[InputEvent] Support |deleteByDrag| and |insertFromDrop|

third_party/WebKit/Source/core/editing/Editor.cpp

Index: third_party/WebKit/Source/core/editing/Editor.cpp
diff --git a/third_party/WebKit/Source/core/editing/Editor.cpp b/third_party/WebKit/Source/core/editing/Editor.cpp
index 428331d3e5ae2796fbebc10dec8be0ffe18ef462..463af6a2d7102545212a546af54db6ae19331501 100644
--- a/third_party/WebKit/Source/core/editing/Editor.cpp
+++ b/third_party/WebKit/Source/core/editing/Editor.cpp
@@ -104,14 +104,21 @@ void dispatchInputEvent(Element* target, InputEvent::InputType inputType, const
         return;
     if (!target)
         return;
-    // TODO(chongz): Pass appreciate |ranges| after it's defined on spec.
-    // http://w3c.github.io/editing/input-events.html#dom-inputevent-inputtype
     InputEvent* inputEvent = InputEvent::createInput(inputType, data, isComposing, nullptr);
     target->dispatchScopedEvent(inputEvent);
 }
 
 void dispatchInputEventEditableContentChanged(Element* startRoot, Element* endRoot, InputEvent::InputType inputType, const String& data, InputEvent::EventIsComposing isComposing)
 {
+    if (inputType == InputEvent::InputType::MoveByDragDrop) {

[chongz, 2016/08/30 23:59:21]

Do we have any other solution that does not require an internal InputType?

+        // Drag&Drop will be combined into one |MoveSelectionCommand|, we need to split it into |DeleteByDrag| and |InsertFromDrop|.
+        if (startRoot)
+            dispatchInputEvent(startRoot, InputEvent::InputType::DeleteByDrag, data, isComposing);
+        if (endRoot)
+            dispatchInputEvent(endRoot, InputEvent::InputType::InsertFromDrop, data, isComposing);

[yosin_UTC9, 2016/08/31 01:20:34]

Q: Do we dispatch "insertFromDrop" even if "deleteByDrag" is canceled?
Q: Do we dispatch "insertFromDrop" even if  |!endRoot.isConnected()|?

[chongz, 2016/09/02 18:02:10]

Yes. Canceling 'deleteByDrag' only means cancelling the DOM update part of it,
but the Drag&Drop process is still going, so we will do
|DragDropBeforeInputResult::InsertOnly|.
e.g. Similar to 'deleteByCut' & 'insertFromPaste', where canceling 'deleteByCut'
won't prevent clipboard update.
From my testing |endRoot| is always connected. If drop target was removed
|endRoot| will point to drag target, so I have to handle it in |DragController|.

[yosin_UTC9, 2016/09/05 01:37:50]

Your testing doesn't covered to make the case |endRoot| becomes not to
connected. ;-)
Attackers can do anything by using JavaScript. ClusterFuzz will find such case.

L123's |startRoot| also can be not connected by both "beforeInput" event from
|startRoot| and |endRoot|.

[chongz, 2016/09/07 17:12:55]

Added check in |dispatchInputEvent()|.

+        return;
+    }
+
     if (startRoot)
         dispatchInputEvent(startRoot, inputType, data, isComposing);
     if (endRoot && endRoot != startRoot)

[yosin_UTC9, 2016/08/31 01:20:34]

Do we need to check |endRoot.isConnected()|?

[chongz, 2016/09/02 18:02:10]

It seems to me that if the element was changed, we should dispatch 'input' event
not matter it's connected or not.
But I'm not sure but will it cause any issue by dispatching events to removed
elements?

[yosin_UTC9, 2016/09/05 01:37:50]

According DOM spec, https://www.w3.org/TR/dom/#dispatching-events, 3.7
Dispatching events

If event's target attribute value is participating in a tree, let event path be
a static ordered list of all its ancestors in tree order, and let event path be
the empty list otherwise.

Event target should be connected before computing event path.

Since |dispatchInputEvent()| checks null target element, let's check whether
target is connected or not
in |dispatchInputEvent()| and remove if-statement from call sites to make code
simpler.

[chongz, 2016/09/07 17:12:55]

OK, thanks for the reference!
Added check in |dispatchInputEvent()|.

@@ -560,7 +567,7 @@ void Editor::replaceSelectionAfterDragging(DocumentFragment* fragment, bool smar
     if (plainText)
         options |= ReplaceSelectionCommand::MatchStyle;
     DCHECK(frame().document());
-    ReplaceSelectionCommand::create(*frame().document(), fragment, options, InputEvent::InputType::Drag)->apply();
+    ReplaceSelectionCommand::create(*frame().document(), fragment, options, InputEvent::InputType::InsertFromDrop)->apply();
 }
 
 void Editor::moveSelectionAfterDragging(DocumentFragment* fragment, const Position& pos, bool smartInsert, bool smartDelete)