[V8] Fix issues with [DoNotCheckSecurity] which depended on non ES5 compliant behavior
https://bugs.webkit.org/show_bug.cgi?id=93555

Reviewed by Kentaro Hara.

Before this change we were relying on a V8 bug where instance properties could be shadow
read only properties on the prototype. With this change we no longer depend on this incorrect
V8 behavior and instead use a hidden v8 property that is only returned if the code can access
the frame.

No new tests. No change in behavior.

* bindings/scripts/CodeGeneratorV8.pm:
(GenerateDomainSafeFunctionGetter):
(GenerateDomainSafeFunctionSetter):
(GenerateNonStandardFunction):
(GenerateImplementation):
* bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
(WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
(WebCore::TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter):
(TestActiveDOMObjectV8Internal):
(WebCore::ConfigureV8TestActiveDOMObjectTemplate):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125232 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTest: fast/forms/select/menulist-popup-crash.html timeout on Windows.
https://bugs.webkit.org/show_bug.cgi?id=93667

Patch by Roger Fong <roger_fong@apple.com> on 2012-08-09
Reviewed by Tim Horton.

Test times out and was added to Mac skiplist: http://trac.webkit.org/changeset/102884.
Adding to Windows skip list as well.

* platform/win/Skipped:
Add test to skip list.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125233 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in WebCore::RenderTable::cellBefore
https://bugs.webkit.org/show_bug.cgi?id=91160

Reviewed by Abhishek Arya.

Source/WebCore:

The issue was that we wouldn't properly set the row index on row in a newly split table. When inserting
the cell into the new row, we would try to repaint the cell which would access the row index and crash.
This came from splitAnonymousBoxesAroundChild calling RenderObjectChildList::insertChildNode directly
which doesn't invoke the row setting logic (RenderTableSection::addChild for example but we cannot call
addChild due to concern over splitting flows in the general case).

Test: fast/table/split-anonymous-boxes-around-table-repaint-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::splitAnonymousBoxesAroundChild):
Dirty our parent box, which forces a cell recomputation which will set the row index. This needs to
be done *before* we insert the child to avoid crashing when repainting the new child.

LayoutTests:

* fast/table/split-anonymous-boxes-around-table-repaint-crash-expected.txt: Added.
* fast/table/split-anonymous-boxes-around-table-repaint-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125234 268f45cc-cd09-0410-ab3c-d52691b4dbfc
http/tests/security/mixedContent/blob-url-in-iframe.html fails on Mac
https://bugs.webkit.org/show_bug.cgi?id=88736

Reviewed by Alexey Proskuryakov.

Source/WebKit/mac:

WebView::_canHandleRequest should return true for "blob:" URL so that it can be shown in iframe.

* WebView/WebView.mm:
(+[WebView _canHandleRequest:forMainFrame:]):

LayoutTests:

Remove security/mixedContent/blob-url-in-iframe.html as it should pass with this patch.

* platform/mac/Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125235 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] V8Utilities::throwTypeMismatchException() should use setDOMException()
https://bugs.webkit.org/show_bug.cgi?id=93610

Reviewed by Adam Barth.

Given that V8Utilities::throwTypeMismatchException() throws a DOM exception,
we should use setDOMException() instead of throwError().

This patch also renames throwTypeMismatchException() to setTypeMismatchException().

No tests. I couldn't figure out how to trigger the call path.
Either way this is just a minor change of error message.

* bindings/v8/V8Utilities.cpp:
(WebCore::setTypeMismatchException):
* bindings/v8/V8Utilities.h:
(WebCore::createFunctionOnlyCallback):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=93587
Node::replaceChild() can create bad DOM topology with MutationEvent, Part 2

Reviewed by Kent Tamura.

Source/WebCore:

This is a followup of r124156. replaceChild() has yet another hidden
MutationEvent trigger. This change added a guard for it.

Test: fast/events/mutation-during-replace-child-2.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::replaceChild):

LayoutTests:

* fast/events/mutation-during-replace-child-2-expected.txt: Added.
* fast/events/mutation-during-replace-child-2.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, Chromium-mac (clang) build fix for r125230.

* platform/graphics/chromium/TiledLayerChromium.cpp:
(WebCore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125238 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HTMLElement.classList cannot remove classnames with uppercase characters
https://bugs.webkit.org/show_bug.cgi?id=93628

Reviewed by Alexey Proskuryakov.

Before this patch we were trying to be smart and determine whether we needed the update m_classNamesForQuirksMode
based on whether m_classNamesForQuirksMode.isNull(), however, m_classNamesForQuirksMode.isNull() is true when the
class name is the empty string.

We also did not update m_classNamesForQuirksMode when the class attribute was cleared.

Source/WebCore:

Updated tests.

* dom/StyledElement.cpp:
(WebCore::StyledElement::classAttributeChanged):
* html/ClassList.cpp:
(WebCore::ClassList::reset):
(WebCore::ClassList::classNames):

LayoutTests:

* fast/dom/HTMLElement/class-list-expected.txt:
* fast/dom/HTMLElement/class-list-quirks-expected.txt:
* fast/dom/HTMLElement/script-tests/class-list.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125239 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium-Android] Skip layout tests directories that are not applicable
https://bugs.webkit.org/show_bug.cgi?id=93670

Reviewed by Dirk Pranke.

Tools:

Added back ChromiumAndroidPort.skipped_layout_tests to skip some whole directories.
The method is more convenient to skip whole directories than SKIP in TestExpectations
because its higher priority. Will still use TestExpectations to skip individual tests.

* Scripts/webkitpy/layout_tests/port/chromium_android.py:
(ChromiumAndroidPort.skipped_layout_tests):

LayoutTests:

Removed 'WONTFIX ANDROID SKIP' lines for whole directories added in r125094.
Use ChromiumAndroidPort.skipped_layout_tests() instead.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125240 268f45cc-cd09-0410-ab3c-d52691b4dbfc