Commit message: None
CVE: CVE-2011-3050
CWE: CWE-399
Vulnerability description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.

Project: Chrome

void BookmarkManagerView::ContentsChanged(views::TextField* sender,
                                          const std::wstring& new_contents) {
  search_factory_.RevokeAll();
  MessageLoop::current()->PostDelayedTask(FROM_HERE,
      search_factory_.NewRunnableMethod(&BookmarkManagerView::PerformSearch),
      kSearchDelayMS);
}

Project: Chrome

BookmarkTableModel* BookmarkManagerView::CreateSearchTableModel() {
  std::wstring search_text = search_tf_->GetText();
  if (search_text.empty())
    return NULL;
  return BookmarkTableModel::CreateSearchTableModel(GetBookmarkModel(),
                                                    search_text);
}

Project: Chrome

void BookmarkManagerView::ExecuteCommand(int id) {
  switch (id) {
    case IDS_BOOKMARK_MANAGER_IMPORT_MENU:
      UserMetrics::RecordAction(L"BookmarkManager_Import", profile_);
      ShowImportBookmarksFileChooser();
      break;

    case IDS_BOOKMARK_MANAGER_EXPORT_MENU:
      UserMetrics::RecordAction(L"BookmarkManager_Export", profile_);
      ShowExportBookmarksFileChooser();
      break;

    default:
      NOTREACHED();
      break;
  }
}

Project: Chrome

void BookmarkManagerView::ExpandAll(BookmarkNode* node) {
  BookmarkNode* parent = node->is_url() ? node->GetParent() : node;
  FolderNode* folder_node = tree_model_->GetFolderNodeForBookmarkNode(parent);
  if (!folder_node) {
    NOTREACHED();
    return;
  }
  tree_view_->ExpandAll(folder_node);
}

Project: Chrome

void BookmarkManagerView::FileSelected(const FilePath& path,
                                       int index,
                                       void* params) {
  int id = reinterpret_cast<int>(params);
  if (id == IDS_BOOKMARK_MANAGER_IMPORT_MENU) {
    ImporterHost* host = new ImporterHost();
    ProfileInfo profile_info;
    profile_info.browser_type = BOOKMARKS_HTML;
    profile_info.source_path = path.ToWStringHack();
    StartImportingWithUI(GetWidget()->GetNativeView(), FAVORITES, host,
                         profile_info, profile_,
                         new ImportObserverImpl(profile()), false);
  } else if (id == IDS_BOOKMARK_MANAGER_EXPORT_MENU) {
    if (g_browser_process->io_thread()) {
      bookmark_html_writer::WriteBookmarks(
          g_browser_process->io_thread()->message_loop(), GetBookmarkModel(),
          path.ToWStringHack());
    }
  } else {
    NOTREACHED();
  }
}

Project: Chrome

void BookmarkManagerView::FileSelectionCanceled(void* params) {
  select_file_dialog_ = NULL;
}

Project: Chrome

BookmarkModel* BookmarkManagerView::GetBookmarkModel() const {
  return profile_->GetBookmarkModel();
}

Project: Chrome

gfx::Size BookmarkManagerView::GetPreferredSize() {
  return gfx::Size(views::Window::GetLocalizedContentsSize(
      IDS_BOOKMARK_MANAGER_DIALOG_WIDTH_CHARS,
      IDS_BOOKMARK_MANAGER_DIALOG_HEIGHT_LINES));
}

Project: Chrome

BookmarkNode* BookmarkManagerView::GetSelectedFolder() {
  return tree_view_->GetSelectedBookmarkNode();
}

Project: Chrome

std::vector<BookmarkNode*> BookmarkManagerView::GetSelectedTableNodes() {
  std::vector<BookmarkNode*> nodes;
  for (views::TableView::iterator i = table_view_->SelectionBegin();
       i != table_view_->SelectionEnd(); ++i) {
    nodes.push_back(table_model_->GetNodeForRow(*i));
  }
  std::reverse(nodes.begin(), nodes.end());
  return nodes;
}

Project: Chrome

std::wstring BookmarkManagerView::GetWindowName() const {
  return prefs::kBookmarkManagerPlacement;
}

Project: Chrome

std::wstring BookmarkManagerView::GetWindowTitle() const {
  return l10n_util::GetString(IDS_BOOKMARK_MANAGER_TITLE);
}

Project: Chrome

bool BookmarkManagerView::HandleKeystroke(
    views::TextField* sender,
    const views::TextField::Keystroke& key) {
  if (views::TextField::IsKeystrokeEnter(key)) {
    PerformSearch();
    search_tf_->SelectAll();
  }

  return false;
}

Project: Chrome

  virtual void ImportCanceled() {
    delete this;
  }

Project: Chrome

  virtual void ImportComplete() {
    MessageLoop::current()->DeleteSoon(FROM_HERE, this);

    BookmarkManagerView* manager = BookmarkManagerView::current();
    if (!manager || manager->profile() != profile_)
      return;

    BookmarkModel* model = profile_->GetBookmarkModel();
    int other_count = model->other_node()->GetChildCount();
    if (other_count == initial_other_count_ + 1) {
      BookmarkNode* imported_node =
          model->other_node()->GetChild(initial_other_count_);
      manager->SelectInTree(imported_node);
      manager->ExpandAll(imported_node);
    }
  }

Project: Chrome

  explicit ImportObserverImpl(Profile* profile) : profile_(profile) {
    BookmarkModel* model = profile->GetBookmarkModel();
    initial_other_count_ = model->other_node()->GetChildCount();
  }

Project: Chrome

BookmarkManagerView::CutCopyPasteType KeyCodeToCutCopyPaste(
    unsigned short virtual_keycode) {
  switch (virtual_keycode) {
    case VK_INSERT:
      if (GetKeyState(VK_CONTROL) < 0)
        return BookmarkManagerView::COPY;
      if (GetKeyState(VK_SHIFT) < 0)
        return BookmarkManagerView::PASTE;
      return BookmarkManagerView::NONE;

    case VK_DELETE:
      if (GetKeyState(VK_SHIFT) < 0)
        return BookmarkManagerView::CUT;
      return BookmarkManagerView::NONE;

    case 'C':
      if (GetKeyState(VK_CONTROL) < 0)
        return BookmarkManagerView::COPY;
      return BookmarkManagerView::NONE;

    case 'V':
      if (GetKeyState(VK_CONTROL) < 0)
        return BookmarkManagerView::PASTE;
      return BookmarkManagerView::NONE;

    case 'X':
      if (GetKeyState(VK_CONTROL) < 0)
        return BookmarkManagerView::CUT;
      return BookmarkManagerView::NONE;

    default:
      return BookmarkManagerView::NONE;
  }
}

Project: Chrome

void BookmarkManagerView::Loaded(BookmarkModel* model) {
  model->RemoveObserver(this);
  LoadedImpl();
}

Project: Chrome

void BookmarkManagerView::LoadedImpl() {
  BookmarkModel* bookmark_model = GetBookmarkModel();
  BookmarkNode* bookmark_bar_node = bookmark_model->GetBookmarkBarNode();
  table_model_.reset(
      BookmarkTableModel::CreateBookmarkTableModelForFolder(bookmark_model,
                                                            bookmark_bar_node));
  table_view_->SetModel(table_model_.get());
  table_view_->set_parent_node(bookmark_bar_node);

  tree_model_.reset(new BookmarkFolderTreeModel(bookmark_model));
  tree_view_->SetModel(tree_model_.get());

  tree_view_->ExpandAll();

  tree_view_->SetSelectedNode(
      tree_model_->GetFolderNodeForBookmarkNode(bookmark_bar_node));

  search_tf_->SetReadOnly(false);
  search_tf_->SetController(this);

  Layout();
  SchedulePaint();
}

Project: Chrome

void BookmarkManagerView::OnCutCopyPaste(CutCopyPasteType type,
                                         bool from_table) {
  if (type == CUT || type == COPY) {
    std::vector<BookmarkNode*> nodes;
    if (from_table) {
      nodes = GetSelectedTableNodes();
    } else {
      BookmarkNode* node = GetSelectedFolder();
      if (!node || node->GetParent() == GetBookmarkModel()->root_node())
        return;
      nodes.push_back(node);
    }
    if (nodes.empty())
      return;

    bookmark_utils::CopyToClipboard(GetBookmarkModel(), nodes, type == CUT);
  } else if (type == PASTE) {
    int index = from_table ? table_view_->FirstSelectedRow() : -1;
    if (index != -1)
      index++;
    bookmark_utils::PasteFromClipboard(GetBookmarkModel(), GetSelectedFolder(),
                                       index);
  }
}

Project: Chrome

 void BookmarkManagerView::OnDoubleClick() {
   std::vector<BookmarkNode*> nodes = GetSelectedTableNodes();
   if (nodes.empty())
    return;
  if (nodes.size() == 1 && nodes[0]->is_folder()) {
    SelectInTree(nodes[0]);
    return;
  }
  bookmark_utils::OpenAll(
      GetWidget()->GetNativeView(), profile_, NULL, nodes, CURRENT_TAB);
}

Project: Chrome

void BookmarkManagerView::OnKeyDown(unsigned short virtual_keycode) {
  switch (virtual_keycode) {
    case VK_RETURN: {
      std::vector<BookmarkNode*> selected_nodes = GetSelectedTableNodes();
      if (selected_nodes.size() == 1 && selected_nodes[0]->is_folder()) {
        SelectInTree(selected_nodes[0]);
      } else {
        bookmark_utils::OpenAll(
            GetWidget()->GetNativeView(), profile_, NULL, selected_nodes,
            CURRENT_TAB);
      }
      break;
    }

    case VK_BACK: {
      BookmarkNode* selected_folder = GetSelectedFolder();
      if (selected_folder != NULL &&
          selected_folder->GetParent() != GetBookmarkModel()->root_node()) {
        SelectInTree(selected_folder->GetParent());
      }
      break;
    }

    default:
      OnCutCopyPaste(KeyCodeToCutCopyPaste(virtual_keycode), true);
      break;
  }
}

Project: Chrome

void BookmarkManagerView::OnMiddleClick() {
  std::vector<BookmarkNode*> nodes = GetSelectedTableNodes();
  if (nodes.empty())
    return;
  if (nodes.size() == 1 && nodes[0]->is_folder()) {
    return;
  }

  bookmark_utils::OpenAll(
      GetWidget()->GetNativeView(), profile_, NULL, nodes, NEW_FOREGROUND_TAB);
}

Project: Chrome

void BookmarkManagerView::OnTableViewDelete(views::TableView* table) {
  std::vector<BookmarkNode*> nodes = GetSelectedTableNodes();
  if (nodes.empty())
    return;
  for (size_t i = 0; i < nodes.size(); ++i) {
    GetBookmarkModel()->Remove(nodes[i]->GetParent(),
                               nodes[i]->GetParent()->IndexOfChild(nodes[i]));
  }
}

Project: Chrome

void BookmarkManagerView::OnTreeViewSelectionChanged(
    views::TreeView* tree_view) {
  TreeModelNode* node = tree_view_->GetSelectedNode();

  BookmarkTableModel* new_table_model = NULL;
  BookmarkNode* table_parent_node = NULL;
  bool is_search = false;

  if (node) {
    switch (tree_model_->GetNodeType(node)) {
      case BookmarkFolderTreeModel::BOOKMARK:
        table_parent_node = tree_model_->TreeNodeAsBookmarkNode(node);
        new_table_model =
            BookmarkTableModel::CreateBookmarkTableModelForFolder(
                profile_->GetBookmarkModel(),
                table_parent_node);
        break;

      case BookmarkFolderTreeModel::RECENTLY_BOOKMARKED:
        new_table_model = BookmarkTableModel::CreateRecentlyBookmarkedModel(
            profile_->GetBookmarkModel());
        break;

      case BookmarkFolderTreeModel::SEARCH:
        is_search = true;
        search_factory_.RevokeAll();
        new_table_model = CreateSearchTableModel();
        break;

      default:
        NOTREACHED();
        break;
    }
  }

  SetTableModel(new_table_model, table_parent_node, is_search);
}

Project: Chrome

void BookmarkManagerView::PaintBackground(gfx::Canvas* canvas) {
  canvas->drawColor(kBackgroundColorBottom, SkPorterDuff::kSrc_Mode);

  SkPaint paint;
  paint.setShader(skia::CreateGradientShader(0, kBackgroundGradientHeight,
      kBackgroundColorTop,
      kBackgroundColorBottom))->safeUnref();
  canvas->FillRectInt(0, 0, width(), kBackgroundGradientHeight, paint);
}

Project: Chrome

void BookmarkManagerView::PerformSearch() {
  search_factory_.RevokeAll();
  tree_view_->SetController(NULL);
  tree_view_->SetSelectedNode(tree_model_->search_node());
  tree_view_->SetController(this);
  SetTableModel(CreateSearchTableModel(), NULL, true);
}

Project: Chrome

void BookmarkManagerView::PrepareForShow() {
  int split_x = g_browser_process->local_state()->GetInteger(
      prefs::kBookmarkManagerSplitLocation);
  if (split_x == -1) {
    split_x = split_view_->width() / 3;
  }
  int min_split_size = split_view_->width() / 8;
  split_x = std::min(split_view_->width() - min_split_size,
                     std::max(min_split_size, split_x));
  split_view_->set_divider_x(split_x);
  if (!GetBookmarkModel()->IsLoaded()) {
    search_tf_->SetReadOnly(true);
    return;
  }

  LoadedImpl();
}

Project: Chrome

void BookmarkManagerView::RegisterPrefs(PrefService* prefs) {
  prefs->RegisterDictionaryPref(prefs::kBookmarkManagerPlacement);
  prefs->RegisterIntegerPref(prefs::kBookmarkManagerSplitLocation, -1);
}

Project: Chrome

void BookmarkManagerView::SelectInTree(BookmarkNode* node) {
  if (!node)
    return;

  BookmarkNode* parent = node->is_url() ? node->GetParent() : node;
  FolderNode* folder_node = tree_model_->GetFolderNodeForBookmarkNode(parent);
  if (!folder_node) {
    NOTREACHED();
    return;
  }

  tree_view_->SetSelectedNode(folder_node);

  if (node->is_url()) {
    int index = table_model_->IndexOfNode(node);
    if (index != -1)
      table_view_->Select(index);
    table_view_->RequestFocus();
  }
}

Project: Chrome

void BookmarkManagerView::SetTableModel(BookmarkTableModel* new_table_model,
                                        BookmarkNode* parent_node,
                                        bool is_search) {
  table_view_->SetModel(NULL);
  table_view_->SetShowPathColumn(!parent_node);
  table_view_->SetModel(new_table_model);
  table_view_->set_parent_node(parent_node);
  table_model_.reset(new_table_model);
  if (!is_search || (new_table_model && new_table_model->RowCount() > 0)) {
    table_view_->SetAltText(std::wstring());
  } else if (search_tf_->GetText().empty()) {
    table_view_->SetAltText(
        l10n_util::GetString(IDS_BOOKMARK_MANAGER_NO_SEARCH_TEXT));
  } else {
    table_view_->SetAltText(
        l10n_util::GetStringF(IDS_BOOKMARK_MANAGER_NO_RESULTS,
                              search_tf_->GetText()));
  }
}

Project: Chrome

void BookmarkManagerView::Show(Profile* profile) {
  if (!profile->GetBookmarkModel())
    return;

  if (open_window != NULL) {
    open_window->Activate();
    return;
  }

  manager = new BookmarkManagerView(profile);

  open_window = views::Window::CreateChromeWindow(NULL, gfx::Rect(), manager);
  manager->PrepareForShow();
  open_window->Show();

  manager->search_tf_->RequestFocus();
}

Project: Chrome

void ShowBookmarkManagerView(Profile* profile) {
  BookmarkManagerView::Show(profile);
}

Project: Chrome

void BookmarkManagerView::ShowContextMenu(views::View* source,
                                          int x,
                                          int y,
                                          bool is_mouse_gesture) {
  DCHECK(source == table_view_ || source == tree_view_);
  bool is_table = (source == table_view_);
  ShowMenu(GetWidget()->GetNativeView(), x, y,
           is_table ? BookmarkContextMenu::BOOKMARK_MANAGER_TABLE :
                      BookmarkContextMenu::BOOKMARK_MANAGER_TREE);
}

Project: Chrome

void BookmarkManagerView::ShowExportBookmarksFileChooser() {
  if (select_file_dialog_.get())
    select_file_dialog_->ListenerDestroyed();

  SelectFileDialog::FileTypeInfo file_type_info;
  file_type_info.extensions.resize(1);
  file_type_info.extensions[0].push_back(FILE_PATH_LITERAL("html"));
  file_type_info.include_all_files = true;
  select_file_dialog_ = SelectFileDialog::Create(this);
  select_file_dialog_->SelectFile(
      SelectFileDialog::SELECT_SAVEAS_FILE, std::wstring(),
      FilePath(FILE_PATH_LITERAL("bookmarks.html")), &file_type_info, 0,
      L"html", GetWidget()->GetNativeView(),
      reinterpret_cast<void*>(IDS_BOOKMARK_MANAGER_EXPORT_MENU));
}

Project: Chrome

void BookmarkManagerView::ShowImportBookmarksFileChooser() {
  if (select_file_dialog_.get())
    select_file_dialog_->ListenerDestroyed();

  SelectFileDialog::FileTypeInfo file_type_info;
  file_type_info.extensions.resize(1);
  file_type_info.extensions[0].push_back(FILE_PATH_LITERAL("html"));
  file_type_info.extensions[0].push_back(FILE_PATH_LITERAL("htm"));
  file_type_info.include_all_files = true;
  select_file_dialog_ = SelectFileDialog::Create(this);
  select_file_dialog_->SelectFile(
      SelectFileDialog::SELECT_OPEN_FILE, std::wstring(),
      FilePath(FILE_PATH_LITERAL("bookmarks.html")), &file_type_info, 0,
      std::wstring(), GetWidget()->GetNativeView(),
      reinterpret_cast<void*>(IDS_BOOKMARK_MANAGER_IMPORT_MENU));
}

Project: Chrome

void BookmarkManagerView::ShowMenu(
    HWND host,
    int x,
    int y,
    BookmarkContextMenu::ConfigurationType config) {
  if (!GetBookmarkModel()->IsLoaded())
    return;

  if (config == BookmarkContextMenu::BOOKMARK_MANAGER_TABLE ||
      (config == BookmarkContextMenu::BOOKMARK_MANAGER_ORGANIZE_MENU &&
       table_view_->HasFocus())) {
    std::vector<BookmarkNode*> nodes = GetSelectedTableNodes();
    BookmarkNode* parent = GetSelectedFolder();
    if (!parent) {
      if (config == BookmarkContextMenu::BOOKMARK_MANAGER_TABLE)
        config = BookmarkContextMenu::BOOKMARK_MANAGER_TABLE_OTHER;
      else
        config = BookmarkContextMenu::BOOKMARK_MANAGER_ORGANIZE_MENU_OTHER;
    }
    BookmarkContextMenu menu(host, profile_, NULL, NULL, parent, nodes,
                             config);
    menu.RunMenuAt(x, y);
  } else {
    BookmarkNode* node = GetSelectedFolder();
    std::vector<BookmarkNode*> nodes;
    if (node)
      nodes.push_back(node);
    BookmarkContextMenu menu(GetWidget()->GetNativeView(), profile_, NULL, NULL,
                             node, nodes, config);
    menu.RunMenuAt(x, y);
  }
}

Project: Chrome

void BookmarkManagerView::ShowToolsMenu(HWND host, int x, int y) {
  views::MenuItemView menu(this);
  menu.AppendMenuItemWithLabel(
          IDS_BOOKMARK_MANAGER_IMPORT_MENU,
          l10n_util::GetString(IDS_BOOKMARK_MANAGER_IMPORT_MENU));
  menu.AppendMenuItemWithLabel(
          IDS_BOOKMARK_MANAGER_EXPORT_MENU,
          l10n_util::GetString(IDS_BOOKMARK_MANAGER_EXPORT_MENU));
  views::MenuItemView::AnchorPosition anchor =
      UILayoutIsRightToLeft() ? views::MenuItemView::TOPRIGHT :
                                views::MenuItemView::TOPLEFT;
  menu.RunMenuAt(GetWidget()->GetNativeView(), gfx::Rect(x, y, 0, 0), anchor,
                 true);
}

Project: Chrome

void BookmarkManagerView::WindowClosing() {
  g_browser_process->local_state()->SetInteger(
       prefs::kBookmarkManagerSplitLocation, split_view_->divider_x());
 }

Project: Chrome

BookmarkManagerView* BookmarkManagerView::current() {
  return manager;
}

Project: Chrome

BookmarkManagerView::~BookmarkManagerView() {
  if (select_file_dialog_.get())
    select_file_dialog_->ListenerDestroyed();

  if (!GetBookmarkModel()->IsLoaded()) {
    GetBookmarkModel()->RemoveObserver(this);
  } else {
    table_view_->SetModel(NULL);
    tree_view_->SetModel(NULL);
  }
  manager = NULL;
  open_window = NULL;
}