Commit 35884699 authored by ddkilzer@apple.com's avatar ddkilzer@apple.com

WebCore: Convert m_documentUnderMouse, m_dragInitiator to RefPtr.

Eliminated unused m_dragInitiator accessor to prevent dereferencing.
https://bugs.webkit.org/show_bug.cgi?id=37618

Patch by Abhishek Arya <inferno@chromium.org> on 2010-04-30
Reviewed by David Kilzer.

Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html

* page/DragController.cpp:
(WebCore::DragController::tryDocumentDrag):
(WebCore::DragController::concludeEditDrag):
* page/DragController.h:
(WebCore::DragController::draggingImageURL):
(WebCore::DragController::documentUnderMouse):

LayoutTests: Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe.
https://bugs.webkit.org/show_bug.cgi?id=37618

Patch by Abhishek Arya <inferno@chromium.org> on 2010-04-30
Reviewed by David Kilzer.

* editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added.
* editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added.
* editing/resources/drag-drop.html: Added.
* platform/qt/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@58616 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 1c6546b9
2010-04-30 Abhishek Arya <inferno@chromium.org>
Reviewed by David Kilzer.
Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe.
https://bugs.webkit.org/show_bug.cgi?id=37618
* editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added.
* editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added.
* editing/resources/drag-drop.html: Added.
* platform/qt/Skipped:
2010-04-30 Dimitri Glazkov <dglazkov@chromium.org>
Unreviewed, expectations update.
......
Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.
SUCCESS
<html>
<head>
<script>
if (window.layoutTestController) {
layoutTestController.waitUntilDone();
layoutTestController.dumpAsText();
}
function log(message) {
var console = document.getElementById("console");
var li = document.createElement("li");
var text = document.createTextNode(message);
console.appendChild(li);
li.appendChild(text);
}
function runTest() {
var doc = window.frames[0].document;
e = doc.getElementById("dragme");
xdrag = e.offsetLeft + e.offsetWidth / 2;
ydrag = e.offsetTop + e.offsetHeight / 2;
e = doc.getElementById("target");
xdrop = e.offsetLeft + e.offsetWidth / 2;
ydrop = e.offsetTop + e.offsetHeight / 2;
var timer = setInterval(function() {
window.frames[0].location = "../resources/drag-drop.html";
}, 100);
if (!window.layoutTestController) {
log("This test uses eventSender. To run it manually, drag the selected image to another position in the editable div and drop it. Renderer should not crash.");
return;
}
var max_tries = 50;
for (i = 0; i < max_tries; i++) {
eventSender.mouseMoveTo(xdrag, ydrag);
eventSender.mouseDown();
eventSender.mouseMoveTo(xdrop, ydrop);
eventSender.mouseUp();
}
clearInterval(timer);
document.write("<p>Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.</p>");
document.write("<p>SUCCESS</p>");
layoutTestController.notifyDone();
}
</script>
</head>
<body onload="runTest()">
<iframe src="../resources/drag-drop.html"></iframe>
<ul id="console"></ul>
</body>
</html>
<div contenteditable>
drag<img src='../resources/abe.png' id=dragme>me
<span id=target>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
</div>
......@@ -444,6 +444,7 @@ editing/pasteboard/block-wrappers-necessary.html
editing/pasteboard/copy-standalone-image.html
editing/pasteboard/drag-drop-dead-frame.html
editing/pasteboard/drag-drop-input-textarea.html
editing/pasteboard/drag-drop-iframe-refresh-crash.html
editing/pasteboard/drag-drop-modifies-page.html
editing/pasteboard/drag-image-to-contenteditable-in-iframe.html
editing/pasteboard/drag-selected-image-to-contenteditable.html
......
2010-04-30 Abhishek Arya <inferno@chromium.org>
Reviewed by David Kilzer.
Convert m_documentUnderMouse, m_dragInitiator to RefPtr.
Eliminated unused m_dragInitiator accessor to prevent dereferencing.
https://bugs.webkit.org/show_bug.cgi?id=37618
Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html
* page/DragController.cpp:
(WebCore::DragController::tryDocumentDrag):
(WebCore::DragController::concludeEditDrag):
* page/DragController.h:
(WebCore::DragController::draggingImageURL):
(WebCore::DragController::documentUnderMouse):
2010-04-29 James Robinson <jamesr@chromium.org>
Reviewed by Simon Fraser.
......@@ -313,7 +313,7 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
}
IntPoint point = frameView->windowToContents(dragData->clientPosition());
Element* element = elementUnderMouse(m_documentUnderMouse, point);
Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
if (!asFileInput(element)) {
VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
m_page->dragCaretController()->setSelection(dragCaret);
......@@ -363,7 +363,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
return false;
IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
Element* element = elementUnderMouse(m_documentUnderMouse, point);
Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
Frame* innerFrame = element->ownerDocument()->frame();
ASSERT(innerFrame);
......@@ -439,7 +439,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartInsert, smartDelete));
} else {
if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText));
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), fragment, true, dragData->canSmartReplace(), chosePlainText));
}
} else {
String text = dragData->asPlainText();
......@@ -450,7 +450,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true));
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), createFragmentFromText(range.get(), text), true, false, true));
}
loader->setAllowStaleResources(false);
......
......@@ -67,13 +67,11 @@ namespace WebCore {
DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
const KURL& draggingImageURL() const { return m_draggingImageURL; }
void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
Document* dragInitiator() const { return m_dragInitiator; }
void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
const IntPoint& dragOffset() const { return m_dragOffset; }
DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
Document* documentUnderMouse() const { return m_documentUnderMouse; }
Document* documentUnderMouse() const { return m_documentUnderMouse.get(); }
DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
......@@ -114,8 +112,8 @@ namespace WebCore {
Page* m_page;
DragClient* m_client;
Document* m_documentUnderMouse; // The document the mouse was last dragged over.
Document* m_dragInitiator; // The Document (if any) that initiated the drag.
RefPtr<Document> m_documentUnderMouse; // The document the mouse was last dragged over.
RefPtr<Document> m_dragInitiator; // The Document (if any) that initiated the drag.
DragDestinationAction m_dragDestinationAction;
DragSourceAction m_dragSourceAction;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment