Small XSSAuditor cleanup.

Avoid keeping a string for longer than necessary, and avoid the
possibility of checking for it more than once. Instead, check once
and keep that result.

R=abarth@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19446002

git-svn-id: svn://svn.chromium.org/blink/trunk@154354 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove Page::m_isInWindow and associated setters/getters

They appear to be completely unused.

BUG=none

Review URL: https://chromiumcodereview.appspot.com/19447003

git-svn-id: svn://svn.chromium.org/blink/trunk@154355 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Don't provide a state object to initial popstate events unless the load was back/forward.

This was regressed in r149766, when we started providing a state object if one
existed for all loads.

BUG=257995
TEST=http/tests/history/popstate-reload.html

Review URL: https://chromiumcodereview.appspot.com/19429004

git-svn-id: svn://svn.chromium.org/blink/trunk@154356 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix a use-after-free condition in spellcheck request

SpellCheckRequest::didCancel() and SpellCheckRequest::didSucceed() call into
SpellChecker::didCheck(), which can delete the SpellCheckRequest object. After
this happens, the methods write to a private member variable in the deleted
instance. That's a use-after-free bug.

The bug was caught with help of ASAN on content shell. Content shell does not
set spellcheck client. The lack of the spellcheck client reduces the number of
references to the SpellCheckRequest object by 1. When SpellChecker::didCheck()
calls clear() on the ref-ptr of the SpellCheckRequest object, the object deletes
itself, because there're no more references to it.

The test WebFrameTest.CancelSpellingRequestCrash works by setting a NULL
spellcheck client and canceling a pending spellcheck request. This setup hits
the bug in SpellCheckRequest::didCancel(). It's not possible to hit the same bug
in SpellCheckRequest::didSucceed(), because it happens when there's no
spellcheck client, but only a spellcheck client calls didSucceed(). 

TEST=WebFrameTest.CancelSpellingRequestCrash
TEST=LayoutTests/editing/spelling/copy-paste-crash.html
BUG=259984

Review URL: https://chromiumcodereview.appspot.com/19275006

git-svn-id: svn://svn.chromium.org/blink/trunk@154357 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Separate WebIDBKey type into separate header

WebIDBKey has exported symbols that we don't want to call from any common or browser
code as well as a type enum that we want to reuse everywhere. This separates the
type enum into a standalone WebKit::WebIDBKeyType enum in its own header and
normalizes the names to standard blink public API conventions. This way we can
use DEPS to enforce that we're only using the types in common and browser code.

BUG=237267

Review URL: https://chromiumcodereview.appspot.com/19316002

git-svn-id: svn://svn.chromium.org/blink/trunk@154358 bbb929c8-8fbe-4397-9dbb-9b2b20218538