Unreviewed GTK gardening.

Again updating baseline for editing/deleting/delete-to-select-table.html.

* platform/gtk/editing/deleting/delete-to-select-table-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138815 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS3 calc: mixed percent/absolute for border-radius
https://bugs.webkit.org/show_bug.cgi?id=106046

Reviewed by Ojan Vafai.

Source/WebCore:

Add the calculation evaluation to the border radius code.

Test: css3/calc/border-radius.html

* css/StyleBuilder.cpp:
(WebCore::ApplyPropertyBorderRadius::applyValue):

LayoutTests:

* css3/calc/border-radius-expected.html: Renamed from LayoutTests/css3/calc/border-radius-expected-mismatch.html.
* css3/calc/border-radius.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138816 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSP: XHR from an isolated world should bypass a page's policy.
https://bugs.webkit.org/show_bug.cgi?id=104480

Reviewed by Adam Barth.

Source/WebCore:

Connections of various types are governed by the page's Content Security
Policy 'connect-src' directive. In the special case of connections
generated from an isolated world, we'd like to bypass these restrictions
in order to allow things like extensions to enjoy their uniquely high-
privilege lifestyle. This patch does just that.

We'll lock them down to their own policy in webkit.org/b/104520, but
that's a bit far away at the moment. Soon!

Test: http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html

* Modules/websockets/WebSocket.cpp:
(WebCore::WebSocket::connect):
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::canRequest):
* page/EventSource.cpp:
(WebCore::EventSource::create):
* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::open):
    Check whether or not code is running in an isolated world that has
    its own Content Security Policy. If so, bypass the main world's CSP
    checks. Isolated worlds gotta be free, man.

LayoutTests:

* http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt: Added.
* http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html: Added.
    A new test! How wonderful!
* platform/efl/TestExpectations:
* platform/mac/TestExpectations:
* platform/qt/TestExpectations:
* platform/win/TestExpectations:
* platform/wincairo/TestExpectations:
    Skipping the new test on ports that don't support it.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138817 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSP: 'frame-src' should block redirects to invalid sources.
https://bugs.webkit.org/show_bug.cgi?id=106084

Reviewed by Adam Barth.

Source/WebCore:

The 'frame-src' CSP directive whitelists valid iframe targets, but
currently fails to correctly deal with redirection. As long as the
initial target is valid, any redirection goes through without
question. This patch moves the CSP check out of
SubframeLoader::loadSubframe, and into
PolicyChecker::checkNavigationPolicy. In the new location, the check
is well-positioned to check each URL in a redirect chain, as opposed
to checking only the initial target.

Test: http/tests/security/contentSecurityPolicy/frame-src-redirect-blocked.html

* loader/PolicyChecker.cpp:
(WebCore::PolicyChecker::checkNavigationPolicy):
* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::loadSubframe):

LayoutTests:

* http/tests/security/contentSecurityPolicy/frame-src-redirect-blocked-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/frame-src-redirect-blocked.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138818 268f45cc-cd09-0410-ab3c-d52691b4dbfc