Deploy smart pointers in TreeScope.cpp, TreeScopeOrderedMap.cpp, and …

…UserGestureIndicator.cpp https://bugs.webkit.org/show_bug.cgi?id=264393 Reviewed by Chris Dumez. Deploy smart pointers as warned by the clang static analyzer. * Source/WebCore/dom/TreeScope.cpp: (WebCore::TreeScope::labelElementsForId): (WebCore::TreeScope::elementFromPoint): (WebCore::TreeScope::findAnchor): * Source/WebCore/dom/TreeScope.h: * Source/WebCore/dom/TreeScopeInlines.h: (WebCore::TreeScope::protectedRootNode const): * Source/WebCore/dom/TreeScopeOrderedMap.cpp: (WebCore::TreeScopeOrderedMap::get const): (WebCore::TreeScopeOrderedMap::getAll const): * Source/WebCore/dom/UserGestureIndicator.cpp: (WebCore::UserGestureToken::UserGestureToken): Canonical link: https://commits.webkit.org/270392@main
WebKit · Nov 8, 2023 · 0def6ce · 0def6ce
1 parent 4a439be
commit 0def6ce
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 10 deletions.
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
@@ -362,8 +362,8 @@ const Vector<CheckedRef<Element>>* TreeScope::labelElementsForId(const AtomStrin
         // Populate the map on first access.
         m_labelsByForAttribute = makeUnique<TreeScopeOrderedMap>();
 
-        for (auto& label : descendantsOfType<HTMLLabelElement>(m_rootNode)) {
-            const AtomString& forValue = label.attributeWithoutSynchronization(forAttr);
+        for (Ref label : descendantsOfType<HTMLLabelElement>(m_rootNode)) {
+            const AtomString& forValue = label->attributeWithoutSynchronization(forAttr);
             if (!forValue.isEmpty())
                 addLabel(forValue, label);
         }
@@ -425,8 +425,7 @@ RefPtr<Node> TreeScope::nodeFromPoint(const LayoutPoint& clientPoint, LayoutPoin
 
 RefPtr<Element> TreeScope::elementFromPoint(double clientX, double clientY)
 {
-    Document& document = documentScope();
-    if (!document.hasLivingRenderTree())
+    if (!protectedDocumentScope()->hasLivingRenderTree())
         return nullptr;
 
     auto node = nodeFromPoint(LayoutPoint { clientX, clientY }, nullptr);
@@ -510,8 +509,9 @@ RefPtr<Element> TreeScope::findAnchor(StringView name)
         return nullptr;
     if (RefPtr element = getElementById(name))
         return element;
-    for (Ref anchor : descendantsOfType<HTMLAnchorElement>(m_rootNode)) {
-        if (m_rootNode.document().inQuirksMode()) {
+    auto inQuirksMode = documentScope().inQuirksMode();
+    for (Ref anchor : descendantsOfType<HTMLAnchorElement>(protectedRootNode())) {
+        if (inQuirksMode) {
             // Quirks mode, ASCII case-insensitive comparison of names.
             // FIXME: This behavior is not mentioned in the HTML specification.
             // We should either remove this or get this into the specification.

diff --git a/Source/WebCore/dom/TreeScope.h b/Source/WebCore/dom/TreeScope.h
@@ -132,6 +132,7 @@ class TreeScope {
     RefPtr<Element> findAnchor(StringView name);
 
     ContainerNode& rootNode() const { return m_rootNode; }
+    Ref<ContainerNode> protectedRootNode() const;
 
     IdTargetObserverRegistry& idTargetObserverRegistry() { return m_idTargetObserverRegistry.get(); }
     const IdTargetObserverRegistry& idTargetObserverRegistry() const { return m_idTargetObserverRegistry.get(); }

diff --git a/Source/WebCore/dom/TreeScopeInlines.h b/Source/WebCore/dom/TreeScopeInlines.h
@@ -25,10 +25,16 @@
 
 #pragma once
 
+#include "ContainerNode.h"
 #include "TreeScopeOrderedMap.h"
 
 namespace WebCore {
 
+inline Ref<ContainerNode> TreeScope::protectedRootNode() const
+{
+    return rootNode();
+}
+
 inline bool TreeScope::hasElementWithId(const AtomString& id) const
 {
     return m_elementsById && m_elementsById->contains(id);

diff --git a/Source/WebCore/dom/TreeScopeOrderedMap.cpp b/Source/WebCore/dom/TreeScopeOrderedMap.cpp
@@ -37,6 +37,7 @@
 #include "HTMLLabelElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNameCollection.h"
+#include "TreeScopeInlines.h"
 #include "TypedElementDescendantIteratorInlines.h"
 
 namespace WebCore {
@@ -117,7 +118,7 @@ inline RefPtr<Element> TreeScopeOrderedMap::get(const AtomString& key, const Tre
     }
 
     // We know there's at least one node that matches; iterate to find the first one.
-    for (Ref element : descendantsOfType<Element>(scope.rootNode())) {
+    for (Ref element : descendantsOfType<Element>(scope.protectedRootNode().get())) {
         if (!element->isInTreeScope())
             continue;
         if (!keyMatches(key, element))
@@ -163,7 +164,7 @@ inline Vector<CheckedRef<Element>>* TreeScopeOrderedMap::getAll(const AtomString
 
     if (entry.orderedList.isEmpty()) {
         entry.orderedList.reserveCapacity(entry.count);
-        auto elementDescendants = descendantsOfType<Element>(scope.rootNode());
+        auto elementDescendants = descendantsOfType<Element>(scope.protectedRootNode().get());
         for (auto it = entry.element ? elementDescendants.beginAt(*entry.element) : elementDescendants.begin(); it; ++it) {
             if (keyMatches(key, *it))
                 entry.orderedList.append(*it);

diff --git a/Source/WebCore/dom/UserGestureIndicator.cpp b/Source/WebCore/dom/UserGestureIndicator.cpp
@@ -69,13 +69,14 @@ UserGestureToken::UserGestureToken(IsProcessingUserGesture isProcessingUserGestu
             m_documentsImpactedByUserGesture.add(*ancestorDocument);
     }
 
-    auto& documentOrigin = document->securityOrigin();
+    Ref documentOrigin = document->securityOrigin();
     for (RefPtr frame = &documentFrame->tree().top(); frame; frame = frame->tree().traverseNext()) {
         RefPtr localFrame = dynamicDowncast<LocalFrame>(frame);
         if (!localFrame)
             continue;
         RefPtr frameDocument = localFrame->document();
-        if (frameDocument && documentOrigin.isSameOriginDomain(frameDocument->securityOrigin()))
+        Ref frameOrigin = frameDocument->securityOrigin();
+        if (frameDocument && documentOrigin->isSameOriginDomain(frameOrigin.get()))
             m_documentsImpactedByUserGesture.add(*frameDocument);
     }
 }