Support 'insertReplacementText' for spellcheck

third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp

Index: third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
index 3fa775ccd9bd7f0a764768cbdbe2cd78d8961310..96b71107746bff1d2d38fb65ead5e5e9d0aa43db 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
@@ -28,10 +28,12 @@
 
 #include "core/HTMLNames.h"
 #include "core/InputTypeNames.h"
+#include "core/clipboard/DataObject.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/NodeTraversal.h"
+#include "core/dom/Range.h"
 #include "core/editing/EditingUtilities.h"
 #include "core/editing/Editor.h"
 #include "core/editing/EphemeralRange.h"
@@ -817,14 +819,35 @@ void SpellChecker::replaceMisspelledRange(const String& text) {
                               markers[0]->endOffset()));
   if (markerRange.isNull())
     return;
+
   frame().selection().setSelection(
       SelectionInDOMTree::Builder().setBaseAndExtent(markerRange).build());
 
+  // Dispatch 'beforeinput'.
+  Element* target = frame().editor().findEventTargetFromSelection();
+  RangeVector* ranges = new RangeVector(1, frame().selection().firstRange());

[yosin_UTC9, 2016/11/10 01:49:52]

Is this work if |FrameSelection::firstRange()| returns null?

Since |FrameSelection::setSelection()| can invoke JS, DOM tree can be gone away
here.

[Xiaocheng, 2016/11/10 02:35:53]

This seems to be a bug that we introduced. When hoisting layout updates, we did
not check whether DOM is gone after FS::setSelection(), and just called
updateSAL directly.

+  DataTransfer* dataTransfer = DataTransfer::create(
+      DataTransfer::DataTransferType::InsertReplacementText,
+      DataTransferAccessPolicy::DataTransferReadable,
+      DataObject::createFromString(text));
+
+  const bool cancel =
+      dispatchBeforeInputDataTransfer(
+          target, InputEvent::InputType::InsertReplacementText, dataTransfer,
+          ranges) != DispatchEventResult::NotCanceled;
+
+  // 'beforeinput' event handler may destroy target frame.
+  if (frame().document()->frame() != m_frame)
+    return;
+
   // TODO(xiaochengh): The use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  See http://crbug.com/590369 for more details.
   frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
 
-  frame().editor().replaceSelectionWithText(text, false, false);
+  if (cancel)

[Xiaocheng, 2016/11/10 02:35:53]

Let's move this return to be before updateStyleAndLayout... so that layout is
updated less frequently.

+    return;
+  frame().editor().replaceSelectionWithText(
+      text, false, false, InputEvent::InputType::InsertReplacementText);
 }
 
 static bool shouldCheckOldSelection(const Position& oldSelectionStart) {