Title: [232434] trunk
Revision
232434
Author
[email protected]
Date
2018-06-01 21:09:30 -0700 (Fri, 01 Jun 2018)

Log Message

Editor can hold references to Documents after you navigate away
https://bugs.webkit.org/show_bug.cgi?id=186215

Reviewed by Simon Fraser.

Source/WebCore:

Clear the various member variables that can hold onto a document in Editor::clear and FrameSelection::prepareForDestruction.

Test: editing/selection/navigation-clears-editor-state.html

* editing/Editor.cpp:
(WebCore::Editor::clear):
* editing/Editor.h:
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::FrameSelection):
(WebCore::FrameSelection::prepareForDestruction):
* editing/FrameSelection.h:

LayoutTests:

Added a regression test.

* editing/selection/navigation-clears-editor-state-expected.txt: Added.
* editing/selection/navigation-clears-editor-state.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (232433 => 232434)


--- trunk/LayoutTests/ChangeLog	2018-06-02 00:21:58 UTC (rev 232433)
+++ trunk/LayoutTests/ChangeLog	2018-06-02 04:09:30 UTC (rev 232434)
@@ -1,5 +1,17 @@
 2018-06-01  Ryosuke Niwa  <[email protected]>
 
+        Editor can hold references to Documents after you navigate away
+        https://bugs.webkit.org/show_bug.cgi?id=186215
+
+        Reviewed by Simon Fraser.
+
+        Added a regression test.
+
+        * editing/selection/navigation-clears-editor-state-expected.txt: Added.
+        * editing/selection/navigation-clears-editor-state.html: Added.
+
+2018-06-01  Ryosuke Niwa  <[email protected]>
+
         Move tests in LayoutTests/editing to appropriate subdirectories
         https://bugs.webkit.org/show_bug.cgi?id=186212
 

Added: trunk/LayoutTests/editing/selection/navigation-clears-editor-state-expected.txt (0 => 232434)


--- trunk/LayoutTests/editing/selection/navigation-clears-editor-state-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/editing/selection/navigation-clears-editor-state-expected.txt	2018-06-02 04:09:30 UTC (rev 232434)
@@ -0,0 +1,13 @@
+This tests navigating away from a document after setting a selection deletes the document.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+iframe = appendIframe()
+PASS internals.numberOfLiveDocuments() is initialDocumentCount + 1
+iframe.src = ""
+PASS internals.numberOfLiveDocuments() is initialDocumentCount + 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/editing/selection/navigation-clears-editor-state.html (0 => 232434)


--- trunk/LayoutTests/editing/selection/navigation-clears-editor-state.html	                        (rev 0)
+++ trunk/LayoutTests/editing/selection/navigation-clears-editor-state.html	2018-06-02 04:09:30 UTC (rev 232434)
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script>
+
+description('This tests navigating away from a document after setting a selection deletes the document.');
+jsTestIsAsync = true;
+
+function appendIframe()
+{
+    const iframe = document.createElement('iframe');
+    document.body.appendChild(iframe);
+    iframe.contentDocument.body.innerHTML = '<p>hello</p>';
+    return iframe;
+}
+
+function setEditorStates(iframe)
+{
+    iframe.contentDocument.designMode = 'on';
+    iframe.contentWindow.getSelection().setPosition(iframe.contentDocument.body, 1);
+    iframe.contentDocument.execCommand('bold', false, null);
+}
+
+function wait(duration)
+{
+    return new Promise(function (resolve) {
+        setTimeout(resolve, 0);
+    });
+}
+
+var frame;
+var initialDocumentCount;
+async function runTest()
+{
+    initialDocumentCount = internals.numberOfLiveDocuments();
+
+    evalAndLog('iframe = appendIframe()');
+
+    await wait(0); // Make sure the transient document created by inserting an iframe is removed.
+    GCController.collect();
+
+    shouldBe('internals.numberOfLiveDocuments()', 'initialDocumentCount + 1');
+    setEditorStates(iframe);
+
+    await wait(0); // Wait for UI update timer to fire.
+
+    evalAndLog('iframe.src = ""
+    iframe._onload_ = () => {
+        GCController.collect();
+        shouldBe('internals.numberOfLiveDocuments()', 'initialDocumentCount + 1');
+        finishJSTest();                
+    }
+}
+
+if (!window.GCController || !window.internals) {
+    debug('This test requires GCController and internals');
+} else {
+    if (window.testRunner)
+        setTimeout(() => testRunner.notifyDone(), 3000);
+    // Clear out any lingering documents from the previous tests.
+    GCController.collect();
+    GCController.collect();
+    runTest();
+
+}
+
+</script>
+</body>
+</html>

Modified: trunk/Source/WebCore/ChangeLog (232433 => 232434)


--- trunk/Source/WebCore/ChangeLog	2018-06-02 00:21:58 UTC (rev 232433)
+++ trunk/Source/WebCore/ChangeLog	2018-06-02 04:09:30 UTC (rev 232434)
@@ -1,5 +1,24 @@
 2018-06-01  Ryosuke Niwa  <[email protected]>
 
+        Editor can hold references to Documents after you navigate away
+        https://bugs.webkit.org/show_bug.cgi?id=186215
+
+        Reviewed by Simon Fraser.
+
+        Clear the various member variables that can hold onto a document in Editor::clear and FrameSelection::prepareForDestruction.
+
+        Test: editing/selection/navigation-clears-editor-state.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::clear):
+        * editing/Editor.h:
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::FrameSelection):
+        (WebCore::FrameSelection::prepareForDestruction):
+        * editing/FrameSelection.h:
+
+2018-06-01  Ryosuke Niwa  <[email protected]>
+
         ResourceLoader::cancel() shouldn't synchronously fire load event on document
         https://bugs.webkit.org/show_bug.cgi?id=185284
 

Modified: trunk/Source/WebCore/editing/Editor.cpp (232433 => 232434)


--- trunk/Source/WebCore/editing/Editor.cpp	2018-06-02 00:21:58 UTC (rev 232433)
+++ trunk/Source/WebCore/editing/Editor.cpp	2018-06-02 04:09:30 UTC (rev 232434)
@@ -1165,6 +1165,7 @@
 
 void Editor::clear()
 {
+    m_lastEditCommand = nullptr;
     if (m_compositionNode) {
         m_compositionNode = nullptr;
         if (EditorClient* client = this->client())
@@ -1173,6 +1174,14 @@
     m_customCompositionUnderlines.clear();
     m_shouldStyleWithCSS = false;
     m_defaultParagraphSeparator = EditorParagraphSeparatorIsDiv;
+    m_mark = { };
+    m_oldSelectionForEditorUIUpdate = { };
+    m_editorUIUpdateTimer.stop();
+
+#if ENABLE(TELEPHONE_NUMBER_DETECTION) && !PLATFORM(IOS)
+    m_telephoneNumberDetectionUpdateTimer.stop();
+    m_detectedTelephoneNumberRanges.clear();
+#endif
 }
 
 bool Editor::insertText(const String& text, Event* triggeringEvent, TextEventInputType inputType)

Modified: trunk/Source/WebCore/editing/Editor.h (232433 => 232434)


--- trunk/Source/WebCore/editing/Editor.h	2018-06-02 00:21:58 UTC (rev 232433)
+++ trunk/Source/WebCore/editing/Editor.h	2018-06-02 04:09:30 UTC (rev 232434)
@@ -582,8 +582,6 @@
     const std::unique_ptr<PAL::KillRing> m_killRing;
     const std::unique_ptr<SpellChecker> m_spellChecker;
     const std::unique_ptr<AlternativeTextController> m_alternativeTextController;
-    VisibleSelection m_mark;
-    bool m_areMarkedTextMatchesHighlighted { false };
     EditorParagraphSeparator m_defaultParagraphSeparator { EditorParagraphSeparatorIsDiv };
     bool m_overwriteModeEnabled { false };
 
@@ -592,6 +590,9 @@
     HashSet<String> m_removedAttachmentIdentifiers;
 #endif
 
+    VisibleSelection m_mark;
+    bool m_areMarkedTextMatchesHighlighted { false };
+
     VisibleSelection m_oldSelectionForEditorUIUpdate;
     Timer m_editorUIUpdateTimer;
     bool m_editorUIUpdateTimerShouldCheckSpellingAndGrammar { false };

Modified: trunk/Source/WebCore/editing/FrameSelection.cpp (232433 => 232434)


--- trunk/Source/WebCore/editing/FrameSelection.cpp	2018-06-02 00:21:58 UTC (rev 232433)
+++ trunk/Source/WebCore/editing/FrameSelection.cpp	2018-06-02 04:09:30 UTC (rev 232434)
@@ -123,7 +123,9 @@
     : m_frame(frame)
     , m_xPosForVerticalArrowNavigation(NoXPosForVerticalArrowNavigation())
     , m_granularity(CharacterGranularity)
+#if ENABLE(TEXT_CARET)
     , m_caretBlinkTimer(*this, &FrameSelection::caretBlinkTimerFired)
+#endif
     , m_appearanceUpdateTimer(*this, &FrameSelection::appearanceUpdateTimerFired)
     , m_caretInsidePositionFixed(false)
     , m_absCaretBoundsDirty(true)
@@ -1542,6 +1544,8 @@
 
     setSelectionWithoutUpdatingAppearance(VisibleSelection(), defaultSetSelectionOptions(), AlignCursorOnScrollIfNeeded, CharacterGranularity);
     m_previousCaretNode = nullptr;
+    m_typingStyle = nullptr;
+    m_appearanceUpdateTimer.stop();
 }
 
 void FrameSelection::setStart(const VisiblePosition &pos, EUserTriggered trigger)

Modified: trunk/Source/WebCore/editing/FrameSelection.h (232433 => 232434)


--- trunk/Source/WebCore/editing/FrameSelection.h	2018-06-02 00:21:58 UTC (rev 232433)
+++ trunk/Source/WebCore/editing/FrameSelection.h	2018-06-02 04:09:30 UTC (rev 232434)
@@ -341,7 +341,9 @@
 
     RefPtr<EditingStyle> m_typingStyle;
 
+#if ENABLE(TEXT_CARET)
     Timer m_caretBlinkTimer;
+#endif
     Timer m_appearanceUpdateTimer;
     // The painted bounds of the caret in absolute coordinates
     IntRect m_absCaretBounds;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to