[CSS Exclusions] Specifying polygonal -webkit-shape-inside value can crash browser (debug mode)
https://bugs.webkit.org/show_bug.cgi?id=112157

Reviewed by David Hyatt.

Source/WebCore:

Corrected the code which maps exclusion segments to pairs of InlineIterators. We now handle the
cases where the end of the line occurs within an exclusion segment or when it occurs before
the last exclusion segment has been reached. This can occur when a non-convex polygonal shape-inside
breaks a line up into two segments, but the shape-inside element's content only fills (or partially
fills) the first exclusion shape segment.

Tests: fast/exclusions/shape-inside/shape-inside-partial-fill-001.html
       fast/exclusions/shape-inside/shape-inside-partial-fill-002.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::LineBreaker::nextLineBreak):

LayoutTests:

Added tests with a polygonal shape-inside exclusion shape, where multiple shape
segments exist on one line, but the line's text either partially or completely
fills only the first exclusion shape segment.

* fast/exclusions/shape-inside/shape-inside-partial-fill-001-expected.html: Added.
* fast/exclusions/shape-inside/shape-inside-partial-fill-001.html: Added.
* fast/exclusions/shape-inside/shape-inside-partial-fill-002-expected.html: Added.
* fast/exclusions/shape-inside/shape-inside-partial-fill-002.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146073 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Crash when accessing onclick attribute of document from XMLHttpRequest
https://bugs.webkit.org/show_bug.cgi?id=112585

Reviewed by Eric Seidel.

Source/WebCore:

This ASSERT was bogus. The frame can be 0 for frameless documents, like
those created by XMLHttpRequest. When there is no frame, we act as if
JavaScript was disabled, which it is.

Test: fast/events/xhr-onclick-crash.html

* bindings/v8/V8LazyEventListener.cpp:
(WebCore::V8LazyEventListener::prepareListenerObject):

LayoutTests:

* fast/events/resources/onclick.html: Added.
* fast/events/xhr-onclick-crash-expected.txt: Added.
* fast/events/xhr-onclick-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146074 268f45cc-cd09-0410-ab3c-d52691b4dbfc