1/*
2 * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
3 * Copyright (C) 2009, 2010, 2011 Google Inc. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
15 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
18 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
19 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
20 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
21 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
22 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
24 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "config.h"
28#include "ReplaceSelectionCommand.h"
29
30#include "ApplyStyleCommand.h"
31#include "BeforeTextInsertedEvent.h"
32#include "BreakBlockquoteCommand.h"
33#include "CSSPropertyNames.h"
34#include "CSSStyleDeclaration.h"
35#include "CSSValueKeywords.h"
36#include "Document.h"
37#include "DocumentFragment.h"
38#include "Element.h"
39#include "EventNames.h"
40#include "ExceptionCodePlaceholder.h"
41#include "Frame.h"
42#include "FrameSelection.h"
43#include "HTMLElement.h"
44#include "HTMLInputElement.h"
45#include "HTMLInterchange.h"
46#include "HTMLNames.h"
47#include "NodeList.h"
48#include "NodeRenderStyle.h"
49#include "NodeTraversal.h"
50#include "RenderInline.h"
51#include "RenderObject.h"
52#include "RenderText.h"
53#include "SimplifyMarkupCommand.h"
54#include "SmartReplace.h"
55#include "StylePropertySet.h"
56#include "Text.h"
57#include "TextIterator.h"
58#include "VisibleUnits.h"
59#include "htmlediting.h"
60#include "markup.h"
61#include <wtf/StdLibExtras.h>
62#include <wtf/Vector.h>
63
64namespace WebCore {
65
66using namespace HTMLNames;
67
68enum EFragmentType { EmptyFragment, SingleTextNodeFragment, TreeFragment };
69
70// --- ReplacementFragment helper class
71
72class ReplacementFragment {
73    WTF_MAKE_NONCOPYABLE(ReplacementFragment);
74public:
75    ReplacementFragment(Document*, DocumentFragment*, const VisibleSelection&);
76
77    Node* firstChild() const;
78    Node* lastChild() const;
79
80    bool isEmpty() const;
81
82    bool hasInterchangeNewlineAtStart() const { return m_hasInterchangeNewlineAtStart; }
83    bool hasInterchangeNewlineAtEnd() const { return m_hasInterchangeNewlineAtEnd; }
84
85    void removeNode(PassRefPtr<Node>);
86    void removeNodePreservingChildren(PassRefPtr<Node>);
87
88private:
89    PassRefPtr<StyledElement> insertFragmentForTestRendering(Node* rootEditableNode);
90    void removeUnrenderedNodes(Node*);
91    void restoreAndRemoveTestRenderingNodesToFragment(StyledElement*);
92    void removeInterchangeNodes(Node*);
93
94    void insertNodeBefore(PassRefPtr<Node> node, Node* refNode);
95
96    RefPtr<Document> m_document;
97    RefPtr<DocumentFragment> m_fragment;
98    bool m_hasInterchangeNewlineAtStart;
99    bool m_hasInterchangeNewlineAtEnd;
100};
101
102static bool isInterchangeNewlineNode(const Node *node)
103{
104    DEFINE_STATIC_LOCAL(String, interchangeNewlineClassString, (AppleInterchangeNewline));
105    return node && node->hasTagName(brTag) &&
106           static_cast<const Element *>(node)->getAttribute(classAttr) == interchangeNewlineClassString;
107}
108
109static bool isInterchangeConvertedSpaceSpan(const Node *node)
110{
111    DEFINE_STATIC_LOCAL(String, convertedSpaceSpanClassString, (AppleConvertedSpace));
112    return node->isHTMLElement() &&
113           static_cast<const HTMLElement *>(node)->getAttribute(classAttr) == convertedSpaceSpanClassString;
114}
115
116static Position positionAvoidingPrecedingNodes(Position pos)
117{
118    // If we're already on a break, it's probably a placeholder and we shouldn't change our position.
119    if (editingIgnoresContent(pos.deprecatedNode()))
120        return pos;
121
122    // We also stop when changing block flow elements because even though the visual position is the
123    // same.  E.g.,
124    //   <div>foo^</div>^
125    // The two positions above are the same visual position, but we want to stay in the same block.
126    Node* enclosingBlockNode = enclosingBlock(pos.containerNode());
127    for (Position nextPosition = pos; nextPosition.containerNode() != enclosingBlockNode; pos = nextPosition) {
128        if (lineBreakExistsAtPosition(pos))
129            break;
130
131        if (pos.containerNode()->nonShadowBoundaryParentNode())
132            nextPosition = positionInParentAfterNode(pos.containerNode());
133
134        if (nextPosition == pos
135            || enclosingBlock(nextPosition.containerNode()) != enclosingBlockNode
136            || VisiblePosition(pos) != VisiblePosition(nextPosition))
137            break;
138    }
139    return pos;
140}
141
142ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* fragment, const VisibleSelection& selection)
143    : m_document(document),
144      m_fragment(fragment),
145      m_hasInterchangeNewlineAtStart(false),
146      m_hasInterchangeNewlineAtEnd(false)
147{
148    if (!m_document)
149        return;
150    if (!m_fragment)
151        return;
152    if (!m_fragment->firstChild())
153        return;
154
155    RefPtr<Element> editableRoot = selection.rootEditableElement();
156    ASSERT(editableRoot);
157    if (!editableRoot)
158        return;
159
160    Node* shadowAncestorNode = editableRoot->deprecatedShadowAncestorNode();
161
162    if (!editableRoot->getAttributeEventListener(eventNames().webkitBeforeTextInsertedEvent) &&
163        // FIXME: Remove these checks once textareas and textfields actually register an event handler.
164        !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextControl()) &&
165        editableRoot->rendererIsRichlyEditable()) {
166        removeInterchangeNodes(m_fragment.get());
167        return;
168    }
169
170    RefPtr<StyledElement> holder = insertFragmentForTestRendering(editableRoot.get());
171    if (!holder) {
172        removeInterchangeNodes(m_fragment.get());
173        return;
174    }
175
176    RefPtr<Range> range = VisibleSelection::selectionFromContentsOfNode(holder.get()).toNormalizedRange();
177    String text = plainText(range.get(), static_cast<TextIteratorBehavior>(TextIteratorEmitsOriginalText | TextIteratorIgnoresStyleVisibility));
178
179    removeInterchangeNodes(holder.get());
180    removeUnrenderedNodes(holder.get());
181    restoreAndRemoveTestRenderingNodesToFragment(holder.get());
182
183    // Give the root a chance to change the text.
184    RefPtr<BeforeTextInsertedEvent> evt = BeforeTextInsertedEvent::create(text);
185    editableRoot->dispatchEvent(evt, ASSERT_NO_EXCEPTION);
186    if (text != evt->text() || !editableRoot->rendererIsRichlyEditable()) {
187        restoreAndRemoveTestRenderingNodesToFragment(holder.get());
188
189        m_fragment = createFragmentFromText(selection.toNormalizedRange().get(), evt->text());
190        if (!m_fragment->firstChild())
191            return;
192
193        holder = insertFragmentForTestRendering(editableRoot.get());
194        removeInterchangeNodes(holder.get());
195        removeUnrenderedNodes(holder.get());
196        restoreAndRemoveTestRenderingNodesToFragment(holder.get());
197    }
198}
199
200bool ReplacementFragment::isEmpty() const
201{
202    return (!m_fragment || !m_fragment->firstChild()) && !m_hasInterchangeNewlineAtStart && !m_hasInterchangeNewlineAtEnd;
203}
204
205Node *ReplacementFragment::firstChild() const
206{
207    return m_fragment ? m_fragment->firstChild() : 0;
208}
209
210Node *ReplacementFragment::lastChild() const
211{
212    return m_fragment ? m_fragment->lastChild() : 0;
213}
214
215void ReplacementFragment::removeNodePreservingChildren(PassRefPtr<Node> node)
216{
217    if (!node)
218        return;
219
220    while (RefPtr<Node> n = node->firstChild()) {
221        removeNode(n);
222        insertNodeBefore(n.release(), node.get());
223    }
224    removeNode(node);
225}
226
227void ReplacementFragment::removeNode(PassRefPtr<Node> node)
228{
229    if (!node)
230        return;
231
232    ContainerNode* parent = node->nonShadowBoundaryParentNode();
233    if (!parent)
234        return;
235
236    parent->removeChild(node.get(), ASSERT_NO_EXCEPTION);
237}
238
239void ReplacementFragment::insertNodeBefore(PassRefPtr<Node> node, Node* refNode)
240{
241    if (!node || !refNode)
242        return;
243
244    ContainerNode* parent = refNode->nonShadowBoundaryParentNode();
245    if (!parent)
246        return;
247
248    parent->insertBefore(node, refNode, ASSERT_NO_EXCEPTION);
249}
250
251PassRefPtr<StyledElement> ReplacementFragment::insertFragmentForTestRendering(Node* rootEditableElement)
252{
253    RefPtr<StyledElement> holder = createDefaultParagraphElement(m_document.get());
254
255    holder->appendChild(m_fragment, ASSERT_NO_EXCEPTION);
256    rootEditableElement->appendChild(holder.get(), ASSERT_NO_EXCEPTION);
257    m_document->updateLayoutIgnorePendingStylesheets();
258
259    return holder.release();
260}
261
262void ReplacementFragment::restoreAndRemoveTestRenderingNodesToFragment(StyledElement* holder)
263{
264    if (!holder)
265        return;
266
267    while (RefPtr<Node> node = holder->firstChild()) {
268        holder->removeChild(node.get(), ASSERT_NO_EXCEPTION);
269        m_fragment->appendChild(node.get(), ASSERT_NO_EXCEPTION);
270    }
271
272    removeNode(holder);
273}
274
275void ReplacementFragment::removeUnrenderedNodes(Node* holder)
276{
277    Vector<RefPtr<Node> > unrendered;
278
279    for (Node* node = holder->firstChild(); node; node = NodeTraversal::next(node, holder))
280        if (!isNodeRendered(node) && !isTableStructureNode(node))
281            unrendered.append(node);
282
283    size_t n = unrendered.size();
284    for (size_t i = 0; i < n; ++i)
285        removeNode(unrendered[i]);
286}
287
288void ReplacementFragment::removeInterchangeNodes(Node* container)
289{
290    m_hasInterchangeNewlineAtStart = false;
291    m_hasInterchangeNewlineAtEnd = false;
292
293    // Interchange newlines at the "start" of the incoming fragment must be
294    // either the first node in the fragment or the first leaf in the fragment.
295    Node* node = container->firstChild();
296    while (node) {
297        if (isInterchangeNewlineNode(node)) {
298            m_hasInterchangeNewlineAtStart = true;
299            removeNode(node);
300            break;
301        }
302        node = node->firstChild();
303    }
304    if (!container->hasChildNodes())
305        return;
306    // Interchange newlines at the "end" of the incoming fragment must be
307    // either the last node in the fragment or the last leaf in the fragment.
308    node = container->lastChild();
309    while (node) {
310        if (isInterchangeNewlineNode(node)) {
311            m_hasInterchangeNewlineAtEnd = true;
312            removeNode(node);
313            break;
314        }
315        node = node->lastChild();
316    }
317
318    node = container->firstChild();
319    while (node) {
320        RefPtr<Node> next = NodeTraversal::next(node);
321        if (isInterchangeConvertedSpaceSpan(node)) {
322            next = NodeTraversal::nextSkippingChildren(node);
323            removeNodePreservingChildren(node);
324        }
325        node = next.get();
326    }
327}
328
329inline void ReplaceSelectionCommand::InsertedNodes::respondToNodeInsertion(Node* node)
330{
331    if (!node)
332        return;
333
334    if (!m_firstNodeInserted)
335        m_firstNodeInserted = node;
336
337    m_lastNodeInserted = node;
338}
339
340inline void ReplaceSelectionCommand::InsertedNodes::willRemoveNodePreservingChildren(Node* node)
341{
342    if (m_firstNodeInserted == node)
343        m_firstNodeInserted = NodeTraversal::next(node);
344    if (m_lastNodeInserted == node)
345        m_lastNodeInserted = node->lastChild() ? node->lastChild() : NodeTraversal::nextSkippingChildren(node);
346}
347
348inline void ReplaceSelectionCommand::InsertedNodes::willRemoveNode(Node* node)
349{
350    if (m_firstNodeInserted == node && m_lastNodeInserted == node) {
351        m_firstNodeInserted = 0;
352        m_lastNodeInserted = 0;
353    } else if (m_firstNodeInserted == node)
354        m_firstNodeInserted = NodeTraversal::nextSkippingChildren(m_firstNodeInserted.get());
355    else if (m_lastNodeInserted == node)
356        m_lastNodeInserted = NodeTraversal::previousSkippingChildren(m_lastNodeInserted.get());
357}
358
359inline void ReplaceSelectionCommand::InsertedNodes::didReplaceNode(Node* node, Node* newNode)
360{
361    if (m_firstNodeInserted == node)
362        m_firstNodeInserted = newNode;
363    if (m_lastNodeInserted == node)
364        m_lastNodeInserted = newNode;
365}
366
367ReplaceSelectionCommand::ReplaceSelectionCommand(Document* document, PassRefPtr<DocumentFragment> fragment, CommandOptions options, EditAction editAction)
368    : CompositeEditCommand(document)
369    , m_selectReplacement(options & SelectReplacement)
370    , m_smartReplace(options & SmartReplace)
371    , m_matchStyle(options & MatchStyle)
372    , m_documentFragment(fragment)
373    , m_preventNesting(options & PreventNesting)
374    , m_movingParagraph(options & MovingParagraph)
375    , m_editAction(editAction)
376    , m_sanitizeFragment(options & SanitizeFragment)
377    , m_shouldMergeEnd(false)
378{
379}
380
381static bool hasMatchingQuoteLevel(VisiblePosition endOfExistingContent, VisiblePosition endOfInsertedContent)
382{
383    Position existing = endOfExistingContent.deepEquivalent();
384    Position inserted = endOfInsertedContent.deepEquivalent();
385    bool isInsideMailBlockquote = enclosingNodeOfType(inserted, isMailBlockquote, CanCrossEditingBoundary);
386    return isInsideMailBlockquote && (numEnclosingMailBlockquotes(existing) == numEnclosingMailBlockquotes(inserted));
387}
388
389bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfParagraph, bool fragmentHasInterchangeNewlineAtStart, bool selectionStartWasInsideMailBlockquote)
390{
391    if (m_movingParagraph)
392        return false;
393
394    VisiblePosition startOfInsertedContent(positionAtStartOfInsertedContent());
395    VisiblePosition prev = startOfInsertedContent.previous(CannotCrossEditingBoundary);
396    if (prev.isNull())
397        return false;
398
399    // When we have matching quote levels, its ok to merge more frequently.
400    // For a successful merge, we still need to make sure that the inserted content starts with the beginning of a paragraph.
401    // And we should only merge here if the selection start was inside a mail blockquote.  This prevents against removing a
402    // blockquote from newly pasted quoted content that was pasted into an unquoted position.  If that unquoted position happens
403    // to be right after another blockquote, we don't want to merge and risk stripping a valid block (and newline) from the pasted content.
404    if (isStartOfParagraph(startOfInsertedContent) && selectionStartWasInsideMailBlockquote && hasMatchingQuoteLevel(prev, positionAtEndOfInsertedContent()))
405        return true;
406
407    return !selectionStartWasStartOfParagraph
408        && !fragmentHasInterchangeNewlineAtStart
409        && isStartOfParagraph(startOfInsertedContent)
410        && !startOfInsertedContent.deepEquivalent().deprecatedNode()->hasTagName(brTag)
411        && shouldMerge(startOfInsertedContent, prev);
412}
413
414bool ReplaceSelectionCommand::shouldMergeEnd(bool selectionEndWasEndOfParagraph)
415{
416    VisiblePosition endOfInsertedContent(positionAtEndOfInsertedContent());
417    VisiblePosition next = endOfInsertedContent.next(CannotCrossEditingBoundary);
418    if (next.isNull())
419        return false;
420
421    return !selectionEndWasEndOfParagraph
422        && isEndOfParagraph(endOfInsertedContent)
423        && !endOfInsertedContent.deepEquivalent().deprecatedNode()->hasTagName(brTag)
424        && shouldMerge(endOfInsertedContent, next);
425}
426
427static bool isMailPasteAsQuotationNode(const Node* node)
428{
429    return node && node->hasTagName(blockquoteTag) && node->isElementNode() && toElement(node)->getAttribute(classAttr) == ApplePasteAsQuotation;
430}
431
432static bool isHeaderElement(const Node* a)
433{
434    if (!a)
435        return false;
436
437    return a->hasTagName(h1Tag)
438        || a->hasTagName(h2Tag)
439        || a->hasTagName(h3Tag)
440        || a->hasTagName(h4Tag)
441        || a->hasTagName(h5Tag)
442        || a->hasTagName(h6Tag);
443}
444
445static bool haveSameTagName(Node* a, Node* b)
446{
447    return a && b && a->isElementNode() && b->isElementNode() && toElement(a)->tagName() == toElement(b)->tagName();
448}
449
450bool ReplaceSelectionCommand::shouldMerge(const VisiblePosition& source, const VisiblePosition& destination)
451{
452    if (source.isNull() || destination.isNull())
453        return false;
454
455    Node* sourceNode = source.deepEquivalent().deprecatedNode();
456    Node* destinationNode = destination.deepEquivalent().deprecatedNode();
457    Node* sourceBlock = enclosingBlock(sourceNode);
458    Node* destinationBlock = enclosingBlock(destinationNode);
459    return !enclosingNodeOfType(source.deepEquivalent(), &isMailPasteAsQuotationNode) &&
460           sourceBlock && (!sourceBlock->hasTagName(blockquoteTag) || isMailBlockquote(sourceBlock))  &&
461           enclosingListChild(sourceBlock) == enclosingListChild(destinationNode) &&
462           enclosingTableCell(source.deepEquivalent()) == enclosingTableCell(destination.deepEquivalent()) &&
463           (!isHeaderElement(sourceBlock) || haveSameTagName(sourceBlock, destinationBlock)) &&
464           // Don't merge to or from a position before or after a block because it would
465           // be a no-op and cause infinite recursion.
466           !isBlock(sourceNode) && !isBlock(destinationNode);
467}
468
469// Style rules that match just inserted elements could change their appearance, like
470// a div inserted into a document with div { display:inline; }.
471void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(InsertedNodes& insertedNodes)
472{
473    RefPtr<Node> pastEndNode = insertedNodes.pastLastLeaf();
474    RefPtr<Node> next;
475    for (RefPtr<Node> node = insertedNodes.firstNodeInserted(); node && node != pastEndNode; node = next) {
476        // FIXME: <rdar://problem/5371536> Style rules that match pasted content can change it's appearance
477
478        next = NodeTraversal::next(node.get());
479        if (!node->isStyledElement())
480            continue;
481
482        StyledElement* element = static_cast<StyledElement*>(node.get());
483
484        const StylePropertySet* inlineStyle = element->inlineStyle();
485        RefPtr<EditingStyle> newInlineStyle = EditingStyle::create(inlineStyle);
486        if (inlineStyle) {
487            if (element->isHTMLElement()) {
488                Vector<QualifiedName> attributes;
489                HTMLElement* htmlElement = toHTMLElement(element);
490
491                if (newInlineStyle->conflictsWithImplicitStyleOfElement(htmlElement)) {
492                    // e.g. <b style="font-weight: normal;"> is converted to <span style="font-weight: normal;">
493                    node = replaceElementWithSpanPreservingChildrenAndAttributes(htmlElement);
494                    element = static_cast<StyledElement*>(node.get());
495                    insertedNodes.didReplaceNode(htmlElement, node.get());
496                } else if (newInlineStyle->extractConflictingImplicitStyleOfAttributes(htmlElement, EditingStyle::PreserveWritingDirection, 0, attributes,
497                    EditingStyle::DoNotExtractMatchingStyle)) {
498                    // e.g. <font size="3" style="font-size: 20px;"> is converted to <font style="font-size: 20px;">
499                    for (size_t i = 0; i < attributes.size(); i++)
500                        removeNodeAttribute(element, attributes[i]);
501                }
502            }
503
504            ContainerNode* context = element->parentNode();
505
506            // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
507            // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
508            Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : enclosingNodeOfType(firstPositionInNode(context), isMailBlockquote, CanCrossEditingBoundary);
509            if (blockquoteNode)
510                newInlineStyle->removeStyleFromRulesAndContext(element, document()->documentElement());
511
512            newInlineStyle->removeStyleFromRulesAndContext(element, context);
513        }
514
515        if (!inlineStyle || newInlineStyle->isEmpty()) {
516            if (isStyleSpanOrSpanWithOnlyStyleAttribute(element) || isEmptyFontTag(element, AllowNonEmptyStyleAttribute)) {
517                insertedNodes.willRemoveNodePreservingChildren(element);
518                removeNodePreservingChildren(element);
519                continue;
520            }
521            removeNodeAttribute(element, styleAttr);
522        } else if (newInlineStyle->style()->propertyCount() != inlineStyle->propertyCount())
523            setNodeAttribute(element, styleAttr, newInlineStyle->style()->asText());
524
525        // FIXME: Tolerate differences in id, class, and style attributes.
526        if (isNonTableCellHTMLBlockElement(element) && areIdenticalElements(element, element->parentNode())
527            && VisiblePosition(firstPositionInNode(element->parentNode())) == VisiblePosition(firstPositionInNode(element))
528            && VisiblePosition(lastPositionInNode(element->parentNode())) == VisiblePosition(lastPositionInNode(element))) {
529            insertedNodes.willRemoveNodePreservingChildren(element);
530            removeNodePreservingChildren(element);
531            continue;
532        }
533
534        if (element->parentNode()->rendererIsRichlyEditable())
535            removeNodeAttribute(element, contenteditableAttr);
536
537        // WebKit used to not add display: inline and float: none on copy.
538        // Keep this code around for backward compatibility
539        if (isLegacyAppleStyleSpan(element)) {
540            if (!element->firstChild()) {
541                insertedNodes.willRemoveNodePreservingChildren(element);
542                removeNodePreservingChildren(element);
543                continue;
544            }
545            // There are other styles that style rules can give to style spans,
546            // but these are the two important ones because they'll prevent
547            // inserted content from appearing in the right paragraph.
548            // FIXME: Hyatt is concerned that selectively using display:inline will give inconsistent
549            // results. We already know one issue because td elements ignore their display property
550            // in quirks mode (which Mail.app is always in). We should look for an alternative.
551
552            // Mutate using the CSSOM wrapper so we get the same event behavior as a script.
553            if (isBlock(element))
554                element->style()->setPropertyInternal(CSSPropertyDisplay, "inline", false, IGNORE_EXCEPTION);
555            if (element->renderer() && element->renderer()->style()->isFloating())
556                element->style()->setPropertyInternal(CSSPropertyFloat, "none", false, IGNORE_EXCEPTION);
557        }
558    }
559}
560
561static bool isProhibitedParagraphChild(const AtomicString& name)
562{
563    // https://dvcs.w3.org/hg/editing/raw-file/57abe6d3cb60/editing.html#prohibited-paragraph-child
564    DEFINE_STATIC_LOCAL(HashSet<AtomicString>, elements, ());
565    if (elements.isEmpty()) {
566        elements.add(addressTag.localName());
567        elements.add(articleTag.localName());
568        elements.add(asideTag.localName());
569        elements.add(blockquoteTag.localName());
570        elements.add(captionTag.localName());
571        elements.add(centerTag.localName());
572        elements.add(colTag.localName());
573        elements.add(colgroupTag.localName());
574        elements.add(ddTag.localName());
575        elements.add(detailsTag.localName());
576        elements.add(dirTag.localName());
577        elements.add(divTag.localName());
578        elements.add(dlTag.localName());
579        elements.add(dtTag.localName());
580        elements.add(fieldsetTag.localName());
581        elements.add(figcaptionTag.localName());
582        elements.add(figureTag.localName());
583        elements.add(footerTag.localName());
584        elements.add(formTag.localName());
585        elements.add(h1Tag.localName());
586        elements.add(h2Tag.localName());
587        elements.add(h3Tag.localName());
588        elements.add(h4Tag.localName());
589        elements.add(h5Tag.localName());
590        elements.add(h6Tag.localName());
591        elements.add(headerTag.localName());
592        elements.add(hgroupTag.localName());
593        elements.add(hrTag.localName());
594        elements.add(liTag.localName());
595        elements.add(listingTag.localName());
596        elements.add(mainTag.localName()); // Missing in the specification.
597        elements.add(menuTag.localName());
598        elements.add(navTag.localName());
599        elements.add(olTag.localName());
600        elements.add(pTag.localName());
601        elements.add(plaintextTag.localName());
602        elements.add(preTag.localName());
603        elements.add(sectionTag.localName());
604        elements.add(summaryTag.localName());
605        elements.add(tableTag.localName());
606        elements.add(tbodyTag.localName());
607        elements.add(tdTag.localName());
608        elements.add(tfootTag.localName());
609        elements.add(thTag.localName());
610        elements.add(theadTag.localName());
611        elements.add(trTag.localName());
612        elements.add(ulTag.localName());
613        elements.add(xmpTag.localName());
614    }
615    return elements.contains(name);
616}
617
618void ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder(InsertedNodes& insertedNodes)
619{
620    RefPtr<Node> pastEndNode = insertedNodes.pastLastLeaf();
621    RefPtr<Node> next;
622    for (RefPtr<Node> node = insertedNodes.firstNodeInserted(); node && node != pastEndNode; node = next) {
623        next = NodeTraversal::next(node.get());
624
625        if (!node->isHTMLElement())
626            continue;
627
628        if (isProhibitedParagraphChild(toHTMLElement(node.get())->localName())) {
629            if (HTMLElement* paragraphElement = toHTMLElement(enclosingNodeWithTag(positionInParentBeforeNode(node.get()), pTag)))
630                moveNodeOutOfAncestor(node, paragraphElement);
631        }
632
633        if (isHeaderElement(node.get())) {
634            if (HTMLElement* headerElement = static_cast<HTMLElement*>(highestEnclosingNodeOfType(positionInParentBeforeNode(node.get()), isHeaderElement)))
635                moveNodeOutOfAncestor(node, headerElement);
636        }
637    }
638}
639
640void ReplaceSelectionCommand::moveNodeOutOfAncestor(PassRefPtr<Node> prpNode, PassRefPtr<Node> prpAncestor)
641{
642    RefPtr<Node> node = prpNode;
643    RefPtr<Node> ancestor = prpAncestor;
644
645    VisiblePosition positionAtEndOfNode = lastPositionInOrAfterNode(node.get());
646    VisiblePosition lastPositionInParagraph = lastPositionInNode(ancestor.get());
647    if (positionAtEndOfNode == lastPositionInParagraph) {
648        removeNode(node);
649        if (ancestor->nextSibling())
650            insertNodeBefore(node, ancestor->nextSibling());
651        else
652            appendNode(node, ancestor->parentNode());
653    } else {
654        RefPtr<Node> nodeToSplitTo = splitTreeToNode(node.get(), ancestor.get(), true);
655        removeNode(node);
656        insertNodeBefore(node, nodeToSplitTo);
657    }
658    if (!ancestor->firstChild())
659        removeNode(ancestor.release());
660}
661
662static inline bool nodeHasVisibleRenderText(Text* text)
663{
664    return text->renderer() && toRenderText(text->renderer())->renderedTextLength() > 0;
665}
666
667void ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds(InsertedNodes& insertedNodes)
668{
669    document()->updateLayoutIgnorePendingStylesheets();
670
671    Node* lastLeafInserted = insertedNodes.lastLeafInserted();
672    if (lastLeafInserted && lastLeafInserted->isTextNode() && !nodeHasVisibleRenderText(toText(lastLeafInserted))
673        && !enclosingNodeWithTag(firstPositionInOrBeforeNode(lastLeafInserted), selectTag)
674        && !enclosingNodeWithTag(firstPositionInOrBeforeNode(lastLeafInserted), scriptTag)) {
675        insertedNodes.willRemoveNode(lastLeafInserted);
676        removeNode(lastLeafInserted);
677    }
678
679    // We don't have to make sure that firstNodeInserted isn't inside a select or script element
680    // because it is a top level node in the fragment and the user can't insert into those elements.
681    Node* firstNodeInserted = insertedNodes.firstNodeInserted();
682    if (firstNodeInserted && firstNodeInserted->isTextNode() && !nodeHasVisibleRenderText(toText(firstNodeInserted))) {
683        insertedNodes.willRemoveNode(firstNodeInserted);
684        removeNode(firstNodeInserted);
685    }
686}
687
688VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent() const
689{
690    // FIXME: Why is this hack here?  What's special about <select> tags?
691    Node* enclosingSelect = enclosingNodeWithTag(m_endOfInsertedContent, selectTag);
692    return enclosingSelect ? lastPositionInOrAfterNode(enclosingSelect) : m_endOfInsertedContent;
693}
694
695VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent() const
696{
697    return m_startOfInsertedContent;
698}
699
700static void removeHeadContents(ReplacementFragment& fragment)
701{
702    Node* next = 0;
703    for (Node* node = fragment.firstChild(); node; node = next) {
704        if (node->hasTagName(baseTag)
705            || node->hasTagName(linkTag)
706            || node->hasTagName(metaTag)
707            || node->hasTagName(styleTag)
708            || node->hasTagName(titleTag)) {
709            next = NodeTraversal::nextSkippingChildren(node);
710            fragment.removeNode(node);
711        } else
712            next = NodeTraversal::next(node);
713    }
714}
715
716// Remove style spans before insertion if they are unnecessary.  It's faster because we'll
717// avoid doing a layout.
718static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const Position& insertionPos)
719{
720    Node* topNode = fragment.firstChild();
721
722    // Handling the case where we are doing Paste as Quotation or pasting into quoted content is more complicated (see handleStyleSpans)
723    // and doesn't receive the optimization.
724    if (isMailPasteAsQuotationNode(topNode) || enclosingNodeOfType(firstPositionInOrBeforeNode(topNode), isMailBlockquote, CanCrossEditingBoundary))
725        return false;
726
727    // Either there are no style spans in the fragment or a WebKit client has added content to the fragment
728    // before inserting it.  Look for and handle style spans after insertion.
729    if (!isLegacyAppleStyleSpan(topNode))
730        return false;
731
732    Node* wrappingStyleSpan = topNode;
733    RefPtr<EditingStyle> styleAtInsertionPos = EditingStyle::create(insertionPos.parentAnchoredEquivalent());
734    String styleText = styleAtInsertionPos->style()->asText();
735
736    // FIXME: This string comparison is a naive way of comparing two styles.
737    // We should be taking the diff and check that the diff is empty.
738    if (styleText != toElement(wrappingStyleSpan)->getAttribute(styleAttr))
739        return false;
740
741    fragment.removeNodePreservingChildren(wrappingStyleSpan);
742    return true;
743}
744
745// At copy time, WebKit wraps copied content in a span that contains the source document's
746// default styles.  If the copied Range inherits any other styles from its ancestors, we put
747// those styles on a second span.
748// This function removes redundant styles from those spans, and removes the spans if all their
749// styles are redundant.
750// We should remove the Apple-style-span class when we're done, see <rdar://problem/5685600>.
751// We should remove styles from spans that are overridden by all of their children, either here
752// or at copy time.
753void ReplaceSelectionCommand::handleStyleSpans(InsertedNodes& insertedNodes)
754{
755    HTMLElement* wrappingStyleSpan = 0;
756    // The style span that contains the source document's default style should be at
757    // the top of the fragment, but Mail sometimes adds a wrapper (for Paste As Quotation),
758    // so search for the top level style span instead of assuming it's at the top.
759    for (Node* node = insertedNodes.firstNodeInserted(); node; node = NodeTraversal::next(node)) {
760        if (isLegacyAppleStyleSpan(node)) {
761            wrappingStyleSpan = toHTMLElement(node);
762            break;
763        }
764    }
765
766    // There might not be any style spans if we're pasting from another application or if
767    // we are here because of a document.execCommand("InsertHTML", ...) call.
768    if (!wrappingStyleSpan)
769        return;
770
771    RefPtr<EditingStyle> style = EditingStyle::create(wrappingStyleSpan->inlineStyle());
772    ContainerNode* context = wrappingStyleSpan->parentNode();
773
774    // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
775    // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
776    Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : enclosingNodeOfType(firstPositionInNode(context), isMailBlockquote, CanCrossEditingBoundary);
777    if (blockquoteNode)
778        context = document()->documentElement();
779
780    // This operation requires that only editing styles to be removed from sourceDocumentStyle.
781    style->prepareToApplyAt(firstPositionInNode(context));
782
783    // Remove block properties in the span's style. This prevents properties that probably have no effect
784    // currently from affecting blocks later if the style is cloned for a new block element during a future
785    // editing operation.
786    // FIXME: They *can* have an effect currently if blocks beneath the style span aren't individually marked
787    // with block styles by the editing engine used to style them.  WebKit doesn't do this, but others might.
788    style->removeBlockProperties();
789
790    if (style->isEmpty() || !wrappingStyleSpan->firstChild()) {
791        insertedNodes.willRemoveNodePreservingChildren(wrappingStyleSpan);
792        removeNodePreservingChildren(wrappingStyleSpan);
793    } else
794        setNodeAttribute(wrappingStyleSpan, styleAttr, style->style()->asText());
795}
796
797void ReplaceSelectionCommand::mergeEndIfNeeded()
798{
799    if (!m_shouldMergeEnd)
800        return;
801
802    VisiblePosition startOfInsertedContent(positionAtStartOfInsertedContent());
803    VisiblePosition endOfInsertedContent(positionAtEndOfInsertedContent());
804
805    // Bail to avoid infinite recursion.
806    if (m_movingParagraph) {
807        ASSERT_NOT_REACHED();
808        return;
809    }
810
811    // Merging two paragraphs will destroy the moved one's block styles.  Always move the end of inserted forward
812    // to preserve the block style of the paragraph already in the document, unless the paragraph to move would
813    // include the what was the start of the selection that was pasted into, so that we preserve that paragraph's
814    // block styles.
815    bool mergeForward = !(inSameParagraph(startOfInsertedContent, endOfInsertedContent) && !isStartOfParagraph(startOfInsertedContent));
816
817    VisiblePosition destination = mergeForward ? endOfInsertedContent.next() : endOfInsertedContent;
818    VisiblePosition startOfParagraphToMove = mergeForward ? startOfParagraph(endOfInsertedContent) : endOfInsertedContent.next();
819
820    // Merging forward could result in deleting the destination anchor node.
821    // To avoid this, we add a placeholder node before the start of the paragraph.
822    if (endOfParagraph(startOfParagraphToMove) == destination) {
823        RefPtr<Node> placeholder = createBreakElement(document());
824        insertNodeBefore(placeholder, startOfParagraphToMove.deepEquivalent().deprecatedNode());
825        destination = VisiblePosition(positionBeforeNode(placeholder.get()));
826    }
827
828    moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
829
830    // Merging forward will remove m_endOfInsertedContent from the document.
831    if (mergeForward) {
832        if (m_startOfInsertedContent.isOrphan())
833            m_startOfInsertedContent = endingSelection().visibleStart().deepEquivalent();
834         m_endOfInsertedContent = endingSelection().visibleEnd().deepEquivalent();
835        // If we merged text nodes, m_endOfInsertedContent could be null. If this is the case, we use m_startOfInsertedContent.
836        if (m_endOfInsertedContent.isNull())
837            m_endOfInsertedContent = m_startOfInsertedContent;
838    }
839}
840
841static Node* enclosingInline(Node* node)
842{
843    while (ContainerNode* parent = node->parentNode()) {
844        if (isBlockFlowElement(parent) || parent->hasTagName(bodyTag))
845            return node;
846        // Stop if any previous sibling is a block.
847        for (Node* sibling = node->previousSibling(); sibling; sibling = sibling->previousSibling()) {
848            if (isBlockFlowElement(sibling))
849                return node;
850        }
851        node = parent;
852    }
853    return node;
854}
855
856static bool isInlineNodeWithStyle(const Node* node)
857{
858    // We don't want to skip over any block elements.
859    if (isBlock(node))
860        return false;
861
862    if (!node->isHTMLElement())
863        return false;
864
865    // We can skip over elements whose class attribute is
866    // one of our internal classes.
867    const HTMLElement* element = static_cast<const HTMLElement*>(node);
868    const AtomicString& classAttributeValue = element->getAttribute(classAttr);
869    if (classAttributeValue == AppleTabSpanClass
870        || classAttributeValue == AppleConvertedSpace
871        || classAttributeValue == ApplePasteAsQuotation)
872        return true;
873
874    return EditingStyle::elementIsStyledSpanOrHTMLEquivalent(element);
875}
876
877inline Node* nodeToSplitToAvoidPastingIntoInlineNodesWithStyle(const Position& insertionPos)
878{
879    Node* containgBlock = enclosingBlock(insertionPos.containerNode());
880    return highestEnclosingNodeOfType(insertionPos, isInlineNodeWithStyle, CannotCrossEditingBoundary, containgBlock);
881}
882
883void ReplaceSelectionCommand::doApply()
884{
885    VisibleSelection selection = endingSelection();
886    ASSERT(selection.isCaretOrRange());
887    ASSERT(selection.start().deprecatedNode());
888    if (!selection.isNonOrphanedCaretOrRange() || !selection.start().deprecatedNode())
889        return;
890
891    if (!selection.rootEditableElement())
892        return;
893
894    ReplacementFragment fragment(document(), m_documentFragment.get(), selection);
895    if (performTrivialReplace(fragment))
896        return;
897
898    // We can skip matching the style if the selection is plain text.
899    if ((selection.start().deprecatedNode()->renderer() && selection.start().deprecatedNode()->renderer()->style()->userModify() == READ_WRITE_PLAINTEXT_ONLY)
900        && (selection.end().deprecatedNode()->renderer() && selection.end().deprecatedNode()->renderer()->style()->userModify() == READ_WRITE_PLAINTEXT_ONLY))
901        m_matchStyle = false;
902
903    if (m_matchStyle) {
904        m_insertionStyle = EditingStyle::create(selection.start());
905        m_insertionStyle->mergeTypingStyle(document());
906    }
907
908    VisiblePosition visibleStart = selection.visibleStart();
909    VisiblePosition visibleEnd = selection.visibleEnd();
910
911    bool selectionEndWasEndOfParagraph = isEndOfParagraph(visibleEnd);
912    bool selectionStartWasStartOfParagraph = isStartOfParagraph(visibleStart);
913
914    Node* startBlock = enclosingBlock(visibleStart.deepEquivalent().deprecatedNode());
915
916    Position insertionPos = selection.start();
917    bool startIsInsideMailBlockquote = enclosingNodeOfType(insertionPos, isMailBlockquote, CanCrossEditingBoundary);
918    bool selectionIsPlainText = !selection.isContentRichlyEditable();
919    Element* currentRoot = selection.rootEditableElement();
920
921    if ((selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote) ||
922        startBlock == currentRoot || isListItem(startBlock) || selectionIsPlainText)
923        m_preventNesting = false;
924
925    if (selection.isRange()) {
926        // When the end of the selection being pasted into is at the end of a paragraph, and that selection
927        // spans multiple blocks, not merging may leave an empty line.
928        // When the start of the selection being pasted into is at the start of a block, not merging
929        // will leave hanging block(s).
930        // Merge blocks if the start of the selection was in a Mail blockquote, since we handle
931        // that case specially to prevent nesting.
932        bool mergeBlocksAfterDelete = startIsInsideMailBlockquote || isEndOfParagraph(visibleEnd) || isStartOfBlock(visibleStart);
933        // FIXME: We should only expand to include fully selected special elements if we are copying a
934        // selection and pasting it on top of itself.
935        deleteSelection(false, mergeBlocksAfterDelete, true, false);
936        visibleStart = endingSelection().visibleStart();
937        if (fragment.hasInterchangeNewlineAtStart()) {
938            if (isEndOfParagraph(visibleStart) && !isStartOfParagraph(visibleStart)) {
939                if (!isEndOfEditableOrNonEditableContent(visibleStart))
940                    setEndingSelection(visibleStart.next());
941            } else
942                insertParagraphSeparator();
943        }
944        insertionPos = endingSelection().start();
945    } else {
946        ASSERT(selection.isCaret());
947        if (fragment.hasInterchangeNewlineAtStart()) {
948            VisiblePosition next = visibleStart.next(CannotCrossEditingBoundary);
949            if (isEndOfParagraph(visibleStart) && !isStartOfParagraph(visibleStart) && next.isNotNull())
950                setEndingSelection(next);
951            else  {
952                insertParagraphSeparator();
953                visibleStart = endingSelection().visibleStart();
954            }
955        }
956        // We split the current paragraph in two to avoid nesting the blocks from the fragment inside the current block.
957        // For example paste <div>foo</div><div>bar</div><div>baz</div> into <div>x^x</div>, where ^ is the caret.
958        // As long as the  div styles are the same, visually you'd expect: <div>xbar</div><div>bar</div><div>bazx</div>,
959        // not <div>xbar<div>bar</div><div>bazx</div></div>.
960        // Don't do this if the selection started in a Mail blockquote.
961        if (m_preventNesting && !startIsInsideMailBlockquote && !isEndOfParagraph(visibleStart) && !isStartOfParagraph(visibleStart)) {
962            insertParagraphSeparator();
963            setEndingSelection(endingSelection().visibleStart().previous());
964        }
965        insertionPos = endingSelection().start();
966    }
967
968    // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break
969    // out of any surrounding Mail blockquotes. Unless we're inserting in a table, in which case
970    // breaking the blockquote will prevent the content from actually being inserted in the table.
971    if (startIsInsideMailBlockquote && m_preventNesting && !(enclosingNodeOfType(insertionPos, &isTableStructureNode))) {
972        applyCommandToComposite(BreakBlockquoteCommand::create(document()));
973        // This will leave a br between the split.
974        Node* br = endingSelection().start().deprecatedNode();
975        ASSERT(br->hasTagName(brTag));
976        // Insert content between the two blockquotes, but remove the br (since it was just a placeholder).
977        insertionPos = positionInParentBeforeNode(br);
978        removeNode(br);
979    }
980
981    // Inserting content could cause whitespace to collapse, e.g. inserting <div>foo</div> into hello^ world.
982    prepareWhitespaceAtPositionForSplit(insertionPos);
983
984    // If the downstream node has been removed there's no point in continuing.
985    if (!insertionPos.downstream().deprecatedNode())
986      return;
987
988    // NOTE: This would be an incorrect usage of downstream() if downstream() were changed to mean the last position after
989    // p that maps to the same visible position as p (since in the case where a br is at the end of a block and collapsed
990    // away, there are positions after the br which map to the same visible position as [br, 0]).
991    RefPtr<Node> endBR = insertionPos.downstream().deprecatedNode()->hasTagName(brTag) ? insertionPos.downstream().deprecatedNode() : nullptr;
992    VisiblePosition originalVisPosBeforeEndBR;
993    if (endBR)
994        originalVisPosBeforeEndBR = VisiblePosition(positionBeforeNode(endBR.get()), DOWNSTREAM).previous();
995
996    RefPtr<Node> insertionBlock = enclosingBlock(insertionPos.deprecatedNode());
997
998    // Adjust insertionPos to prevent nesting.
999    // If the start was in a Mail blockquote, we will have already handled adjusting insertionPos above.
1000    if (m_preventNesting && insertionBlock && !isTableCell(insertionBlock.get()) && !startIsInsideMailBlockquote) {
1001        ASSERT(insertionBlock != currentRoot);
1002        VisiblePosition visibleInsertionPos(insertionPos);
1003        if (isEndOfBlock(visibleInsertionPos) && !(isStartOfBlock(visibleInsertionPos) && fragment.hasInterchangeNewlineAtEnd()))
1004            insertionPos = positionInParentAfterNode(insertionBlock.get());
1005        else if (isStartOfBlock(visibleInsertionPos))
1006            insertionPos = positionInParentBeforeNode(insertionBlock.get());
1007    }
1008
1009    // Paste at start or end of link goes outside of link.
1010    insertionPos = positionAvoidingSpecialElementBoundary(insertionPos);
1011
1012    // FIXME: Can this wait until after the operation has been performed?  There doesn't seem to be
1013    // any work performed after this that queries or uses the typing style.
1014    if (Frame* frame = document()->frame())
1015        frame->selection()->clearTypingStyle();
1016
1017    removeHeadContents(fragment);
1018
1019    // We don't want the destination to end up inside nodes that weren't selected.  To avoid that, we move the
1020    // position forward without changing the visible position so we're still at the same visible location, but
1021    // outside of preceding tags.
1022    insertionPos = positionAvoidingPrecedingNodes(insertionPos);
1023
1024    // Paste into run of tabs splits the tab span.
1025    insertionPos = positionOutsideTabSpan(insertionPos);
1026
1027    bool handledStyleSpans = handleStyleSpansBeforeInsertion(fragment, insertionPos);
1028
1029    // We're finished if there is nothing to add.
1030    if (fragment.isEmpty() || !fragment.firstChild())
1031        return;
1032
1033    // If we are not trying to match the destination style we prefer a position
1034    // that is outside inline elements that provide style.
1035    // This way we can produce a less verbose markup.
1036    // We can skip this optimization for fragments not wrapped in one of
1037    // our style spans and for positions inside list items
1038    // since insertAsListItems already does the right thing.
1039    if (!m_matchStyle && !enclosingList(insertionPos.containerNode())) {
1040        if (insertionPos.containerNode()->isTextNode() && insertionPos.offsetInContainerNode() && !insertionPos.atLastEditingPositionForNode()) {
1041            splitTextNode(insertionPos.containerText(), insertionPos.offsetInContainerNode());
1042            insertionPos = firstPositionInNode(insertionPos.containerNode());
1043        }
1044
1045        if (RefPtr<Node> nodeToSplitTo = nodeToSplitToAvoidPastingIntoInlineNodesWithStyle(insertionPos)) {
1046            if (insertionPos.containerNode() != nodeToSplitTo->parentNode()) {
1047                Node* splitStart = insertionPos.computeNodeAfterPosition();
1048                if (!splitStart)
1049                    splitStart = insertionPos.containerNode();
1050                nodeToSplitTo = splitTreeToNode(splitStart, nodeToSplitTo->parentNode()).get();
1051                insertionPos = positionInParentBeforeNode(nodeToSplitTo.get());
1052            }
1053        }
1054    }
1055
1056    // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
1057    // again here if they've been removed.
1058
1059    // 1) Insert the content.
1060    // 2) Remove redundant styles and style tags, this inner <b> for example: <b>foo <b>bar</b> baz</b>.
1061    // 3) Merge the start of the added content with the content before the position being pasted into.
1062    // 4) Do one of the following: a) expand the last br if the fragment ends with one and it collapsed,
1063    // b) merge the last paragraph of the incoming fragment with the paragraph that contained the
1064    // end of the selection that was pasted into, or c) handle an interchange newline at the end of the
1065    // incoming fragment.
1066    // 5) Add spaces for smart replace.
1067    // 6) Select the replacement if requested, and match style if requested.
1068
1069    InsertedNodes insertedNodes;
1070    RefPtr<Node> refNode = fragment.firstChild();
1071    RefPtr<Node> node = refNode->nextSibling();
1072
1073    fragment.removeNode(refNode);
1074
1075    Node* blockStart = enclosingBlock(insertionPos.deprecatedNode());
1076    if ((isListElement(refNode.get()) || (isLegacyAppleStyleSpan(refNode.get()) && isListElement(refNode->firstChild())))
1077        && blockStart && blockStart->renderer()->isListItem())
1078        refNode = insertAsListItems(toHTMLElement(refNode.get()), blockStart, insertionPos, insertedNodes);
1079    else {
1080        insertNodeAt(refNode, insertionPos);
1081        insertedNodes.respondToNodeInsertion(refNode.get());
1082    }
1083
1084    // Mutation events (bug 22634) may have already removed the inserted content
1085    if (!refNode->inDocument())
1086        return;
1087
1088    bool plainTextFragment = isPlainTextMarkup(refNode.get());
1089
1090    while (node) {
1091        RefPtr<Node> next = node->nextSibling();
1092        fragment.removeNode(node.get());
1093        insertNodeAfter(node, refNode.get());
1094        insertedNodes.respondToNodeInsertion(node.get());
1095
1096        // Mutation events (bug 22634) may have already removed the inserted content
1097        if (!node->inDocument())
1098            return;
1099
1100        refNode = node;
1101        if (node && plainTextFragment)
1102            plainTextFragment = isPlainTextMarkup(node.get());
1103        node = next;
1104    }
1105
1106    removeUnrenderedTextNodesAtEnds(insertedNodes);
1107
1108    if (!handledStyleSpans)
1109        handleStyleSpans(insertedNodes);
1110
1111    // Mutation events (bug 20161) may have already removed the inserted content
1112    if (!insertedNodes.firstNodeInserted() || !insertedNodes.firstNodeInserted()->inDocument())
1113        return;
1114
1115    VisiblePosition startOfInsertedContent = firstPositionInOrBeforeNode(insertedNodes.firstNodeInserted());
1116
1117    // We inserted before the insertionBlock to prevent nesting, and the content before the insertionBlock wasn't in its own block and
1118    // didn't have a br after it, so the inserted content ended up in the same paragraph.
1119    if (insertionBlock && insertionPos.deprecatedNode() == insertionBlock->parentNode() && (unsigned)insertionPos.deprecatedEditingOffset() < insertionBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
1120        insertNodeAt(createBreakElement(document()).get(), startOfInsertedContent.deepEquivalent());
1121
1122    if (endBR && (plainTextFragment || shouldRemoveEndBR(endBR.get(), originalVisPosBeforeEndBR))) {
1123        RefPtr<Node> parent = endBR->parentNode();
1124        insertedNodes.willRemoveNode(endBR.get());
1125        removeNode(endBR);
1126        if (Node* nodeToRemove = highestNodeToRemoveInPruning(parent.get())) {
1127            insertedNodes.willRemoveNode(nodeToRemove);
1128            removeNode(nodeToRemove);
1129        }
1130    }
1131
1132    makeInsertedContentRoundTrippableWithHTMLTreeBuilder(insertedNodes);
1133
1134    removeRedundantStylesAndKeepStyleSpanInline(insertedNodes);
1135
1136    if (m_sanitizeFragment)
1137        applyCommandToComposite(SimplifyMarkupCommand::create(document(), insertedNodes.firstNodeInserted(), insertedNodes.pastLastLeaf()));
1138
1139    // Setup m_startOfInsertedContent and m_endOfInsertedContent. This should be the last two lines of code that access insertedNodes.
1140    m_startOfInsertedContent = firstPositionInOrBeforeNode(insertedNodes.firstNodeInserted());
1141    m_endOfInsertedContent = lastPositionInOrAfterNode(insertedNodes.lastLeafInserted());
1142
1143    // Determine whether or not we should merge the end of inserted content with what's after it before we do
1144    // the start merge so that the start merge doesn't effect our decision.
1145    m_shouldMergeEnd = shouldMergeEnd(selectionEndWasEndOfParagraph);
1146
1147    if (shouldMergeStart(selectionStartWasStartOfParagraph, fragment.hasInterchangeNewlineAtStart(), startIsInsideMailBlockquote)) {
1148        VisiblePosition startOfParagraphToMove = positionAtStartOfInsertedContent();
1149        VisiblePosition destination = startOfParagraphToMove.previous();
1150        // We need to handle the case where we need to merge the end
1151        // but our destination node is inside an inline that is the last in the block.
1152        // We insert a placeholder before the newly inserted content to avoid being merged into the inline.
1153        Node* destinationNode = destination.deepEquivalent().deprecatedNode();
1154        if (m_shouldMergeEnd && destinationNode != enclosingInline(destinationNode) && enclosingInline(destinationNode)->nextSibling())
1155            insertNodeBefore(createBreakElement(document()), refNode.get());
1156
1157        // Merging the the first paragraph of inserted content with the content that came
1158        // before the selection that was pasted into would also move content after
1159        // the selection that was pasted into if: only one paragraph was being pasted,
1160        // and it was not wrapped in a block, the selection that was pasted into ended
1161        // at the end of a block and the next paragraph didn't start at the start of a block.
1162        // Insert a line break just after the inserted content to separate it from what
1163        // comes after and prevent that from happening.
1164        VisiblePosition endOfInsertedContent = positionAtEndOfInsertedContent();
1165        if (startOfParagraph(endOfInsertedContent) == startOfParagraphToMove) {
1166            insertNodeAt(createBreakElement(document()).get(), endOfInsertedContent.deepEquivalent());
1167            // Mutation events (bug 22634) triggered by inserting the <br> might have removed the content we're about to move
1168            if (!startOfParagraphToMove.deepEquivalent().anchorNode()->inDocument())
1169                return;
1170        }
1171
1172        // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
1173        // only ever used to create positions where inserted content starts/ends.
1174        moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
1175        m_startOfInsertedContent = endingSelection().visibleStart().deepEquivalent().downstream();
1176        if (m_endOfInsertedContent.isOrphan())
1177            m_endOfInsertedContent = endingSelection().visibleEnd().deepEquivalent().upstream();
1178    }
1179
1180    Position lastPositionToSelect;
1181    if (fragment.hasInterchangeNewlineAtEnd()) {
1182        VisiblePosition endOfInsertedContent = positionAtEndOfInsertedContent();
1183        VisiblePosition next = endOfInsertedContent.next(CannotCrossEditingBoundary);
1184
1185        if (selectionEndWasEndOfParagraph || !isEndOfParagraph(endOfInsertedContent) || next.isNull()) {
1186            if (!isStartOfParagraph(endOfInsertedContent)) {
1187                setEndingSelection(endOfInsertedContent);
1188                Node* enclosingNode = enclosingBlock(endOfInsertedContent.deepEquivalent().deprecatedNode());
1189                if (isListItem(enclosingNode)) {
1190                    RefPtr<Node> newListItem = createListItemElement(document());
1191                    insertNodeAfter(newListItem, enclosingNode);
1192                    setEndingSelection(VisiblePosition(firstPositionInNode(newListItem.get())));
1193                } else {
1194                    // Use a default paragraph element (a plain div) for the empty paragraph, using the last paragraph
1195                    // block's style seems to annoy users.
1196                    insertParagraphSeparator(true, !startIsInsideMailBlockquote && highestEnclosingNodeOfType(endOfInsertedContent.deepEquivalent(),
1197                        isMailBlockquote, CannotCrossEditingBoundary, insertedNodes.firstNodeInserted()->parentNode()));
1198                }
1199
1200                // Select up to the paragraph separator that was added.
1201                lastPositionToSelect = endingSelection().visibleStart().deepEquivalent();
1202                updateNodesInserted(lastPositionToSelect.deprecatedNode());
1203            }
1204        } else {
1205            // Select up to the beginning of the next paragraph.
1206            lastPositionToSelect = next.deepEquivalent().downstream();
1207        }
1208
1209    } else
1210        mergeEndIfNeeded();
1211
1212    if (Node* mailBlockquote = enclosingNodeOfType(positionAtStartOfInsertedContent().deepEquivalent(), isMailPasteAsQuotationNode))
1213        removeNodeAttribute(toElement(mailBlockquote), classAttr);
1214
1215    if (shouldPerformSmartReplace())
1216        addSpacesForSmartReplace();
1217
1218    // If we are dealing with a fragment created from plain text
1219    // no style matching is necessary.
1220    if (plainTextFragment)
1221        m_matchStyle = false;
1222
1223    completeHTMLReplacement(lastPositionToSelect);
1224}
1225
1226bool ReplaceSelectionCommand::shouldRemoveEndBR(Node* endBR, const VisiblePosition& originalVisPosBeforeEndBR)
1227{
1228    if (!endBR || !endBR->inDocument())
1229        return false;
1230
1231    VisiblePosition visiblePos(positionBeforeNode(endBR));
1232
1233    // Don't remove the br if nothing was inserted.
1234    if (visiblePos.previous() == originalVisPosBeforeEndBR)
1235        return false;
1236
1237    // Remove the br if it is collapsed away and so is unnecessary.
1238    if (!document()->inNoQuirksMode() && isEndOfBlock(visiblePos) && !isStartOfParagraph(visiblePos))
1239        return true;
1240
1241    // A br that was originally holding a line open should be displaced by inserted content or turned into a line break.
1242    // A br that was originally acting as a line break should still be acting as a line break, not as a placeholder.
1243    return isStartOfParagraph(visiblePos) && isEndOfParagraph(visiblePos);
1244}
1245
1246bool ReplaceSelectionCommand::shouldPerformSmartReplace() const
1247{
1248    if (!m_smartReplace)
1249        return false;
1250
1251    Element* textControl = enclosingTextFormControl(positionAtStartOfInsertedContent().deepEquivalent());
1252    if (textControl && textControl->hasTagName(inputTag) && static_cast<HTMLInputElement*>(textControl)->isPasswordField())
1253        return false; // Disable smart replace for password fields.
1254
1255    return true;
1256}
1257
1258static bool isCharacterSmartReplaceExemptConsideringNonBreakingSpace(UChar32 character, bool previousCharacter)
1259{
1260    return isCharacterSmartReplaceExempt(character == noBreakSpace ? ' ' : character, previousCharacter);
1261}
1262
1263void ReplaceSelectionCommand::addSpacesForSmartReplace()
1264{
1265    VisiblePosition startOfInsertedContent = positionAtStartOfInsertedContent();
1266    VisiblePosition endOfInsertedContent = positionAtEndOfInsertedContent();
1267
1268    Position endUpstream = endOfInsertedContent.deepEquivalent().upstream();
1269    Node* endNode = endUpstream.computeNodeBeforePosition();
1270    int endOffset = endNode && endNode->isTextNode() ? toText(endNode)->length() : 0;
1271    if (endUpstream.anchorType() == Position::PositionIsOffsetInAnchor) {
1272        endNode = endUpstream.containerNode();
1273        endOffset = endUpstream.offsetInContainerNode();
1274    }
1275
1276    bool needsTrailingSpace = !isEndOfParagraph(endOfInsertedContent) && !isCharacterSmartReplaceExemptConsideringNonBreakingSpace(endOfInsertedContent.characterAfter(), false);
1277    if (needsTrailingSpace && endNode) {
1278        bool collapseWhiteSpace = !endNode->renderer() || endNode->renderer()->style()->collapseWhiteSpace();
1279        if (endNode->isTextNode()) {
1280            insertTextIntoNode(toText(endNode), endOffset, collapseWhiteSpace ? nonBreakingSpaceString() : " ");
1281            if (m_endOfInsertedContent.containerNode() == endNode)
1282                m_endOfInsertedContent.moveToOffset(m_endOfInsertedContent.offsetInContainerNode() + 1);
1283        } else {
1284            RefPtr<Node> node = document()->createEditingTextNode(collapseWhiteSpace ? nonBreakingSpaceString() : " ");
1285            insertNodeAfter(node, endNode);
1286            updateNodesInserted(node.get());
1287        }
1288    }
1289
1290    document()->updateLayout();
1291
1292    Position startDownstream = startOfInsertedContent.deepEquivalent().downstream();
1293    Node* startNode = startDownstream.computeNodeAfterPosition();
1294    unsigned startOffset = 0;
1295    if (startDownstream.anchorType() == Position::PositionIsOffsetInAnchor) {
1296        startNode = startDownstream.containerNode();
1297        startOffset = startDownstream.offsetInContainerNode();
1298    }
1299
1300    bool needsLeadingSpace = !isStartOfParagraph(startOfInsertedContent) && !isCharacterSmartReplaceExemptConsideringNonBreakingSpace(startOfInsertedContent.previous().characterAfter(), true);
1301    if (needsLeadingSpace && startNode) {
1302        bool collapseWhiteSpace = !startNode->renderer() || startNode->renderer()->style()->collapseWhiteSpace();
1303        if (startNode->isTextNode()) {
1304            insertTextIntoNode(toText(startNode), startOffset, collapseWhiteSpace ? nonBreakingSpaceString() : " ");
1305            if (m_endOfInsertedContent.containerNode() == startNode && m_endOfInsertedContent.offsetInContainerNode())
1306                m_endOfInsertedContent.moveToOffset(m_endOfInsertedContent.offsetInContainerNode() + 1);
1307        } else {
1308            RefPtr<Node> node = document()->createEditingTextNode(collapseWhiteSpace ? nonBreakingSpaceString() : " ");
1309            // Don't updateNodesInserted. Doing so would set m_endOfInsertedContent to be the node containing the leading space,
1310            // but m_endOfInsertedContent is supposed to mark the end of pasted content.
1311            insertNodeBefore(node, startNode);
1312            m_startOfInsertedContent = firstPositionInNode(node.get());
1313        }
1314    }
1315}
1316
1317void ReplaceSelectionCommand::completeHTMLReplacement(const Position &lastPositionToSelect)
1318{
1319    Position start = positionAtStartOfInsertedContent().deepEquivalent();
1320    Position end = positionAtEndOfInsertedContent().deepEquivalent();
1321
1322    // Mutation events may have deleted start or end
1323    if (start.isNotNull() && !start.isOrphan() && end.isNotNull() && !end.isOrphan()) {
1324        // FIXME (11475): Remove this and require that the creator of the fragment to use nbsps.
1325        rebalanceWhitespaceAt(start);
1326        rebalanceWhitespaceAt(end);
1327
1328        if (m_matchStyle) {
1329            ASSERT(m_insertionStyle);
1330            applyStyle(m_insertionStyle.get(), start, end);
1331        }
1332
1333        if (lastPositionToSelect.isNotNull())
1334            end = lastPositionToSelect;
1335
1336        mergeTextNodesAroundPosition(start, end);
1337        mergeTextNodesAroundPosition(end, start);
1338    } else if (lastPositionToSelect.isNotNull())
1339        start = end = lastPositionToSelect;
1340    else
1341        return;
1342
1343    if (m_selectReplacement)
1344        setEndingSelection(VisibleSelection(start, end, SEL_DEFAULT_AFFINITY, endingSelection().isDirectional()));
1345    else
1346        setEndingSelection(VisibleSelection(end, SEL_DEFAULT_AFFINITY, endingSelection().isDirectional()));
1347}
1348
1349void ReplaceSelectionCommand::mergeTextNodesAroundPosition(Position& position, Position& positionOnlyToBeUpdated)
1350{
1351    bool positionIsOffsetInAnchor = position.anchorType() == Position::PositionIsOffsetInAnchor;
1352    bool positionOnlyToBeUpdatedIsOffsetInAnchor = positionOnlyToBeUpdated.anchorType() == Position::PositionIsOffsetInAnchor;
1353    RefPtr<Text> text = 0;
1354    if (positionIsOffsetInAnchor && position.containerNode() && position.containerNode()->isTextNode())
1355        text = toText(position.containerNode());
1356    else {
1357        Node* before = position.computeNodeBeforePosition();
1358        if (before && before->isTextNode())
1359            text = toText(before);
1360        else {
1361            Node* after = position.computeNodeAfterPosition();
1362            if (after && after->isTextNode())
1363                text = toText(after);
1364        }
1365    }
1366    if (!text)
1367        return;
1368
1369    if (text->previousSibling() && text->previousSibling()->isTextNode()) {
1370        RefPtr<Text> previous = toText(text->previousSibling());
1371        insertTextIntoNode(text, 0, previous->data());
1372
1373        if (positionIsOffsetInAnchor)
1374            position.moveToOffset(previous->length() + position.offsetInContainerNode());
1375        else
1376            updatePositionForNodeRemoval(position, previous.get());
1377
1378        if (positionOnlyToBeUpdatedIsOffsetInAnchor) {
1379            if (positionOnlyToBeUpdated.containerNode() == text)
1380                positionOnlyToBeUpdated.moveToOffset(previous->length() + positionOnlyToBeUpdated.offsetInContainerNode());
1381            else if (positionOnlyToBeUpdated.containerNode() == previous)
1382                positionOnlyToBeUpdated.moveToPosition(text, positionOnlyToBeUpdated.offsetInContainerNode());
1383        } else
1384            updatePositionForNodeRemoval(positionOnlyToBeUpdated, previous.get());
1385
1386        removeNode(previous);
1387    }
1388    if (text->nextSibling() && text->nextSibling()->isTextNode()) {
1389        RefPtr<Text> next = toText(text->nextSibling());
1390        unsigned originalLength = text->length();
1391        insertTextIntoNode(text, originalLength, next->data());
1392
1393        if (!positionIsOffsetInAnchor)
1394            updatePositionForNodeRemoval(position, next.get());
1395
1396        if (positionOnlyToBeUpdatedIsOffsetInAnchor && positionOnlyToBeUpdated.containerNode() == next)
1397            positionOnlyToBeUpdated.moveToPosition(text, originalLength + positionOnlyToBeUpdated.offsetInContainerNode());
1398        else
1399            updatePositionForNodeRemoval(positionOnlyToBeUpdated, next.get());
1400
1401        removeNode(next);
1402    }
1403}
1404
1405EditAction ReplaceSelectionCommand::editingAction() const
1406{
1407    return m_editAction;
1408}
1409
1410// If the user is inserting a list into an existing list, instead of nesting the list,
1411// we put the list items into the existing list.
1412Node* ReplaceSelectionCommand::insertAsListItems(PassRefPtr<HTMLElement> prpListElement, Node* insertionBlock, const Position& insertPos, InsertedNodes& insertedNodes)
1413{
1414    RefPtr<HTMLElement> listElement = prpListElement;
1415
1416    while (listElement->hasChildNodes() && isListElement(listElement->firstChild()) && listElement->childNodeCount() == 1)
1417        listElement = toHTMLElement(listElement->firstChild());
1418
1419    bool isStart = isStartOfParagraph(insertPos);
1420    bool isEnd = isEndOfParagraph(insertPos);
1421    bool isMiddle = !isStart && !isEnd;
1422    Node* lastNode = insertionBlock;
1423
1424    // If we're in the middle of a list item, we should split it into two separate
1425    // list items and insert these nodes between them.
1426    if (isMiddle) {
1427        int textNodeOffset = insertPos.offsetInContainerNode();
1428        if (insertPos.deprecatedNode()->isTextNode() && textNodeOffset > 0)
1429            splitTextNode(toText(insertPos.deprecatedNode()), textNodeOffset);
1430        splitTreeToNode(insertPos.deprecatedNode(), lastNode, true);
1431    }
1432
1433    while (RefPtr<Node> listItem = listElement->firstChild()) {
1434        listElement->removeChild(listItem.get(), ASSERT_NO_EXCEPTION);
1435        if (isStart || isMiddle) {
1436            insertNodeBefore(listItem, lastNode);
1437            insertedNodes.respondToNodeInsertion(listItem.get());
1438        } else if (isEnd) {
1439            insertNodeAfter(listItem, lastNode);
1440            insertedNodes.respondToNodeInsertion(listItem.get());
1441            lastNode = listItem.get();
1442        } else
1443            ASSERT_NOT_REACHED();
1444    }
1445    if (isStart || isMiddle)
1446        lastNode = lastNode->previousSibling();
1447    return lastNode;
1448}
1449
1450void ReplaceSelectionCommand::updateNodesInserted(Node *node)
1451{
1452    if (!node)
1453        return;
1454
1455    if (m_startOfInsertedContent.isNull())
1456        m_startOfInsertedContent = firstPositionInOrBeforeNode(node);
1457
1458    m_endOfInsertedContent = lastPositionInOrAfterNode(node->lastDescendant());
1459}
1460
1461// During simple pastes, where we're just pasting a text node into a run of text, we insert the text node
1462// directly into the text node that holds the selection.  This is much faster than the generalized code in
1463// ReplaceSelectionCommand, and works around <https://bugs.webkit.org/show_bug.cgi?id=6148> since we don't
1464// split text nodes.
1465bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& fragment)
1466{
1467    if (!fragment.firstChild() || fragment.firstChild() != fragment.lastChild() || !fragment.firstChild()->isTextNode())
1468        return false;
1469
1470    // FIXME: Would be nice to handle smart replace in the fast path.
1471    if (m_smartReplace || fragment.hasInterchangeNewlineAtStart() || fragment.hasInterchangeNewlineAtEnd())
1472        return false;
1473
1474    // e.g. when "bar" is inserted after "foo" in <div><u>foo</u></div>, "bar" should not be underlined.
1475    if (nodeToSplitToAvoidPastingIntoInlineNodesWithStyle(endingSelection().start()))
1476        return false;
1477
1478    RefPtr<Node> nodeAfterInsertionPos = endingSelection().end().downstream().anchorNode();
1479    Text* textNode = toText(fragment.firstChild());
1480    // Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
1481
1482    Position start = endingSelection().start();
1483    Position end = replaceSelectedTextInNode(textNode->data());
1484    if (end.isNull())
1485        return false;
1486
1487    if (nodeAfterInsertionPos && nodeAfterInsertionPos->parentNode() && nodeAfterInsertionPos->hasTagName(brTag)
1488        && shouldRemoveEndBR(nodeAfterInsertionPos.get(), positionBeforeNode(nodeAfterInsertionPos.get())))
1489        removeNodeAndPruneAncestors(nodeAfterInsertionPos.get());
1490
1491    VisibleSelection selectionAfterReplace(m_selectReplacement ? start : end, end);
1492
1493    setEndingSelection(selectionAfterReplace);
1494
1495    return true;
1496}
1497
1498} // namespace WebCore
1499