use-after-free removing a frame from its parent in a beforeload event of an OBJECT element
https://bugs.webkit.org/show_bug.cgi?id=113964

Source/WebCore:

Object elements have the tendecny to modify or even fully remove
the containing Document inside beforeload callback. While Document is removed,
RenderArena gets destroyed. Retained RenderWidgets fails to function with NULL arena.

Protect RendereArena from getting wiped out, when Document is removed
during FrameView::updateWidget().

Patch by Zalan Bujtas <zalan@apple.com> on 2013-04-26
Reviewed by Antti Koivisto.

Test: fast/frames/crash-remove-iframe-during-object-beforeload.html

* dom/Document.cpp:
(WebCore::Document::attach):
* dom/Document.h:
(Document):
* page/FrameView.cpp:
(WebCore::FrameView::updateWidgets):
* rendering/RenderArena.h:
(RenderArena):
(WebCore::RenderArena::create):

LayoutTests:

Patch by Zalan Bujtas <zalan@apple.com> on 2013-04-26
Reviewed by Antti Koivisto.

* fast/frames/crash-remove-iframe-during-object-beforeload-expected.txt: Added.
* fast/frames/crash-remove-iframe-during-object-beforeload.html: Added.
* fast/frames/resources/remove-this-during-object-beforeload.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149185 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove wxWebKit from WebCore.
<http://webkit.org/b/115255>

Reviewed by Anders Carlsson.

* DerivedSources.make:
* WebCorePrefix.h:
* bindings/js/JSInspectorFrontendHostCustom.cpp:
(WebCore::JSInspectorFrontendHost::port):
* config.h:
* html/HTMLFormElement.cpp:
* platform/ContextMenu.h:
(ContextMenu):
* platform/ContextMenuItem.h:
* platform/Cursor.h:
* platform/DragData.h:
* platform/DragImage.h:
* platform/FileSystem.h:
* platform/PlatformExportMacros.h:
* platform/PlatformKeyboardEvent.h:
(PlatformKeyboardEvent):
* platform/PlatformMenuDescription.h:
* platform/PlatformMouseEvent.h:
(PlatformMouseEvent):
* platform/PlatformWheelEvent.h:
(PlatformWheelEvent):
* platform/ScrollView.cpp:
* platform/ScrollView.h:
(ScrollView):
* platform/Widget.h:
* platform/win/SharedTimerWin.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149186 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] in-band cues sometimes have incorrect duration
https://bugs.webkit.org/show_bug.cgi?id=115200

Reviewed by Jer Noble.

No new tests, this is not possible to test in DRT.

* html/track/InbandTextTrack.cpp:
(WebCore::InbandTextTrack::addGenericCue): Don't add completed cues to the map.
(WebCore::InbandTextTrack::removeGenericCue): Log when a cue is removed from the track.

* platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
(WebCore::InbandTextTrackPrivateAVF::InbandTextTrackPrivateAVF): Initialize m_pendingCueStatus.
(WebCore::InbandTextTrackPrivateAVF::processCue): Never call update() on a cue that is delivered
    while seeking.
(WebCore::InbandTextTrackPrivateAVF::beginSeeking): Flush all incomplete cues, remember that
    we are seeking.
(WebCore::InbandTextTrackPrivateAVF::resetCueValues):
* platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:

* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
(WebCore::MediaPlayerPrivateAVFoundation::seek): Call track->beginSeeking() instead of resetCueValues().
(WebCore::MediaPlayerPrivateAVFoundation::seekCompleted): Call track->endSeeking().

* platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm:
(WebCore::InbandTextTrackPrivateAVFObjC::kind): Include class name in Kind enum values to
    avoid compile error.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149187 268f45cc-cd09-0410-ab3c-d52691b4dbfc