Restrict network process to remote connections
https://bugs.webkit.org/show_bug.cgi?id=134908

Reviewed by Geoffrey Garen.

Further restrict network client

* Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171090 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use the legacy session coder for encoding/decoding session state
https://bugs.webkit.org/show_bug.cgi?id=134910

Reviewed by Beth Dakin.

* UIProcess/Cocoa/SessionStateCoding.mm:
(WebKit::encodeSessionState):
(WebKit::decodeSessionState):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171091 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Flattening dictionaries with oversize backing stores can cause crashes
https://bugs.webkit.org/show_bug.cgi?id=134906

Reviewed by Filip Pizlo.

The collector expects any pointers into CopiedSpace passed to copyLater are within 32 KB
of the CopiedBlock header. This was always the case except for when flattening a dictionary
caused the size of the Butterfly to decrease. This was equivalent to moving the base of the
Butterfly to higher addresses. If the object was reduced sufficiently in size, the base
would no longer be within the first 32 KB of the CopiedBlock and the next collection would
choke on the Butterfly pointer.

This patch fixes this issue by detect this situation during flattening and memmove-ing
the Butterfly down to where the old base was.

* runtime/JSObject.cpp:
(JSC::JSObject::shiftButterflyAfterFlattening):
* runtime/JSObject.h:
(JSC::JSObject::butterflyPreCapacity):
(JSC::JSObject::butterflyTotalSize):
* runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):
* tests/stress/flatten-oversize-dictionary-object.js: Added.
(foo):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix 32-bit build.

* UIProcess/Cocoa/SessionStateCoding.mm:
(WebKit::encodeSessionState):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171093 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] Add tests to ensure CSS :active and :hover are applied when processing touch events
https://bugs.webkit.org/show_bug.cgi?id=134905
<rdar://problem/16602779>

Reviewed by Simon Fraser.

.:
Add a manual test to ensure that styles for CSS pseudo-class :hover aren't temporarily cleared
on the tapped element when processing a touchend as a result of finger pressing and releasing
on the same element that is initially positioned outside the visible content area.

* ManualTests/ios/touchstart-touchend-on-same-element-should-not-clear-hover.html: Added.

LayoutTests:
Upstream tests by Andreas Kling for <rdar://problem/14324231>.

Add a DRT test to ensure that we apply the style for the CSS pseudo-class :active when
processing touch events.

* platform/iphone-simulator/fast/events/ontouchstart-active-selector-expected.txt: Added.
* platform/iphone-simulator/fast/events/ontouchstart-active-selector.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[PlugIns] Check for a non-null snapshot image before trying to decode it
https://bugs.webkit.org/show_bug.cgi?id=134913
<rdar://problem/17606033>

Reviewed by Tim Horton.

Changeset r169820 introduced a bug where we could examine the pixels of
an image (looking for solid colors) before checking if the image actually
existed.

I added a null check, and moved the code around a bit to avoid checking
for existence three times.

* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::pluginSnapshotTimerFired): Check that snapshotImage exists
before trying to look at it.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171095 268f45cc-cd09-0410-ab3c-d52691b4dbfc