Changeset 208173 in webkit


Ignore:
Timestamp:
Oct 31, 2016 2:03:56 PM (8 years ago)
Author:
matthew_hanson@apple.com
Message:

Merge r208168. rdar://problem/28962886

Location:
branches/safari-602-branch/Source
Files:
15 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-602-branch/Source/WebCore/ChangeLog

    r208167 r208173  
     12016-10-31  Matthew Hanson  <matthew_hanson@apple.com>
     2
     3        Merge r208168. rdar://problem/28962886
     4
     5    2016-10-28  Brent Fulgham  <bfulgham@apple.com>
     6
     7            Do a better job of protecting Frame objects in the context of JavaScript calls
     8            https://bugs.webkit.org/show_bug.cgi?id=164163
     9            <rdar://problem/28955249>
     10
     11            Reviewed by Darin Adler.
     12
     13            * editing/AlternativeTextController.cpp:
     14            (WebCore::AlternativeTextController::respondToUnappliedSpellCorrection): Protected the Frame.
     15            * editing/Editor.cpp:
     16            (WebCore::Editor::setTextAsChildOfElement): Ditto.
     17            * editing/EditorCommand.cpp:
     18            (WebCore::executeSwapWithMark): Ditto.
     19            * editing/TypingCommand.cpp:
     20            (WebCore::TypingCommand::deleteKeyPressed): Ditto.
     21            (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.
     22            * editing/mac/EditorMac.mm:
     23            (WebCore::Editor::replaceNodeFromPasteboard): Ditto.
     24            * page/ContextMenuController.cpp:
     25            (WebCore::ContextMenuController::contextMenuItemSelected): Ditto.
     26            * page/DOMSelection.cpp:
     27            (WebCore::DOMSelection::collapse): Ditto.
     28            (WebCore::DOMSelection::collapseToEnd): Ditto.
     29            (WebCore::DOMSelection::collapseToStart): Ditto.
     30            (WebCore::DOMSelection::setBaseAndExtent): Ditto.
     31            (WebCore::DOMSelection::setPosition): Ditto.
     32            (WebCore::DOMSelection::modify): Ditto.
     33            (WebCore::DOMSelection::extend): Ditto.
     34            (WebCore::DOMSelection::addRange): Ditto.
     35            (WebCore::DOMSelection::deleteFromDocument): Ditto.
     36            * page/DragController.cpp:
     37            (WebCore::setSelectionToDragCaret): Ditto.
     38            (WebCore::DragController::startDrag): Ditto.
     39            * page/Frame.cpp:
     40            (WebCore::Frame::checkOverflowScroll): Ditto.
     41            * page/TextIndicator.cpp:
     42            (WebCore::TextIndicator::createWithRange): Ditto.
     43
    1442016-10-31  Matthew Hanson  <matthew_hanson@apple.com>
    245

  • branches/safari-602-branch/Source/WebCore/editing/AlternativeTextController.cpp

    r203322 r208173  
    11/*
    2  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2008, 2016 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
    44 *
    … …  
    318318    if (AlternativeTextClient* client = alternativeTextClient())
    319319        client->recordAutocorrectionResponse(AutocorrectionReverted, corrected, correction);
     320
     321    Ref<Frame> protector(m_frame);
    320322    m_frame.document()->updateLayout();
    321323    m_frame.selection().setSelection(selectionOfCorrected, FrameSelection::defaultSetSelectionOptions() | FrameSelection::SpellCorrectionTriggered);

  • branches/safari-602-branch/Source/WebCore/editing/Editor.cpp

    r205950 r208173  
    11/*
    2  * Copyright (C) 2006, 2007, 2008, 2011, 2013-2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2008, 2011, 2013-2016 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
    44 *
    … …  
    17911791void Editor::setComposition(const String& text, const Vector<CompositionUnderline>& underlines, unsigned selectionStart, unsigned selectionEnd)
    17921792{
     1793    Ref<Frame> protection(m_frame);
     1794
    17931795    UserTypingGestureIndicator typingGestureIndicator(m_frame);
    17941796
    … …  
    19241926void Editor::advanceToNextMisspelling(bool startBeforeSelection)
    19251927{
     1928    Ref<Frame> protection(m_frame);
     1929
    19261930    // The basic approach is to search in two phases - from the selection end to the end of the doc, and
    19271931    // then we wrap and search from the doc start to (approximately) where we started.
    … …  
    22422246void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping, bool doReplacement)
    22432247{
     2248    Ref<Frame> protection(m_frame);
     2249
    22442250#if PLATFORM(IOS)
    22452251    UNUSED_PARAM(selectionAfterTyping);
    … …  
    24922498void Editor::markAndReplaceFor(PassRefPtr<SpellCheckRequest> request, const Vector<TextCheckingResult>& results)
    24932499{
     2500    Ref<Frame> protection(m_frame);
    24942501    ASSERT(request);
    24952502
    … …  
    29502957void Editor::changeSelectionAfterCommand(const VisibleSelection& newSelection, FrameSelection::SetSelectionOptions options)
    29512958{
     2959    Ref<Frame> protection(m_frame);
     2960
    29522961    // If the new selection is orphaned, then don't update the selection.
    29532962    if (newSelection.start().isOrphan() || newSelection.end().isOrphan())
    … …  
    31403149bool Editor::findString(const String& target, FindOptions options)
    31413150{
     3151    Ref<Frame> protection(m_frame);
     3152
    31423153    VisibleSelection selection = m_frame.selection().selection();
    31433154

  • branches/safari-602-branch/Source/WebCore/editing/EditorCommand.cpp

    r202242 r208173  
    11/*
    2  * Copyright (C) 2006, 2007, 2008, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2008, 2014, 2016 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
    44 * Copyright (C) 2009 Igalia S.L.
    … …  
    10621062static bool executeSwapWithMark(Frame& frame, Event*, EditorCommandSource, const String&)
    10631063{
     1064    Ref<Frame> protector(frame);
    10641065    const VisibleSelection& mark = frame.editor().mark();
    10651066    const VisibleSelection& selection = frame.selection().selection();

  • branches/safari-602-branch/Source/WebCore/editing/TypingCommand.cpp

    r203322 r208173  
    11/*
    2  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc.  All rights reserved.
     2 * Copyright (C) 2005-2008, 2016 Apple Inc.  All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    476476{
    477477    Frame& frame = this->frame();
     478    Ref<Frame> protector(frame);
    478479
    479480    frame.editor().updateMarkersForWordsAffectedByEditing(false);
    … …  
    589590{
    590591    Frame& frame = this->frame();
     592    Ref<Frame> protector(frame);
    591593
    592594    frame.editor().updateMarkersForWordsAffectedByEditing(false);

  • branches/safari-602-branch/Source/WebCore/editing/mac/EditorMac.mm

    r203322 r208173  
    261261        return;
    262262
     263    Ref<Frame> protector(m_frame);
    263264    RefPtr<Range> range = Range::create(node->document(), Position(node, Position::PositionIsBeforeAnchor), Position(node, Position::PositionIsAfterAnchor));
    264265    m_frame.selection().setSelection(VisibleSelection(*range), FrameSelection::DoNotSetFocus);

  • branches/safari-602-branch/Source/WebCore/page/ContextMenuController.cpp

    r203322 r208173  
    11/*
    2  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2007, 2016 Apple Inc. All rights reserved.
    33 * Copyright (C) 2010 Igalia S.L
    44 *
    … …  
    224224        return;
    225225
     226    Ref<Frame> protector(*frame);
     227
    226228    switch (action) {
    227229    case ContextMenuItemTagOpenLinkInNewWindow:

  • branches/safari-602-branch/Source/WebCore/page/DOMSelection.cpp

    r200931 r208173  
    11/*
    2  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007, 2009, 2016 Apple Inc. All rights reserved.
    33 * Copyright (C) 2012 Google Inc. All rights reserved.
    44 *
    … …  
    202202
    203203    // FIXME: Eliminate legacy editing positions
     204    Ref<Frame> protector(*m_frame);
    204205    m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
    205206}
    … …  
    217218    }
    218219
     220    Ref<Frame> protector(*m_frame);
    219221    m_frame->selection().moveTo(selection.end(), DOWNSTREAM);
    220222}
    … …  
    232234    }
    233235
     236    Ref<Frame> protector(*m_frame);
    234237    m_frame->selection().moveTo(selection.start(), DOWNSTREAM);
    235238}
    … …  
    256259
    257260    // FIXME: Eliminate legacy editing positions
     261    Ref<Frame> protector(*m_frame);
    258262    m_frame->selection().moveTo(createLegacyEditingPosition(baseNode, baseOffset), createLegacyEditingPosition(extentNode, extentOffset), DOWNSTREAM);
    259263}
    … …  
    272276
    273277    // FIXME: Eliminate legacy editing positions
     278    Ref<Frame> protector(*m_frame);
    274279    m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
    275280}
    … …  
    322327        return;
    323328
     329    Ref<Frame> protector(*m_frame);
    324330    m_frame->selection().modify(alter, direction, granularity);
    325331}
    … …  
    339345
    340346    // FIXME: Eliminate legacy editing positions
     347    Ref<Frame> protector(*m_frame);
    341348    m_frame->selection().setExtent(createLegacyEditingPosition(&node, offset), DOWNSTREAM);
    342349}
    … …  
    377384    if (!r)
    378385        return;
     386
     387    Ref<Frame> protector(*m_frame);
    379388
    380389    FrameSelection& selection = m_frame->selection();
    … …  
    429438        return;
    430439
     440    Ref<Frame> protector(*m_frame);
    431441    selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
    432442

  • branches/safari-602-branch/Source/WebCore/page/DragController.cpp

    r203085 r208173  
    11/*
    2  * Copyright (C) 2007, 2009, 2010, 2013, 2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007, 2009-2010, 2013, 2015-2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    433433static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, RefPtr<Range>& range, const IntPoint& point)
    434434{
     435    Ref<Frame> protector(*frame);
    435436    frame->selection().setSelection(dragCaret);
    436437    if (frame->selection().selection().isNone()) {
    … …  
    753754        return false;
    754755
     756    Ref<Frame> protector(src);
    755757    HitTestResult hitTestResult = src.eventHandler().hitTestResultAtPoint(dragOrigin, HitTestRequest::ReadOnly | HitTestRequest::Active);
    756758

  • branches/safari-602-branch/Source/WebCore/page/Frame.cpp

    r207207 r208173  
    604604    }
    605605
     606    Ref<Frame> protectedThis(*this);
     607
    606608    if (action == PerformOverflowScroll && (deltaX || deltaY)) {
    607609        layer->scrollToOffset(layer->scrollOffset() + IntSize(deltaX, deltaY));

  • branches/safari-602-branch/Source/WebCore/page/TextIndicator.cpp

    r199817 r208173  
    11/*
    2  * Copyright (C) 2010, 2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2010, 2015-2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    7070        return nullptr;
    7171
     72    Ref<Frame> protector(*frame);
     73
    7274#if PLATFORM(IOS)
    7375    frame->editor().setIgnoreCompositionSelectionChange(true);

  • branches/safari-602-branch/Source/WebKit2/ChangeLog

    r208162 r208173  
     12016-10-31  Matthew Hanson  <matthew_hanson@apple.com>
     2
     3        Merge r208168. rdar://problem/28962886
     4
     5    2016-10-28  Brent Fulgham  <bfulgham@apple.com>
     6
     7            Do a better job of protecting Frame objects in the context of JavaScript calls
     8            https://bugs.webkit.org/show_bug.cgi?id=164163
     9            <rdar://problem/28955249>
     10
     11            Reviewed by Darin Adler.
     12
     13            * WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:
     14            (WebKit::InjectedBundleRangeHandle::renderedImage): Protected the Frame.
     15            * WebProcess/WebPage/WebPage.cpp:
     16            (WebKit::WebPage::insertTextAsync): Ditto.
     17            (WebKit::WebPage::setComposition): Ditto.
     18            * WebProcess/WebPage/mac/WebPageMac.mm:
     19            (WebKit::WebPage::insertDictatedTextAsync): Ditto.
     20
    1212016-10-31  Matthew Hanson  <matthew_hanson@apple.com>
    222

  • branches/safari-602-branch/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp

    r202242 r208173  
    11/*
    2  * Copyright (C) 2010, 2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2010, 2015-2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    114114        return nullptr;
    115115
     116    Ref<Frame> protector(*frame);
     117
    116118    VisibleSelection oldSelection = frame->selection().selection();
    117119    frame->selection().setSelection(VisibleSelection(*m_range));

  • branches/safari-602-branch/Source/WebKit2/WebProcess/WebPage/WebPage.cpp

    r207801 r208173  
    45834583    Frame& frame = m_page->focusController().focusedOrMainFrame();
    45844584
     4585    Ref<Frame> protector(frame);
     4586
    45854587    if (replacementEditingRange.location != notFound) {
    45864588        RefPtr<Range> replacementRange = rangeFromEditingRange(frame, replacementEditingRange, static_cast<EditingRangeIsRelativeTo>(editingRangeIsRelativeTo));
    … …  
    47464748        return;
    47474749    }
     4750
     4751    Ref<Frame> protector(*targetFrame);
    47484752
    47494753    if (replacementLength > 0) {

  • branches/safari-602-branch/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm

    r207750 r208173  
    11/*
    2  * Copyright (C) 2010, 2011, 2012, 2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2010-2012, 2015-2016 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    328328    Frame& frame = m_page->focusController().focusedOrMainFrame();
    329329
     330    Ref<Frame> protector(frame);
     331
    330332    if (replacementEditingRange.location != notFound) {
    331333        RefPtr<Range> replacementRange = rangeFromEditingRange(frame, replacementEditingRange);
Note: See TracChangeset for help on using the changeset viewer.