Regression(r127163): Heap-use-after-free in WebCore::RenderBoxModelObject::hasSelfPaintingLayer
https://bugs.webkit.org/show_bug.cgi?id=95632

Reviewed by Abhishek Arya.

Source/WebCore:

Don't add floats to the floating object set of blocks that avoid floats. There's no point in doing that
and they will never get cleared out during relayout.

Tests: fast/css/intruding-floats-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::clearFloatsIfNeeded):

LayoutTests:

* fast/css/intruding-floats-crash-expected.txt: Added.
* fast/css/intruding-floats-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Update test expectations for Android.

* platform/chromium-android/TestExpectations:
* platform/chromium-android/compositing/layer-creation/overflow-scrolling-touch-expected.txt:
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127510 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Rebaseline Windows expected results for accessibility\canvas-description-and-role-expected.txt.
One of the results in the test now passes.

* platform/win/accessibility/canvas-description-and-role-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127511 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium-Android] Include device serial number in ChromiumAndroidDriver log messages
https://bugs.webkit.org/show_bug.cgi?id=95770

Reviewed by Adam Barth.

* Scripts/webkitpy/layout_tests/port/chromium_android.py:
(ChromiumAndroidDriver.__init__):
(ChromiumAndroidDriver._log_error): Added to replace original _log.error().
(ChromiumAndroidDriver._log_debug): Added to replace original _log.debug().
(ChromiumAndroidDriver._abort): Added to replace original raise AssertionError().
(ChromiumAndroidDriver._push_executable):
(ChromiumAndroidDriver._push_fonts):
(ChromiumAndroidDriver._push_test_resources):
(ChromiumAndroidDriver._run_adb_command):
(ChromiumAndroidDriver._get_last_stacktrace):
(ChromiumAndroidDriver._get_crash_log):
(ChromiumAndroidDriver._start):
(ChromiumAndroidDriver._start_once):
(ChromiumAndroidDriver._start_once.deadlock_detector):
* Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
(ChromiumAndroidDriverTest.test_get_crash_log):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127512 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make plugins respect third-party storage blocking setting
https://bugs.webkit.org/show_bug.cgi?id=94888

Reviewed by Brady Eidson.

Source/WebCore:

Added functions for discerning if a plugin should be able to access its storage in its current origin.

Tests: http/tests/security/cross-origin-plugin-allowed.html
       http/tests/security/cross-origin-plugin.html

* WebCore.exp.in: Export FrameTree::top and SecurityOrigin::canAccessStorage
* page/SecurityOrigin.h: Added canAccessPluginStorage
(WebCore::SecurityOrigin::canAccessPluginStorage):

Source/WebKit2:

Plugins that are in a third-party context should be put into private browsing mode so their storage is temporary.

* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::isPrivateBrowsingEnabled): Put the plugin into private browsing mode if it is in a third-party context.
(WebKit::PluginView::privateBrowsingStateChanged): Make sure a plugin doesn't leave private browsing mode if it's in a third-party context.

LayoutTests:

Created tests for plugins in a third party and first party context when third-party blocking is on and off.

* http/tests/security/cross-origin-plugin-allowed-expected.txt: Added.
* http/tests/security/cross-origin-plugin-allowed.html: Added.
* http/tests/security/cross-origin-plugin-expected.txt: Added.
* http/tests/security/cross-origin-plugin-private-browsing-toggled-allowed-expected.txt: Added.
* http/tests/security/cross-origin-plugin-private-browsing-toggled-allowed.html: Added.
* http/tests/security/cross-origin-plugin-private-browsing-toggled-expected.txt: Added.
* http/tests/security/cross-origin-plugin-private-browsing-toggled.html: Added.
* http/tests/security/cross-origin-plugin.html: Added.
* http/tests/security/resources/cross-origin-iframe-for-plugin.html: Added.
* http/tests/security/resources/cross-origin-iframe-for-plugin-async.html: Added.
* platform/mac-wk2/http/tests/security/cross-origin-plugin-expected.txt: Added.
* platform/mac-wk2/http/tests/security/cross-origin-plugin-private-browsing-toggled-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127513 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix style for Event.h
https://bugs.webkit.org/show_bug.cgi?id=95779

Patch by Nikhil Bhargava <nbhargava@google.com> on 2012-09-04
Reviewed by Eric Seidel.

Changes indenting for Event.h to match style guidelines for namespaces

* dom/Event.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127514 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] FatFingers::cachingStrategy uses incorrect enum value
https://bugs.webkit.org/show_bug.cgi?id=95783

Reviewed by Antonio Gomes.

Use the correct enum values.

* WebKitSupport/FatFingers.cpp:
(BlackBerry::WebKit::FatFingers::cachingStrategy):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r127503.
http://trac.webkit.org/changeset/127503
https://bugs.webkit.org/show_bug.cgi?id=95788

broke some tests (fast/js/dfg-negative-array-index, fast/js
/dfg-put-by-val-setter-then-get-by-val) (Requested by thorton
on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-09-04

* bytecode/DFGExitProfile.h:
(JSC::DFG::exitKindToString):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127516 268f45cc-cd09-0410-ab3c-d52691b4dbfc