Explicit management of FrameSelection availability

third_party/WebKit/Source/core/editing/SelectionController.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2012 Digia Plc. and/or its subsidiary(-ies)
  * Copyright (C) 2015 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 255 matching lines @@
 }
 
 bool SelectionController::updateSelectionForMouseDownDispatchingSelectStart(Node* targetNode, const VisibleSelectionInFlatTree& selection, TextGranularity granularity)
 {
     if (targetNode && targetNode->layoutObject() && !targetNode->layoutObject()->isSelectable())
         return false;
 
     if (dispatchSelectStart(targetNode) != DispatchEventResult::NotCanceled)
         return false;
 
-    if (!selection.isValidFor(*m_frame->document()))
+    // |dispatchSelectStart()| can change document hosted by |m_frame|.
+    if (!this->selection().isAvailable())
+        return false;
+
+    if (!selection.isValidFor(this->selection().document()))
         return false;
 
     if (selection.isRange()) {
         m_selectionState = SelectionState::ExtendedSelection;
     } else {
         granularity = CharacterGranularity;
         m_selectionState = SelectionState::PlacedCaret;
     }
 
     this->selection().setNonDirectionalSelectionIfNeeded(selection, granularity);
@@ skipping 100 matching lines @@
     if (pos.isNotNull() && pos.deepEquivalent().anchorNode()->isDescendantOf(URLElement))
         newSelection = VisibleSelectionInFlatTree::selectionFromContentsOfNode(URLElement);
 
     updateSelectionForMouseDownDispatchingSelectStart(innerNode, expandSelectionToRespectUserSelectAll(innerNode, newSelection), WordGranularity);
 }
 
 bool SelectionController::handleMousePressEventDoubleClick(const MouseEventWithHitTestResults& event)
 {
     TRACE_EVENT0("blink", "SelectionController::handleMousePressEventDoubleClick");
 
+    if (!selection().isAvailable())
+        return false;
+
     if (!m_mouseDownAllowsMultiClick)
         return handleMousePressEventSingleClick(event);
 
     if (event.event().button() != LeftButton)
         return false;
 
     if (selection().isRange()) {
         // A double-click when range is already selected
         // should not change the selection.  So, do not call
         // selectClosestWordFromMouseEvent, but do set
         // m_beganSelectingText to prevent handleMouseReleaseEvent
         // from setting caret selection.
         m_selectionState = SelectionState::ExtendedSelection;
     } else {
         selectClosestWordFromMouseEvent(event);
     }
     return true;
 }
 
 bool SelectionController::handleMousePressEventTripleClick(const MouseEventWithHitTestResults& event)
 {
     TRACE_EVENT0("blink", "SelectionController::handleMousePressEventTripleClick");
 
+    if (!selection().isAvailable()) {
+        // editing/shadow/doubleclick-on-meter-in-shadow-crash.html reach here.
+        return false;
+    }
+
     if (!m_mouseDownAllowsMultiClick)
         return handleMousePressEventSingleClick(event);
 
     if (event.event().button() != LeftButton)
         return false;
 
     Node* innerNode = event.innerNode();
     if (!(innerNode && innerNode->layoutObject() && m_mouseDownMayStartSelect))
         return false;
 
     VisibleSelectionInFlatTree newSelection;
     const VisiblePositionInFlatTree& pos = visiblePositionOfHitTestResult(event.hitTestResult());
     if (pos.isNotNull()) {
         newSelection = VisibleSelectionInFlatTree(pos);
         newSelection.expandUsingGranularity(ParagraphGranularity);
     }
 
     return updateSelectionForMouseDownDispatchingSelectStart(innerNode, expandSelectionToRespectUserSelectAll(innerNode, newSelection), ParagraphGranularity);
 }
 
 void SelectionController::handleMousePressEvent(const MouseEventWithHitTestResults& event)
 {
     // If we got the event back, that must mean it wasn't prevented,
     // so it's allowed to start a drag or selection if it wasn't in a scrollbar.
     m_mouseDownMayStartSelect = (canMouseDownStartSelect(event.innerNode()) || isLinkSelection(event))
         && !event.scrollbar();
     m_mouseDownWasSingleClickInSelection = false;
+    if (!selection().isAvailable()) {
+        // "gesture-tap-frame-removed.html" reaches here.
+        m_mouseDownAllowsMultiClick = !event.event().fromTouch();
+        return;
+    }
+
     // Avoid double-tap touch gesture confusion by restricting multi-click side
     // effects, e.g., word selection, to editable regions.
     m_mouseDownAllowsMultiClick = !event.event().fromTouch() || selection().hasEditableStyle();
 }
 
 void SelectionController::handleMouseDraggedEvent(const MouseEventWithHitTestResults& event, const IntPoint& mouseDownPos, const LayoutPoint& dragStartPos, Node* mousePressNode, const IntPoint& lastKnownMousePosition)
 {
+    if (!selection().isAvailable())
+        return;
     if (m_selectionState != SelectionState::ExtendedSelection) {
         HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
         HitTestResult result(request, mouseDownPos);
         m_frame->document()->layoutViewItem().hitTest(result);
 
         updateSelectionForMouseDrag(result, mousePressNode, dragStartPos, lastKnownMousePosition);
     }
     updateSelectionForMouseDrag(event.hitTestResult(), mousePressNode, dragStartPos, lastKnownMousePosition);
 }
 
 void SelectionController::updateSelectionForMouseDrag(Node* mousePressNode, const LayoutPoint& dragStartPos, const IntPoint& lastKnownMousePosition)
 {
     FrameView* view = m_frame->view();
     if (!view)
         return;
     LayoutViewItem layoutItem = m_frame->contentLayoutItem();
     if (layoutItem.isNull())
         return;
 
     HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active | HitTestRequest::Move);
     HitTestResult result(request, view->rootFrameToContents(lastKnownMousePosition));
     layoutItem.hitTest(result);
     updateSelectionForMouseDrag(result, mousePressNode, dragStartPos, lastKnownMousePosition);
 }
 
 bool SelectionController::handleMouseReleaseEvent(const MouseEventWithHitTestResults& event, const LayoutPoint& dragStartPos)
 {
+    if (!selection().isAvailable())
+        return false;
+
     bool handled = false;
     m_mouseDownMayStartSelect = false;
     // Clear the selection if the mouse didn't move after the last mouse
     // press and it's not a context menu click.  We do this so when clicking
     // on the selection, the selection goes away.  However, if we are
     // editing, place the caret.
     if (m_mouseDownWasSingleClickInSelection && m_selectionState != SelectionState::ExtendedSelection
         && dragStartPos == event.event().position()
         && selection().isRange()
         && event.event().button() != RightButton) {
@@ skipping 48 matching lines @@
     Frame* focusFrame = m_frame->page()->focusController().focusedOrMainFrame();
     // Do not paste here if the focus was moved somewhere else.
     if (m_frame == focusFrame && m_frame->editor().behavior().supportsGlobalSelection())
         return m_frame->editor().createCommand("PasteGlobalSelection").execute();
 
     return false;
 }
 
 bool SelectionController::handleGestureLongPress(const PlatformGestureEvent& gestureEvent, const HitTestResult& hitTestResult)
 {
+    if (!selection().isAvailable())
+        return false;
     if (hitTestResult.isLiveLink())
         return false;
 
     Node* innerNode = hitTestResult.innerNode();
     bool innerNodeIsSelectable = innerNode && (innerNode->isContentEditable() || innerNode->isTextNode() || innerNode->canStartSelection());
     if (!innerNodeIsSelectable)
         return false;
 
     selectClosestWordFromHitTestResult(hitTestResult, AppendTrailingWhitespace::DontAppend, SelectInputEventType::GestureLongPress);
+    if (!selection().isAvailable()) {
+        // "editing/selection/longpress-selection-in-iframe-removed-crash.html"
+        // reach here.
+        return false;
+    }
     return selection().isRange();
 }
 
 void SelectionController::sendContextMenuEvent(const MouseEventWithHitTestResults& mev, const LayoutPoint& position)
 {
+    if (!selection().isAvailable())
+        return;
     if (selection().contains(position)
         || mev.scrollbar()
         // FIXME: In the editable case, word selection sometimes selects content that isn't underneath the mouse.
         // If the selection is non-editable, we do word selection to make it easier to use the contextual menu items
         // available for text selections.  But only if we're above text.
         || !(selection().isContentEditable() || (mev.innerNode() && mev.innerNode()->isTextNode())))
         return;
 
     // Context menu events are always allowed to perform a selection.
     TemporaryChange<bool> mouseDownMayStartSelectChange(m_mouseDownMayStartSelect, true);
@@ skipping 56 matching lines @@
 {
     return m_frame->selection();
 }
 
 bool isLinkSelection(const MouseEventWithHitTestResults& event)
 {
     return event.event().altKey() && event.isOverLink();
 }
 
 } // namespace blink