[V8] Fix issues with [DoNotCheckSecurity] which depended on non ES5 compliant behavior
https://bugs.webkit.org/show_bug.cgi?id=93555

Reviewed by Kentaro Hara.

Before this change we were relying on a V8 bug where instance properties could be shadow
read only properties on the prototype. With this change we no longer depend on this incorrect
V8 behavior and instead use a hidden v8 property that is only returned if the code can access
the frame.

No new tests. No change in behavior.

* bindings/scripts/CodeGeneratorV8.pm:
(GenerateDomainSafeFunctionGetter):
(GenerateDomainSafeFunctionSetter):
(GenerateNonStandardFunction):
(GenerateImplementation):
* bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
(WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
(WebCore::TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter):
(TestActiveDOMObjectV8Internal):
(WebCore::ConfigureV8TestActiveDOMObjectTemplate):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125232 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTest: fast/forms/select/menulist-popup-crash.html timeout on Windows.
https://bugs.webkit.org/show_bug.cgi?id=93667

Patch by Roger Fong <roger_fong@apple.com> on 2012-08-09
Reviewed by Tim Horton.

Test times out and was added to Mac skiplist: http://trac.webkit.org/changeset/102884.
Adding to Windows skip list as well.

* platform/win/Skipped:
Add test to skip list.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125233 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in WebCore::RenderTable::cellBefore
https://bugs.webkit.org/show_bug.cgi?id=91160

Reviewed by Abhishek Arya.

Source/WebCore:

The issue was that we wouldn't properly set the row index on row in a newly split table. When inserting
the cell into the new row, we would try to repaint the cell which would access the row index and crash.
This came from splitAnonymousBoxesAroundChild calling RenderObjectChildList::insertChildNode directly
which doesn't invoke the row setting logic (RenderTableSection::addChild for example but we cannot call
addChild due to concern over splitting flows in the general case).

Test: fast/table/split-anonymous-boxes-around-table-repaint-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::splitAnonymousBoxesAroundChild):
Dirty our parent box, which forces a cell recomputation which will set the row index. This needs to
be done *before* we insert the child to avoid crashing when repainting the new child.

LayoutTests:

* fast/table/split-anonymous-boxes-around-table-repaint-crash-expected.txt: Added.
* fast/table/split-anonymous-boxes-around-table-repaint-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125234 268f45cc-cd09-0410-ab3c-d52691b4dbfc
http/tests/security/mixedContent/blob-url-in-iframe.html fails on Mac
https://bugs.webkit.org/show_bug.cgi?id=88736

Reviewed by Alexey Proskuryakov.

Source/WebKit/mac:

WebView::_canHandleRequest should return true for "blob:" URL so that it can be shown in iframe.

* WebView/WebView.mm:
(+[WebView _canHandleRequest:forMainFrame:]):

LayoutTests:

Remove security/mixedContent/blob-url-in-iframe.html as it should pass with this patch.

* platform/mac/Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125235 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] V8Utilities::throwTypeMismatchException() should use setDOMException()
https://bugs.webkit.org/show_bug.cgi?id=93610

Reviewed by Adam Barth.

Given that V8Utilities::throwTypeMismatchException() throws a DOM exception,
we should use setDOMException() instead of throwError().

This patch also renames throwTypeMismatchException() to setTypeMismatchException().

No tests. I couldn't figure out how to trigger the call path.
Either way this is just a minor change of error message.

* bindings/v8/V8Utilities.cpp:
(WebCore::setTypeMismatchException):
* bindings/v8/V8Utilities.h:
(WebCore::createFunctionOnlyCallback):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=93587
Node::replaceChild() can create bad DOM topology with MutationEvent, Part 2

Reviewed by Kent Tamura.

Source/WebCore:

This is a followup of r124156. replaceChild() has yet another hidden
MutationEvent trigger. This change added a guard for it.

Test: fast/events/mutation-during-replace-child-2.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::replaceChild):

LayoutTests:

* fast/events/mutation-during-replace-child-2-expected.txt: Added.
* fast/events/mutation-during-replace-child-2.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, Chromium-mac (clang) build fix for r125230.

* platform/graphics/chromium/TiledLayerChromium.cpp:
(WebCore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125238 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HTMLElement.classList cannot remove classnames with uppercase characters
https://bugs.webkit.org/show_bug.cgi?id=93628

Reviewed by Alexey Proskuryakov.

Before this patch we were trying to be smart and determine whether we needed the update m_classNamesForQuirksMode
based on whether m_classNamesForQuirksMode.isNull(), however, m_classNamesForQuirksMode.isNull() is true when the
class name is the empty string.

We also did not update m_classNamesForQuirksMode when the class attribute was cleared.

Source/WebCore:

Updated tests.

* dom/StyledElement.cpp:
(WebCore::StyledElement::classAttributeChanged):
* html/ClassList.cpp:
(WebCore::ClassList::reset):
(WebCore::ClassList::classNames):

LayoutTests:

* fast/dom/HTMLElement/class-list-expected.txt:
* fast/dom/HTMLElement/class-list-quirks-expected.txt:
* fast/dom/HTMLElement/script-tests/class-list.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125239 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium-Android] Skip layout tests directories that are not applicable
https://bugs.webkit.org/show_bug.cgi?id=93670

Reviewed by Dirk Pranke.

Tools:

Added back ChromiumAndroidPort.skipped_layout_tests to skip some whole directories.
The method is more convenient to skip whole directories than SKIP in TestExpectations
because its higher priority. Will still use TestExpectations to skip individual tests.

* Scripts/webkitpy/layout_tests/port/chromium_android.py:
(ChromiumAndroidPort.skipped_layout_tests):

LayoutTests:

Removed 'WONTFIX ANDROID SKIP' lines for whole directories added in r125094.
Use ChromiumAndroidPort.skipped_layout_tests() instead.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125240 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Remove duplicate test expectation entry causing a lint error.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125241 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Rename V8BindingPerContextData to V8PerContextData
https://bugs.webkit.org/show_bug.cgi?id=93595

Reviewed by Adam Barth.

For a better name. See discussion in bug 93333.

No tests. No change in behavior.

* UseV8.cmake: Added V8PerContextData.cpp. The fact that missing V8BindingPerContextData.cpp
has not caused any problem indicates that UseV8.cmake is not used at all?
* WebCore.gypi:
* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::V8DOMWindowShell::initContextIfNeeded):
* bindings/v8/V8DOMWindowShell.h:
(WebCore::V8DOMWindowShell::perContextData):
(V8DOMWindowShell):
* bindings/v8/V8DOMWrapper.cpp:
(WebCore::V8DOMWrapper::constructorForType):
(WebCore::V8DOMWrapper::perContextData):
(WebCore::V8DOMWrapper::instantiateV8Object):
* bindings/v8/V8DOMWrapper.h:
(WebCore):
(V8DOMWrapper):
* bindings/v8/V8IsolatedContext.cpp:
(WebCore::V8IsolatedContext::V8IsolatedContext):
* bindings/v8/V8IsolatedContext.h:
(WebCore):
(WebCore::V8IsolatedContext::perContextData):
(V8IsolatedContext):
* bindings/v8/V8PerContextData.cpp: Renamed from Source/WebCore/bindings/v8/V8BindingPerContextData.cpp.
(WebCore):
(WebCore::V8PerContextData::dispose):
(WebCore::V8PerContextData::init):
(WebCore::V8PerContextData::createWrapperFromCacheSlowCase):
(WebCore::V8PerContextData::constructorForTypeSlowCase):
* bindings/v8/V8PerContextData.h: Renamed from Source/WebCore/bindings/v8/V8BindingPerContextData.h.
(WebCore):
(V8PerContextData):
(WebCore::V8PerContextData::create):
(WebCore::V8PerContextData::~V8PerContextData):
(WebCore::V8PerContextData::createWrapperFromCache):
(WebCore::V8PerContextData::constructorForType):
(WebCore::V8PerContextData::V8PerContextData):
* bindings/v8/V8Proxy.cpp:
(WebCore::V8Proxy::retrievePerContextData):
* bindings/v8/V8Proxy.h:
(WebCore):
(V8Proxy):
* bindings/v8/WorkerContextExecutionProxy.cpp:
(WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
* bindings/v8/WorkerContextExecutionProxy.h:
(WebCore):
(WebCore::WorkerContextExecutionProxy::perContextData):
(WorkerContextExecutionProxy):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125242 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix null pointer deref in RenderFileUploadControl::computePreferredLogicalWidth().
https://bugs.webkit.org/show_bug.cgi?id=93579

Reviewed by Kent Tamura.

Source/WebCore:

Checks the upload control has a non-null button renderer before dereferencing.

Test: fast/forms/file/file-crash-by-display-none-button.html

* rendering/RenderFileUploadControl.cpp:
(WebCore::RenderFileUploadControl::computePreferredLogicalWidths):

LayoutTests:

Exercise code path that causes an upload button to exist without a renderer.

* fast/forms/file/file-crash-by-display-none-button.html: Added.
* fast/forms/file/file-crash-by-display-none-button-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125243 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Updated run-binding-tests results.

* bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
(WebCore::TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125244 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed gardening.

Unskip tests that are now non-flaky (see fix in http://trac.webkit.org/changeset/121506)

* platform/chromium/TestExpectations:
* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125245 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Unreviewed gardening

Rebaseline compositing/repaint/newly-composited-on-scroll.html on EFL after r125086.
Rebaseline fast/forms/datalist/range-snap-to-datalist.html on EFL after r125048.

* platform/efl/compositing/repaint/newly-composited-on-scroll-expected.png: Added.
* platform/efl/compositing/repaint/newly-composited-on-scroll-expected.txt: Added.
* platform/efl/fast/forms/datalist/range-snap-to-datalist-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125246 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Mouse-select then Cut, results in preceding character being lost
https://bugs.webkit.org/show_bug.cgi?id=60830

Patch by Sukolsak Sakshuwong <sukolsak@google.com> on 2012-08-09
Reviewed by Ryosuke Niwa.

Source/WebCore:

This bug happened only in text fields and text areas, not in other
content-editable elements. That's because when we cut or copied text
in a text control, we called Pasteboard::writePlainText instead of
Pasteboard::writeSelection. writePlainText did not record the smart replace
information. Make writePlainText record the smart replace information.

Test: editing/pasteboard/smart-paste-in-text-control.html

* editing/Editor.cpp:
(WebCore::Editor::cut):
(WebCore::Editor::copy):
* inspector/InjectedScriptHost.cpp:
(WebCore::InjectedScriptHost::copyText):
* inspector/InspectorFrontendHost.cpp:
(WebCore::InspectorFrontendHost::copyText):
* platform/Pasteboard.h:
* platform/blackberry/PasteboardBlackBerry.cpp:
(WebCore::Pasteboard::writePlainText):
* platform/chromium/PasteboardChromium.cpp:
(WebCore::Pasteboard::writePlainText):
* platform/efl/PasteboardEfl.cpp:
(WebCore::Pasteboard::writePlainText):
* platform/gtk/PasteboardGtk.cpp:
(WebCore::Pasteboard::writePlainText):
* platform/mac/ClipboardMac.mm:
(WebCore::ClipboardMac::writePlainText):
* platform/mac/PasteboardMac.mm:
(WebCore::Pasteboard::writePlainText):
* platform/qt/PasteboardQt.cpp:
(WebCore::Pasteboard::writePlainText):
* platform/win/PasteboardWin.cpp:
(WebCore::Pasteboard::writePlainText):
* platform/wince/PasteboardWinCE.cpp:
(WebCore::Pasteboard::writePlainText):
* platform/wx/ClipboardWx.cpp:
(WebCore::ClipboardWx::writePlainText):
* platform/wx/PasteboardWx.cpp:
(WebCore::Pasteboard::writePlainText):

LayoutTests:

* editing/pasteboard/smart-paste-in-text-control-expected.txt: Added.
* editing/pasteboard/smart-paste-in-text-control.html: Added.
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125247 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: CodeGeneratorInspector.py: add complete support for TypeBuilder::Array
https://bugs.webkit.org/show_bug.cgi?id=93559

Patch by Peter Rybin <peter.rybin@gmail.com> on 2012-08-09
Reviewed by Pavel Feldman.

Missing binding methods are added to templates. Core assert methods are declared in a helper class now.

* inspector/CodeGeneratorInspector.py:
(RawTypes.BaseType.generate_validate_method):
(RawTypes.BaseType.get_raw_validator_call_text):
(RawTypes.generate_validate_methods):
(RawTypes.Int.generate_validate_method):
(RawTypes.Int.get_raw_validator_call_text):
(RawTypes.Number.get_validate_method_params.ValidateMethodParams):
(RawTypes.Any.generate_validate_method):
(RawTypes.Any.get_raw_validator_call_text):
(RawTypes.Array.get_validate_method_params.ValidateMethodParams):
(RawTypes.Array.get_validate_method_params):
(PlainObjectBinding.get_validator_call_text):
(RuntimeCastHelper):
(Generator):
(Generator.go):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125248 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Remove unused method InspectorResourceAgent::clearCache from Resource Agent.
https://bugs.webkit.org/show_bug.cgi?id=93675

Patch by Vivek Galatage <vivekgalatage@gmail.com> on 2012-08-09
Reviewed by Pavel Feldman.

Removing unused method declaration for clearCache in InspectorResourceAgent. It's marked as FIXME.
Hence cleaning up.

No new tests as cleanup.

* inspector/InspectorResourceAgent.h:
(InspectorResourceAgent):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125249 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add DOMString reflection test
https://bugs.webkit.org/show_bug.cgi?id=93681

Reviewed by Hajime Morita.

Introduce fast/dom/domstring-atribute-reflection.html, which
should have tess for all of reflected DOMString IDL attribute,
like fast/dom/boolean-attribute-reflection.html and
URL-attribute-reflectin.html.

As the first step, integrate fast/forms/input-step.html and
fast/form/name-attribute.html into
domstring-attribute-reflection.html.

* fast/dom/domstring-attribute-reflection-expected.txt: Renamed from LayoutTests/fast/forms/name-attribute-expected.txt.
* fast/dom/domstring-attribute-reflection.html: Added.
* fast/forms/input-step-expected.txt: Removed.
* fast/forms/input-step.html: Removed.
* fast/forms/name-attribute.html: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125250 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SVGElementInstance should have EventTarget on the prototype chain
https://bugs.webkit.org/show_bug.cgi?id=88232

Reviewed by Adam Barth.

SVG 1.1 specifies that SVGElementInstance has EventTarget as its
parent interface:
<http://www.w3.org/TR/SVG/struct.html#InterfaceSVGElementInstance>
Match the spec by putting EventTarget on the prototype chain of
SVGElementInstance instead of redundantly declaring
addEventListener, removeEventListener and dispatchEvent on the
SVGElementInstance interface. This is an incremental step to make
all EventTargets do it this way, being tracked in bug 67312.

Covered by existing tests, eg
svg/custom/use-instanceRoot-as-event-target.xhtml

* CMakeLists.txt: Finding base interface types requires
searching directories with the IDLs of base interfaces.
* DerivedSources.cpp: Add generated JSEventTarget.cpp.
* DerivedSources.make: (Search paths again -- see CMakeLists.txt)
* DerivedSources.pri: "
* bindings/js/JSEventTargetCustom.cpp:
(WebCore::toEventTarget): Try to unwrap EventTargets simply as
EventTargets. When all EventTargets do this consistently this
function will be simplified.
* bindings/js/JSSVGElementInstanceCustom.cpp:
(WebCore::JSSVGElementInstance::visitChildren): SVGElementInstance
skips walking its event listener list because it forwards
listeners to its corresponding element.
* bindings/scripts/CodeGenerator.pm:
(IsStrictSubtype): For finding what is an EventTarget based on
parent interface.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader): Extend the heuristic for what is an
EventTarget. When all EventTargets are handled consistently this
will be simplified.
(GenerateImplementation):
* bindings/scripts/CodeGeneratorV8.pm: Extend the heuristic for
what is an EventTarget, and remove some of the special-casing for
EventTarget.
(GenerateHeader):
(GetInternalFields):
(GenerateImplementation):
(BaseInterfaceName):
(GenerateToV8Converters):
(GetNativeType):
(JSValueToNative):
(GetV8HeaderName):
* bindings/scripts/test/V8/V8Float64Array.cpp:
(WebCore::V8Float64Array::wrapSlow): Add assertions.
* bindings/scripts/test/V8/V8TestNode.cpp:
(WebCore::V8TestNode::wrapSlow):
* svg/SVGElementInstance.h: Must extend EventTarget first so that
static_cast<EventTarget*>(elementInstance) is the same pointer as
elementInstance, similar to how static_cast<Node*>(element) is the
same pointer as element.
* svg/SVGElementInstance.idl: Extend EventTarget; no longer need
to declare add/removeEventListener and dispatchEvent.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125251 268f45cc-cd09-0410-ab3c-d52691b4dbfc