Changeset 167689 in webkit

Timestamp:

Apr 22, 2014 4:25:59 PM (10 years ago)

Author:

rniwa@webkit.org

Message:

REGRESSION (r157328): popover to check into flight ba.com dismisses instantly when focusing form
​https://bugs.webkit.org/show_bug.cgi?id=131949

Reviewed by Darin Adler.

Source/WebCore:
The regression was caused by two bugs:

1. The event didn't stop propagating itself even when it should. If the related target is same as the event origin, the event propagation should stop when the event reaches the root of the related target's tree scope. Otherwise, it should stop when it reaches the related target.

2. Mouse event's related target exposed nodes inside a user-agent shadow DOM when the related target appeared inside the origin.

Fixed the bugs by re-introducing path shrinkage algorithm removed in r157328 into EventPath::setRelatedTarget
and adding an algorithm to determine the least common ancestor of the related target and the current target
in moveToParentOrShadowHost. The latter algorithm doesn't match the shadow DOM specification:
​http://www.w3.org/TR/2013/WD-shadow-dom-20130514/
but it's good enough in terms of the Web exposed behavior as we don't support author defined insertion points.

Test: fast/events/shadow-event-path.html

• dom/EventDispatcher.cpp:

(WebCore::EventRelatedNodeResolver::moveToParentOrShadowHost):
(WebCore::EventRelatedNodeResolver::findHostOfTreeScopeInTargetTreeScope): Added.
(WebCore::EventDispatcher::dispatchEvent):
(WebCore::EventPath::setRelatedTarget):

LayoutTests:
Add a test that dumps the event target and the related target of every mouse event
when dispatched inside an input element inside a details element.

This catches the regression as well as other bugs I encountered while fixing the bug.

We need a WK2 specific results because WK1 mac results contain an extra fake mouse move event.

• fast/events/shadow-event-path-expected.txt: Added.
• fast/events/shadow-event-path.html: Added.
• platform/mac-wk2/fast/events/shadow-event-expected.txt: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/shadow-event-path-expected.txt (added)
• LayoutTests/fast/events/shadow-event-path.html (added)
• LayoutTests/platform/mac-wk2/fast/events/shadow-event-path-expected.txt (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/EventDispatcher.cpp (modified) (5 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-04-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION (r157328): popover to check into flight ba.com dismisses instantly when focusing form
+        https://bugs.webkit.org/show_bug.cgi?id=131949
+
+        Reviewed by Darin Adler.
+
+        Add a test that dumps the event target and the related target of every mouse event
+        when dispatched inside an input element inside a details element.
+
+        This catches the regression as well as other bugs I encountered while fixing the bug.
+
+        We need a WK2 specific results because WK1 mac results contain an extra fake mouse move event.
+
+        * fast/events/shadow-event-path-expected.txt: Added.
+        * fast/events/shadow-event-path.html: Added.
+        * platform/mac-wk2/fast/events/shadow-event-expected.txt: Added.
+
 2014-04-22  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-04-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION (r157328): popover to check into flight ba.com dismisses instantly when focusing form
+        https://bugs.webkit.org/show_bug.cgi?id=131949
+
+        Reviewed by Darin Adler.
+
+        The regression was caused by two bugs:
+        1. The event didn't stop propagating itself even when it should.
+           If the related target is same as the event origin, the event propagation should stop when the event reaches
+           the root of the related target's tree scope. Otherwise, it should stop when it reaches the related target.
+
+        2. Mouse event's related target exposed nodes inside a user-agent shadow DOM when the related target appeared
+           inside the origin.
+
+        Fixed the bugs by re-introducing path shrinkage algorithm removed in r157328 into EventPath::setRelatedTarget
+        and adding an algorithm to determine the least common ancestor of the related target and the current target
+        in moveToParentOrShadowHost. The latter algorithm doesn't match the shadow DOM specification:
+        http://www.w3.org/TR/2013/WD-shadow-dom-20130514/
+        but it's good enough in terms of the Web exposed behavior as we don't support author defined insertion points.
+
+        Test: fast/events/shadow-event-path.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedNodeResolver::moveToParentOrShadowHost):
+        (WebCore::EventRelatedNodeResolver::findHostOfTreeScopeInTargetTreeScope): Added.
+        (WebCore::EventDispatcher::dispatchEvent):
+        (WebCore::EventPath::setRelatedTarget):
+
 2014-04-22  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/dom/EventDispatcher.cpp

@@ -91 +91 @@
     void updateTouchLists(const TouchEvent&);
 #endif
-    void setRelatedTarget(EventTarget&);
+    void setRelatedTarget(Node& origin, EventTarget&);
 
     bool hasEventListeners(const AtomicString& eventType) const;
@@ -149 +149 @@
         }
 
-        if (m_relatedNodeInCurrentTreeScope) { // relatedNode is under the current tree scope
+        if (&newTreeScope == &m_relatedNodeTreeScope)
+            m_relatedNodeInCurrentTreeScope = &m_relatedNode;
+        else if (m_relatedNodeInCurrentTreeScope) {
             ASSERT(m_currentTreeScope);
             m_relatedNodeInCurrentTreeScope = &newTarget;
-        } else if (&newTreeScope == &m_relatedNodeTreeScope) // relatedNode is in the current tree scope;
-            m_relatedNodeInCurrentTreeScope = &m_relatedNode;
-        // Otherwise, we haven't reached the tree scope that contains relatedNode yet.
+        } else {
+            if (!m_currentTreeScope) {
+                TreeScope* newTreeScopeAncestor = &newTreeScope;
+                do {
+                    m_relatedNodeInCurrentTreeScope = findHostOfTreeScopeInTargetTreeScope(m_relatedNodeTreeScope, *newTreeScopeAncestor);
+                    newTreeScopeAncestor = newTreeScopeAncestor->parentTreeScope();
+                    if (newTreeScopeAncestor == &m_relatedNodeTreeScope) {
+                        m_relatedNodeInCurrentTreeScope = &m_relatedNode;
+                        break;
+                    }
+                } while (newTreeScopeAncestor && !m_relatedNodeInCurrentTreeScope);
+            }
+            ASSERT(m_relatedNodeInCurrentTreeScope || findHostOfTreeScopeInTargetTreeScope(newTreeScope, m_relatedNodeTreeScope)
+                || &newTreeScope.documentScope() != &m_relatedNodeTreeScope.documentScope());
+        }
 
         m_currentTreeScope = &newTreeScope;
 
         return m_relatedNodeInCurrentTreeScope;
+    }
+
+    static Node* findHostOfTreeScopeInTargetTreeScope(const TreeScope& startingTreeScope, const TreeScope& targetScope)
+    {
+        ASSERT(&targetScope != &startingTreeScope);
+        Node* previousHost = 0;
+        for (const TreeScope* scope = &startingTreeScope; scope; scope = scope->parentTreeScope()) {
+            if (scope == &targetScope) {
+                ASSERT(previousHost);
+                ASSERT_WITH_SECURITY_IMPLICATION(&previousHost->treeScope() == &targetScope);
+                return previousHost;
+            }
+            if (scope->rootNode().isShadowRoot())
+                previousHost = toShadowRoot(scope->rootNode()).hostElement();
+            else
+                ASSERT_WITH_SECURITY_IMPLICATION(!scope->parentTreeScope());
+        }
+        return 0;
     }
 
@@ -306 +338 @@
 
     if (EventTarget* relatedTarget = event->relatedTarget())
-        eventPath.setRelatedTarget(*relatedTarget);
+        eventPath.setRelatedTarget(*node, *relatedTarget);
 #if ENABLE(TOUCH_EVENTS) && !PLATFORM(IOS)
     if (event->isTouchEvent())
@@ -453 +485 @@
 #endif
 
-void EventPath::setRelatedTarget(EventTarget& relatedTarget)
+void EventPath::setRelatedTarget(Node& origin, EventTarget& relatedTarget)
 {
     Node* relatedNode = relatedTarget.toNode();
@@ -461 +493 @@
     EventRelatedNodeResolver resolver(*relatedNode);
 
+    bool originIsRelatedTarget = &origin == relatedNode;
+    Node& rootNodeInOriginTreeScope = origin.treeScope().rootNode();
+
     size_t eventPathSize = m_path.size();
-    for (size_t i = 0; i < eventPathSize; i++)
-        toMouseOrFocusEventContext(*m_path[i]).setRelatedTarget(resolver.moveToParentOrShadowHost(*m_path[i]->node()));
+    size_t i = 0;
+    while (i < eventPathSize) {
+        Node* contextNode = m_path[i]->node();
+        Node* currentRelatedNode = resolver.moveToParentOrShadowHost(*contextNode);
+        if (!originIsRelatedTarget && m_path[i]->target() == currentRelatedNode)
+            break;
+        toMouseOrFocusEventContext(*m_path[i]).setRelatedTarget(currentRelatedNode);
+        i++;
+        if (originIsRelatedTarget && &rootNodeInOriginTreeScope == contextNode)
+            break;
+    }
+    m_path.shrink(i);
 }