FrameSelection::rootEditableElementOrDocumentElement() const
 {
     Element* selectionRoot = selection().rootEditableElement();
-    return selectionRoot ? selectionRoot : m_frame->document()->documentElement();
+    return selectionRoot ? selectionRoot : document().documentElement();
 }
 
 ContainerNode* FrameSelection::rootEditableElementOrTreeScopeRootNode() const
 {
     Element* selectionRoot = selection().rootEditableElement();
     if (selectionRoot)
         return selectionRoot;
 
     Node* node = selection().base().computeContainerNode();
     return node ? &node->treeScope().rootNode() : 0;
@@ skipping 114 matching lines @@
 }
 
 void FrameSelection::setNonDirectionalSelectionIfNeeded(const VisibleSelectionInFlatTree& passedNewSelection, TextGranularity granularity, EndPointsAdjustmentMode endpointsAdjustmentMode)
 {
     setNonDirectionalSelectionIfNeededAlgorithm<EditingInFlatTreeStrategy>(passedNewSelection, granularity, endpointsAdjustmentMode);
 }
 
 template <typename Strategy>
 void FrameSelection::setSelectionAlgorithm(const VisibleSelectionTemplate<Strategy>& newSelection, SetSelectionOptions options, CursorAlignOnScroll align, TextGranularity granularity)
 {
+    DCHECK(isAvailable());
+    const Document& currentDocument = document();
     if (m_granularityStrategy && (options & FrameSelection::DoNotClearStrategy) == 0)
         m_granularityStrategy->Clear();
     bool closeTyping = options & CloseTyping;
     bool shouldClearTypingStyle = options & ClearTypingStyle;
     EUserTriggered userTriggered = selectionOptionsToUserTriggered(options);
 
     VisibleSelectionTemplate<Strategy> s = validateSelection(newSelection);
     if (shouldAlwaysUseDirectionalSelection(m_frame))
         s.setIsDirectional(true);
 
-    // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at

[tkent, 2016/06/07 23:41:59]

Why can we remove this code block?

[yosin_UTC9, 2016/06/08 04:06:10]

This can't be happened any more as proofed by no layout test failure.
|newSelection| should be valid when this function called. If not,
|SelectionEditor::setVisibleSelection()| asserts it.
I'll add assert for |newSelection| in top of this function.

-    // |FrameSelection::setSelection|
-    // if |document->frame()| == |m_frame| we can get into an infinite loop
-    if (s.base().anchorNode()) {
-        Document& document = *s.base().document();
-        // TODO(hajimehoshi): validateSelection already checks if the selection
-        // is valid, thus we don't need this 'if' clause any more.
-        if (document.frame() && document.frame() != m_frame && document != m_frame->document()) {
-            document.frame()->selection().setSelection(s, options, align, granularity);
-            // It's possible that during the above set selection, this
-            // |FrameSelection| has been modified by
-            // |selectFrameElementInParentIfFullySelected|, but that the
-            // selection is no longer valid since the frame is about to be
-            // destroyed. If this is the case, clear our selection.
-            if (!document.frame()->host() && !selection().isNonOrphanedCaretOrRange())
-                clear();
-            return;
-        }
-    }
-
     m_granularity = granularity;
 
     // TODO(yosin): We should move to call |TypingCommand::closeTyping()| to
     // |Editor| class.
     if (closeTyping)
         TypingCommand::closeTyping(m_frame);
 
     if (shouldClearTypingStyle)
         clearTypingStyle();
 
     if (m_selectionEditor->visibleSelection<Strategy>() == s) {
         // Even if selection was not changed, selection offsets may have been
         // changed.
         m_frame->inputMethodController().cancelCompositionIfSelectionIsInvalid();
         notifyLayoutObjectOfSelectionChange(userTriggered);
         return;
     }
 
     const VisibleSelectionTemplate<Strategy> oldSelection = visibleSelection<Strategy>();
     const VisibleSelection oldSelectionInDOMTree = selection();
 
     m_selectionEditor->setVisibleSelection(s, options);
     if (s.isCaret())
         m_frameCaret->setCaretPosition(PositionWithAffinity(toPositionInDOMTree(s.start()), s.affinity()));
     else
         m_frameCaret->clear();
 
-    if (!s.isNone() && !(options & DoNotSetFocus))
+    if (!s.isNone() && !(options & DoNotSetFocus)) {
         setFocusedNodeIfNeeded();
+        // |setFocusedNodeIfNeeded()| dispatches sync events "FocusOut" and
+        // "FocusIn", |m_frame| may associate to another document.
+        if (!isAvailable() || document() != currentDocument) {
+            // Once we get test case to reach here, we should change this
+            // if-statement to |DCHECK()|.
+            NOTREACHED();
+            return;
+        }
+    }
 
     if (!(options & DoNotUpdateAppearance)) {
         // Hits in compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html
         DisableCompositingQueryAsserts disabler;
         m_frameCaret->stopCaretBlinkTimer();
         updateAppearance();
     }
 
     // Always clear the x position used for vertical arrow navigation.
     // It will be restored by the vertical arrow navigation code if necessary.
     m_xPosForVerticalArrowNavigation = NoXPosForVerticalArrowNavigation();
     // This may dispatch a synchronous focus-related events.
     selectFrameElementInParentIfFullySelected();
+    if (!isAvailable() || document() != currentDocument) {
+        // editing/selection/selectallchildren-crash.html and
+        // editing/selection/longpress-selection-in-iframe-removed-crash.html
+        // reach here.
+        return;
+    }
     notifyLayoutObjectOfSelectionChange(userTriggered);
     // If the selections are same in the DOM tree but not in the flat tree,
     // don't fire events. For example, if the selection crosses shadow tree
     // boundary, selection for the DOM tree is shrunk while that for the
     // flat tree is not. Additionally, this case occurs in some edge cases.
     // See also: editing/pasteboard/4076267-3.html
     if (oldSelection == m_selectionEditor->visibleSelection<Strategy>()) {
         m_frame->inputMethodController().cancelCompositionIfSelectionIsInvalid();
         return;
     }
@@ skipping 114 matching lines @@
     } else {
         const VisibleSelection& selection = m_selectionEditor->visibleSelection<EditingStrategy>();
         if (selection.isCaret())
             m_frameCaret->setCaretPosition(PositionWithAffinity(selection.start(), selection.affinity()));
         else
             m_frameCaret->clear();
     }
 
     // TODO(yosin): We should move to call |TypingCommand::closeTyping()| to
     // |Editor| class.
-    if (!m_frame->document()->isRunningExecCommand())
+    if (!document().isRunningExecCommand())
         TypingCommand::closeTyping(m_frame);
 }
 
 static Position updatePositionAfterAdoptingTextReplacement(const Position& position, CharacterData* node, unsigned offset, unsigned oldLength, unsigned newLength)
 {
     if (!position.anchorNode() || position.anchorNode() != node || !position.isOffsetInAnchor())
         return position;
 
     // See: http://www.w3.org/TR/DOM-Level-2-Traversal-Range/ranges.html#Level-2-Range-Mutation
     DCHECK_GE(position.offsetInContainerNode(), 0);
@@ skipping 83 matching lines @@
     Position end = updatePostionAfterAdoptingTextNodeSplit(selection().end(), oldNode);
     updateSelectionIfNeeded(base, extent, start, end);
 }
 
 void FrameSelection::updateSelectionIfNeeded(const Position& base, const Position& extent, const Position& start, const Position& end)
 {
     if (base == selection().base() && extent == selection().extent() && start == selection().start() && end == selection().end())
         return;
     // TODO(yosin): We should move to call |TypingCommand::closeTyping()| to
     // |Editor| class.
-    if (!m_frame->document()->isRunningExecCommand())
+    if (!document().isRunningExecCommand())
         TypingCommand::closeTyping(m_frame);
     VisibleSelection newSelection;
     if (selection().isBaseFirst())
         newSelection.setWithoutValidation(start, end);
     else
         newSelection.setWithoutValidation(end, start);
     setSelection(newSelection, DoNotSetFocus);
 }
 
 void FrameSelection::didChangeFocus()
@@ skipping 58 matching lines @@
 }
 
 void FrameSelection::clear()
 {
     m_granularity = CharacterGranularity;
     if (m_granularityStrategy)
         m_granularityStrategy->Clear();
     setSelection(VisibleSelection());
 }
 
-void FrameSelection::prepareForDestruction()
+void FrameSelection::documentAttached(Document* document)
 {

[tkent, 2016/06/07 23:41:59]

We should have DCHECK(document).

[yosin_UTC9, 2016/06/08 04:06:10]

Done.

+    DCHECK(!m_document) << "FrameSelection is already attached to " << m_document;
+    m_document = document;
+    m_selectionEditor->documentAttached(document);
+}
+
+void FrameSelection::documentDetached(const Document& document)
+{
+    DCHECK_EQ(m_document, document);
+    m_document = nullptr;
     m_originalBase = VisiblePosition();
     m_originalBaseInFlatTree = VisiblePositionInFlatTree();
     m_granularity = CharacterGranularity;
 
     LayoutViewItem view = m_frame->contentLayoutItem();
     if (!view.isNull())
         view.clearSelection();
 
-    setSelection(VisibleSelection(), CloseTyping | ClearTypingStyle | DoNotUpdateAppearance);
-    m_selectionEditor->dispose();
-    m_frameCaret->prepareForDestruction();
+    clearTypingStyle();
+    m_selectionEditor->documentDetached(document);
+    m_frameCaret->documentDetached();
 }
 
 LayoutBlock* FrameSelection::caretLayoutObject() const
 {
-    DCHECK(selection().isValidFor(*m_frame->document()));
+    DCHECK(selection().isValidFor(document()));
     if (!isCaret())
         return nullptr;
     return CaretBase::caretLayoutObject(selection().start().anchorNode());
 }
 
 IntRect FrameSelection::absoluteCaretBounds()
 {
     DCHECK(selection().isValidFor(*m_frame->document()));
     return m_frameCaret->absoluteCaretBounds();
 }
 
 void FrameSelection::invalidateCaretRect()
 {
     m_frameCaret->invalidateCaretRect();
 }
 
 void FrameSelection::dataWillChange(const CharacterData& node)
 {
     m_frameCaret->dataWillChange(node);
 }
 
 void FrameSelection::paintCaret(GraphicsContext& context, const LayoutPoint& paintOffset)
 {
     m_frameCaret->paintCaret(context, paintOffset);
 }
 
 bool FrameSelection::contains(const LayoutPoint& point)
 {
-    Document* document = m_frame->document();
-    if (document->layoutViewItem().isNull())
+    if (document().layoutViewItem().isNull())
         return false;
 
     // Treat a collapsed selection like no selection.
     const VisibleSelectionInFlatTree& visibleSelection = this->visibleSelection<EditingInFlatTreeStrategy>();
     if (!visibleSelection.isRange())
         return false;
 
     HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
     HitTestResult result(request, point);
-    document->layoutViewItem().hitTest(result);
+    document().layoutViewItem().hitTest(result);
     Node* innerNode = result.innerNode();
     if (!innerNode || !innerNode->layoutObject())
         return false;
 
     const VisiblePositionInFlatTree& visiblePos = createVisiblePosition(fromPositionInDOMTree<EditingInFlatTreeStrategy>(innerNode->layoutObject()->positionForPoint(result.localPoint())));
     if (visiblePos.isNull())
         return false;
 
     const VisiblePositionInFlatTree& visibleStart = visibleSelection.visibleStart();
     const VisiblePositionInFlatTree& visibleEnd = visibleSelection.visibleEnd();
@@ skipping 62 matching lines @@
 
 // Returns a shadow tree node for legacy shadow trees, a child of the
 // ShadowRoot node for new shadow trees, or 0 for non-shadow trees.
 static Node* nonBoundaryShadowTreeRootNode(const Position& position)
 {
     return position.anchorNode() && !position.anchorNode()->isShadowRoot() ? position.anchorNode()->nonBoundaryShadowTreeRootNode() : nullptr;
 }
 
 void FrameSelection::selectAll()
 {
-    Document* document = m_frame->document();
-
-    if (isHTMLSelectElement(document->focusedElement())) {
-        HTMLSelectElement* selectElement = toHTMLSelectElement(document->focusedElement());
+    if (isHTMLSelectElement(document().focusedElement())) {
+        HTMLSelectElement* selectElement = toHTMLSelectElement(document().focusedElement());
         if (selectElement->canSelectAll()) {
             selectElement->selectAll();
             return;
         }
     }
 
     Node* root = nullptr;
     Node* selectStartTarget = nullptr;
     if (isContentEditable()) {
         root = highestEditableRoot(selection().start());
         if (Node* shadowRoot = nonBoundaryShadowTreeRootNode(selection().start()))
             selectStartTarget = shadowRoot->shadowHost();
         else
             selectStartTarget = root;
     } else {
         root = nonBoundaryShadowTreeRootNode(selection().start());
         if (root) {
             selectStartTarget = root->shadowHost();
         } else {
-            root = document->documentElement();
-            selectStartTarget = document->body();
+            root = document().documentElement();
+            selectStartTarget = document().body();
         }
     }
     if (!root || editingIgnoresContent(root))
         return;
 
     if (selectStartTarget) {
+        const Document& expectedDocument = document();
         if (selectStartTarget->dispatchEvent(Event::createCancelableBubble(EventTypeNames::selectstart)) != DispatchEventResult::NotCanceled)
             return;
         // |root| may be detached due to selectstart event.
-        if (!root->inShadowIncludingDocument() || root->document() != document)
+        if (!root->inShadowIncludingDocument() || expectedDocument != root->document())
             return;
     }
 
     VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root));
     setSelection(newSelection);
     selectFrameElementInParentIfFullySelected();
     notifyLayoutObjectOfSelectionChange(UserTriggered);
 }
 
 bool FrameSelection::setSelectedRange(Range* range, TextAffinity affinity, SelectionDirectionalMode directional, SetSelectionOptions options)
@@ skipping 26 matching lines @@
 
 bool FrameSelection::isInPasswordField() const
 {
     HTMLTextFormControlElement* textControl = enclosingTextFormControl(start());
     return isHTMLInputElement(textControl) && toHTMLInputElement(textControl)->type() == InputTypeNames::password;
 }
 
 void FrameSelection::notifyAccessibilityForSelectionChange()
 {
     if (selection().start().isNotNull() && selection().end().isNotNull()) {
-        if (AXObjectCache* cache = m_frame->document()->existingAXObjectCache())
+        if (AXObjectCache* cache = document().existingAXObjectCache())
             cache->selectionChanged(selection().start().computeContainerNode());
     }
 }
 
 void FrameSelection::notifyCompositorForSelectionChange()
 {
     if (!RuntimeEnabledFeatures::compositedSelectionUpdateEnabled())
         return;
 
     scheduleVisualUpdate();
 }
 
 void FrameSelection::notifyEventHandlerForSelectionChange()
 {
     m_frame->eventHandler().selectionController().notifySelectionChanged();
 }
 
 void FrameSelection::focusedOrActiveStateChanged()
 {
     bool activeAndFocused = isFocusedAndActive();
-    Document* document = m_frame->document();
 
     // Trigger style invalidation from the focused element. Even though
     // the focused element hasn't changed, the evaluation of focus pseudo
     // selectors are dependent on whether the frame is focused and active.
-    if (Element* element = document->focusedElement())
+    if (Element* element = document().focusedElement())
         element->focusStateChanged();
 
-    document->updateStyleAndLayoutTree();
+    document().updateStyleAndLayoutTree();
 
     // Because LayoutObject::selectionBackgroundColor() and
     // LayoutObject::selectionForegroundColor() check if the frame is active,
     // we have to update places those colors were painted.
-    LayoutViewItem view = document->layoutViewItem();
+    LayoutViewItem view = document().layoutViewItem();
     if (!view.isNull())
         view.invalidatePaintForSelection();
 
     // Caret appears in the active frame.
     if (activeAndFocused)
         setSelectionFromNone();
     else
         m_frame->spellChecker().spellCheckAfterBlur();
     m_frameCaret->setCaretVisibility(activeAndFocused ? CaretVisibility::Visible : CaretVisibility::Hidden);
 
     // Update for caps lock state
     m_frame->eventHandler().capsLockStateMayHaveChanged();
 
     // Secure keyboard entry is set by the active frame.
-    if (document->useSecureKeyboardEntryWhenActive())
+    if (document().useSecureKeyboardEntryWhenActive())
         setUseSecureKeyboardEntry(activeAndFocused);
 }
 
 void FrameSelection::pageActivationChanged()
 {
     focusedOrActiveStateChanged();
 }
 
 void FrameSelection::updateSecureKeyboardEntryIfActive()
 {
-    if (m_frame->document() && isFocusedAndActive())
-        setUseSecureKeyboardEntry(m_frame->document()->useSecureKeyboardEntryWhenActive());
+    if (isFocusedAndActive())
+        setUseSecureKeyboardEntry(document().useSecureKeyboardEntryWhenActive());
 }
 
 void FrameSelection::setUseSecureKeyboardEntry(bool enable)
 {
     if (enable)
         enableSecureTextInput();
     else
         disableSecureTextInput();
 }
 
@@ skipping 57 matching lines @@
     bool caretBrowsing = m_frame->settings() && m_frame->settings()->caretBrowsingEnabled();
     if (caretBrowsing) {
         if (Element* anchor = enclosingAnchorElement(base())) {
             m_frame->page()->focusController().setFocusedElement(anchor, m_frame);
             return;
         }
     }
 
     if (Element* target = rootEditableElement()) {
         // Walk up the DOM tree to search for a node to focus.
-        m_frame->document()->updateStyleAndLayoutTreeIgnorePendingStylesheets();
+        document().updateStyleAndLayoutTreeIgnorePendingStylesheets();
         while (target) {
             // We don't want to set focus on a subframe when selecting in a parent frame,
             // so add the !isFrameElement check here. There's probably a better way to make this
             // work in the long term, but this is the safest fix at this time.
             if (target->isMouseFocusable() && !isFrameElement(target)) {
                 m_frame->page()->focusController().setFocusedElement(target, m_frame);
                 return;
             }
             target = target->parentOrShadowHostElement();
         }
-        m_frame->document()->clearFocusedElement();
+        document().clearFocusedElement();
     }
 
     if (caretBrowsing)
         m_frame->page()->focusController().setFocusedElement(0, m_frame);
 }
 
 static String extractSelectedText(const FrameSelection& selection, TextIteratorBehavior behavior)
 {
     const VisibleSelectionInFlatTree& visibleSelection = selection.visibleSelection<EditingInFlatTreeStrategy>();
     const EphemeralRangeInFlatTree& range = visibleSelection.toNormalizedEphemeralRange();
@@ skipping 64 matching lines @@
                 return frameResult;
         }
     }
     return 0;
 }
 
 // We look for either the form containing the current focus, or for one immediately after it
 HTMLFormElement* FrameSelection::currentForm() const
 {
     // Start looking either at the active (first responder) node, or where the selection is.
-    Node* start = m_frame->document()->focusedElement();
+    Node* start = document().focusedElement();
     if (!start)
         start = this->start().anchorNode();
     if (!start)
         return 0;
 
     // Try walking up the node tree to find a form element.
     for (HTMLElement* element = Traversal<HTMLElement>::firstAncestorOrSelf(*start); element; element = Traversal<HTMLElement>::firstAncestor(*element)) {
         if (HTMLFormElement* form = associatedFormElement(*element))
             return form;
     }
@@ skipping 98 matching lines @@
 
 void FrameSelection::showTreeForThis() const
 {
     selection().showTreeForThis();
 }
 
 #endif
 
 DEFINE_TRACE(FrameSelection)
 {
+    visitor->trace(m_document);
     visitor->trace(m_frame);
     visitor->trace(m_pendingSelection);
     visitor->trace(m_selectionEditor);
     visitor->trace(m_originalBase);
     visitor->trace(m_originalBaseInFlatTree);
     visitor->trace(m_typingStyle);
     visitor->trace(m_frameCaret);
 }
 
 void FrameSelection::scheduleVisualUpdate() const
@@ skipping 113 matching lines @@
 
 void showTree(const blink::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
     else
         fprintf(stderr, "Cannot showTree for (nil) FrameSelection.\n");
 }
 
 #endif