Skip to content

Commit db69d52

Browse files
eseideleseidel
committed
2010-04-28 Abhishek Arya <inferno@chromium.org>
 Reviewed by Eric Seidel. Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe. https://bugs.webkit.org/show_bug.cgi?id=37618 * editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added. * editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added. * editing/resources/drag-drop.html: Added. 2010-04-28 Abhishek Arya <inferno@chromium.org> Reviewed by Eric Seidel. Convert m_documentUnderMouse, m_dragInitiator to RefPtr. Eliminated unused m_dragInitiator accessor to prevent dereferencing. https://bugs.webkit.org/show_bug.cgi?id=37618 Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html * page/DragController.cpp: (WebCore::DragController::tryDocumentDrag): (WebCore::DragController::concludeEditDrag): * page/DragController.h: (WebCore::DragController::draggingImageURL): (WebCore::DragController::documentUnderMouse): Canonical link: https://commits.webkit.org/49710@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@58441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent f716845 commit db69d52

7 files changed

Lines changed: 100 additions & 9 deletions

File tree

‎LayoutTests/ChangeLog‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
2010-04-28 Abhishek Arya <inferno@chromium.org>
2+
3+
Reviewed by Eric Seidel.
4+
5+
Tests for a crash when an image drag-drop operation happens inside a continuously refreshing iframe.
6+
https://bugs.webkit.org/show_bug.cgi?id=37618
7+
8+
* editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt: Added.
9+
* editing/pasteboard/drag-drop-iframe-refresh-crash.html: Added.
10+
* editing/resources/drag-drop.html: Added.
11+
112
2010-04-28 Adam Langley <agl@chromium.org>
213

314
Unreviewed, expectations update.

‎LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash-expected.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.
2+
3+
SUCCESS

‎LayoutTests/editing/pasteboard/drag-drop-iframe-refresh-crash.html‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
<html>
2+
<head>
3+
<script>
4+
if (window.layoutTestController) {
5+
layoutTestController.waitUntilDone();
6+
layoutTestController.dumpAsText();
7+
}
8+
9+
function log(message) {
10+
var console = document.getElementById("console");
11+
var li = document.createElement("li");
12+
var text = document.createTextNode(message);
13+
14+
console.appendChild(li);
15+
li.appendChild(text);
16+
}
17+
18+
function runTest() {
19+
20+
var doc = window.frames[0].document;
21+
e = doc.getElementById("dragme");
22+
xdrag = e.offsetLeft + e.offsetWidth / 2;
23+
ydrag = e.offsetTop + e.offsetHeight / 2;
24+
e = doc.getElementById("target");
25+
xdrop = e.offsetLeft + e.offsetWidth / 2;
26+
ydrop = e.offsetTop + e.offsetHeight / 2;
27+
28+
var timer = setInterval(function() {
29+
window.frames[0].location = "../resources/drag-drop.html";
30+
}, 100);
31+
32+
if (!window.layoutTestController) {
33+
log("This test uses eventSender. To run it manually, drag the selected image to another position in the editable div and drop it. Renderer should not crash.");
34+
return;
35+
}
36+
37+
var max_tries = 50;
38+
for (i = 0; i < max_tries; i++) {
39+
eventSender.mouseMoveTo(xdrag, ydrag);
40+
eventSender.mouseDown();
41+
eventSender.mouseMoveTo(xdrop, ydrop);
42+
eventSender.mouseUp();
43+
}
44+
45+
clearInterval(timer);
46+
47+
document.write("<p>Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.</p>");
48+
document.write("<p>SUCCESS</p>");
49+
50+
layoutTestController.notifyDone();
51+
}
52+
</script>
53+
</head>
54+
<body onload="runTest()">
55+
<iframe src="../resources/drag-drop.html"></iframe>
56+
<ul id="console"></ul>
57+
</body>
58+
</html>

‎LayoutTests/editing/resources/drag-drop.html‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<div contenteditable>
2+
drag<img src='../resources/abe.png' id=dragme>me
3+
<span id=target>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
4+
</div>

‎WebCore/ChangeLog‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,20 @@
1+
2010-04-28 Abhishek Arya <inferno@chromium.org>
2+
3+
Reviewed by Eric Seidel.
4+
5+
Convert m_documentUnderMouse, m_dragInitiator to RefPtr.
6+
Eliminated unused m_dragInitiator accessor to prevent dereferencing.
7+
https://bugs.webkit.org/show_bug.cgi?id=37618
8+
9+
Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html
10+
11+
* page/DragController.cpp:
12+
(WebCore::DragController::tryDocumentDrag):
13+
(WebCore::DragController::concludeEditDrag):
14+
* page/DragController.h:
15+
(WebCore::DragController::draggingImageURL):
16+
(WebCore::DragController::documentUnderMouse):
17+
118
2010-04-28 Dumitru Daniliuc <dumi@chromium.org>
219

320
Unreviewed, fixing a build problem introduced by the previous patch.

‎WebCore/page/DragController.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,7 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
313313
}
314314

315315
IntPoint point = frameView->windowToContents(dragData->clientPosition());
316-
Element* element = elementUnderMouse(m_documentUnderMouse, point);
316+
Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
317317
if (!asFileInput(element)) {
318318
VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
319319
m_page->dragCaretController()->setSelection(dragCaret);
@@ -363,7 +363,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
363363
return false;
364364

365365
IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
366-
Element* element = elementUnderMouse(m_documentUnderMouse, point);
366+
Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
367367
Frame* innerFrame = element->ownerDocument()->frame();
368368
ASSERT(innerFrame);
369369

@@ -439,7 +439,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
439439
applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartInsert, smartDelete));
440440
} else {
441441
if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
442-
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText));
442+
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), fragment, true, dragData->canSmartReplace(), chosePlainText));
443443
}
444444
} else {
445445
String text = dragData->asPlainText();
@@ -450,7 +450,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
450450

451451
m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
452452
if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
453-
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true));
453+
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), createFragmentFromText(range.get(), text), true, false, true));
454454
}
455455
loader->setAllowStaleResources(false);
456456

‎WebCore/page/DragController.h‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,11 @@ namespace WebCore {
6767
DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
6868
void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
6969
const KURL& draggingImageURL() const { return m_draggingImageURL; }
70-
void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
71-
Document* dragInitiator() const { return m_dragInitiator; }
7270
void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
7371
const IntPoint& dragOffset() const { return m_dragOffset; }
7472
DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
7573

76-
Document* documentUnderMouse() const { return m_documentUnderMouse; }
74+
Document* documentUnderMouse() const { return m_documentUnderMouse.get(); }
7775
DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
7876
DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
7977

@@ -114,8 +112,8 @@ namespace WebCore {
114112
Page* m_page;
115113
DragClient* m_client;
116114

117-
Document* m_documentUnderMouse; // The document the mouse was last dragged over.
118-
Document* m_dragInitiator; // The Document (if any) that initiated the drag.
115+
RefPtr<Document> m_documentUnderMouse; // The document the mouse was last dragged over.
116+
RefPtr<Document> m_dragInitiator; // The Document (if any) that initiated the drag.
119117

120118
DragDestinationAction m_dragDestinationAction;
121119
DragSourceAction m_dragSourceAction;

0 commit comments

Comments
 (0)