Stub out the web process -> UI process message SPI
https://bugs.webkit.org/show_bug.cgi?id=131048

Reviewed by Sam Weinig.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView initWithFrame:configuration:]):
* UIProcess/API/Cocoa/WKWebViewConfiguration.mm:
(-[WKWebViewConfiguration copyWithZone:]):
(-[WKWebViewConfiguration _userContentController]):
(-[WKWebViewConfiguration _setUserContentController:]):
* UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
* UIProcess/API/Cocoa/WKWebViewPrivate.h:
* UIProcess/API/Cocoa/_WKScriptMessage.h: Copied from Source/WebKit2/UIProcess/API/Cocoa/_WKScriptWorld.h.
* UIProcess/API/Cocoa/_WKScriptMessage.mm: Copied from Source/WebKit2/UIProcess/API/Cocoa/_WKScriptWorld.h.
(-[_WKScriptMessage body]):
(-[_WKScriptMessage originatingWebView]):
* UIProcess/API/Cocoa/_WKScriptMessageHandler.h: Copied from Source/WebKit2/UIProcess/API/Cocoa/_WKScriptWorld.h.
* UIProcess/API/Cocoa/_WKScriptWorld.h:
* UIProcess/API/Cocoa/_WKUserContentController.h: Copied from Source/WebKit2/UIProcess/API/Cocoa/_WKScriptWorld.h.
* UIProcess/API/Cocoa/_WKUserContentController.mm: Copied from Source/WebKit2/UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h.
(-[_WKUserContentController addScriptMessageHandler:name:world:]):
(-[_WKUserContentController removeScriptMessageHandler:]):
* WebKit2.xcodeproj/project.pbxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166598 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix. Remove duplicate file entries.

* WebCore.xcodeproj/project.pbxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166599 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Do not allow HTTP refresh headers to refresh to javascript: URLs
<http://webkit.org/b/119051>
<rdar://problem/14536453>

Reviewed by Alexey Proskuryakov.

Merged from Blink (patch by tsepez@chromium.org):
https://src.chromium.org/viewvc/blink?revision=153912&view=revision
http://crbug.com/258151

    This behaviour has been standard in IE since IE7.  This makes us both
    more compatible and less vulnerable to XSS.

Source/WebCore:

Tests: http/tests/security/no-javascript-location-percent-escaped.html
       http/tests/security/no-javascript-location.html
       http/tests/security/no-javascript-refresh-percent-escaped.php
       http/tests/security/no-javascript-refresh-spaces.php
       http/tests/security/no-javascript-refresh-static-percent-escaped.html
       http/tests/security/no-javascript-refresh-static-spaces.html
       http/tests/security/no-javascript-refresh-static.html
       http/tests/security/no-javascript-refresh.php

* dom/Document.cpp:
(WebCore::Document::processHttpEquiv):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::receivedFirstData):
- Do not fire meta http refresh for a javascript: URL protocol.

LayoutTests:

* http/tests/security/no-javascript-refresh-expected.txt: Added.
* http/tests/security/no-javascript-refresh-static-expected.txt: Added.
* http/tests/security/no-javascript-refresh-static.html: Added.
* http/tests/security/no-javascript-refresh.php: Added.
- Original Blink layout tests with typos fixed and 'PASS:' text
  added.

* http/tests/security/no-javascript-location.html: Added.
* http/tests/security/no-javascript-location-expected.txt: Added.
* http/tests/security/resources/no-javascript-location.php: Copied from LayoutTests/http/tests/security/no-javascript-refresh.php.
* http/tests/security/no-javascript-location-percent-escaped.html: Added.
* http/tests/security/no-javascript-location-percent-escaped-expected.txt: Added.
* http/tests/security/resources/no-javascript-location-percent-escaped.php: Added.
- Add tests using a javascript: URL in a Location: header.

* http/tests/security/no-javascript-refresh-percent-escaped.php: Copied from LayoutTests/http/tests/security/no-javascript-refresh.php.
* http/tests/security/no-javascript-refresh-percent-escaped-expected.txt: Added.
* http/tests/security/no-javascript-refresh-spaces.php: Copied from LayoutTests/http/tests/security/no-javascript-refresh.php.
* http/tests/security/no-javascript-refresh-spaces-expected.txt: Added.
- Add tests using a percent-escaped javascript: URL and a
  javascript: URL with leading spaces in a Refresh: header from
  a web server.

* http/tests/security/no-javascript-refresh-static-percent-escaped.html: Added.
* http/tests/security/no-javascript-refresh-static-percent-escaped-expected.txt: Added.
* http/tests/security/no-javascript-refresh-static-spaces.html: Added.
* http/tests/security/no-javascript-refresh-static-spaces-expected.txt: Added.
- Add tests using a percent-escaped javascript: URL and a
  javascript: URL with leading spaces in a meta http-equiv tag.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderQuote must destroy remaining text renderer before first letter renderer
https://bugs.webkit.org/show_bug.cgi?id=78023
<rdar://problem/10830009>

Reviewed by Brent Fulgham.

Merged from Blink (patch by Abhishek Arya):
https://src.chromium.org/viewvc/blink?view=rev&revision=151270

Source/WebCore:

Following the fix for <https://bugs.webkit.org/show_bug.cgi?id=114586>, a
RenderQuote may have child render objects for the first letter of its text
and everything following the first letter so as to support the CSS first-
letter property. The latter renderer is responsible for destroying the former
on destruction. It's sufficient to reverse the destruction of the children of
RenderQuote to ensure that we destroy the remaining text renderer before we
destroy the first letter renderer.

Test: fast/css-generated-content/quote-first-letter-crash.html

* rendering/RenderQuote.cpp:
(WebCore::RenderQuote::updateText):

LayoutTests:

* fast/css-generated-content/quote-first-letter-crash-expected.txt: Added.
* fast/css-generated-content/quote-first-letter-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166601 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove limits from WKBackForwardList getters
https://bugs.webkit.org/show_bug.cgi?id=131052

Reviewed by Beth Dakin.

* UIProcess/API/Cocoa/WKBackForwardList.h:
* UIProcess/API/Cocoa/WKBackForwardList.mm:
(-[WKBackForwardList backList]):
(-[WKBackForwardList forwardList]):
(-[WKBackForwardList backListCount]): Deleted.
(-[WKBackForwardList forwardListCount]): Deleted.
(-[WKBackForwardList backListWithLimit:]): Deleted.
(-[WKBackForwardList forwardListWithLimit:]): Deleted.
* UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::backList):
(WebKit::WebBackForwardList::forwardList):
* UIProcess/WebBackForwardList.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166602 268f45cc-cd09-0410-ab3c-d52691b4dbfc
svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures.html and svg/css/font-face-crash.html frequently assert in ComplexTextController::offsetForPosition
https://bugs.webkit.org/show_bug.cgi?id=119747

Reviewed by Simon Fraser.

Source/WebCore:

Even though kerning and ligatures currently don't work with the
simple text path, messing those up is better than creating null
CTRun and CTLine objects.

Rather than calling the badly-named renderingContext() function on TextRun objects
to determine if they are drawn with an SVG font, this patch creates a wrapper function
with a better name and uses that instead.

Test: svg/text/svg-font-hittest.html

* platform/graphics/Font.cpp:
(WebCore::isDrawnWithSVGFont): Wrapper around renderingContext()
(WebCore::Font::drawText): Use wrapper function
(WebCore::Font::drawEmphasisMarks): Use wrapper function
(WebCore::Font::width): Use wrapper function
(WebCore::Font::selectionRectForText): Use wrapper function
(WebCore::Font::offsetForPosition): If we are using an SVG font, use the simple path
instead of the complex one
(WebCore::Font::codePath): Use wrapper function
* platform/graphics/cocoa/FontPlatformDataCocoa.mm:
(WebCore::FontPlatformData::ctFont):

LayoutTests:

Clicking on SVG text used to cause a ComplexTextController to be built
around the SVG text (which is incorrect and would crash). This test
does just that and makes sure there is no crash.

* svg/text/resources/Litherum.svg: Added.
* svg/text/svg-font-hittest-expected.txt: Added.
* svg/text/svg-font-hittest.html: Added.
* LayoutTests/platform/mac/TestExpectations: Unskipped tests


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166603 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove a couple of useless static strings
https://bugs.webkit.org/show_bug.cgi?id=131003

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-01
Reviewed by David Kilzer.

There is zero value in keeping those strings alive.

* css/StyleProperties.cpp:
(WebCore::isInitialOrInherit):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166604 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS][WK2] Remove the two finger pan gesture recognizer until it is actually implemented
https://bugs.webkit.org/show_bug.cgi?id=131009

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-01
Reviewed by Sam Weinig.

The two finger pan should not block the pinch gesture recognizer.

* UIProcess/ios/WKContentViewInteraction.h:
* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView setupInteraction]):
(-[WKContentView cleanupInteraction]):
(-[WKContentView gestureRecognizerShouldBegin:]):
(-[WKContentView _twoFingerPanRecognized:]): Deleted.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166605 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pass a WKNavigationAction to the create UIDelegate method
https://bugs.webkit.org/show_bug.cgi?id=131053

Reviewed by Sam Weinig.

* UIProcess/API/Cocoa/WKUIDelegate.h:
* UIProcess/Cocoa/UIClient.h:
* UIProcess/Cocoa/UIClient.mm:
(WebKit::UIClient::setDelegate):
(WebKit::UIClient::createNewPage):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166606 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WebKit2] Partial repaint is broken
https://bugs.webkit.org/show_bug.cgi?id=131056

Reviewed by Dean Jackson.

* Shared/mac/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::display):
We need to check if the repaint rects themselves cover the whole
layer's surface, not just their bounds. Otherwise, we'll optimize
out the back->front copy and end up not painting the whole layer.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166607 268f45cc-cd09-0410-ab3c-d52691b4dbfc