<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[225855] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/225855">225855</a></dd>
<dt>Author</dt> <dd>zalan@apple.com</dd>
<dt>Date</dt> <dd>2017-12-13 10:43:05 -0800 (Wed, 13 Dec 2017)</dd>
</dl>

<h3>Log Message</h3>
<pre>ASSERT(LayoutDisallowedScope::isLayoutAllowed()) whenever hitting Enter in Web Inspector console
https://bugs.webkit.org/show_bug.cgi?id=180690

Reviewed by Simon Fraser.

Defer text replacement notification until after layout is done to avoid unexpected forced layouts.

Covered by existing tests.

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::disableAccessibility):
(WebCore::AXObjectCache::remove):
(WebCore::filterMapForRemoval):
(WebCore::filterListForRemoval):
(WebCore::AXObjectCache::prepareForDocumentDestruction):
(WebCore::AXObjectCache::performDeferredCacheUpdate):
(WebCore::AXObjectCache::deferTextReplacementNotificationForTextControl):
(WebCore::filterForRemoval): Deleted.
* accessibility/AXObjectCache.h: Need to use the base (Element) class since
we can't call is<HTMLTextFormControlElement> in Node d'tor.
(WebCore::AXObjectCache::deferTextReplacementNotificationForTextControl):
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::setInnerTextValue):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAXObjectCachecpp">trunk/Source/WebCore/accessibility/AXObjectCache.cpp</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAXObjectCacheh">trunk/Source/WebCore/accessibility/AXObjectCache.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTextFormControlElementcpp">trunk/Source/WebCore/html/HTMLTextFormControlElement.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (225854 => 225855)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog   2017-12-13 18:36:26 UTC (rev 225854)
+++ trunk/Source/WebCore/ChangeLog      2017-12-13 18:43:05 UTC (rev 225855)
</span><span class="lines">@@ -1,3 +1,29 @@
</span><ins>+2017-12-13  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERT(LayoutDisallowedScope::isLayoutAllowed()) whenever hitting Enter in Web Inspector console
+        https://bugs.webkit.org/show_bug.cgi?id=180690
+
+        Reviewed by Simon Fraser.
+
+        Defer text replacement notification until after layout is done to avoid unexpected forced layouts.
+
+        Covered by existing tests.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::disableAccessibility):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::filterMapForRemoval):
+        (WebCore::filterListForRemoval):
+        (WebCore::AXObjectCache::prepareForDocumentDestruction):
+        (WebCore::AXObjectCache::performDeferredCacheUpdate):
+        (WebCore::AXObjectCache::deferTextReplacementNotificationForTextControl):
+        (WebCore::filterForRemoval): Deleted.
+        * accessibility/AXObjectCache.h: Need to use the base (Element) class since
+        we can't call is<HTMLTextFormControlElement> in Node d'tor.
+        (WebCore::AXObjectCache::deferTextReplacementNotificationForTextControl):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::setInnerTextValue):
+
</ins><span class="cx"> 2017-12-13  Ryan Haddad  <ryanhaddad@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r225836.
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAXObjectCachecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (225854 => 225855)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp     2017-12-13 18:36:26 UTC (rev 225854)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp        2017-12-13 18:43:05 UTC (rev 225855)
</span><span class="lines">@@ -721,6 +721,7 @@
</span><span class="cx">     if (is<Element>(node)) {
</span><span class="cx">         m_deferredRecomputeIsIgnoredList.remove(downcast<Element>(&node));
</span><span class="cx">         m_deferredSelectedChildredChangedList.remove(downcast<Element>(&node));
</span><ins>+        m_deferredTextFormControlValue.remove(downcast<Element>(&node));
</ins><span class="cx">     }
</span><span class="cx">     m_deferredTextChangedList.remove(&node);
</span><span class="cx">     removeNodeForUse(node);
</span><span class="lines">@@ -2725,8 +2726,19 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template<typename T, typename U>
+static void filterMapForRemoval(const HashMap<T, U>& list, const Document& document, HashSet<Node*>& nodesToRemove)
+{
+    for (auto& entry : list) {
+        auto* node = entry.key;
+        if (node->isConnected() && &node->document() != &document)
+            continue;
+        nodesToRemove.add(node);
+    }
+}
+
</ins><span class="cx"> template<typename T>
</span><del>-static void filterForRemoval(const ListHashSet<T>& list, const Document& document, HashSet<Node*>& nodesToRemove)
</del><ins>+static void filterListForRemoval(const ListHashSet<T>& list, const Document& document, HashSet<Node*>& nodesToRemove)
</ins><span class="cx"> {
</span><span class="cx">     for (auto* node : list) {
</span><span class="cx">         if (node->isConnected() && &node->document() != &document)
</span><span class="lines">@@ -2738,11 +2750,12 @@
</span><span class="cx"> void AXObjectCache::prepareForDocumentDestruction(const Document& document)
</span><span class="cx"> {
</span><span class="cx">     HashSet<Node*> nodesToRemove;
</span><del>-    filterForRemoval(m_textMarkerNodes, document, nodesToRemove);
-    filterForRemoval(m_modalNodesSet, document, nodesToRemove);
-    filterForRemoval(m_deferredRecomputeIsIgnoredList, document, nodesToRemove);
-    filterForRemoval(m_deferredTextChangedList, document, nodesToRemove);
-    filterForRemoval(m_deferredSelectedChildredChangedList, document, nodesToRemove);
</del><ins>+    filterListForRemoval(m_textMarkerNodes, document, nodesToRemove);
+    filterListForRemoval(m_modalNodesSet, document, nodesToRemove);
+    filterListForRemoval(m_deferredRecomputeIsIgnoredList, document, nodesToRemove);
+    filterListForRemoval(m_deferredTextChangedList, document, nodesToRemove);
+    filterListForRemoval(m_deferredSelectedChildredChangedList, document, nodesToRemove);
+    filterMapForRemoval(m_deferredTextFormControlValue, document, nodesToRemove);
</ins><span class="cx"> 
</span><span class="cx">     for (auto* node : nodesToRemove)
</span><span class="cx">         remove(*node);
</span><span class="lines">@@ -2776,6 +2789,12 @@
</span><span class="cx">     for (auto* selectElement : m_deferredSelectedChildredChangedList)
</span><span class="cx">         selectedChildrenChanged(selectElement);
</span><span class="cx">     m_deferredSelectedChildredChangedList.clear();
</span><ins>+
+    for (auto& deferredFormControlContext : m_deferredTextFormControlValue) {
+        auto& textFormControlElement = downcast<HTMLTextFormControlElement>(*deferredFormControlContext.key);
+        postTextReplacementNotificationForTextControl(textFormControlElement, deferredFormControlContext.value, textFormControlElement.innerTextValue());
+    }
+    m_deferredTextFormControlValue.clear();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static bool rendererNeedsDeferredUpdate(RenderObject& renderer)
</span><span class="lines">@@ -2841,6 +2860,14 @@
</span><span class="cx">     selectedChildrenChanged(&selectElement);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void AXObjectCache::deferTextReplacementNotificationForTextControl(HTMLTextFormControlElement& formControlElement, const String& previousValue)
+{
+    auto* renderer = formControlElement.renderer();
+    if (!renderer)
+        return;
+    m_deferredTextFormControlValue.add(&formControlElement, previousValue);
+}
+
</ins><span class="cx"> bool isNodeAriaVisible(Node* node)
</span><span class="cx"> {
</span><span class="cx">     if (!node)
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAXObjectCacheh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AXObjectCache.h (225854 => 225855)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AXObjectCache.h       2017-12-13 18:36:26 UTC (rev 225854)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.h  2017-12-13 18:43:05 UTC (rev 225855)
</span><span class="lines">@@ -337,7 +337,8 @@
</span><span class="cx">     void deferTextChangedIfNeeded(Node*);
</span><span class="cx">     void deferSelectedChildrenChangedIfNeeded(Element&);
</span><span class="cx">     void performDeferredCacheUpdate();
</span><del>-    
</del><ins>+    void deferTextReplacementNotificationForTextControl(HTMLTextFormControlElement&, const String& previousValue);
+
</ins><span class="cx">     RefPtr<Range> rangeMatchesTextNearRange(RefPtr<Range>, const String&);
</span><span class="cx">     
</span><span class="cx"> 
</span><span class="lines">@@ -444,6 +445,7 @@
</span><span class="cx">     ListHashSet<Element*> m_deferredRecomputeIsIgnoredList;
</span><span class="cx">     ListHashSet<Node*> m_deferredTextChangedList;
</span><span class="cx">     ListHashSet<Element*> m_deferredSelectedChildredChangedList;
</span><ins>+    HashMap<Element*, String> m_deferredTextFormControlValue;
</ins><span class="cx">     bool m_isSynchronizingSelection { false };
</span><span class="cx">     bool m_performingDeferredCacheUpdate { false };
</span><span class="cx"> };
</span><span class="lines">@@ -496,6 +498,7 @@
</span><span class="cx"> inline void AXObjectCache::deferRecomputeIsIgnored(Element*) { }
</span><span class="cx"> inline void AXObjectCache::deferTextChangedIfNeeded(Node*) { }
</span><span class="cx"> inline void AXObjectCache::deferSelectedChildrenChangedIfNeeded(Element&) { }
</span><ins>+inline void AXObjectCache::deferTextReplacementNotificationForTextControl(HTMLTextFormControlElement&, const String&) { }
</ins><span class="cx"> inline void AXObjectCache::detachWrapper(AccessibilityObject*, AccessibilityDetachmentType) { }
</span><span class="cx"> inline void AXObjectCache::focusModalNodeTimerFired() { }
</span><span class="cx"> inline void AXObjectCache::frameLoadingEventNotification(Frame*, AXLoadingEvent) { }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTextFormControlElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTextFormControlElement.cpp (225854 => 225855)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTextFormControlElement.cpp 2017-12-13 18:36:26 UTC (rev 225854)
+++ trunk/Source/WebCore/html/HTMLTextFormControlElement.cpp    2017-12-13 18:43:05 UTC (rev 225855)
</span><span class="lines">@@ -576,7 +576,7 @@
</span><span class="cx"> #if HAVE(ACCESSIBILITY) && PLATFORM(COCOA)
</span><span class="cx">         if (textIsChanged && renderer()) {
</span><span class="cx">             if (AXObjectCache* cache = document().existingAXObjectCache())
</span><del>-                cache->postTextReplacementNotificationForTextControl(*this, previousValue, value);
</del><ins>+                cache->deferTextReplacementNotificationForTextControl(*this, previousValue);
</ins><span class="cx">         }
</span><span class="cx"> #endif
</span><span class="cx">     }
</span></span></pre>
</div>
</div>

</body>
</html>