Frame element doesn't always unload its child frame.
https://bugs.webkit.org/show_bug.cgi?id=94717

Patch by Sergey Glazunov <serg.glazunov@gmail.com> on 2012-09-04
Reviewed by Hajime Morita.

Source/WebCore:

It's possible for a frame element that has been removed from the document
to retain an active child frame. This inconsistent state may become a source
of security vulnerabilities.

The patch adds a global HashSet to store the nodes currently processed by
ChildFrameDisconnector. Insertion into these nodes' subtrees is not allowed until
the processing is complete.

Also, the ChildFrameDisconnector call in removeChild(ren) is now immediately
followed by the actual removal.

Test: fast/frames/out-of-document-iframe-has-child-frame.html

* dom/ContainerNode.cpp:
(WebCore::willRemoveChildren): Move the ChildFrameDisconnector call out of a loop.
(WebCore::ContainerNode::removeChild): Rearrange some event firing code.
(WebCore::ContainerNode::removeChildren): Ditto.
* dom/ContainerNodeAlgorithms.cpp:
(WebCore::ChildFrameDisconnector::collectDescendant): Pass a new parameter to collectDescendant(Node*).
* dom/ContainerNodeAlgorithms.h:
(WebCore::ChildFrameDisconnector::ChildFrameDisconnector):
(ChildFrameDisconnector): Maintain a list of nodes that have an active ChildFrameDisconnector.
(WebCore::ChildFrameDisconnector::~ChildFrameDisconnector):
(WebCore::ChildFrameDisconnector::rootNodes):
(WebCore::ChildFrameDisconnector::collectDescendant): Add ShouldIncludeRoot parameter.
(WebCore::ChildFrameDisconnector::nodeHasDisconnector):
(WebCore):
* dom/Node.cpp:
(WebCore::checkAcceptChild): Reject a parent node if it or one of its parents has an active ChildFrameDisconnector.
* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::didNotifySubtreeInsertions): Check if an element is still in the document.

LayoutTests:

* fast/frames/out-of-document-iframe-has-child-frame-expected.txt: Added.
* fast/frames/out-of-document-iframe-has-child-frame.html: Added.
* fast/innerHTML/innerHTML-iframe-expected.txt:
* platform/chromium/fast/frames/out-of-document-iframe-has-child-frame-expected.txt: Added.
* platform/chromium/fast/innerHTML: Added.
* platform/chromium/fast/innerHTML/innerHTML-iframe-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127534 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: remove final createIndex backend glue
https://bugs.webkit.org/show_bug.cgi?id=95385

Patch by Alec Flett <alecflett@chromium.org> on 2012-09-04
Reviewed by Adam Barth.

Source/WebCore:

Remove all code that created index keys in the IndexedDB backend.

No new tests, this is just removal of dead code.

* Modules/indexeddb/IDBKeyPathBackendImpl.cpp: Removed.
* Modules/indexeddb/IDBKeyPathBackendImpl.h: Removed.
* Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
(WebCore):
* WebCore.gyp/WebCore.gyp:
* WebCore.gypi:
* storage/chromium/IDBKeyPathBackendImpl.cpp: Removed.

Source/WebKit/chromium:

Remove chromium glue for old key-generation code.

* public/WebIDBKey.h:
(WebIDBKey):
* src/WebIDBKey.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127535 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound
https://bugs.webkit.org/show_bug.cgi?id=95717

Reviewed by Oliver Hunt.
        
Rolling back in after fixing the negative index case.

Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already
there so we should just use it!

* bytecode/DFGExitProfile.h:
(JSC::DFG::exitKindToString):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127536 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Some flaky inspector tests on Windows. Adding to skip list.
https://bugs.webkit.org/show_bug.cgi?id=95802

* platform/win/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127537 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use TrackedRendererListHashSet typedef for percentHeightDescendants()
https://bugs.webkit.org/show_bug.cgi?id=95791

Reviewed by Ojan Vafai.

There were a couple callers that were using ListHashSet<RenderBox*> instead of the typedef.

No new tests, this is just a refactor.

* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::layoutRows):
* rendering/RenderView.cpp:
(WebCore::RenderView::setFixedPositionedObjectsNeedLayout):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127538 268f45cc-cd09-0410-ab3c-d52691b4dbfc