2010-04-28 Abhishek Arya <inferno@chromium.org>

Reviewed by Eric Seidel. Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe. https://bugs.webkit.org/show_bug.cgi?id=37618 * editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added. * editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added. * editing/resources/drag-drop.html: Added. 2010-04-28 Abhishek Arya <inferno@chromium.org> Reviewed by Eric Seidel. Convert m_documentUnderMouse, m_dragInitiator to RefPtr. Eliminated unused m_dragInitiator accessor to prevent dereferencing. https://bugs.webkit.org/show_bug.cgi?id=37618 Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html * page/DragController.cpp: (WebCore::DragController::tryDocumentDrag): (WebCore::DragController::concludeEditDrag): * page/DragController.h: (WebCore::DragController::draggingImageURL): (WebCore::DragController::documentUnderMouse): Canonical link: https://commits.webkit.org/49710@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@58441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Apr 28, 2010 · db69d52 · db69d52
1 parent f716845
commit db69d52
Show file tree

Hide file tree

Showing 7 changed files with 100 additions and 9 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-04-28  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe.
+        https://bugs.webkit.org/show_bug.cgi?id=37618
+
+        * editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added.
+        * editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added.
+        * editing/resources/drag-drop.html: Added.
+
 2010-04-28  Adam Langley  <agl@chromium.org>
 
         Unreviewed, expectations update.

diff --git a/LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt b/LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt
@@ -0,0 +1,3 @@
+Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.
+
+SUCCESS
diff --git a/LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash.html b/LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash.html
@@ -0,0 +1,58 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+function log(message) {
+    var console = document.getElementById("console");
+    var li = document.createElement("li");
+    var text = document.createTextNode(message);
+
+    console.appendChild(li);
+    li.appendChild(text);
+}
+
+function runTest() {
+
+    var doc = window.frames[0].document;
+    e = doc.getElementById("dragme");
+    xdrag = e.offsetLeft + e.offsetWidth / 2;
+    ydrag = e.offsetTop + e.offsetHeight / 2;
+    e = doc.getElementById("target");
+    xdrop = e.offsetLeft + e.offsetWidth / 2;
+    ydrop = e.offsetTop + e.offsetHeight / 2;
+
+    var timer = setInterval(function() {
+                                window.frames[0].location = "../resources/drag-drop.html";
+                            }, 100);
+
+    if (!window.layoutTestController) {
+        log("This test uses eventSender. To run it manually, drag the selected image to another position in the editable div and drop it. Renderer should not crash.");
+        return;
+    }
+
+    var max_tries = 50; 
+    for (i = 0; i < max_tries; i++) {
+         eventSender.mouseMoveTo(xdrag, ydrag);
+         eventSender.mouseDown();    
+         eventSender.mouseMoveTo(xdrop, ydrop);
+         eventSender.mouseUp();
+    }
+
+    clearInterval(timer);
+
+    document.write("<p>Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.</p>");
+    document.write("<p>SUCCESS</p>");
+
+    layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body onload="runTest()">
+<iframe src="../resources/drag-drop.html"></iframe>
+<ul id="console"></ul>
+</body>
+</html>
diff --git a/LayoutTests/editing/resources/drag-drop.html b/LayoutTests/editing/resources/drag-drop.html
@@ -0,0 +1,4 @@
+<div contenteditable>
+drag<img src='../resources/abe.png' id=dragme>me
+<span id=target>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+</div>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2010-04-28  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Convert m_documentUnderMouse, m_dragInitiator to RefPtr.
+        Eliminated unused m_dragInitiator accessor to prevent dereferencing.
+        https://bugs.webkit.org/show_bug.cgi?id=37618
+
+        Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+        * page/DragController.h:
+        (WebCore::DragController::draggingImageURL):
+        (WebCore::DragController::documentUnderMouse):
+
 2010-04-28  Dumitru Daniliuc  <dumi@chromium.org>
 
         Unreviewed, fixing a build problem introduced by the previous patch.

diff --git a/WebCore/page/DragController.cpp b/WebCore/page/DragController.cpp
@@ -313,7 +313,7 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
         }
 
         IntPoint point = frameView->windowToContents(dragData->clientPosition());
-        Element* element = elementUnderMouse(m_documentUnderMouse, point);
+        Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
         if (!asFileInput(element)) {
             VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
@@ -363,7 +363,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return false;
 
     IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
-    Element* element = elementUnderMouse(m_documentUnderMouse, point);
+    Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
@@ -439,7 +439,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
             applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartInsert, smartDelete));
         } else {
             if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText));
+                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), fragment, true, dragData->canSmartReplace(), chosePlainText));
         }
     } else {
         String text = dragData->asPlainText();
@@ -450,7 +450,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
 
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
         if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true));
+            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), createFragmentFromText(range.get(), text), true, false, true));
     }
     loader->setAllowStaleResources(false);
 

diff --git a/WebCore/page/DragController.h b/WebCore/page/DragController.h
@@ -67,13 +67,11 @@ namespace WebCore {
         DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
         void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
-        void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
-        Document* dragInitiator() const { return m_dragInitiator; }
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
         const IntPoint& dragOffset() const { return m_dragOffset; }
         DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
 
-        Document* documentUnderMouse() const { return m_documentUnderMouse; }
+        Document* documentUnderMouse() const { return m_documentUnderMouse.get(); }
         DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
         DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
 
@@ -114,8 +112,8 @@ namespace WebCore {
         Page* m_page;
         DragClient* m_client;
 
-        Document* m_documentUnderMouse; // The document the mouse was last dragged over.
-        Document* m_dragInitiator; // The Document (if any) that initiated the drag.
+        RefPtr<Document> m_documentUnderMouse; // The document the mouse was last dragged over.
+        RefPtr<Document> m_dragInitiator; // The Document (if any) that initiated the drag.
 
         DragDestinationAction m_dragDestinationAction;
         DragSourceAction m_dragSourceAction;