Unreviewed. [GTK] Plugin process crashes when loading totem plugin
https://bugs.webkit.org/show_bug.cgi?id=131357

Make Netscape browser functions static to avoid conflicts with
plugins defining those functions as well.

* GNUmakefile.list.am: Do not build npapi.cpp.
* plugins/PluginPackage.cpp:
(WebCore::pluginViewForInstance):
(WebCore::NPN_MemAlloc):
(WebCore::NPN_MemFree):
(WebCore::NPN_MemFlush):
(WebCore::NPN_ReloadPlugins):
(WebCore::NPN_RequestRead):
(WebCore::NPN_GetURLNotify):
(WebCore::NPN_GetURL):
(WebCore::NPN_PostURLNotify):
(WebCore::NPN_PostURL):
(WebCore::NPN_NewStream):
(WebCore::NPN_Write):
(WebCore::NPN_DestroyStream):
(WebCore::NPN_UserAgent):
(WebCore::NPN_Status):
(WebCore::NPN_InvalidateRect):
(WebCore::NPN_InvalidateRegion):
(WebCore::NPN_ForceRedraw):
(WebCore::NPN_GetValue):
(WebCore::NPN_SetValue):
(WebCore::NPN_GetJavaEnv):
(WebCore::NPN_GetJavaPeer):
(WebCore::NPN_PushPopupsEnabledState):
(WebCore::NPN_PopPopupsEnabledState):
(WebCore::NPN_PluginThreadAsyncCall):
(WebCore::NPN_GetValueForURL):
(WebCore::NPN_SetValueForURL):
(WebCore::NPN_GetAuthenticationInfo):
(WebCore::NPN_PopUpContextMenu):
* plugins/PluginPackage.h:
(WebCore::PluginPackage::browserFuncs): Add accessor to browser
function pointers.
* plugins/PluginView.cpp:
(WebCore::PluginView::stop): Use browser function pointers instead
of NPN wrappers that are now private.
(WebCore::PluginView::getValueForURL): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167120 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166924 - [SOUP] Control cookie management according ResourceRequest.allowCookies()
https://bugs.webkit.org/show_bug.cgi?id=131026

Patch by Youenn Fablet <youenn.fablet@crf.canon.fr> on 2014-04-08
Reviewed by Sergio Villar Senin.

Source/WebCore:

Added per soup-message disabling of cookie jar manager when related ResourceRequest does not allow cookies (e.g. some cross-origin requests).

Patch is covered by unskipped test http/tests/xmlhttprequest/cross-origin-cookie-storage.html.

* platform/network/soup/ResourceRequestSoup.cpp:
(WebCore::ResourceRequest::updateSoupMessageMembers): Added disabling of cookie jar manager if cookies are not allowed.

Source/WebKit2:

Added setting of accept cookies policy for the current soup network session cookie jar and all tracked sessions.
Moved the implementation of cookie policy setting from WebCookieManager to WebFrameNetworkingContext.

* WebProcess/Cookies/soup/WebCookieManagerSoup.cpp:
(WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy): Moved implementation to WebCookieManager::platformSetHTTPCookieAcceptPolicy.
* WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.cpp:
(WebKit::WebFrameNetworkingContext::setCookieAcceptPolicyForAllContexts): Moved implementation from WebCookieManager::platformSetHTTPCookieAcceptPolicy and set the cookie jar accept policy to the cookie jars of all sessions in addition to the default cookie jar.
* WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.h: Added method prototype.

LayoutTests:

* platform/efl/TestExpectations: Unskipped test http/tests/xmlhttprequest/cross-origin-cookie-storage.html.
* platform/gtk/TestExpectations: Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167121 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167116 - [GTK][WK2] Move Vector objects into WebEditorClient::executePendingEditorCommands() invocations
https://bugs.webkit.org/show_bug.cgi?id=131454

Reviewed by Carlos Garcia Campos.

* WebProcess/WebCoreSupport/WebEditorClient.h:
* WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
(WebKit::WebEditorClient::executePendingEditorCommands): Take a const reference of the Vector
object to avoid unnecessary copies. Also deploy two range-based for loops and efficiently move
the Editor::Command objects into the other Vector.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167122 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167185 - [SOUP] Libsoup internal credential setting should be controlled by loader decision
https://bugs.webkit.org/show_bug.cgi?id=130963

Patch by Youenn Fablet <youenn.fablet@crf.canon.fr> on 2014-04-12
Reviewed by Darin Adler.

Source/WebCore:

Disabled libsoup internal authentication manager for messages for which no credential is available and no stored credentials should be used.
Updated synchronous loader to return whether using credentials or not according StoredCredential loader option parameter.
Unskipped test http/tests/xmlhttprequest/cross-origin-no-authorization.html covers the patch.

* platform/network/ResourceHandleInternal.h:
(WebCore::ResourceHandleInternal::ResourceHandleInternal): Added m_useAuthenticationManager boolean to control whether disable authentication manager or not.
* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader): Added m_storedCredentials member.
(WebCore::WebCoreSynchronousLoader::shouldUseCredentialStorage): Return true if stored credentials are allowed.
(WebCore::applyAuthenticationToRequest): Set m_useAuthenticationManager value to disable authentication manager if cannot use stored credentials and ResourceHandleInternal has no username and password.
(WebCore::createSoupMessageForHandleAndRequest): Disable authentication mananger according m_useAuthenticationManager value.
(WebCore::ResourceHandle::platformLoadResourceSynchronously): Added StoredCredentials loader option to the sync loader constructor.

Source/WebKit/efl:

* WebCoreSupport/FrameLoaderClientEfl.cpp:
(WebCore::FrameLoaderClientEfl::shouldUseCredentialStorage): Similarly to GTK, let soup/loader layer handle when to use credential storage. Return always true

LayoutTests:

* platform/efl/TestExpectations: Unskipped http/tests/xmlhttprequest/cross-origin-no-authorization.html.
* platform/gtk/TestExpectations: Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167212 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167128 - wk2-gtk does not display anything
https://bugs.webkit.org/show_bug.cgi?id=125558

Reviewed by Martin Robinson.

Remove fcntl call to set access mode flags on the duplicated files
descriptor. Those flags are ignored in Linux and make fcntl to
fail in FreeBSD. We should handle the case where the passed
protection is ReadOnly.
Thanks to Raphael Kubo da Costa who proposed the solution.

* Platform/unix/SharedMemoryUnix.cpp:
(WebKit::SharedMemory::createHandle):
(WebKit::accessModeFile): Deleted.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167214 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163465 - Move characterAt index checks from InlineIterator to RenderText
https://bugs.webkit.org/show_bug.cgi?id=128224

Source/WebCore:

Reviewed by Simon Fraser.

Move characterAt index checks from InlineIterator to RenderText
so that all RenderText calls are covered. Few safe instances are
now covered with uncheckedCharacterAt.

Merged from Blink:
http://src.chromium.org/viewvc/blink?view=revision&revision=150830

Test: fast/text/character-at-crash.html

* rendering/InlineIterator.h:
(WebCore::InlineIterator::characterAt):
* rendering/RenderText.cpp:
(WebCore::RenderText::computePreferredLogicalWidths):
* rendering/RenderText.h:
(WebCore::RenderText::operator[]):
(WebCore::RenderText::uncheckedCharacterAt):
(WebCore::RenderText::characterAt):

LayoutTests:

Move characterAt index checks from InlineIterator to RenderText
so that all RenderText calls are covered. Few safe instances are
now covered with uncheckedCharacterAt.

Merged from Blink:
http://src.chromium.org/viewvc/blink?view=revision&revision=150830

Reviewed by Simon Fraser.

* fast/text/character-at-crash-expected.txt: Added.
* fast/text/character-at-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167217 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163579 - Make adoption agency use the task queue
https://bugs.webkit.org/show_bug.cgi?id=109445

Reviewed by Ryosuke Niwa.

Source/WebCore:

Tests: fast/parser/adoption-agency-crash-01.html
       fast/parser/adoption-agency-crash-02.html
       fast/parser/adoption-agency-crash-03.html

* html/parser/HTMLConstructionSite.cpp:
(WebCore::insert):
(WebCore::executeInsertTask):
(WebCore::executeReparentTask):
(WebCore::executeInsertAlreadyParsedChildTask):
(WebCore::executeTakeAllChildrenTask):
(WebCore::executeTask):
(WebCore::HTMLConstructionSite::attachLater):
(WebCore::HTMLConstructionSite::executeQueuedTasks):
(WebCore::HTMLConstructionSite::insertTextNode):
(WebCore::HTMLConstructionSite::reparent):
(WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
(WebCore::HTMLConstructionSite::takeAllChildren):
(WebCore::HTMLConstructionSite::fosterParent):
* html/parser/HTMLConstructionSite.h:
(WebCore::HTMLConstructionSiteTask::HTMLConstructionSiteTask):
(WebCore::HTMLConstructionSiteTask::oldParent):
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

LayoutTests:

* TestExpectations:
* fast/parser/adoption-agency-crash-01-expected.txt: Added.
* fast/parser/adoption-agency-crash-01.html: Added.
* fast/parser/adoption-agency-crash-02-expected.txt: Added.
* fast/parser/adoption-agency-crash-02.html: Added.
* fast/parser/adoption-agency-crash-03-expected.txt: Added.
* fast/parser/adoption-agency-crash-03.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167221 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163599 - loadSubframe can return null in SubframeLoader::loadOrRedirectSubframe
https://bugs.webkit.org/show_bug.cgi?id=128344

Reviewed by Ryosuke Niwa.

Source/WebCore:

* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::loadOrRedirectSubframe):

LayoutTests:

* TestExpectations: Unskipped tests that were previously crashing

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167222 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164170 - ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
https://bugs.webkit.org/show_bug.cgi?id=128810

Patch by Renata Hodovan <rhodovan.u-szeged@partner.samsung.com> on 2014-02-15
Reviewed by Ryosuke Niwa.

Source/WebCore:

Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
doesn't contain |start|.

Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
|outerNode| only if |outerNode| contains |start| position.

Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&view=revision by yosin@chromium.org.

Test: editing/execCommand/indent-with-uneditable-crash.html

* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):

LayoutTests:

* editing/execCommand/indent-with-uneditable-crash-expected.txt: Added.
* editing/execCommand/indent-with-uneditable-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167223 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164204 - Ensure that removing an iframe from the DOM tree disconnects its Frame.
<https://webkit.org/b/128889>
<rdar://problem/15671221>

Merged from Blink (patch by Adam Klein):
https://src.chromium.org/viewvc/blink?revision=156174&view=revision

Source/WebCore:

SubframeLoadingDisabler wasn't catching the case when an <iframe> was,
in its unload handler, removed and re-added to the same parent.
Fix this by using a count of SubframeLoadingDisablers that are on the
stack for a given root, rather than a simple boolean.

Test: fast/frames/reattach-in-unload.html

* html/HTMLFrameOwnerElement.h:
(WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):

LayoutTests:

* fast/frames/reattach-in-unload-expected.txt: Added.
* fast/frames/reattach-in-unload.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167224 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164249 - AX: Invalid cast in WebCore::AccessibilityTable::isDataTable (CRBug 280352)
<https://webkit.org/b/128925>
<rdar://problem/16087351>

Merged from Blink (patch by Dominic Mazzoni):
https://src.chromium.org/viewvc/blink?revision=159711&view=revision

Reviewed by Oliver Hunt.

Source/WebCore:

Don't cast to a table cell element unless we are sure it is one.

Test: accessibility/display-table-cell-causes-crash.html

* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::isDataTable):

LayoutTests:

* accessibility/display-table-cell-causes-crash-expected.txt: Added.
* accessibility/display-table-cell-causes-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167225 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164367 - Do not dispatch change event twice in single step action
https://bugs.webkit.org/show_bug.cgi?id=116936
<rdar://problem/16086828>

Reviewed by Ryosuke Niwa.

Merged from Blink (patch by Kent Tamura):
https://src.chromium.org/viewvc/blink?view=rev&revision=151175

Source/WebCore:

Test: fast/forms/number/number-type-update-by-change-event.html

* html/InputType.cpp:
(WebCore::InputType::stepUpFromRenderer):

LayoutTests:

* fast/forms/number/number-type-update-by-change-event-expected.txt: Added.
* fast/forms/number/number-type-update-by-change-event.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167226 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164408 - Crash in WTF::StringBuilder::append()

https://bugs.webkit.org/show_bug.cgi?id=125817
<rdar://problem/15671883>

Reviewed by Oliver Hunt.

* wtf/text/StringBuilder.cpp:
(WTF::expandedCapacity):
Ensure that we return a new capacity of at least 'requiredLength' in
the case where requiredLength is large. Also, use unsigned rather than
size_t for the parameters and the return value, as callers pass
unsigned arguments and treat the result as an unsigned int.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167227 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164876 - Properly clear m_logicallyLastRun to remove use-after-free possibility
https://bugs.webkit.org/show_bug.cgi?id=129489

Reviewed by David Hyatt.

A use-after-free issue was caught in Blink because m_logicallyLastRun
is not cleared when the item it points to is deleted. Clearing it
turns the use-after-free into a segfault, and prevents any future
use-after-frees from happening.

* platform/text/BidiRunList.h:
(WebCore::BidiRunList<Run>::deleteRuns):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167228 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164933 - Ensure keySplines is valid in SMIL animations
<http://webkit.org/b/129547>
<rdar://problem/15676128>

Reviewed by Darin Adler.

Merged from Blink (patch by Philip Rogers):
https://src.chromium.org/viewvc/blink?revision=156452&view=revision
http://crbug.com/276111

    This patch fixes a crash in SMIL animations when keySplines are not
    specified. The SMIL spec is clear on this:
    http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
    "If there are any errors in the keyTimes specification (bad values,
    too many or too few values), the animation will have no effect."

    This patch simply checks that keyTimes is not empty. Previously,
    splinesCount was set to be m_keySplines.size() + 1 in
    SVGAnimationElement.cpp; this patch changes splinesCount to be equal
    to m_keySplines.size() to make the logic easier to follow and to
    match other checks in SVGAnimationElement::startedActiveInterval.

Source/WebCore:

Test: svg/animations/animate-keysplines-crash.html

* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::startedActiveInterval):

LayoutTests:

* svg/animations/animate-keysplines-crash-expected.txt: Added.
* svg/animations/animate-keysplines-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167229 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165138 - Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
<http://webkit.org/b/129751>
<rdar://problem/16237965>

Reviewed by Jon Honeycutt.

Merged from Blink (patch by Yuta Kitamura):
https://src.chromium.org/viewvc/blink?revision=168160&view=revision
http://crbug.com/345005

    The root cause is CompositeEditCommand::moveParagraphWithClones() passing
    two positions |start| and |end| which do not follow the document order,
    i.e. in some situations |start| is located after |end| because of
    the difference in affinity.

    This patch fixes this crash by normalizing |end| to |start| in such situations.
    It also adds an ASSERT that checks the relationship between |start| and |end|.

Source/WebCore:

Test: editing/execCommand/format-block-crash.html

* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
(WebCore::CompositeEditCommand::moveParagraphWithClones):
* editing/CompositeEditCommand.h:

LayoutTests:

* editing/execCommand/format-block-crash-expected.txt: Added.
* editing/execCommand/format-block-crash.html: Added.
* editing/execCommand/resources/format-block-crash-iframe.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167230 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165145 - ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
https://bugs.webkit.org/show_bug.cgi?id=129753
<rdar://problem/12069835>

Reviewed by Alexey Proskuryakov.

Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
app cache doesn't contain a manifest resource.

For some reason an app cache for a web site may be partially written to disk. In particular, the
app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
and hence have been unable to create such an app cache. We were able to reproduce this issue using
an app cache database file that was provided by a person that was affected by this issue.

No test included because it's not straightforward to write a test for this change.

* loader/appcache/ApplicationCacheGroup.cpp:
(WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated->manifestResource()
is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
expression into two assertion expressions to make it straightforward to identify the failing sub-expression
on failure.
* loader/appcache/ApplicationCacheStorage.cpp:
(WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
(WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
have a manifest resource.
(WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
(WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
ApplicationCacheStorage::deleteCacheGroupRecord().
* loader/appcache/ApplicationCacheStorage.h:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167231 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165339 - SerializedScriptValue may move Identifiers between worlds
https://bugs.webkit.org/show_bug.cgi?id=129979

Reviewed by Andreas Kling.

Source/WebCore:

Test: fast/workers/worker-copy-shared-blob-url.html

Don't use Strings to store blob URLs as String's may be Identifiers
and they can only exist in one world/thread at a time.

* Modules/indexeddb/IDBObjectStore.cpp:
(WebCore::IDBObjectStore::put):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::deserializeString):
(WebCore::SerializedScriptValue::addBlobURL):
(WebCore::SerializedScriptValue::SerializedScriptValue):
* bindings/js/SerializedScriptValue.h:

LayoutTests:

Add test cases

* fast/workers/resources/worker-copy-shared-blob-url-worker.js: Added.
(count.0.onmessage):
* fast/workers/worker-copy-shared-blob-url-expected.txt: Added.
* fast/workers/worker-copy-shared-blob-url.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167232 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165425 - Improve WeakPtr operators.
https://bugs.webkit.org/show_bug.cgi?id=130053

Reviewed by Andreas Kling.

Replace the "operator!()" with an explicit bool operator.  Add an "operator->()".

* wtf/WeakPtr.h:
(WTF::WeakPtr::operator bool):
(WTF::WeakPtr::operator->):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167233 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165548 - Don't send synchronous resize events when FrameView has auto-sizing enabled.
<https://webkit.org/b/130198>
<rdar://problem/15991333>

Reviewed by Dan Bernstein.

* page/FrameView.cpp:
(WebCore::FrameView::sendResizeEventIfNeeded):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@167234 268f45cc-cd09-0410-ab3c-d52691b4dbfc