Harden FrameSelection methods against JS running inside recalcStyle

Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1534 matching lines @@
     if (m_selection.start().isNotNull() && m_selection.end().isNotNull()) {
         if (AXObjectCache* cache = m_frame->document()->existingAXObjectCache())
             cache->selectionChanged(m_selection.start().containerNode());
     }
 }
 
 void FrameSelection::focusedOrActiveStateChanged()
 {
     bool activeAndFocused = isFocusedAndActive();
 
+    RefPtr<Document> document = m_frame->document();
+    document->updateStyleIfNeeded();
+
     // Because RenderObject::selectionBackgroundColor() and
     // RenderObject::selectionForegroundColor() check if the frame is active,
     // we have to update places those colors were painted.
-    if (RenderView* view = m_frame->document()->renderView())

[abarth-chromium, 2013/09/27 22:55:00]

Should we bail out at some point if the document leaves the frame?

+    if (RenderView* view = document->renderView())
         view->repaintSelection();
 
     // Caret appears in the active frame.
     if (activeAndFocused)
         setSelectionFromNone();
     else
         m_frame->editor().spellCheckAfterBlur();
     setCaretVisibility(activeAndFocused ? Visible : Hidden);
 
     // Update for caps lock state
     m_frame->eventHandler()->capsLockStateMayHaveChanged();
 
     // Because StyleResolver::checkOneSelector() and
     // RenderTheme::isFocused() check if the frame is active, we have to
     // update style and theme state that depended on those.
-    if (Element* element = m_frame->document()->focusedElement()) {
+    if (Element* element = document->focusedElement()) {
         element->setNeedsStyleRecalc();
         if (RenderObject* renderer = element->renderer()) {
             if (renderer && renderer->style()->hasAppearance())
                 RenderTheme::theme().stateChanged(renderer, FocusState);
         }
     }
 
     // Secure keyboard entry is set by the active frame.
-    if (m_frame->document()->useSecureKeyboardEntryWhenActive())
+    if (document->useSecureKeyboardEntryWhenActive())
         setUseSecureKeyboardEntry(activeAndFocused);
 }
 
 void FrameSelection::pageActivationChanged()
 {
     focusedOrActiveStateChanged();
 }
 
 void FrameSelection::updateSecureKeyboardEntryIfActive()
 {
@@ skipping 221 matching lines @@
     return selectedText();
 }
 
 bool FrameSelection::shouldDeleteSelection(const VisibleSelection& selection) const
 {
     return m_frame->editor().client().shouldDeleteRange(selection.toNormalizedRange().get());
 }
 
 FloatRect FrameSelection::bounds(bool clipToVisibleContent) const
 {
-    RenderView* root = m_frame->contentRenderer();
+    m_frame->document()->updateStyleIfNeeded();
+
     FrameView* view = m_frame->view();
-    if (!root || !view)
-        return LayoutRect();
+    RenderView* renderView = m_frame->contentRenderer();
 
-    LayoutRect selectionRect = root->selectionBounds(clipToVisibleContent);
+    if (!view || !renderView);
+        return FloatRect();
+
+    LayoutRect selectionRect = renderView->selectionBounds(clipToVisibleContent);
     return clipToVisibleContent ? intersection(selectionRect, view->visibleContentRect()) : selectionRect;
 }
 
 void FrameSelection::getClippedVisibleTextRectangles(Vector<FloatRect>& rectangles) const
 {
     RenderView* root = m_frame->contentRenderer();
     if (!root)
         return;
 
     FloatRect visibleContentRect = m_frame->view()->visibleContentRect();
@@ skipping 145 matching lines @@
     sel.showTreeForThis();
 }
 
 void showTree(const WebCore::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
 }
 
 #endif