Import WebKit commit 6d0ad27b6bc4209fb8d8cee2692dc0c6a5462051v5.212.0-alpha2

Change-Id: Ifdedb7bc3162434686201813dc1d994cf5ae7e70
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>

8 files changed, 37 insertions, 11 deletions

diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 47e5fc970..d528a92cd 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2007, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Igalia S.L
  *
  * Redistribution and use in source and binary forms, with or without
@@ -223,6 +223,8 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuAction action, co
     if (!frame)
         return;
 
+    Ref<Frame> protector(*frame);
+
     switch (action) {
     case ContextMenuItemTagOpenLinkInNewWindow:
         openNewWindow(m_context.hitTestResult().absoluteLinkURL(), frame, ShouldOpenExternalURLsPolicy::ShouldAllowExternalSchemes);
diff --git a/Source/WebCore/page/DOMSelection.cpp b/Source/WebCore/page/DOMSelection.cpp
index e119f64d8..064f76837 100644
--- a/Source/WebCore/page/DOMSelection.cpp
+++ b/Source/WebCore/page/DOMSelection.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -203,7 +203,7 @@ void DOMSelection::collapse(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -219,6 +219,7 @@ void DOMSelection::collapseToEnd(ExceptionCode& ec)
         return;
     }
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(selection.end(), DOWNSTREAM);
 }
 
@@ -234,6 +235,7 @@ void DOMSelection::collapseToStart(ExceptionCode& ec)
         return;
     }
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(selection.start(), DOWNSTREAM);
 }
 
@@ -257,7 +259,7 @@ void DOMSelection::setBaseAndExtent(Node* baseNode, int baseOffset, Node* extent
     if (!isValidForPosition(baseNode) || !isValidForPosition(extentNode))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(baseNode, baseOffset), createLegacyEditingPosition(extentNode, extentOffset), DOWNSTREAM);
 }
 
@@ -273,7 +275,7 @@ void DOMSelection::setPosition(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -324,6 +326,7 @@ void DOMSelection::modify(const String& alterString, const String& directionStri
     else
         return;
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().modify(alter, direction, granularity);
 }
 
@@ -345,7 +348,7 @@ void DOMSelection::extend(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().setExtent(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -385,6 +388,8 @@ void DOMSelection::addRange(Range* r)
     if (!r)
         return;
 
+    Ref<Frame> protector(*m_frame);
+
     FrameSelection& selection = m_frame->selection();
 
     if (selection.isNone()) {
@@ -433,6 +438,7 @@ void DOMSelection::deleteFromDocument()
     if (!selectedRange)
         return;
 
+    Ref<Frame> protector(*m_frame);
     selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
 
     setBaseAndExtent(&selectedRange->startContainer(), selectedRange->startOffset(), &selectedRange->startContainer(), selectedRange->startOffset(), ASSERT_NO_EXCEPTION);
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index c4cbb67ef..7a874db56 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009, 2010, 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009-2010, 2013, 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -432,6 +432,7 @@ DragOperation DragController::operationForLoad(DragData& dragData)
 
 static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, RefPtr<Range>& range, const IntPoint& point)
 {
+    Ref<Frame> protector(*frame);
     frame->selection().setSelection(dragCaret);
     if (frame->selection().selection().isNone()) {
         dragCaret = frame->visiblePositionForPoint(point);
@@ -752,6 +753,7 @@ bool DragController::startDrag(Frame& src, const DragState& state, DragOperation
     if (!src.view() || !src.contentRenderer() || !state.source)
         return false;
 
+    Ref<Frame> protector(src);
     HitTestResult hitTestResult = src.eventHandler().hitTestResultAtPoint(dragOrigin, HitTestRequest::ReadOnly | HitTestRequest::Active);
 
     // FIXME(136836): Investigate whether all elements should use the containsIncludingShadowDOM() path here.
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index a40b4bfab..97a0d2d39 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -1138,8 +1138,8 @@ HitTestResult EventHandler::hitTestResultAtPoint(const LayoutPoint& point, HitTe
     }
 
     // We should always start hit testing a clean tree.
-    if (m_frame.document())
-        m_frame.document()->updateLayoutIgnorePendingStylesheets();
+    if (auto* frameView = m_frame.view())
+        frameView->updateLayoutAndStyleIfNeededRecursive();
     HitTestResult result(point, padding.height(), padding.width(), padding.height(), padding.width());
     RenderView* renderView = m_frame.contentRenderer();
     if (!renderView)
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 9315237af..f447d5ded 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -267,6 +267,11 @@ void Frame::setDocument(RefPtr<Document>&& newDocument)
 {
     ASSERT(!newDocument || newDocument->frame() == this);
 
+    if (m_documentIsBeingReplaced)
+        return;
+
+    m_documentIsBeingReplaced = true;
+    
     if (m_doc && m_doc->pageCacheState() != Document::InPageCache)
         m_doc->prepareForDestruction();
 
@@ -280,6 +285,8 @@ void Frame::setDocument(RefPtr<Document>&& newDocument)
         newDocument->didBecomeCurrentDocumentInFrame();
 
     InspectorInstrumentation::frameDocumentUpdated(this);
+
+    m_documentIsBeingReplaced = false;
 }
 
 #if ENABLE(ORIENTATION_EVENTS)
@@ -603,6 +610,8 @@ int Frame::checkOverflowScroll(OverflowScrollAction action)
         }
     }
 
+    Ref<Frame> protectedThis(*this);
+
     if (action == PerformOverflowScroll && (deltaX || deltaY)) {
         layer->scrollToOffset(layer->scrollOffset() + IntSize(deltaX, deltaY));
 
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index d0e22ef4e..f43a93ecb 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -162,6 +162,8 @@ namespace WebCore {
         WEBCORE_EXPORT RenderView* contentRenderer() const; // Root of the render tree for the document contained in this frame.
         WEBCORE_EXPORT RenderWidget* ownerRenderer() const; // Renderer for the element that contains this frame.
 
+        bool documentIsBeingReplaced() const { return m_documentIsBeingReplaced; }
+
     // ======== All public functions below this point are candidates to move out of Frame into another class. ========
 
         void injectUserScripts(UserScriptInjectionTime);
@@ -329,6 +331,7 @@ namespace WebCore {
 
         int m_activeDOMObjectsAndAnimationsSuspendedCount;
         bool m_mainFrameWasDestroyed { false };
+        bool m_documentIsBeingReplaced { false };
 
     protected:
         std::unique_ptr<EventHandler> m_eventHandler;
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index bf35cf8b2..2983a2d92 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -2741,8 +2741,10 @@ void FrameView::setNeedsLayout()
         return;
     }
 
-    if (RenderView* renderView = this->renderView())
+    if (auto* renderView = this->renderView()) {
+        ASSERT(!renderView->inHitTesting());
         renderView->setNeedsLayout();
+    }
 }
 
 void FrameView::unscheduleRelayout()
diff --git a/Source/WebCore/page/TextIndicator.cpp b/Source/WebCore/page/TextIndicator.cpp
index fd0c0ba73..768fd9aa7 100644
--- a/Source/WebCore/page/TextIndicator.cpp
+++ b/Source/WebCore/page/TextIndicator.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -69,6 +69,8 @@ RefPtr<TextIndicator> TextIndicator::createWithRange(const Range& range, TextInd
     if (!frame)
         return nullptr;
 
+    Ref<Frame> protector(*frame);
+
 #if PLATFORM(IOS)
     frame->editor().setIgnoreCompositionSelectionChange(true);
     frame->selection().setUpdateAppearanceEnabled(true);