Address safer CPP failures in WebViewImpl.h

https://bugs.webkit.org/show_bug.cgi?id=290220

Reviewed by Geoffrey Garen.

* Source/WebKit/SaferCPPExpectations/NoUnretainedMemberCheckerExpectations:
* Source/WebKit/UIProcess/mac/WebViewImpl.h:
* Source/WebKit/UIProcess/mac/WebViewImpl.mm:
(WebKit::WebViewImpl::collectKeyboardLayoutCommandsForEvent):
(WebKit::WebViewImpl::doCommandBySelector):
(WebKit::WebViewImpl::insertText):

Canonical link: https://commits.webkit.org/292563@main

Author: cdumez

Source/WebKit/SaferCPPExpectations/ForwardDeclCheckerExpectations

@@ -27,7 +27,6 @@ UIProcess/Cocoa/WebPageProxyCocoa.mm
 UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm
 UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.cpp
 UIProcess/WebProcessPool.h
-UIProcess/mac/WebViewImpl.h
 WebProcess/Extensions/Bindings/JSWebExtensionWrapper.h
 WebProcess/InjectedBundle/InjectedBundle.h
 WebProcess/Inspector/WebInspectorClient.cpp
@@ -37,4 +36,4 @@ WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm
 WebProcess/WebAuthentication/WebAuthenticatorCoordinator.cpp
 WebProcess/WebCoreSupport/WebChromeClient.cpp
 WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
-WebProcess/WebPage/WebPage.cpp
+WebProcess/WebPage/WebPage.cpp

Source/WebKit/SaferCPPExpectations/NoUnretainedMemberCheckerExpectations

@@ -1,6 +1,5 @@
 UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.mm
 UIProcess/DisplayLink.h
 UIProcess/mac/PageClientImplMac.h
-UIProcess/mac/WebViewImpl.h
 WebProcess/InjectedBundle/API/mac/WKWebProcessPlugInBrowserContextController.mm
 WebProcess/InjectedBundle/InjectedBundle.h

Source/WebKit/UIProcess/API/mac/WKWebViewMac.mm

@@ -1705,7 +1705,7 @@ - (_WKThumbnailView *)_thumbnailView
 {
     if (!_impl)
         return nil;
-    return _impl->thumbnailView();
+    return _impl->thumbnailView().autorelease();
 }
 
 - (void)_setIgnoresAllEvents:(BOOL)ignoresAllEvents

Source/WebKit/UIProcess/mac/PageClientImplMac.mm

@@ -161,7 +161,7 @@ - (BOOL)_hostsLayersInWindowServer;
 NSWindow *PageClientImpl::activeWindow() const
 {
     if (m_impl && m_impl->thumbnailView())
-        return m_impl->thumbnailView().window;
+        return [m_impl->thumbnailView() window];
     if (m_impl && m_impl->targetWindowForMovePreparation())
         return m_impl->targetWindowForMovePreparation();
     return m_view.window;

Source/WebKit/UIProcess/mac/WebViewImpl.h

@@ -36,6 +36,7 @@
 #include "WKTextAnimationType.h"
 #include <WebCore/DOMPasteAccess.h>
 #include <WebCore/FocusDirection.h>
+#include <WebCore/KeypressCommand.h>
 #include <WebCore/PlatformPlaybackSessionInterface.h>
 #include <WebCore/ScrollTypes.h>
 #include <WebCore/ShareableBitmap.h>
@@ -184,7 +185,6 @@ enum class ReplacementBehavior : uint8_t;
 
 namespace WebCore {
 struct DragItem;
-struct KeypressCommand;
 #if ENABLE(DIGITAL_CREDENTIALS_UI)
 struct DigitalCredentialsRequestData;
 #endif
@@ -527,7 +527,7 @@ class WebViewImpl final : public CanMakeWeakPtr<WebViewImpl>, public CanMakeChec
     CALayer *acceleratedCompositingRootLayer() const { return m_rootLayer.get(); }
 
     void setThumbnailView(_WKThumbnailView *);
-    _WKThumbnailView *thumbnailView() const { return m_thumbnailView; }
+    RetainPtr<_WKThumbnailView> thumbnailView() const { return m_thumbnailView.get(); }
 
     void setHeaderBannerLayer(CALayer *);
     CALayer *headerBannerLayer() const { return m_headerBannerLayer.get(); }
@@ -985,7 +985,7 @@ class WebViewImpl final : public CanMakeWeakPtr<WebViewImpl>, public CanMakeChec
     RetainPtr<CALayer> m_headerBannerLayer;
     RetainPtr<CALayer> m_footerBannerLayer;
 
-    _WKThumbnailView *m_thumbnailView { nullptr };
+    WeakObjCPtr<_WKThumbnailView> m_thumbnailView;
 
     RetainPtr<_WKRemoteObjectRegistry> m_remoteObjectRegistry;
 
@@ -1012,7 +1012,14 @@ ALLOW_DEPRECATED_DECLARATIONS_END
     // the application to distinguish the case of a new event from one
     // that has been already sent to WebCore.
     RetainPtr<NSEvent> m_keyDownEventBeingResent;
-    Vector<WebCore::KeypressCommand>* m_collectedKeypressCommands { nullptr };
+
+    struct CheckedCommands : public CanMakeCheckedPtr<CheckedCommands> {
+        WTF_MAKE_FAST_ALLOCATED;
+        WTF_OVERRIDE_DELETE_FOR_CHECKED_PTR(CheckedCommands);
+    public:
+        Vector<WebCore::KeypressCommand> commands;
+    };
+    CheckedPtr<CheckedCommands> m_collectedKeypressCommands;
 
     String m_lastStringForCandidateRequest;
     NSInteger m_lastCandidateRequestSequenceNumber;

Source/WebKit/UIProcess/mac/WebViewImpl.mm

@@ -105,7 +105,6 @@
 #import <WebCore/FixedContainerEdges.h>
 #import <WebCore/FontAttributeChanges.h>
 #import <WebCore/FontAttributes.h>
-#import <WebCore/KeypressCommand.h>
 #import <WebCore/LegacyNSPasteboardTypes.h>
 #import <WebCore/LoaderNSURLExtras.h>
 #import <WebCore/LocalizedStrings.h>
@@ -4063,15 +4062,15 @@ static String commandNameForSelector(SEL selector)
 
 void WebViewImpl::reparentLayerTreeInThumbnailView()
 {
-    m_thumbnailView._thumbnailLayer = m_rootLayer.get();
+    [m_thumbnailView.get() _setThumbnailLayer: m_rootLayer.get()];
 }
 
 void WebViewImpl::updateThumbnailViewLayer()
 {
-    _WKThumbnailView *thumbnailView = m_thumbnailView;
+    RetainPtr thumbnailView = m_thumbnailView.get();
     ASSERT(thumbnailView);
 
-    if (thumbnailView._waitingForSnapshot && [m_view window])
+    if ([thumbnailView _waitingForSnapshot] && [m_view window])
         reparentLayerTreeInThumbnailView();
 }
 
@@ -5064,10 +5063,10 @@ static bool eventKeyCodeIsZeroOrNumLockOrFn(NSEvent *event)
 
 Vector<WebCore::KeypressCommand> WebViewImpl::collectKeyboardLayoutCommandsForEvent(NSEvent *event)
 {
-    Vector<WebCore::KeypressCommand> commands;
-
     if ([event type] != NSEventTypeKeyDown)
-        return commands;
+        return { };
+
+    CheckedCommands commands;
 
     ASSERT(!m_collectedKeypressCommands);
     m_collectedKeypressCommands = &commands;
@@ -5081,12 +5080,12 @@ static bool eventKeyCodeIsZeroOrNumLockOrFn(NSEvent *event)
 
     if (auto menu = NSApp.mainMenu; event.modifierFlags & NSEventModifierFlagFunction
         && [menu respondsToSelector:@selector(_containsItemMatchingEvent:includingDisabledItems:)] && [menu _containsItemMatchingEvent:event includingDisabledItems:YES]) {
-        commands.removeAllMatching([](auto& command) {
+        commands.commands.removeAllMatching([](auto& command) {
             return command.commandName == "insertText:"_s;
         });
     }
 
-    return commands;
+    return WTFMove(commands.commands);
 }
 
 void WebViewImpl::interpretKeyEvent(NSEvent *event, void(^completionHandler)(BOOL handled, const Vector<WebCore::KeypressCommand>& commands))
@@ -5119,9 +5118,9 @@ static bool eventKeyCodeIsZeroOrNumLockOrFn(NSEvent *event)
 {
     LOG(TextInput, "doCommandBySelector:\"%s\"", sel_getName(selector));
 
-    if (auto* keypressCommands = m_collectedKeypressCommands) {
+    if (m_collectedKeypressCommands) {
         WebCore::KeypressCommand command(NSStringFromSelector(selector));
-        keypressCommands->append(command);
+        m_collectedKeypressCommands->commands.append(command);
         LOG(TextInput, "...stored");
         m_page->registerKeypressCommandName(command.commandName);
     } else {
@@ -5173,11 +5172,10 @@ static bool eventKeyCodeIsZeroOrNumLockOrFn(NSEvent *event)
     // - If it's from an input method, then we should insert the text now.
     // - If it's sent outside of keyboard event processing (e.g. from Character Viewer, or when confirming an inline input area with a mouse),
     // then we also execute it immediately, as there will be no other chance.
-    Vector<WebCore::KeypressCommand>* keypressCommands = m_collectedKeypressCommands;
-    if (keypressCommands && !m_isTextInsertionReplacingSoftSpace) {
+    if (m_collectedKeypressCommands && !m_isTextInsertionReplacingSoftSpace) {
         ASSERT(replacementRange.location == NSNotFound);
         WebCore::KeypressCommand command("insertText:"_s, text);
-        keypressCommands->append(command);
+        m_collectedKeypressCommands->commands.append(command);
         LOG(TextInput, "...stored");
         m_page->registerKeypressCommandName(command.commandName);
         return;