Merge r164917 - Fix lifetime handling of SVGPropertyTearOffs
<http://webkit.org/b/129211>
<rdar://problem/15696025>

Reviewed by Maciej Stachowiak.

Merged from Blink (patch by Ojan Vafai):
https://src.chromium.org/viewvc/blink?revision=157801&view=revision
http://crbug.com/288771

    -Replace SVGStaticPropertyWithParentTearOff with SVGMatrixTearOff
    since it's only used in that one place. This means we can get rid
    of the templatizing and the method pointer.
    -Change SVGPropertyTearOff to keep track of it's child tearoffs
    and call detachWrapper on its child tearoffs when it's destroyed
    or when it's wrapper is detached.
    -Have SVGPropertyTearOff hold WeakPtrs to the child tearoffs
    to avoid having a cycle.

Source/WebCore:

Test: svg/transforms/svg-matrix-tearoff-crash.html

* GNUmakefile.list.am:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
* WebCore.xcodeproj/project.pbxproj:
* bindings/scripts/CodeGeneratorJS.pm:
(NativeToJSValue):
* svg/properties/SVGMatrixTearOff.h: Renamed from Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h.
(WebCore::SVGMatrixTearOff::create):
(WebCore::SVGMatrixTearOff::commitChange):
(WebCore::SVGMatrixTearOff::SVGMatrixTearOff):
* svg/properties/SVGPropertyTearOff.h:
(WebCore::SVGPropertyTearOff::addChild):
(WebCore::SVGPropertyTearOff::detachChildren):

LayoutTests:

* svg/transforms/svg-matrix-tearoff-crash-expected.txt: Added.
* svg/transforms/svg-matrix-tearoff-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168266 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165053 - SVGPropertyTearOffs should detachChildren before deleting its value.
<http://webkit.org/b/129618>
<rdar://problem/15661617>

Reviewed by Maciej Stachowiak.

Merged from Blink (patch by kouhei@chromium.org):
https://src.chromium.org/viewvc/blink?revision=158563&view=revision
http://crbug.com/296276

Test: svg/transforms/svg-matrix-tearoff-crash.html

NOTE: The test does not reproduce a crash on WebKit using
JavaScriptCore.

* svg/properties/SVGPropertyTearOff.h:
(WebCore::SVGPropertyTearOff::setValue):
(WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
- Call detachChildren() if m_value is a copy.  The original
  Blink patch did not modify the destructor code path, although
  that seems obvious via code inspection.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168268 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163282 - Minor SVGRootInlineBox cleanup.
<https://webkit.org/b/128094>

Remove two virtual functions and sprinkle some missing overrides.

Reviewed by Anders Carlsson.

* rendering/svg/SVGRootInlineBox.h:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168269 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166420 - Clear SVGInlineTextBox fragments when the text changes.
https://bugs.webkit.org/show_bug.cgi?id=130879

Reviewed by Darin Adler.

Ported from Blink: https://src.chromium.org/viewvc/blink?revision=150456&view=revision

Source/WebCore:

This patch modifies SVGInlineTextBox::dirtyLineBoxes to clear all
following text boxes when invoked. Typically this method is called
when the underlying text string changes, and that change needs to
be propagated to all the boxes that use the text beyond the point
where the text is first modified.

Also cleans up final function keywords for SVGRootInlineBox.

Test: svg/custom/unicode-in-tspan-multi-svg-crash.html

* rendering/InlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
(WebCore::InlineTextBox::dirtyOwnLineBoxes): Calls dirtyLineBoxes()
* rendering/svg/SVGInlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
(WebCore::SVGInlineTextBox::dirtyOwnLineBoxes):
* rendering/svg/SVGInlineTextBox.cpp:
(WebCore::SVGInlineTextBox::dirtyOwnLineBoxes): Non-recursive part of dirtyLineBoxes()
(WebCore::SVGInlineTextBox::dirtyLineBoxes): Calls dirtyOwnLineBoxes() in a loop
* rendering/svg/SVGRootInlineBox.h:

LayoutTests:

When failing, this test will render garbage characters or crash.

* svg/custom/unicode-in-tspan-multi-svg-crash-expected.txt: Added.
* svg/custom/unicode-in-tspan-multi-svg-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168270 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166428 - In some situations, partial layouts of floating elements produce incorrect results.
https://bugs.webkit.org/show_bug.cgi?id=122668

Reviewed by David Hyatt.

Source/WebCore:

When performing partial layout of float elements and checking if other float
elements are encountered, incorrect results were obtained by not checking
the size of the existing floats vector.

Test: fast/block/float/floats-in-clean-line-crash.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::checkFloatsInCleanLine):

LayoutTests:

Added test to ensure an assertion is not reached when performing a partial
layout of float elements in certain situations.

* fast/block/float/floats-in-clean-line-crash-expected.txt: Added.
* fast/block/float/floats-in-clean-line-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168271 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166457 - Preserve selection end positions in directionOfSelection
<http://webkit.org/b/104813>
<rdar://problem/13666417>

Reviewed by Brent Fulgham.

Merged from Blink (patch by kenrb@chromium.org):
https://src.chromium.org/viewvc/blink?revision=150621&view=revision
http://crbug.com/164263

    VisibleSelection::visibleStart() and VisibleSelection::visibleEnd()
    can both cause layouts, which has the potential to invalidate any
    rendertree-based objects. This was causing a problem in
    FrameSelection::directionOfSelection(), where a reference to a
    lineBox was being held across a call to visibleEnd().

    This patch ensures that the any layout is completed before linebox
    references are retrieved.

Source/WebCore:

Test: editing/selection/layout-during-move-selection-crash.html

* editing/FrameSelection.cpp:
(WebCore::FrameSelection::directionOfSelection):

LayoutTests:

* editing/selection/layout-during-move-selection-crash-expected.txt: Added.
* editing/selection/layout-during-move-selection-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168272 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166600 - Do not allow HTTP refresh headers to refresh to javascript: URLs
<http://webkit.org/b/119051>
<rdar://problem/14536453>

Reviewed by Alexey Proskuryakov.

Merged from Blink (patch by tsepez@chromium.org):
https://src.chromium.org/viewvc/blink?revision=153912&view=revision
http://crbug.com/258151

    This behaviour has been standard in IE since IE7.  This makes us both
    more compatible and less vulnerable to XSS.

Source/WebCore:

Tests: http/tests/security/no-javascript-location-percent-escaped.html
       http/tests/security/no-javascript-location.html
       http/tests/security/no-javascript-refresh-percent-escaped.php
       http/tests/security/no-javascript-refresh-spaces.php
       http/tests/security/no-javascript-refresh-static-percent-escaped.html
       http/tests/security/no-javascript-refresh-static-spaces.html
       http/tests/security/no-javascript-refresh-static.html
       http/tests/security/no-javascript-refresh.php

* dom/Document.cpp:
(WebCore::Document::processHttpEquiv):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::receivedFirstData):
- Do not fire meta http refresh for a javascript: URL protocol.

LayoutTests:

* http/tests/security/no-javascript-refresh-expected.txt: Added.
* http/tests/security/no-javascript-refresh-static-expected.txt: Added.
* http/tests/security/no-javascript-refresh-static.html: Added.
* http/tests/security/no-javascript-refresh.php: Added.
- Original Blink layout tests with typos fixed and 'PASS:' text
  added.

* http/tests/security/no-javascript-location.html: Added.
* http/tests/security/no-javascript-location-expected.txt: Added.
* http/tests/security/resources/no-javascript-location.php: Copied from LayoutTests/http/tests/security/no-javascript-refresh.php.
* http/tests/security/no-javascript-location-percent-escaped.html: Added.
* http/tests/security/no-javascript-location-percent-escaped-expected.txt: Added.
* http/tests/security/resources/no-javascript-location-percent-escaped.php: Added.
- Add tests using a javascript: URL in a Location: header.

* http/tests/security/no-javascript-refresh-percent-escaped.php: Copied from LayoutTests/http/tests/security/no-javascript-refresh.php.
* http/tests/security/no-javascript-refresh-percent-escaped-expected.txt: Added.
* http/tests/security/no-javascript-refresh-spaces.php: Copied from LayoutTests/http/tests/security/no-javascript-refresh.php.
* http/tests/security/no-javascript-refresh-spaces-expected.txt: Added.
- Add tests using a percent-escaped javascript: URL and a
  javascript: URL with leading spaces in a Refresh: header from
  a web server.

* http/tests/security/no-javascript-refresh-static-percent-escaped.html: Added.
* http/tests/security/no-javascript-refresh-static-percent-escaped-expected.txt: Added.
* http/tests/security/no-javascript-refresh-static-spaces.html: Added.
* http/tests/security/no-javascript-refresh-static-spaces-expected.txt: Added.
- Add tests using a percent-escaped javascript: URL and a
  javascript: URL with leading spaces in a meta http-equiv tag.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168273 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166601 - RenderQuote must destroy remaining text renderer before first letter renderer
https://bugs.webkit.org/show_bug.cgi?id=78023
<rdar://problem/10830009>

Reviewed by Brent Fulgham.

Merged from Blink (patch by Abhishek Arya):
https://src.chromium.org/viewvc/blink?view=rev&revision=151270

Source/WebCore:

Following the fix for <https://bugs.webkit.org/show_bug.cgi?id=114586>, a
RenderQuote may have child render objects for the first letter of its text
and everything following the first letter so as to support the CSS first-
letter property. The latter renderer is responsible for destroying the former
on destruction. It's sufficient to reverse the destruction of the children of
RenderQuote to ensure that we destroy the remaining text renderer before we
destroy the first letter renderer.

Test: fast/css-generated-content/quote-first-letter-crash.html

* rendering/RenderQuote.cpp:
(WebCore::RenderQuote::updateText):

LayoutTests:

* fast/css-generated-content/quote-first-letter-crash-expected.txt: Added.
* fast/css-generated-content/quote-first-letter-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168274 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166645 - Add LayoutTest for crash with bidi isolates

Merged from Blink (patch by jww@chromium.org):
https://src.chromium.org/viewvc/blink?revision=156580&view=revision
http://crbug.com/265838

See Bug 120504: Fix nested unicode-bidi: isolate
<https://bugs.webkit.org/show_bug.cgi?id=120504>
<http://trac.webkit.org/changeset/155554>

* fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt: Added.
* fast/text/international/unicode-bidi-isolate-nested-with-removes.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168277 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166650 - Use outermost containing isolate when constructing bidi runs
<http://webkit.org/b/131107>
<rdar://problem/15690021>

Reviewed by Darin Adler.

Merged from Blink (patch by jww@chromium.org):
https://src.chromium.org/viewvc/blink?revision=157268&view=revision
http://crbug.com/279277

    Update containingIsolate to go back all the way to top
    isolate from current root, rather than stopping at the first
    isolate it finds. This works because the current root is
    always updated with each isolate run.

Source/WebCore:

Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
       fast/text/international/unicode-bidi-isolate-nested-with-removes.html

* rendering/InlineIterator.h:
(WebCore::highestContainingIsolateWithinRoot):
* rendering/RenderBlockLineLayout.cpp:
(WebCore::constructBidiRunsForSegment):

LayoutTests:

* fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt: Updated.
* fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent-expected.txt: Added.
* fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html: Added.
* fast/text/international/unicode-bidi-isolate-nested-with-removes.html: Updated.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167447 - Tidy up isIsolatedInline() and highestContainingIsolateWithinRoot()
<http://webkit.org/b/131117>

Reviewed by Daniel Bates.

Based on review feedback for r166650.

* rendering/InlineIterator.h:
(WebCore::isIsolatedInline):
- Switch argument to a reference since it is never called with a
  nullptr.
(WebCore::highestContainingIsolateWithinRoot):
- Switch first argument to a reference since it's never a
  nullptr.
- Use nullptr for pointer initialization.
- Switch while() loop to for() loop. Pass reference to
  isIsolatedInline().
(WebCore::numberOfIsolateAncestors):
- Switch while() loop to for() loop. Pass reference to
  isIsolatedInline().
* rendering/RenderBlockLineLayout.cpp:
(WebCore::constructBidiRunsForSegment):
- Rename startObj to startObject.
- No longer need to pass the address of startObject here.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168279 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167092 - Assertion failure, !node || node->isElementNode(), in
WebCore::RenderBlock::clone()
<https://bugs.webkit.org/show_bug.cgi?id=110489>
<rdar://problem/13666425>

Reviewed by Antti Koivisto.

Source/WebCore:

We're ending up in RenderBlock::splitBlocks() with |this| ==
|fromBlock|.  We then try to climb the ancestor block chain from
this->parent() to |fromBlock|, but this->parent() is already above
|fromBlock|, so we end up climbing up to the RenderView and trying to
clone it, causing the assertion failure.

Adopt Chromium's mitigation for this from
<https://codereview.chromium.org/13852041>. This is not intended as a
fix for the underlying issue.

Also, fix another issue that occurs with this fuzzed test case that's
not handled by the Chromium fix.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::splitBlocks):
Ensure while we're in the loop that |curr| is a descendant of
|fromBlock|. From the Chromium patch:

    We need to check in every iteration of the loop because
    moveChildrenTo could have moved |curr|. This is a mitigation and
    not really a fix against a class of tree craziness.

Finally, before moving children from |fromBlock| to |toBlock|, ensure
that the children are children of |fromBlock|. If we never entered the
loop, they will be siblings of |fromBlock|, not children.

LayoutTests:

* fast/multicol/fuzzed-test-case-expected.txt: Added.
* fast/multicol/fuzzed-test-case.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168280 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167093 - Assertion failure in WebCore::FlexBoxIterator::next()
<https://bugs.webkit.org/show_bug.cgi?id=117176>
<rdar://problem/14054549>

Source/WebCore:

Code added in r115687 began removing anonymous wrappers when children
become inline. However, there are some objects, like
RenderDeprecatedFlexBox, whose children should always be blocks.

Reviewed by Tim Horton.

* rendering/RenderBlock.h:
(WebCore::RenderBlock::canCollapseAnonymousBlockChild):
Made public.

* rendering/RenderObject.cpp:
(WebCore::RenderObject::removeAnonymousWrappersForInlinesIfNecessary):
Return early if we can't collapse anonymous block children.

LayoutTests:

Reviewed by Tim Horton.

* fast/flexbox/collapse-anonymous-wrappers-assertion-expected.txt: Added.
* fast/flexbox/collapse-anonymous-wrappers-assertion.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167167 - Assertion failure changing select element size during focus event
dispatch
<https://bugs.webkit.org/show_bug.cgi?id=131566>
<rdar://problem/16400735>

Reviewed by Andy Estes.

Source/WebCore:

Test: fast/forms/select-change-size-during-focus.html

* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
Adopt the fix from Chromium r171216; check that the renderer is still
of the expected type, and return early if it is not.

LayoutTests:

* fast/forms/select-change-size-during-focus-expected.txt: Added.
* fast/forms/select-change-size-during-focus.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168282 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167278 - Assertion failure !node || node->isElementNode() in
WebCore::RenderBlock::inlineElementContinuation

https://bugs.webkit.org/show_bug.cgi?id=108829
<rdar://problem/13666405>

I can't reproduce this assertion failure, but there seems to be an
invalid assumption in RenderBlock::inlineElementContinuation() that
anything with the "isInline()" bit set is a RenderInline.

No new test because the test case in the bug does not repro for me.

Reviewed by Brent Fulgham.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::inlineElementContinuation):
Dave Hyatt says that this function should only return RenderInline
objects (not non-RenderInline inline objects), so update the checks
from isInline() to isRenderInline() before casting with
toRenderInline().

* rendering/RenderInline.cpp:
(WebCore::RenderInline::inlineElementContinuation):
Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168283 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167295 - Assertion failure under FEImage::determineAbsolutePaintRect()

<https://bugs.webkit.org/show_bug.cgi?id=131660>
<rdar://problem/15669294>

Source/WebCore:
This patch merges Chromium r149536 (see
<https://chromiumcodereview.appspot.com/14701012>), which moves
m_absoluteTransform out of SVGFilter and into the base Filter class, so
that it isn't necessary to cast a Filter to SVGFilter to get the
absolute transform.

Reviewed by Geoffrey Garen.

Test: svg/filters/feImage-filter-assertion.html

* platform/graphics/filters/Filter.h:
(WebCore::Filter::Filter):
Changed to take the absolute transform.
(WebCore::Filter::absoluteTransform):
Moved from SVGFilter.
(WebCore::Filter::mapAbsolutePointToLocalPoint):
Ditto.

* rendering/FilterEffectRenderer.cpp:
(WebCore::FilterEffectRenderer::FilterEffectRenderer):
Pass a default AffineTransform() to the Filter base class.

* svg/graphics/filters/SVGFEImage.cpp:
(WebCore::FEImage::determineAbsolutePaintRect):
Use the Filter without casting it to SVGFilter.
(WebCore::FEImage::platformApplySoftware):
Ditto.

* svg/graphics/filters/SVGFilter.cpp:
(WebCore::SVGFilter::SVGFilter):
Pass the transform to the base class, and remove initialization of a
removed member var.

* svg/graphics/filters/SVGFilter.h:
Member var moved to Filter.h.

LayoutTests:
Reviewed by Geoffrey Garen.

* svg/filters/feImage-filter-assertion-expected.txt: Added.
* svg/filters/feImage-filter-assertion.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168284 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166736 - Continuations casting issue.
https://bugs.webkit.org/show_bug.cgi?id=130057
<rdar://problem/16283406>

Reviewed by Simon Fraser.

Source/WebCore:

The code to update relative positioned anonymous block continuations should not
have assumed that all siblings were RenderBlocks. Make the code smarter and
make it bail when it hits something that isn't part of the block continuation
chain.

Added fast/block/continuation-crash.html

* rendering/RenderInline.cpp:
(WebCore::updateStyleOfAnonymousBlockContinuations):

LayoutTests:

* fast/block/continuation-crash-expected.txt: Added.
* fast/block/continuation-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168285 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167336 - compileMakeRope does not emit necessary bounds checks
https://bugs.webkit.org/show_bug.cgi?id=130684
<rdar://problem/16398388>

Reviewed by Oliver Hunt.

Add string length bounds checks in a bunch of places. We should never allow a string
to have a length greater than 2^31-1 because it's not clear that the language has
semantics for it and because there is code that assumes that this cannot happen.

Also add a bunch of tests to that effect to cover the various ways in which this was
previously allowed to happen.

* dfg/DFGOperations.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileMakeRope):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMakeRope):
* runtime/JSString.cpp:
(JSC::JSRopeString::RopeBuilder::expand):
* runtime/JSString.h:
(JSC::JSString::create):
(JSC::JSRopeString::RopeBuilder::append):
(JSC::JSRopeString::RopeBuilder::release):
(JSC::JSRopeString::append):
* runtime/Operations.h:
(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
* tests/stress/make-large-string-jit-strcat.js: Added.
(foo):
* tests/stress/make-large-string-jit.js: Added.
(foo):
* tests/stress/make-large-string-strcat.js: Added.
* tests/stress/make-large-string.js: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168295 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167480 - Source/WebCore: origin spoofing possible (HTTP Origin, postMessage event.origin) due to inappropriate URL escape sequence decoding
https://bugs.webkit.org/show_bug.cgi?id=131837
rdar://problem/15211936

Reviewed by Anders Carlsson and Dave Hyatt.

Tests: fast/dom/DOMURL/parsing.html
       fast/dom/HTMLAnchorElement/anchor-element-href-parsing.html

* platform/URL.cpp:
(WebCore::URL::host): Removed unnecessary call to decodeURLEscapeSequences, which caused
problems and was not needed.

LayoutTests: hostname extraction from a URL should not decode percent-escape sequences
https://bugs.webkit.org/show_bug.cgi?id=131837
rdar://problem/15211936

Reviewed by Anders Carlsson and Dave Hyatt.

* fast/dom/DOMURL/parsing-expected.txt: Added.
* fast/dom/DOMURL/parsing.html: Added.
* fast/dom/HTMLAnchorElement/anchor-element-href-parsing-expected.txt: Added.
* fast/dom/HTMLAnchorElement/anchor-element-href-parsing.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168296 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167524 - Harden RenderInline::inlineElementContinuation()

<https://bugs.webkit.org/show_bug.cgi?id=131858>

Reviewed by Sam Weinig.

No new tests, as there are no known cases of this happening.

* rendering/RenderInline.cpp:
(WebCore::RenderInline::inlineElementContinuation):
Return nullptr if the continuation is neither a RenderInline nor a
RenderBlock.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.4@168297 268f45cc-cd09-0410-ab3c-d52691b4dbfc