Variant of non-primary fell-back SVGFont causes crash.
https://bugs.webkit.org/show_bug.cgi?id=112367

Reviewed by Stephen Chenney.

Source/WebCore:

Don't go to PlatformFontData path for SimpleFontData::createScaledFontData()
for SVG fonts.

Test: svg/css/font-face-variant-crash.html

* platform/graphics/SimpleFontData.cpp:
(WebCore::SimpleFontData::~SimpleFontData):
(WebCore::SimpleFontData::createScaledFontData): Don't go to PlatformFontData path for SVG fonts.
(WebCore):
* platform/graphics/SimpleFontData.h:
(SimpleFontData): Added createScaledFontData and renamed the original createScaledFontData to platformCreateScaledFontData.
                  BTW, Removed unreferenced commonInit.
* platform/graphics/blackberry/SimpleFontDataBlackBerry.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Renamed from createScaledFontData.
* platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.
* platform/graphics/freetype/SimpleFontDataFreeType.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.
* platform/graphics/mac/SimpleFontDataMac.mm:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.
* platform/graphics/qt/SimpleFontDataQt.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.
* platform/graphics/skia/SimpleFontDataSkia.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.
* platform/graphics/win/SimpleFontDataWin.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.
* platform/graphics/wince/SimpleFontDataWinCE.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.
* platform/graphics/wx/SimpleFontDataWx.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Ditto.

LayoutTests:

* resources/SpaceOnly.otf: Added. A font containing only the space glyph for testing font fallback.
* svg/css/font-face-variant-crash-expected.txt: Added.
* svg/css/font-face-variant-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146129 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=112627
MessagePort::disentangle() takes an ExceptionCode argument without any need

Reviewed by Geoffrey Garen.

MessagePort::disentangle() is called in two places. One has ASSERT_NO_EXCEPTION,
and another fails to check the exception, but clearly cannot get one.

This function is also not exposed to bindings.

* dom/MessagePort.cpp:
(WebCore::MessagePort::disentangle):
(WebCore::MessagePort::disentanglePorts):
* dom/MessagePort.h:
* workers/SharedWorker.cpp:
(WebCore::SharedWorker::create):
Also removed some unhelpful comments.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146130 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AppleWin VS2010 Debug configuration build fix..

* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146131 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Protect against key prefix overflows
https://bugs.webkit.org/show_bug.cgi?id=111138

Reviewed by Tony Chang.

Source/WebCore:

This reworks the boundary checking for all databaseId,
objectStoreId, and indexId, including negative and
zero-based ids. All entrypoints into IDBLevelDBCoding
are protected with explicit checks and all internal
uses of KeyPrefix are protected with ASSERTs in the
various constructors.

Tests: WebKit unit tests IDBBackingStoreTest.cpp in WebKit/chromium

* Modules/indexeddb/IDBBackingStore.h: Make all public methods boolean-based for errors.
* Modules/indexeddb/IDBLevelDBCoding.h: Add methods for checking databaseId, objectStoreId, and indexId.

Source/WebKit/chromium:

Add tests for invalid indexIds in basic get/put operations.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146132 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Another flakey iframe flattening test.

* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146133 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed gardening. Suppressed flaky test.
https://bugs.webkit.org/show_bug.cgi?id=112629

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146134 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/Platform: [chromium] Remove code that relies on boundsContainsPageScale().
https://bugs.webkit.org/show_bug.cgi?id=112465

The boundsContainsPageScale() API is going away, remove code that
depends on it.

Reviewed by James Robinson.

* chromium/public/WebContentLayer.h:
(WebContentLayer):

Source/WebCore: [chromium] Remove NCCH code that relies on boundsContainsPageScale().
https://bugs.webkit.org/show_bug.cgi?id=112465

Reviewed by James Robinson.

The boundsContainsPageScale() API is going away, remove code that
depends on it. Uses existing tests as no behaviour change.

* platform/graphics/chromium/GraphicsLayerChromium.cpp:
(WebCore::GraphicsLayerChromium::setAppliesPageScale):
(WebCore::GraphicsLayerChromium::appliesPageScale):

Source/WebKit/chromium: [chromium] Remove NCCH code that relies on boundsContainsPageScale().
https://bugs.webkit.org/show_bug.cgi?id=112465

Reviewed by James Robinson.

The boundContainsPageScale API is going away, remove code that relies
on it.

* src/NonCompositedContentHost.cpp:
(WebKit::NonCompositedContentHost::NonCompositedContentHost):
(WebKit::NonCompositedContentHost::setViewport):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSP 1.1: Add 'effective-directive' to violation reports.
https://bugs.webkit.org/show_bug.cgi?id=112568

Reviewed by Adam Barth.

Source/WebCore:

https://dvcs.w3.org/hg/content-security-policy/rev/bc2bb0e5072a
introduced an 'effective-directive' field on CSP violation reports,
which allows developers to distinguish between resource types when
'default-src' is the violated directive.

This patch implements the new field behind the CSP_NEXT flag.

Test: http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.html

* page/ContentSecurityPolicy.cpp:
(WebCore::CSPDirectiveList::checkSourceAndReportViolation):
(WebCore::CSPDirectiveList::reportViolation):
    These methods now accept an additional parameter to pipe the
    effective directive from the initial callsite down into
    ContentSecurityPolicy::reportViolation.
(WebCore::CSPDirectiveList::checkEvalAndReportViolation):
(WebCore::CSPDirectiveList::checkNonceAndReportViolation):
(WebCore::CSPDirectiveList::checkMediaTypeAndReportViolation):
(WebCore::CSPDirectiveList::checkInlineAndReportViolation):
(WebCore::CSPDirectiveList::allowScriptFromSource):
(WebCore::CSPDirectiveList::allowObjectFromSource):
(WebCore::CSPDirectiveList::allowChildFrameFromSource):
(WebCore::CSPDirectiveList::allowImageFromSource):
(WebCore::CSPDirectiveList::allowStyleFromSource):
(WebCore::CSPDirectiveList::allowFontFromSource):
(WebCore::CSPDirectiveList::allowMediaFromSource):
(WebCore::CSPDirectiveList::allowConnectToSource):
(WebCore::CSPDirectiveList::allowFormAction):
    These methods now pass the effective directive name down
    into checkSourceAndReportViolation or reportViolation.
(WebCore::ContentSecurityPolicy::reportViolation):
* page/ContentSecurityPolicy.h:
    This method now accepts a new parameter that carries
    the effective directive name. If CSP_NEXT is enabled,
    the field is added to the violation report before it's
    sent out into the world.

LayoutTests:

* http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.html: Added.
    A new test that ensures that 'default-src' doesn't show up in the
    effective directive field, even if it's the directive that was
    actually violated.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-only-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-uri-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt: Added.
* platform/chromium/http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-only-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-uri-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt: Added.
    This patch changes the output of violation reports for ports that
    have enabled CSP_NEXT. At the moment, I think that's Chromium and
    GTK only.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146137 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement icon change notification dump for Chromium's test shell.
https://bugs.webkit.org/show_bug.cgi?id=112614

This was previously implemented for some other platforms in r58111
and r116547.

In r122806, fast/dom/icon-url-property.html stopped using it, but
it is useful for tests, so I plan to re-add it to that test again.

Reviewed by Jochen Eisinger.

* DumpRenderTree/chromium/TestRunner/public/WebTestProxy.h:
(WebTestRunner::WebTestProxy::didChangeIcon): Add handler so that
 icon change notifications from WebKit may be logged in test output.
* DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp:
(WebTestRunner::TestRunner::TestRunner): Expose dumpIconChanges.
(WebTestRunner::TestRunner::reset): Clear the new dump variable.
(WebTestRunner::TestRunner::shouldDumpIconChanges): Expose the dump vairable.
(WebTestRunner):
(WebTestRunner::TestRunner::dumpIconChanges): Implement the test method.
* DumpRenderTree/chromium/TestRunner/src/TestRunner.h:
(TestRunner):
* DumpRenderTree/chromium/TestRunner/src/WebTestProxy.cpp:
(WebTestRunner::WebTestProxyBase::didChangeIcon):
(WebTestRunner):
* DumpRenderTree/chromium/WebViewHost.cpp:
(WebViewHost::didChangeIcon): Add the output about changing the icon.
* DumpRenderTree/chromium/WebViewHost.h:
(WebViewHost):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146139 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Text track cues do not update sizes when entering or exiting full screen.
https://bugs.webkit.org/show_bug.cgi?id=112472

Reviewed by Eric Carlson.

The style properties of the TextCueBoxes were not being updated after the size of the video bounds changed.
Because getDisplayTree() will not do it when the cue itself has not changed, explicitly call videoSizeDidChange()
from updateSizes().

* html/shadow/MediaControlElements.cpp:
(WebCore::MediaControlTextTrackContainerElement::updateSizes): call videoSizeDidChange() on every active cue.
* html/track/TextTrackCue.h:
(WebCore::TextTrackCue::hasDisplayTree): returns whether or not the cue has created a display tree without side effects.
(WebCore::TextTrackCue::videoSizeDidChange): Overridable empty method.
* html/track/TextTrackCueGeneric.cpp:
(WebCore::TextTrackCueGeneric::videoSizeDidChange): Update the CSS height attribute of the cue box using the new video size.
* html/track/TextTrackCueGeneric.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146140 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSP 1.1: Schemeless source expressions match HTTPS resources on HTTP sites.
https://bugs.webkit.org/show_bug.cgi?id=112573

Reviewed by Adam Barth.

Source/WebCore:

Currently, the directive 'script-src example.com' would match only
scripts served from 'http://example.com' when served on an HTTP site,
and only scripts served from 'https://example.com' when served on an
HTTPS site. This patch changes the matching behavior for ports that
have enabled CSP_NEXT in order to encourage use of HTTPS resources by
allow schemeless source expressions to match HTTPS origins when on
HTTP sites.

Thread: http://lists.w3.org/Archives/Public/public-webappsec/2013Mar/0013.html
Spec change: https://dvcs.w3.org/hg/content-security-policy/rev/a7dc8820946e

Test: http/tests/security/contentSecurityPolicy/source-list-parsing-10.html

* page/ContentSecurityPolicy.cpp:
(WebCore::CSPSource::CSPSource):
    Pass the current policy into CSPSource so that we can check the
    protected resource's scheme inside schemeMatches, rather than
    overwriting the source expression's scheme before creating the
    CSPSource.
(WebCore::CSPSource::schemeMatches):
    If CSP_NEXT is enabled, ensure that HTTPS resources match the
    HTTP scheme when loaded on HTTP pages with schemaless source
    expressions.
(WebCore::CSPSource::portMatches):
    Check the port against the URL's scheme: if m_scheme isn't
    empty, this will match it. If m_scheme is empty, we can't
    do a strict match against it, nor can we do a strict match
    against the protected resource's port. Checking the URL's
    port against the default port for its scheme solves this
    problem elegantly.
(WebCore::CSPSourceList::parse):
(WebCore::CSPSourceList::addSourceSelf):
    Pass in the policy when creating a CSPSource object.

LayoutTests:

* http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js:
    Add support for full URLs in this type of test, which enables loading
    scripts from hosts other than the current page's.
* http/tests/security/contentSecurityPolicy/source-list-parsing-01-expected.txt:
* http/tests/security/contentSecurityPolicy/source-list-parsing-01.html:
    Drops a test from the first parsing group, as it's better grouped
    with the new test added below.
* http/tests/security/contentSecurityPolicy/source-list-parsing-10-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/source-list-parsing-10.html: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-01.html.
    Adds a new test that checks HTTPS scripts loaded against a
    schemeless source expression.
* platform/chromium/http/tests/security/contentSecurityPolicy/source-list-parsing-10-expected.txt: Added.
* platform/gtk/http/tests/security/contentSecurityPolicy/source-list-parsing-10-expected.txt: Added.
    This patch has different behavior for ports that enable CSP_NEXT,
    currently Chromium and GTK.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146141 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fast/loader/document-with-fragment-url-4.html sometimes asserts
https://bugs.webkit.org/show_bug.cgi?id=97124

* platform/mac-wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146142 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2][Mac] Don't consider empty window frames cacheable.
<http://webkit.org/b/112631>
<rdar://problem/13384894>

Reviewed by Anders Carlsson.

If the UI client overrides getWindowFrame() and returns an empty rect, send that over
to the web process and mark it as uncached. This forces the next ChromeClient::windowRect()
call to synchronously retrieve the window frame from the other side.

Fixes an issue with the Mac Web Inspector which uses empty rects to signify that there is
no known window frame yet. In this case, we should not be falling back to the native frame.

* UIProcess/mac/WebPageProxyMac.mm:
(WebKit::WebPageProxy::windowAndViewFramesChanged):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::windowAndViewFramesChanged):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146143 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WinCairo] Get build working under VS2010.
https://bugs.webkit.org/show_bug.cgi?id=112604

Reviewed by Tim Horton.

* JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Use CFLite-specific
build target (standard version links against CoreFoundation.lib
instead of CFLite.lib).
* JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props: Added.
* JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props: Added.
* JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Support Windows HTMLSelectElement keystrokes on Chromium win
https://bugs.webkit.org/show_bug.cgi?id=112460

Reviewed by Kent Tamura.

Compile in the windows-specific variant of
HTMLSelectElement::platformHandleKeydownEvent
on Chromium win, in addition to PLATFORM(WIN).

* WebCore.gypi:
    Add html/HTMLSelectElementWin.cpp.
* html/HTMLSelectElement.cpp:
    Don't compile generic platformHandleKeydownEvent on
    Chromium win.
* html/HTMLSelectElementWin.cpp:
    Only compile platformHandleKeydownEvent on Windows.
    Fix compile error in assertion.
(WebCore):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146145 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove failing Windows-specific result; this test passes now.

* platform/win/media/nodesFromRect-shadowContent-expected.txt: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146146 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[v8] Suppress binding integrity check of HTMLContentElement.
https://bugs.webkit.org/show_bug.cgi?id=112613

Reviewed by Adam Barth.

Patch is correct so long as fast/dom/shadow/content-element-user-agent-shadow.html
continues to pass.

* html/shadow/HTMLContentElement.idl:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146147 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] build xdisplaycheck when building DRT
https://bugs.webkit.org/show_bug.cgi?id=112636

Reviewed by Tony Chang.

It appears that we need xdisplaycheck to be built in order for
Xvfb to be started correctly on the bots, and DRT was missing
a dependency on it. This may be the cause of the ASAN bot not
starting up properly (it only builds DRT).

* DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146148 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove the temporary hack for webkit-perf.appspot.com and cleanup the code
https://bugs.webkit.org/show_bug.cgi?id=112494

Reviewed by Dirk Pranke.

Removed the code to override webkit-perf.appspot.com by perf.webkit.org.
Also merged two pairs of methods to cleanup the code.

* Scripts/webkitpy/performance_tests/perftestsrunner.py:
(PerfTestsRunner.run): Merged _upload_and_show_results.
(PerfTestsRunner._generate_results): Merged _generate_output_files.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146150 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        MessagePortChannel::EventData should not be exposed
        https://bugs.webkit.org/show_bug.cgi?id=112635

        Reviewed by Geoff Garen.

        MessagePortChannel::EventData is an implementation detail that's only needed to
        store events in MessageQueue. Other existing code already gets away without it,
        just passing message and ports separately.

        * dom/MessagePort.cpp:
        (WebCore::MessagePort::postMessage):
        (WebCore::MessagePort::dispatchMessages):
        * dom/MessagePortChannel.cpp:
        * dom/MessagePortChannel.h:
        * dom/default/PlatformMessagePortChannel.cpp:
        (WebCore::PlatformMessagePortChannel::EventData::create):
        (WebCore::PlatformMessagePortChannel::EventData::EventData):
        (WebCore::MessagePortChannel::postMessageToRemote):
        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
        * dom/default/PlatformMessagePortChannel.h:
        (WebCore::PlatformMessagePortChannel::EventData::message):
        (WebCore::PlatformMessagePortChannel::EventData::channels):
        (PlatformMessagePortChannel):
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
        * dom/default/chromium/PlatformMessagePortChannelChromium.cpp:
        (WebCore::MessagePortChannel::postMessageToRemote):
        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
        * dom/default/chromium/PlatformMessagePortChannelChromium.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146151 268f45cc-cd09-0410-ab3c-d52691b4dbfc