[chromium] harden ScriptWrappable::m_wrapper against tampering
https://bugs.webkit.org/show_bug.cgi?id=107318

Reviewed by Adam Barth.

Patch is correct if existing tests past without crashing.

* bindings/v8/ScriptWrappable.h:
(WebCore::ScriptWrappable::ScriptWrappable):
(WebCore::ScriptWrappable::wrapper):
(WebCore::ScriptWrappable::setWrapper):
(WebCore::ScriptWrappable::clearWrapper):
(WebCore::ScriptWrappable::disposeWrapper):
(WebCore::ScriptWrappable::reportMemoryUsage):
(ScriptWrappable):
(WebCore::ScriptWrappable::maskOrUnmaskPointer):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140575 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Incorrect scrollable height during simplified layout
https://bugs.webkit.org/show_bug.cgi?id=107193

Reviewed by David Hyatt.

Source/WebCore:

When computing overflow we need the height of the block before
it was clamped (i.e., before updateLogicalHeight() has been called).

During simplified layout, we don't have this information and we were
using the clamped height by mistake. To fix this, we now store the
pre-clamped height on RenderOverflow so we can properly compute
overflow.

Test: fast/overflow/height-during-simplified-layout.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::computeOverflow): Save the height if we have overflow.
(WebCore::RenderBlock::simplifiedLayout): If we have overflow, use the height that we saved
in computeOverflow.
* rendering/RenderOverflow.h:
(WebCore::RenderOverflow::layoutClientAfterEdge):
(WebCore::RenderOverflow::setLayoutClientAfterEdge):
(RenderOverflow): Add a member variable to save the height.

LayoutTests:

* fast/overflow/height-during-simplified-layout-expected.txt: Added.
* fast/overflow/height-during-simplified-layout.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140576 268f45cc-cd09-0410-ab3c-d52691b4dbfc