DevTools: InspectorHistory actions become refcounted.

This patch makes InspectorHistory::Action class to be refcounted. This
helps to get results of completed operations in InspectorHistory without
possibility of use-after-free (this patch fixes two of this cases).

BUG=

Review URL: https://codereview.chromium.org/208893007

git-svn-id: svn://svn.chromium.org/blink/trunk@170054 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/inspector/DOMEditor.cpp

@@ -94,7 +94,7 @@ public:
     virtual bool perform(ExceptionState& exceptionState) OVERRIDE
     {
         if (m_node->parentNode()) {
-            m_removeChildAction = adoptPtr(new RemoveChildAction(m_node->parentNode(), m_node.get()));
+            m_removeChildAction = adoptRef(new RemoveChildAction(m_node->parentNode(), m_node.get()));
             if (!m_removeChildAction->perform(exceptionState))
                 return false;
         }
@@ -124,7 +124,7 @@ private:
     RefPtr<Node> m_parentNode;
     RefPtr<Node> m_node;
     RefPtr<Node> m_anchorNode;
-    OwnPtr<RemoveChildAction> m_removeChildAction;
+    RefPtr<RemoveChildAction> m_removeChildAction;
 };
 
 class DOMEditor::RemoveAttributeAction FINAL : public InspectorHistory::Action {
@@ -361,47 +361,46 @@ DOMEditor::~DOMEditor() { }
 
 bool DOMEditor::insertBefore(Node* parentNode, PassRefPtr<Node> node, Node* anchorNode, ExceptionState& exceptionState)
 {
-    return m_history->perform(adoptPtr(new InsertBeforeAction(parentNode, node, anchorNode)), exceptionState);
+    return m_history->perform(adoptRef(new InsertBeforeAction(parentNode, node, anchorNode)), exceptionState);
 }
 
 bool DOMEditor::removeChild(Node* parentNode, Node* node, ExceptionState& exceptionState)
 {
-    return m_history->perform(adoptPtr(new RemoveChildAction(parentNode, node)), exceptionState);
+    return m_history->perform(adoptRef(new RemoveChildAction(parentNode, node)), exceptionState);
 }
 
 bool DOMEditor::setAttribute(Element* element, const String& name, const String& value, ExceptionState& exceptionState)
 {
-    return m_history->perform(adoptPtr(new SetAttributeAction(element, AtomicString(name), AtomicString(value))), exceptionState);
+    return m_history->perform(adoptRef(new SetAttributeAction(element, AtomicString(name), AtomicString(value))), exceptionState);
 }
 
 bool DOMEditor::removeAttribute(Element* element, const String& name, ExceptionState& exceptionState)
 {
-    return m_history->perform(adoptPtr(new RemoveAttributeAction(element, AtomicString(name))), exceptionState);
+    return m_history->perform(adoptRef(new RemoveAttributeAction(element, AtomicString(name))), exceptionState);
 }
 
 bool DOMEditor::setOuterHTML(Node* node, const String& html, Node** newNode, ExceptionState& exceptionState)
 {
-    OwnPtr<SetOuterHTMLAction> action = adoptPtr(new SetOuterHTMLAction(node, html));
-    SetOuterHTMLAction* rawAction = action.get();
-    bool result = m_history->perform(action.release(), exceptionState);
+    RefPtr<SetOuterHTMLAction> action = adoptRef(new SetOuterHTMLAction(node, html));
+    bool result = m_history->perform(action, exceptionState);
     if (result)
-        *newNode = rawAction->newNode();
+        *newNode = action->newNode();
     return result;
 }
 
 bool DOMEditor::replaceWholeText(Text* textNode, const String& text, ExceptionState& exceptionState)
 {
-    return m_history->perform(adoptPtr(new ReplaceWholeTextAction(textNode, text)), exceptionState);
+    return m_history->perform(adoptRef(new ReplaceWholeTextAction(textNode, text)), exceptionState);
 }
 
 bool DOMEditor::replaceChild(Node* parentNode, PassRefPtr<Node> newNode, Node* oldNode, ExceptionState& exceptionState)
 {
-    return m_history->perform(adoptPtr(new ReplaceChildNodeAction(parentNode, newNode, oldNode)), exceptionState);
+    return m_history->perform(adoptRef(new ReplaceChildNodeAction(parentNode, newNode, oldNode)), exceptionState);
 }
 
 bool DOMEditor::setNodeValue(Node* node, const String& value, ExceptionState& exceptionState)
 {
-    return m_history->perform(adoptPtr(new SetNodeValueAction(node, value)), exceptionState);
+    return m_history->perform(adoptRef(new SetNodeValueAction(node, value)), exceptionState);
 }
 
 static void populateErrorString(ExceptionState& exceptionState, ErrorString* errorString)

third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp

@@ -200,7 +200,7 @@ public:
         return String::format("SetStyleSheetText %s", m_styleSheet->id().utf8().data());
     }
 
-    virtual void merge(PassOwnPtr<Action> action) OVERRIDE
+    virtual void merge(PassRefPtr<Action> action) OVERRIDE
     {
         ASSERT(action->mergeId() == mergeId());
 
@@ -256,7 +256,7 @@ public:
         return String::format("SetPropertyText %s:%u:%s", m_styleSheet->id().utf8().data(), m_propertyIndex, m_overwrite ? "true" : "false");
     }
 
-    virtual void merge(PassOwnPtr<Action> action) OVERRIDE
+    virtual void merge(PassRefPtr<Action> action) OVERRIDE
     {
         ASSERT(action->mergeId() == mergeId());
 
@@ -832,7 +832,7 @@ void InspectorCSSAgent::setStyleSheetText(ErrorString* errorString, const String
     }
 
     TrackExceptionState exceptionState;
-    m_domAgent->history()->perform(adoptPtr(new SetStyleSheetTextAction(inspectorStyleSheet, text)), exceptionState);
+    m_domAgent->history()->perform(adoptRef(new SetStyleSheetTextAction(inspectorStyleSheet, text)), exceptionState);
     *errorString = InspectorDOMAgent::toErrorString(exceptionState);
 }
 
@@ -846,7 +846,7 @@ void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<J
         return;
 
     TrackExceptionState exceptionState;
-    bool success = m_domAgent->history()->perform(adoptPtr(new SetPropertyTextAction(inspectorStyleSheet, compoundId, propertyIndex, text, overwrite)), exceptionState);
+    bool success = m_domAgent->history()->perform(adoptRef(new SetPropertyTextAction(inspectorStyleSheet, compoundId, propertyIndex, text, overwrite)), exceptionState);
     if (success)
         result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
     *errorString = InspectorDOMAgent::toErrorString(exceptionState);
@@ -862,7 +862,7 @@ void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<J
         return;
 
     TrackExceptionState exceptionState;
-    bool success = m_domAgent->history()->perform(adoptPtr(new SetRuleSelectorAction(inspectorStyleSheet, compoundId, selector)), exceptionState);
+    bool success = m_domAgent->history()->perform(adoptRef(new SetRuleSelectorAction(inspectorStyleSheet, compoundId, selector)), exceptionState);
 
     if (success) {
         CSSStyleRule* rule = inspectorStyleSheet->ruleForId(compoundId);
@@ -903,15 +903,14 @@ void InspectorCSSAgent::addRule(ErrorString* errorString, const String& styleShe
         return;
 
     TrackExceptionState exceptionState;
-    OwnPtr<AddRuleAction> action = adoptPtr(new AddRuleAction(inspectorStyleSheet, selector));
-    AddRuleAction* rawAction = action.get();
-    bool success = m_domAgent->history()->perform(action.release(), exceptionState);
+    RefPtr<AddRuleAction> action = adoptRef(new AddRuleAction(inspectorStyleSheet, selector));
+    bool success = m_domAgent->history()->perform(action, exceptionState);
     if (!success) {
         *errorString = InspectorDOMAgent::toErrorString(exceptionState);
         return;
     }
 
-    InspectorCSSId ruleId = rawAction->newRuleId();
+    InspectorCSSId ruleId = action->newRuleId();
     CSSStyleRule* rule = inspectorStyleSheet->ruleForId(ruleId);
     result = inspectorStyleSheet->buildObjectForRule(rule, buildMediaListChain(rule));
 }

third_party/WebKit/Source/core/inspector/InspectorHistory.cpp

@@ -77,13 +77,13 @@ String InspectorHistory::Action::mergeId()
     return "";
 }
 
-void InspectorHistory::Action::merge(PassOwnPtr<Action>)
+void InspectorHistory::Action::merge(PassRefPtr<Action>)
 {
 }
 
 InspectorHistory::InspectorHistory() : m_afterLastActionIndex(0) { }
 
-bool InspectorHistory::perform(PassOwnPtr<Action> action, ExceptionState& exceptionState)
+bool InspectorHistory::perform(PassRefPtr<Action> action, ExceptionState& exceptionState)
 {
     if (!action->perform(exceptionState))
         return false;
@@ -100,7 +100,7 @@ bool InspectorHistory::perform(PassOwnPtr<Action> action, ExceptionState& except
 
 void InspectorHistory::markUndoableState()
 {
-    perform(adoptPtr(new UndoableStateMark()), IGNORE_EXCEPTION);
+    perform(adoptRef(new UndoableStateMark()), IGNORE_EXCEPTION);
 }
 
 bool InspectorHistory::undo(ExceptionState& exceptionState)

third_party/WebKit/Source/core/inspector/InspectorHistory.h

@@ -31,7 +31,7 @@
 #ifndef InspectorHistory_h
 #define InspectorHistory_h
 
-#include "wtf/OwnPtr.h"
+#include "wtf/RefPtr.h"
 #include "wtf/Vector.h"
 #include "wtf/text/WTFString.h"
 
@@ -42,7 +42,7 @@ class ExceptionState;
 class InspectorHistory FINAL {
     WTF_MAKE_NONCOPYABLE(InspectorHistory); WTF_MAKE_FAST_ALLOCATED;
 public:
-    class Action {
+    class Action : public RefCounted<Action> {
         WTF_MAKE_FAST_ALLOCATED;
     public:
         Action(const String& name);
@@ -50,7 +50,7 @@ public:
         virtual String toString();
 
         virtual String mergeId();
-        virtual void merge(PassOwnPtr<Action>);
+        virtual void merge(PassRefPtr<Action>);
 
         virtual bool perform(ExceptionState&) = 0;
 
@@ -64,7 +64,7 @@ public:
 
     InspectorHistory();
 
-    bool perform(PassOwnPtr<Action>, ExceptionState&);
+    bool perform(PassRefPtr<Action>, ExceptionState&);
     void markUndoableState();
 
     bool undo(ExceptionState&);
@@ -72,7 +72,7 @@ public:
     void reset();
 
 private:
-    Vector<OwnPtr<Action> > m_history;
+    Vector<RefPtr<Action> > m_history;
     size_t m_afterLastActionIndex;
 };