Regression(120096): Protect the element used by ImageLoader until the end of notifyFinished().
https://bugs.webkit.org/show_bug.cgi?id=90471

Reviewed by Brady Eidson.

Source/WebCore:

Test: http/tests/security/video-poster-cross-origin-crash.html

* html/HTMLImageLoader.cpp:
(WebCore::HTMLImageLoader::notifyFinished): Hang on to the element until we're done.
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::setImage): No behavior change.
(WebCore):
(WebCore::ImageLoader::setImageWithoutConsideringPendingLoadEvent): Split off from old setImage, minus calling updatedHasPendingLoadEvent().
(WebCore::ImageLoader::notifyFinished): Invoke updatedHasPendingLoadEvent when done with cross origin errors.
* loader/ImageLoader.h:
(ImageLoader):

LayoutTests:

* http/tests/security/video-poster-cross-origin-crash-expected.txt: Added.
* http/tests/security/video-poster-cross-origin-crash.html: Added. From fuzzer.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123121 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Move WebAudioSourceProvider destructor from public to protected
https://bugs.webkit.org/show_bug.cgi?id=91669

Reviewed by Darin Fisher.

The lifetime of a WebAudioSourceProvider is managed by the implementor
and should never be deallocted by WebKit.

* public/WebAudioSourceProvider.h:
(WebAudioSourceProvider):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123122 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] WebView is missing isSelectionEditable and backgroundColor which are used by chromium-android
https://bugs.webkit.org/show_bug.cgi?id=91671

Reviewed by Darin Fisher.

I haven't studied what these APIs are used for downstream, but they
seem harmless enough.

* public/WebView.h:
(WebView):
* public/WebWidget.h:
(WebWidget):
(WebKit::WebWidget::backgroundColor):
* src/WebViewImpl.cpp:
(WebKit::WebViewImpl::isSelectionEditable):
(WebKit):
(WebKit::WebViewImpl::backgroundColor):
* src/WebViewImpl.h:
(WebViewImpl):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123123 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r123117.
http://trac.webkit.org/changeset/123117
https://bugs.webkit.org/show_bug.cgi?id=91667

Breaks chromium-win compile.

* WebCore.gyp/WebCore.gyp:
* WebCore.gyp/scripts/rule_bison.py:
* bindings/scripts/preprocessor.pm:
(applyPreprocessor):
* make-hash-tools.pl:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123124 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT)
https://bugs.webkit.org/show_bug.cgi?id=91243

Reviewed by Geoffrey Garen.

Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer.

* runtime/JSGlobalData.h:
(JSC):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123125 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Shape-inside / shape-outside should support percent-based measurements
https://bugs.webkit.org/show_bug.cgi?id=90311

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2012-07-19
Reviewed by Andreas Kling.

Source/WebCore:

Update the CSS Parser to accept percentage length values for exclusion
shapes.

Testing added to LayoutTests/fast/exclusions/parsing-wrap-shape-lengths.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseExclusionShapeRectangle):
(WebCore::CSSParser::parseExclusionShapeCircle):
(WebCore::CSSParser::parseExclusionShapeEllipse):
(WebCore::CSSParser::parseExclusionShapePolygon):

LayoutTests:

Added tests for percent based lengths for exclusion shapes.

* fast/exclusions/parsing-wrap-shape-lengths-expected.txt:
* fast/exclusions/parsing-wrap-shape-lengths.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123126 268f45cc-cd09-0410-ab3c-d52691b4dbfc