Preserve original document URL for XSSAuditor reports

Merged from Blink (patch by Tom Sepez):
https://src.chromium.org/viewvc/blink?view=rev&revision=158406

Source/WebCore:

Test: http/tests/security/xssAuditor/report-script-tag-replace-state.html

* html/parser/XSSAuditor.cpp:
(WebCore::XSSAuditor::filterToken):
* html/parser/XSSAuditorDelegate.cpp:
(WebCore::buildConsoleError):
(WebCore::XSSAuditorDelegate::generateViolationReport):
(WebCore::XSSAuditorDelegate::didBlockScript):
* html/parser/XSSAuditorDelegate.h:
(WebCore::XSSInfo::XSSInfo):

LayoutTests:

* http/tests/security/xssAuditor/report-script-tag-replace-state-expected.txt: Added.
* http/tests/security/xssAuditor/report-script-tag-replace-state.html: Added.
* http/tests/security/xssAuditor/resources/echo-intertag.pl:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165986 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: probe sidebar should use overflow:scroll and split space evenly
https://bugs.webkit.org/show_bug.cgi?id=129627

Patch by Katie Madonna <madonnk@gmail.com> on 2014-03-20
Reviewed by Timothy Hatcher.

Use flexbox to split space evenly in the probe sidebar, which required changes to collapse
format, remove scrollbar styles from old timelapse branch.

* UserInterface/Views/ProbeDetailsSidebarPanel.css: Space elements evenly with flexbox
and make collapse correctly, remove scrollbar style.
* UserInterface/Views/ProbeSetDetailsSection.js: Removed inline style.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165987 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: DebuggerDashboardView looks scrunched debugging JSContext
https://bugs.webkit.org/show_bug.cgi?id=130527

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-20
Reviewed by Timothy Hatcher.

Instead of using body.javascript to force a collapsed style,
actually use the toolbar's collapsed class.

* UserInterface/Views/DashboardContainerView.css:
(.toolbar.collapsed .dashboard-container):
* UserInterface/Views/Toolbar.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165988 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Incorrect behavior when mutating a typed array during set.
https://bugs.webkit.org/show_bug.cgi?id=130428

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This fixes a null derefence that occurs if a typed array
is mutated during the set() operation. The patch gets rid
of the "Quickly" version of setIndex that is assigning
JSValues of unknown type, as the numeric conversion can trigger
side effects that lead to neutering, and so we deref null.

* runtime/JSGenericTypedArrayView.h:
(JSC::JSGenericTypedArrayView::setIndex):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::set):
(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):

LayoutTests:

Test behaviour of TypedArray.set(array) when we neuter the array.

* js/typed-array-mutated-during-set-expected.txt: Added.
* js/typed-array-mutated-during-set.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165989 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge AtomicString, Identifier
https://bugs.webkit.org/show_bug.cgi?id=128624

Unreviewed build fix following r165982.

* WebProcess/Plugins/Netscape/NPJSObject.cpp:
    - update includes.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165990 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[New Multicolumn] getClientRects returns wrong rectangle
https://bugs.webkit.org/show_bug.cgi?id=128614

Reviewed by Sam Weinig.

Added fast/multicol/newmulticol/client-rects.html and beefed up existing
fast/multicol/client-rects.html to use more writing modes.

Source/WebCore: 

* rendering/LayoutState.h:
Removed unused function.

* rendering/RenderFlowThread.h:
Make mapFlowToRegion virtual so that RenderMultiColumnFlowThread can
override it.

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::mapFromFlowToRegion):
* rendering/RenderMultiColumnFlowThread.h:
Implement mapFlowToRegion to correctly translate a flow thread position
into a column offset within a region.

* rendering/RenderMultiColumnSet.cpp:
(WebCore::RenderMultiColumnSet::columnTranslationForOffset):
(WebCore::RenderMultiColumnSet::adjustRegionBoundsFromFlowThreadPortionRect):
* rendering/RenderMultiColumnSet.h:
Refactored some code to make a columnTranslationForOffset helper that
can be used by RenderMultiColumnFlowThread.

LayoutTests: 

* fast/multicol/client-rects.html:
* fast/multicol/newmulticol/client-rects-expected.html: Added.
* fast/multicol/newmulticol/client-rects.html: Added.
* platform/mac/fast/multicol/client-rects-expected.png:
* platform/mac/fast/multicol/client-rects-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165991 268f45cc-cd09-0410-ab3c-d52691b4dbfc
iOS build fix after r165979.

* generate-export-file:
(preprocessorMacros):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165992 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build.

Rename WKPreferencesPrivate.h to WKPreferencesRefPrivate.h.

* UIProcess/API/C/WKPreferencesRefPrivate.h: Renamed from Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h.
* UIProcess/API/Cocoa/WKPreferencesPrivate.h:
* WebKit2.xcodeproj/project.pbxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165993 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fixes for Win64.
https://bugs.webkit.org/show_bug.cgi?id=130481

Reviewed by Brent Fulgham.

* WebKit.vcxproj/WebKit.sln:
Don't build ANGLE projects for now, corrected build configurations,
and build WebInspectorUI.
* WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in:
Added 64-bit linker symbol.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165994 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash beneath operationTearOffActivation running this JS compression demo
https://bugs.webkit.org/show_bug.cgi?id=130295
<rdar://problem/16332337>

Reviewed by Oliver Hunt.
        
Make sure that we flush things as if we were at a terminal, if we are at a block with
no forward edges. This fixes infinitely loopy code with captured variables.

Make sure that the CFG simplifier adds explicit flushes whenever it jettisons a block.
        
Make it so that NodeIsFlushed is a thing. Previously only SSA used it and it computed
it by itself. Now it's an artifact of CPS rethreading.
        
Add a bunch of tests. All of them previously either crashed or returned bad output due
to memory corruption.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::isCaptured):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::flushForTerminal):
(JSC::DFG::ByteCodeParser::flushForReturn):
(JSC::DFG::ByteCodeParser::flushIfTerminal):
(JSC::DFG::ByteCodeParser::branchData):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
* dfg/DFGCPSRethreadingPhase.cpp:
(JSC::DFG::CPSRethreadingPhase::run):
(JSC::DFG::CPSRethreadingPhase::computeIsFlushed):
(JSC::DFG::CPSRethreadingPhase::addFlushedLocalOp):
(JSC::DFG::CPSRethreadingPhase::addFlushedLocalEdge):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::clearFlagsOnAllNodes):
* dfg/DFGGraph.h:
* dfg/DFGNode.h:
* dfg/DFGNodeFlags.cpp:
(JSC::DFG::dumpNodeFlags):
* dfg/DFGNodeFlags.h:
* dfg/DFGSSAConversionPhase.cpp:
(JSC::DFG::SSAConversionPhase::run):
* tests/stress/activation-test-loop.js: Added.
(Inner.this.doStuff):
(Inner):
(foo.inner.isDone):
(foo):
* tests/stress/inferred-infinite-loop-that-uses-captured-variables.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables-before-throwing.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables-but-they-do-not-escape.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables-with-osr-entry.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/tricky-indirectly-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
(bar):
(fuzz):
(foo.f):
(foo):
* tests/stress/tricky-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
(bar):
(foo.f):
(foo):
* tests/stress/tricky-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
(bar):
(foo.f):
(foo):
* tests/stress/tricky-infinite-loop-that-uses-captured-variables.js: Added.
(bar):
(foo):
(noInline):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165995 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Preparation for using Soup on Windows.
https://bugs.webkit.org/show_bug.cgi?id=130472

Reviewed by Brent Fulgham.

* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
Added Soup source to build on WinCairo.
* platform/network/curl/CookieJarCurl.cpp:
* platform/network/curl/CredentialStorageCurl.cpp:
* platform/network/curl/CurlCacheEntry.cpp:
* platform/network/curl/CurlCacheManager.cpp:
* platform/network/curl/CurlDownload.cpp:
* platform/network/curl/DNSCurl.cpp:
* platform/network/curl/FormDataStreamCurl.cpp:
* platform/network/curl/MultipartHandle.cpp:
* platform/network/curl/ProxyServerCurl.cpp:
* platform/network/curl/ResourceHandleCurl.cpp:
* platform/network/curl/ResourceHandleManager.cpp:
* platform/network/curl/SSLHandle.cpp:
* platform/network/curl/SocketStreamHandleCurl.cpp:
Protected with USE(CURL) to avoid duplicate symbols when linking.
* platform/network/soup/AuthenticationChallengeSoup.cpp:
* platform/network/soup/CertificateInfo.cpp:
* platform/network/soup/CookieJarSoup.cpp:
* platform/network/soup/CookieStorageSoup.cpp:
* platform/network/soup/CredentialStorageSoup.cpp:
* platform/network/soup/DNSSoup.cpp:
* platform/network/soup/NetworkStorageSessionSoup.cpp:
* platform/network/soup/ProxyResolverSoup.cpp:
* platform/network/soup/ProxyServerSoup.cpp:
* platform/network/soup/ResourceErrorSoup.cpp:
* platform/network/soup/ResourceHandleSoup.cpp:
* platform/network/soup/ResourceRequestSoup.cpp:
* platform/network/soup/ResourceResponseSoup.cpp:
* platform/network/soup/SocketStreamHandleSoup.cpp:
* platform/network/soup/SoupNetworkSession.cpp:
* platform/network/soup/SynchronousLoaderClientSoup.cpp:
Protected with USE(CURL) to avoid duplicate symbols when linking.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165996 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a flushing mechanism for the WebVTTParser
https://bugs.webkit.org/show_bug.cgi?id=130532

Reviewed by Eric Carlson.

Merged from Blink (patch by vcarbune@chromium.org):
https://chromium.googlesource.com/chromium/blink/+/1ac2b3081492ab8661429230004013a9a3623f0f
http://crbug.com/54203003
https://chromium.googlesource.com/chromium/blink/+/24343d32bc36d20d59ef3e10040faddde65929e6
http://crbug.com/59453002
https://chromium.googlesource.com/chromium/blink/+/ef2793f1d9d207389589ecf9a136ea5c7170b4af
http://crbug.com/75233002
https://chromium.googlesource.com/chromium/blink/+/a29f2f8324abcd4826b41e7dc34373dee2ec57a9
http://crbug.com/52713005
https://chromium.googlesource.com/chromium/blink/+/7ce003c8d47b39f116f1f2a592a5dfb4a9e77228
http://crbug.com/64303004
https://chromium.googlesource.com/chromium/blink/+/18f896b3498478311e880f782813d5dfc8c0c7d1
http://crbug.com/96933004
https://chromium.googlesource.com/chromium/blink/+/8670e8ecb13254a651f5493ec83f4484d18c154e
http://crbug.com/98783005
https://chromium.googlesource.com/chromium/blink/+/4ac55780a6af3d76e0159c1d145330964ad56647
http://crbug.com/104713002

Tests: http/tests/media/track/track-webvtt-slow-loading-2.html
       http/tests/media/track/track-webvtt-slow-loading.html

* CMakeLists.txt:
* GNUmakefile.list.am:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
* WebCore.xcodeproj/project.pbxproj:
* html/track/BufferedLineReader.cpp: Added.
* html/track/BufferedLineReader.h: Added.
* html/track/TextTrackRegion.cpp:
* html/track/VTTCue.cpp:
* html/track/WebVTTParser.cpp:
* html/track/WebVTTParser.h:
* loader/TextTrackLoader.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165997 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] asynchronous media callbacks should happen on the web thread
https://bugs.webkit.org/show_bug.cgi?id=130536

Reviewed by Jer Noble.

* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
(WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability): Use callOnMainThread
    instead of dispatch_async(dispatch_get_main_queue()).


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165998 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore: Crash beneath operationTearOffActivation running this JS compression demo
https://bugs.webkit.org/show_bug.cgi?id=130295
<rdar://problem/16332337>

Patch by Filip Pizlo <fpizlo@apple.com> on 2014-03-20
Reviewed by Oliver Hunt.
        
Make sure that we flush things as if we were at a terminal, if we are at a block with
no forward edges. This fixes infinitely loopy code with captured variables.

Make sure that the CFG simplifier adds explicit flushes whenever it jettisons a block.
        
Make it so that NodeIsFlushed is a thing. Previously only SSA used it and it computed
it by itself. Now it's an artifact of CPS rethreading.
        
Add a bunch of tests. All of them previously either crashed or returned bad output due
to memory corruption.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::isCaptured):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::flushForTerminal):
(JSC::DFG::ByteCodeParser::flushForReturn):
(JSC::DFG::ByteCodeParser::flushIfTerminal):
(JSC::DFG::ByteCodeParser::branchData):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
* dfg/DFGCPSRethreadingPhase.cpp:
(JSC::DFG::CPSRethreadingPhase::run):
(JSC::DFG::CPSRethreadingPhase::computeIsFlushed):
(JSC::DFG::CPSRethreadingPhase::addFlushedLocalOp):
(JSC::DFG::CPSRethreadingPhase::addFlushedLocalEdge):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::clearFlagsOnAllNodes):
* dfg/DFGGraph.h:
* dfg/DFGNode.h:
* dfg/DFGNodeFlags.cpp:
(JSC::DFG::dumpNodeFlags):
* dfg/DFGNodeFlags.h:
* dfg/DFGSSAConversionPhase.cpp:
(JSC::DFG::SSAConversionPhase::run):
* tests/stress/activation-test-loop.js: Added.
(Inner.this.doStuff):
(Inner):
(foo.inner.isDone):
(foo):
* tests/stress/inferred-infinite-loop-that-uses-captured-variables.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables-before-throwing.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables-but-they-do-not-escape.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables-with-osr-entry.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/infinite-loop-that-uses-captured-variables.js: Added.
(bar):
(foo):
(noInline):
* tests/stress/tricky-indirectly-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
(bar):
(fuzz):
(foo.f):
(foo):
* tests/stress/tricky-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
(bar):
(foo.f):
(foo):
* tests/stress/tricky-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
(bar):
(foo.f):
(foo):
* tests/stress/tricky-infinite-loop-that-uses-captured-variables.js: Added.
(bar):
(foo):
(noInline):

Source/WTF: Remove IdentifierTable typedef, isIdentifier()
https://bugs.webkit.org/show_bug.cgi?id=130533

Rubber stamped by Geoff Garen.

Code should use AtomicStringTable, isAtomic() directly.

* wtf/WTFThreadData.h:
(WTF::WTFThreadData::setCurrentAtomicStringTable):
(WTF::WTFThreadData::resetCurrentAtomicStringTable):
    - removed IdentifierTypedef.
* wtf/text/StringImpl.h:
(WTF::StringImpl::flagIsAtomic):
    - renamed flagIsIdentfier -> flagIsAtomic.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165999 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: event == [NSApp currentEvent] hitting Command-+
https://bugs.webkit.org/show_bug.cgi?id=130526
<rdar://problem/16371612>

Reviewed by Anders Carlsson.

* UIProcess/API/mac/WKView.mm: (-[WKView performKeyEquivalent:]): Cut custom
processing short whenever we are redispatching an event, not just when the event
we are handling is the one being redispatched. There shouldn't be any other unrelated
events here, just the one being redispatched and synthetic ones generated from it by AppKit.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166000 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WinCairo] Unreviewed speculative build after my r165996.

* platform/network/soup/AuthenticationChallengeSoup.cpp:
* platform/network/soup/CertificateInfo.cpp:
* platform/network/soup/CookieJarSoup.cpp:
* platform/network/soup/ResourceRequestSoup.cpp:
* platform/network/soup/ResourceResponseSoup.cpp:
* platform/network/soup/SynchronousLoaderClientSoup.cpp:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166001 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update iOS input method code to use new cross-platform async functions
https://bugs.webkit.org/show_bug.cgi?id=130530

Reviewed by Enrica Casucci.

Merge identical iOS and cross-platform functions.

Also tightened up ifdefs, and removed stub iOS implementations of sync methods,
which hopefully won't be ever needed. The only tricky case is sync cancelComposition,
will I'll investigate separately.

* UIProcess/WebPageProxy.h:
* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView setMarkedText:selectedRange:]):
(-[WKContentView unmarkText]):
(-[WKContentView insertText:]):
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::cancelComposition):
* UIProcess/mac/WebPageProxyMac.mm:
(WebKit::WebPageProxy::cancelComposition):
(WebKit::WebPageProxy::insertDictatedTextAsync):
(WebKit::WebPageProxy::attributedSubstringForCharacterRangeAsync):
(WebKit::WebPageProxy::attributedStringForCharacterRangeCallback):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:
* WebProcess/WebPage/ios/WebPageIOS.mm:
* WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::cancelComposition):
(WebKit::WebPage::insertDictatedTextAsync):
(WebKit::WebPage::attributedSubstringForCharacterRangeAsync):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166002 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebRTC] Moving RTCConfiguration and RTCIceServer to Modules/mediastream
https://bugs.webkit.org/show_bug.cgi?id=130434

Reviewed by Eric Carlson.

Those classes are defined in WebRTC spec, so they should not be in platform layer.
Adding a platform implementation to be passed to handler classes.

* Modules/mediastream/RTCConfiguration.h: Copied from Source/WebCore/platform/mediastream/RTCConfiguration.h.
* Modules/mediastream/RTCIceServer.h: Copied from Source/WebCore/platform/mediastream/RTCIceServer.h.
* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::RTCPeerConnection):
(WebCore::RTCPeerConnection::updateIce):
* WebCore.xcodeproj/project.pbxproj:
* platform/mediastream/RTCConfigurationPrivate.h: Added.
* platform/mediastream/RTCIceServerPrivate.h: Added.
* platform/mediastream/RTCPeerConnectionHandler.h:
* platform/mock/RTCPeerConnectionHandlerMock.cpp:
(WebCore::RTCPeerConnectionHandlerMock::initialize):
(WebCore::RTCPeerConnectionHandlerMock::updateIce):
* platform/mock/RTCPeerConnectionHandlerMock.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166003 268f45cc-cd09-0410-ab3c-d52691b4dbfc
iOS build fix after r165992.

* generate-export-file:
(preprocessorMacros):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@166004 268f45cc-cd09-0410-ab3c-d52691b4dbfc