[InputEvent] Support |deleteByDrag| and |insertFromDrop|

third_party/WebKit/Source/core/editing/Editor.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 86 matching lines @@
 using namespace Unicode;
 
 namespace {
 
 void dispatchInputEvent(Element* target, InputEvent::InputType inputType, const String& data, InputEvent::EventIsComposing isComposing)
 {
     if (!RuntimeEnabledFeatures::inputEventEnabled())
         return;
     if (!target)
         return;
-    // TODO(chongz): Pass appreciate |ranges| after it's defined on spec.
-    // http://w3c.github.io/editing/input-events.html#dom-inputevent-inputtype
     InputEvent* inputEvent = InputEvent::createInput(inputType, data, isComposing, nullptr);
     target->dispatchScopedEvent(inputEvent);
 }
 
 void dispatchInputEventEditableContentChanged(Element* startRoot, Element* endRoot, InputEvent::InputType inputType, const String& data, InputEvent::EventIsComposing isComposing)
 {
+    if (inputType == InputEvent::InputType::MoveByDragDrop) {

[chongz, 2016/08/30 23:59:21]

Do we have any other solution that does not require an internal InputType?

+        // Drag&Drop will be combined into one |MoveSelectionCommand|, we need to split it into |DeleteByDrag| and |InsertFromDrop|.
+        if (startRoot)
+            dispatchInputEvent(startRoot, InputEvent::InputType::DeleteByDrag, data, isComposing);
+        if (endRoot)
+            dispatchInputEvent(endRoot, InputEvent::InputType::InsertFromDrop, data, isComposing);

[yosin_UTC9, 2016/08/31 01:20:34]

Q: Do we dispatch "insertFromDrop" even if "deleteByDrag" is canceled?
Q: Do we dispatch "insertFromDrop" even if  |!endRoot.isConnected()|?

[chongz, 2016/09/02 18:02:10]

Yes. Canceling 'deleteByDrag' only means cancelling the DOM update part of it,
but the Drag&Drop process is still going, so we will do
|DragDropBeforeInputResult::InsertOnly|.
e.g. Similar to 'deleteByCut' & 'insertFromPaste', where canceling 'deleteByCut'
won't prevent clipboard update.
From my testing |endRoot| is always connected. If drop target was removed
|endRoot| will point to drag target, so I have to handle it in |DragController|.

[yosin_UTC9, 2016/09/05 01:37:50]

Your testing doesn't covered to make the case |endRoot| becomes not to
connected. ;-)
Attackers can do anything by using JavaScript. ClusterFuzz will find such case.

L123's |startRoot| also can be not connected by both "beforeInput" event from
|startRoot| and |endRoot|.

[chongz, 2016/09/07 17:12:55]

Added check in |dispatchInputEvent()|.

+        return;
+    }
+
     if (startRoot)
         dispatchInputEvent(startRoot, inputType, data, isComposing);
     if (endRoot && endRoot != startRoot)

[yosin_UTC9, 2016/08/31 01:20:34]

Do we need to check |endRoot.isConnected()|?

[chongz, 2016/09/02 18:02:10]

It seems to me that if the element was changed, we should dispatch 'input' event
not matter it's connected or not.
But I'm not sure but will it cause any issue by dispatching events to removed
elements?

[yosin_UTC9, 2016/09/05 01:37:50]

According DOM spec, https://www.w3.org/TR/dom/#dispatching-events, 3.7
Dispatching events

If event's target attribute value is participating in a tree, let event path be
a static ordered list of all its ancestors in tree order, and let event path be
the empty list otherwise.

Event target should be connected before computing event path.

Since |dispatchInputEvent()| checks null target element, let's check whether
target is connected or not
in |dispatchInputEvent()| and remove if-statement from call sites to make code
simpler.

[chongz, 2016/09/07 17:12:55]

OK, thanks for the reference!
Added check in |dispatchInputEvent()|.

         dispatchInputEvent(endRoot, inputType, data, isComposing);

[chongz, 2016/08/30 23:59:21]

Do we have other commands that will affect two editing hosts? (Other than
Drap&Drop and it's Undo&Redo)

 }
 
 InputEvent::EventIsComposing isComposingFromCommand(const CompositeEditCommand* command)
 {
     if (command->isTypingCommand() && toTypingCommand(command)->compositionType() != TypingCommand::TextCompositionNone)
         return InputEvent::EventIsComposing::IsComposing;
     return InputEvent::EventIsComposing::NotComposing;
 }
 
 } // anonymous namespace
@@ skipping 424 matching lines @@
 
 // TODO(xiaochengh): Merge it with |replaceSelectionWithFragment()|.
 void Editor::replaceSelectionAfterDragging(DocumentFragment* fragment, bool smartReplace, bool plainText)
 {
     ReplaceSelectionCommand::CommandOptions options = ReplaceSelectionCommand::SelectReplacement | ReplaceSelectionCommand::PreventNesting;
     if (smartReplace)
         options |= ReplaceSelectionCommand::SmartReplace;
     if (plainText)
         options |= ReplaceSelectionCommand::MatchStyle;
     DCHECK(frame().document());
-    ReplaceSelectionCommand::create(*frame().document(), fragment, options, InputEvent::InputType::Drag)->apply();
+    ReplaceSelectionCommand::create(*frame().document(), fragment, options, InputEvent::InputType::InsertFromDrop)->apply();
 }
 
 void Editor::moveSelectionAfterDragging(DocumentFragment* fragment, const Position& pos, bool smartInsert, bool smartDelete)
 {
     MoveSelectionCommand::create(fragment, pos, smartInsert, smartDelete)->apply();
 }
 
 EphemeralRange Editor::selectedRange()
 {
     return frame().selection().selection().toNormalizedEphemeralRange();
@@ skipping 838 matching lines @@
 
 DEFINE_TRACE(Editor)
 {
     visitor->trace(m_frame);
     visitor->trace(m_lastEditCommand);
     visitor->trace(m_undoStack);
     visitor->trace(m_mark);
 }
 
 } // namespace blink