Support 'insertReplacementText' for spellcheck

third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp

Index: third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
index 9c780a63b799d153c031bb37dc2ea6248d9a54fb..29e7f844ccf14cc3da9a83db349002543f1157da 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
@@ -28,10 +28,12 @@
 
 #include "core/HTMLNames.h"
 #include "core/InputTypeNames.h"
+#include "core/clipboard/DataObject.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/NodeTraversal.h"
+#include "core/dom/Range.h"
 #include "core/editing/EditingUtilities.h"
 #include "core/editing/Editor.h"
 #include "core/editing/EphemeralRange.h"
@@ -818,14 +820,39 @@ void SpellChecker::replaceMisspelledRange(const String& text) {
                               markers[0]->endOffset()));
   if (markerRange.isNull())
     return;
+
   frame().selection().setSelection(
       SelectionInDOMTree::Builder().setBaseAndExtent(markerRange).build());
 
-  // TODO(xiaochengh): The use of updateStyleAndLayoutIgnorePendingStylesheets
-  // needs to be audited.  See http://crbug.com/590369 for more details.
-  frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
+  // Dispatch 'beforeinput'.
+  Element* target = frame().editor().findEventTargetFromSelection();
+  RangeVector* ranges = new RangeVector(
+      1, createRange(
+             frame().selection().selection().toNormalizedEphemeralRange()));

[chongz, 2016/10/27 16:41:24]

I think you can just do
```
new RangeVector(1, m_frame->selection().firstRange());
```

See
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/editing/I...

+
+  bool cancel = dispatchBeforeInputPlainText(
+                    target, InputEvent::InputType::InsertReplacementText, text,
+                    DataTransfer::DataTransferType::InsertReplacementText,
+                    DataTransferAccessPolicy::DataTransferReadable,
+                    ranges) != DispatchEventResult::NotCanceled;
 

[chongz, 2016/10/27 16:41:25]

Can you add the following check after dispatching 'beforeinput'?
```
      // 'beforeinput' event handler may destroy target frame.
      if (m_frame->document()->frame() != m_frame)
        return;
```
The reason is JS handlers may destroy frame (e.g. iframe), thus the code after
would crash. 

See
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/editing/E...

-  frame().editor().replaceSelectionWithText(text, false, false);
+  if (cancel) {
+    // reset selection
+    frame().selection().setSelection(SelectionInDOMTree::Builder()

[chongz, 2016/10/27 16:41:25]

Thinking more about this I think we shouldn't reset selection.
For example if JS canceled 'beforeinput' and handled itself (replace text and
adjust selection), resetting selection here will make their life harder.

+                                         .collapse(markerRange.endPosition())
+                                         .build(),
+                                     FrameSelection::CloseTyping |
+                                         FrameSelection::ClearTypingStyle |
+                                         FrameSelection::DoNotSetFocus);
+    frame().selection().revealSelection();
+  } else {
+    // TODO(xiaochengh): The use of updateStyleAndLayoutIgnorePendingStylesheets
+    // needs to be audited.  See http://crbug.com/590369 for more details.
+    frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
+
+    frame().editor().replaceSelectionWithText(

[chongz, 2016/10/27 16:41:25]

Actually can we dispatch 'beforeinput' right before this line? I think
'beforeinput' should only cover the DOM mutation part, and shouldn't affect
other stuff like style or selection.

[chaopeng, 2016/10/28 00:33:08]

frame().document()->updateStyleAndLayoutIgnorePendingStylesheets(); must call
just before replaceSelectionWithText or selection() will fail. 

[chongz, 2016/10/28 02:12:16]

I see, I'm not sure how |updateStyleAndLayoutIgnorePendingStylesheets()| works,
but maybe yosin@ could give some suggestions.

+        text, false, false, InputEvent::InputType::InsertReplacementText);
+  }
 }
 
 static bool shouldCheckOldSelection(const Position& oldSelectionStart) {