Fix crashes in InputMethodController.

This CL moves functions that fire events to JS from anonymous namespace to the |InputMethodController| so we can check if the ExecutionContext is still valid after firing the events or not and bail out if its not valid. Bug: 1088364 Change-Id: I2b98724bf305aed998222581a608dc16b0f64baf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2276666Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Anupam Snigdha <snianu@microsoft.com> Cr-Commit-Position: refs/heads/master@{#784340}

Fix crashes in InputMethodController.
This CL moves functions that fire events to JS from anonymous namespace to the |InputMethodController| so we can check if the ExecutionContext is still valid after firing the events or not and bail out if its not valid. Bug: 1088364 Change-Id: I2b98724bf305aed998222581a608dc16b0f64baf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2276666Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Anupam Snigdha <snianu@microsoft.com> Cr-Commit-Position: refs/heads/master@{#784340}
f16cceaf · Anupam Snigdha · Commit Bot · fbbf57ec · f16cceaf · f16cceaf
Commit f16cceaf authored Jul 01, 2020 by Anupam Snigdha Committed by Commit Bot Jul 01, 2020
4 changed files
--- a/third_party/blink/renderer/core/editing/ime/input_method_controller.cc
+++ b/third_party/blink/renderer/core/editing/ime/input_method_controller.cc
--- a/third_party/blink/renderer/core/editing/ime/input_method_controller.h
+++ b/third_party/blink/renderer/core/editing/ime/input_method_controller.h
@@ -33,9 +33,11 @@
 #include "third_party/blink/public/platform/web_text_input_type.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/editing/commands/typing_command.h"
 #include "third_party/blink/renderer/core/editing/forward.h"
 #include "third_party/blink/renderer/core/editing/ime/ime_text_span.h"
 #include "third_party/blink/renderer/core/editing/plain_text_range.h"
+#include "third_party/blink/renderer/core/events/input_event.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
@@ -226,6 +228,17 @@ class CORE_EXPORT InputMethodController final
  //   3) SetComposingText() (SetComposition())
  void RemoveSuggestionMarkerInCompositionRange();
+  void DispatchCompositionUpdateEvent(LocalFrame& frame, const String& text);
+  void DispatchBeforeInputFromComposition(EventTarget* target,
+                                          InputEvent::InputType input_type,
+                                          const String& data);
+  void InsertTextDuringCompositionWithEvents(
+      LocalFrame& frame,
+      const String& text,
+      TypingCommand::Options options,
+      TypingCommand::TextCompositionType composition_type);
+  void DispatchCompositionEndEvent(LocalFrame& frame, const String& text);
  FRIEND_TEST_ALL_PREFIXES(InputMethodControllerTest,
                           InputModeOfFocusedElement);
  FRIEND_TEST_ALL_PREFIXES(InputMethodControllerTest,

--- a/third_party/blink/web_tests/editing/inserting/insert-text-remove-iframe-on-beforeinput-event.html
+++ b/third_party/blink/web_tests/editing/inserting/insert-text-remove-iframe-on-beforeinput-event.html
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
+<script>
+selection_test(
+    '<iframe></iframe>',
+    selection => {
+        assert_own_property(window, 'textInputController',
+                'this test requires window.textInputController.');
+        const document = selection.document;
+        const iframe = document.querySelector('iframe');
+        iframe.contentDocument.documentElement.contentEditable = true;
+        iframe.contentDocument.documentElement.addEventListener(
+            'beforeinput',
+            () => iframe.parentNode.removeChild(iframe));
+        iframe.contentDocument.documentElement.focus();
+        textInputController.setMarkedText('1', 0, 1);
+        textInputController.insertText('x');
+    },
+    '',
+    'Should not crash when beforeinput handler removes current frame when doing InsertText');
+</script>
--- a/third_party/blink/web_tests/editing/inserting/insert-text-remove-iframe-on-compositionend-event.html
+++ b/third_party/blink/web_tests/editing/inserting/insert-text-remove-iframe-on-compositionend-event.html
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
+<script>
+selection_test(
+    '<iframe></iframe>',
+    selection => {
+        assert_own_property(window, 'textInputController',
+                'this test requires window.textInputController.');
+        const document = selection.document;
+        const iframe = document.querySelector('iframe');
+        iframe.contentDocument.documentElement.contentEditable = true;
+        iframe.contentDocument.documentElement.addEventListener(
+            'compositionend',
+            () => iframe.parentNode.removeChild(iframe));
+        iframe.contentDocument.documentElement.focus();
+        textInputController.setMarkedText('1', 0, 1);
+        textInputController.insertText('x');
+    },
+    '',
+    'Should not crash when compositionend handler removes current frame when doing InsertText');
+</script>