Make previousLinePosition() not to use dangling RootInlineBox

Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated since
document isn't rendering ready, |haveImportLoaded()| &&
|haveRenderBlockingStyleSheetsLoaded()|.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html

Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
Committed: https://crrev.com/e9c943f368d15bbfe414aedf5e001792257f3eeb
Cr-Original-Commit-Position: refs/heads/master@{#401231}
Cr-Commit-Position: refs/heads/master@{#401581}

[yosin_UTC9, 2016-06-22 06:36:04]

Description was changed from

==========
2016-06-22T14:22:55

BUG=618237
==========

to

==========
Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated due
by pending style sheet.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
==========

[yosin_UTC9, 2016-06-22 06:36:05]

yosin@chromium.org changed reviewers:
+ yoichio@chromium.org

[yosin_UTC9, 2016-06-22 06:36:23]

PTAL

mac and win10 bots failures aren't related to this patch.

[yoichio, 2016-06-22 07:42:05]

lgtm
but one question.
Does isEditablePosition need update with pending stylesheets?
Since canonicalization requires only
updateStyleAndLayoutIgnorePendingStylesheets,
 who needs isEditablePosition with fully loaded style sheets?

[yosin_UTC9, 2016-06-22 07:56:29]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2016-06-22 07:56:36]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2082893005/1

[yosin_UTC9, 2016-06-22 08:03:09]

On 2016/06/22 at 07:42:05, yoichio wrote:
> lgtm
> but one question.
> Does isEditablePosition need update with pending stylesheets?
> Since canonicalization requires only
updateStyleAndLayoutIgnorePendingStylesheets,
>  who needs isEditablePosition with fully loaded style sheets?

Update layout is happened due by |m_hasNodesWithPlaceholderStyle| is true from
|StyleResolver::styleForElement()| for OPTION elements when not
|Document::isRenderingReady()|
 == |haveImportsLoaded() && haveRenderBlockingStylesheetsLoaded()|

[yosin_UTC9, 2016-06-22 08:04:59]

Description was changed from

==========
Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated due
by pending style sheet.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
==========

to

==========
Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated since
document isn't rendering ready, |haveImportLoaded()| && 
|haveRenderBlockingStyleSheetsLoaded()|.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
==========

[commit-bot: I haz the power, 2016-06-22 08:41:35]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-06-22 08:42:41]

Description was changed from

==========
Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated since
document isn't rendering ready, |haveImportLoaded()| && 
|haveRenderBlockingStyleSheetsLoaded()|.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
==========

to

==========
Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated since
document isn't rendering ready, |haveImportLoaded()| &&
|haveRenderBlockingStyleSheetsLoaded()|.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html

Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
Cr-Commit-Position: refs/heads/master@{#401231}
==========

[commit-bot: I haz the power, 2016-06-22 08:42:43]

Patchset 1 (id:??) landed as
https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
Cr-Commit-Position: refs/heads/master@{#401231}

[dgozman, 2016-06-22 17:08:53]

A revert of this CL (patchset #1 id:1) has been created in
https://codereview.chromium.org/2084913005/ by dgozman@chromium.org.

The reason for reverting is: New test
editing/selection/modify_move/move_backward_line_import_crash.html fails on
WebKit Linux MSAN.

Dashboard:
https://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=ed...

First failed build:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20MSAN/b....

[yosin_UTC9, 2016-06-23 09:46:18]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2016-06-23 09:46:35]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2082893005/1

[commit-bot: I haz the power, 2016-06-23 11:32:15]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-06-23 11:43:13]

Description was changed from

==========
Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated since
document isn't rendering ready, |haveImportLoaded()| &&
|haveRenderBlockingStyleSheetsLoaded()|.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html

Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
Cr-Commit-Position: refs/heads/master@{#401231}
==========

to

==========
Make previousLinePosition() not to use dangling RootInlineBox

This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
pointer to avoid use-after-free.

Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
parameter to update layout tree if needed. Usually, layout tree isn't updated
by this |isEditablePosition()| call since |previousLinePosition()| updates
layout tree at entry. However, if there are pending style sheet, e.g. @import
directive, and HTML import, e.g link rel=import, layout tree is updated since
document isn't rendering ready, |haveImportLoaded()| &&
|haveRenderBlockingStyleSheetsLoaded()|.

BUG=618237
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html

Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
Committed: https://crrev.com/e9c943f368d15bbfe414aedf5e001792257f3eeb
Cr-Original-Commit-Position: refs/heads/master@{#401231}
Cr-Commit-Position: refs/heads/master@{#401581}
==========

[commit-bot: I haz the power, 2016-06-23 11:43:15]

Patchset 1 (id:??) landed as
https://crrev.com/e9c943f368d15bbfe414aedf5e001792257f3eeb
Cr-Commit-Position: refs/heads/master@{#401581}