Changeset 58441 in webkit

Timestamp:

Apr 28, 2010 3:48:23 PM (14 years ago)

Author:

eric@webkit.org

Message:

2010-04-28 Abhishek Arya <​inferno@chromium.org>

Reviewed by Eric Seidel.

Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe.
​https://bugs.webkit.org/show_bug.cgi?id=37618

• editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added.
• editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added.
• editing/resources/drag-drop.html: Added.

2010-04-28 Abhishek Arya <​inferno@chromium.org>

Reviewed by Eric Seidel.

Convert m_documentUnderMouse, m_dragInitiator to RefPtr.
Eliminated unused m_dragInitiator accessor to prevent dereferencing.
​https://bugs.webkit.org/show_bug.cgi?id=37618

Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html

• page/DragController.cpp: (WebCore::DragController::tryDocumentDrag): (WebCore::DragController::concludeEditDrag):
• page/DragController.h: (WebCore::DragController::draggingImageURL): (WebCore::DragController::documentUnderMouse):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt (added)
• LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash.html (added)
• LayoutTests/editing/resources/drag-drop.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/page/DragController.cpp (modified) (4 diffs)
• WebCore/page/DragController.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-04-28  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe.
+        https://bugs.webkit.org/show_bug.cgi?id=37618
+
+        * editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added.
+        * editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added.
+        * editing/resources/drag-drop.html: Added.
+
 2010-04-28  Adam Langley  <agl@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-04-28  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Convert m_documentUnderMouse, m_dragInitiator to RefPtr.
+        Eliminated unused m_dragInitiator accessor to prevent dereferencing.
+        https://bugs.webkit.org/show_bug.cgi?id=37618
+
+        Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+        * page/DragController.h:
+        (WebCore::DragController::draggingImageURL):
+        (WebCore::DragController::documentUnderMouse):
+
 2010-04-28  Dumitru Daniliuc  <dumi@chromium.org>
 

trunk/WebCore/page/DragController.cpp

@@ -314 +314 @@
 
         IntPoint point = frameView->windowToContents(dragData->clientPosition());
-        Element* element = elementUnderMouse(m_documentUnderMouse, point);
+        Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
         if (!asFileInput(element)) {
             VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
@@ -364 +364 @@
 
     IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
-    Element* element = elementUnderMouse(m_documentUnderMouse, point);
+    Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
@@ -440 +440 @@
         } else {
             if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText));
+                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), fragment, true, dragData->canSmartReplace(), chosePlainText));
         }
     } else {
@@ -451 +451 @@
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
         if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true));
+            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), createFragmentFromText(range.get(), text), true, false, true));
     }
     loader->setAllowStaleResources(false);

trunk/WebCore/page/DragController.h

@@ -68 +68 @@
         void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
-        void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
-        Document* dragInitiator() const { return m_dragInitiator; }
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
         const IntPoint& dragOffset() const { return m_dragOffset; }
         DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
 
-        Document* documentUnderMouse() const { return m_documentUnderMouse; }
+        Document* documentUnderMouse() const { return m_documentUnderMouse.get(); }
         DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
         DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
@@ -115 +113 @@
         DragClient* m_client;
         
-        Document* m_documentUnderMouse; // The document the mouse was last dragged over.
-        Document* m_dragInitiator; // The Document (if any) that initiated the drag.
+        RefPtr<Document> m_documentUnderMouse; // The document the mouse was last dragged over.
+        RefPtr<Document> m_dragInitiator; // The Document (if any) that initiated the drag.
         
         DragDestinationAction m_dragDestinationAction;