Source/WebKit/chromium: Fix use after free in ContextMenuClientImpl.cpp
https://bugs.webkit.org/show_bug.cgi?id=109220

Patch by Rouslan Solomakhin <rouslan@chromium.org> on 2013-02-20
Reviewed by Tony Chang.

ContextMenuClientImpl can use a DocumentMarker after it is freed. The DocumentMarker is originally allocated
by the spell checker. When the user context-clicks on a misspelling, ContextMenuClientImpl saves a reference
to the clicked DocumentMarker, changes the selection, and then uses the DocumentMarker. Changing the selection
causes re-check of spelling. If the spell check client serves the spellcheck request from cache, then re-checking
spelling will delete the DocumentMarker and add a new one. This invalidates the DocumentMarker reference held by
ContextMenuClientImpl. When ContextMenuClientImpl attempts to use the DocumentMarker, Address Sanitizer detects
use after free. The fix is to save a copy of the DocumentMarker before changing selection.

* src/ContextMenuClientImpl.cpp:
(WebKit::selectMisspellingAsync): Save a copy of DocumentMarker before changing selection.
(WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems): Use DocumentMarker instead of Vector<DocumentMarker*>.

Tools: [Chromium] Serve spellcheck suggestions for editing/spelling/spelling-changed-text.html from cache
https://bugs.webkit.org/show_bug.cgi?id=109220

Patch by Rouslan Solomakhin <rouslan@chromium.org> on 2013-02-19
Reviewed by Tony Chang.

* DumpRenderTree/chromium/TestRunner/src/MockSpellCheck.cpp:
(WebTestRunner::MockSpellCheck::hasInCache): Added a method to detect whether spellcheck results can be served from cache.
(WebTestRunner):
(WebTestRunner::MockSpellCheck::fillSuggestionList): Modified to suggest "checker" for the word "cheher".
(WebTestRunner::MockSpellCheck::initializeIfNeeded): Modified to mark "cheher" as misspelling.
* DumpRenderTree/chromium/TestRunner/src/MockSpellCheck.h:
(MockSpellCheck):
* DumpRenderTree/chromium/TestRunner/src/SpellCheckClient.cpp:
(WebTestRunner::SpellCheckClient::requestCheckingOfText): Modified to serve spellcheck suggestions from cache when possible.

LayoutTests: Spellchecker should not crash after text has changed and spellcheck results are served from cache
https://bugs.webkit.org/show_bug.cgi?id=109220

Patch by Rouslan Solomakhin <rouslan@chromium.org> on 2013-02-20
Reviewed by Tony Chang.

* editing/spelling/spelling-changed-text-expected.txt: Added the expected output for serving spellcheck results from cache for edited text.
* editing/spelling/spelling-changed-text.html: Added a test for serving spellcheck results from cache for edited text.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143470 268f45cc-cd09-0410-ab3c-d52691b4dbfc