Crashes in HTMLFormElement::submit.
https://bugs.webkit.org/show_bug.cgi?id=131910
<rdar://problem/15661790>


Source/WebCore: 
Based on a patch by Kent Tamura.

Reviewed by Anders Carlsson.

Tests: fast/forms/form-submission-crash-2.html
       fast/forms/form-submission-crash.html

Code that executes arbitrary JS needs to protect objects that it uses afterwards.

* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::prepareForSubmission):
(WebCore::HTMLFormElement::submit):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::submitForm):

LayoutTests: 
Reviewed by Anders Carlsson.

* fast/forms/form-submission-crash-2-expected.txt: Added.
* fast/forms/form-submission-crash-2.html: Added.
* fast/forms/form-submission-crash-expected.txt: Added.
* fast/forms/form-submission-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167569 268f45cc-cd09-0410-ab3c-d52691b4dbfc
bmalloc: Segregate pages by objects size
https://bugs.webkit.org/show_bug.cgi?id=131909

Reviewed by Andreas Kling.

2% reduction in memory-at-end on the Membuster memory_warning benchmarks.

* bmalloc/Allocator.cpp:
(bmalloc::Allocator::allocateSlowCase):
* bmalloc/Allocator.h:
(bmalloc::Allocator::allocateFastCase):
(bmalloc::Allocator::smallAllocatorFor): Use the new shared helper
function for size class calculation.

* bmalloc/Deallocator.cpp:
(bmalloc::Deallocator::Deallocator):
(bmalloc::Deallocator::scavenge):
(bmalloc::Deallocator::deallocateSmallLine):
(bmalloc::Deallocator::allocateSmallLine):
* bmalloc/Deallocator.h: Keep a cache for every size class, since the
cache can't be shared anymore.

* bmalloc/Heap.cpp:
(bmalloc::Heap::allocateSmallLineSlowCase):
* bmalloc/Heap.h:
(bmalloc::Heap::deallocateSmallLine): Ditto.

(bmalloc::Heap::allocateSmallLine): Check size class in addition to
page refcount when allocating a line because we might have deallocated
the page and the recycled it for another size class.

(bmalloc::Heap::deallocateMediumLine):
(bmalloc::Heap::allocateMediumLine):
* bmalloc/Line.h:
(bmalloc::Line::refCount):
* bmalloc/Page.h:
(bmalloc::Page::refCount):
(bmalloc::Page::smallSizeClass):
(bmalloc::Page::setSmallSizeClass):
(bmalloc::Page<Traits>::refCount): Deleted.
* bmalloc/Sizes.h:
(bmalloc::Sizes::smallSizeClassFor): New shared API for computing
an index into an array from a size.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167570 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rename the CSSSelector PseudoType to PseudoClassType
https://bugs.webkit.org/show_bug.cgi?id=131907

Reviewed by Andreas Kling.

Pseudo Elements and Page Pseudo Classes have been moved out of PseudoType in previous patches.
The remaining values in the PseudoType enumeration are the pseudo classes.

This patch is the final clean up, PseudoType is renamed to PseudoClassType.

* css/CSSGrammar.y.in:
* css/CSSParserValues.cpp:
(WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):
* css/CSSParserValues.h:
(WebCore::CSSParserSelector::pseudoClassType):
(WebCore::CSSParserSelector::pseudoType): Deleted.
* css/CSSSelector.cpp:
(WebCore::CSSSelector::specificityForOneSelector):
(WebCore::appendPseudoClassFunctionTail):
(WebCore::CSSSelector::selectorText):
* css/CSSSelector.h:
(WebCore::CSSSelector::pseudoClassType):
(WebCore::CSSSelector::pseudoElementType):
(WebCore::CSSSelector::pagePseudoClassType):
(WebCore::pseudoClassIsRelativeToSiblings):
(WebCore::CSSSelector::isSiblingSelector):
(WebCore::CSSSelector::CSSSelector):
(WebCore::CSSSelector::pseudoType): Deleted.
* css/RuleSet.cpp:
(WebCore::RuleSet::findBestRuleSetAndAdd):
* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOne):
(WebCore::SelectorChecker::checkScrollbarPseudoClass):
(WebCore::SelectorChecker::determineLinkMatchType):
(WebCore::SelectorChecker::matchesFocusPseudoClass):
* css/SelectorChecker.h:
(WebCore::SelectorChecker::isCommonPseudoClassSelector):
* css/SelectorCheckerFastPath.cpp:
(WebCore::SelectorCheckerFastPath::commonPseudoClassSelectorMatches):
* css/SelectorPseudoClassAndCompatibilityElementMap.in:
* css/SelectorPseudoTypeMap.h:
* css/StyleResolver.cpp:
(WebCore::StyleResolver::styleForElement):
* css/makeSelectorPseudoClassAndCompatibilityElementMap.py:
(enumerablePseudoType):
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::addPseudoClassType):
(WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
(WebCore::SelectorCompiler::addPseudoType): Deleted.
* inspector/InspectorCSSAgent.cpp:
(WebCore::computePseudoClassMask):
(WebCore::InspectorCSSAgent::forcePseudoState):
* inspector/InspectorCSSAgent.h:
* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::forcePseudoStateImpl):
* inspector/InspectorInstrumentation.h:
(WebCore::InspectorInstrumentation::forcePseudoState):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167571 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Cocoa] Remove unused -webView:didFinishLoadingNavigation: delegate method
https://bugs.webkit.org/show_bug.cgi?id=131914

Reviewed by Sam Weinig.

* UIProcess/Cocoa/NavigationState.h: Removed flag from m_navigationDelegateMethods struct.
* UIProcess/Cocoa/NavigationState.mm:
(WebKit::NavigationState::setNavigationDelegate): Removed check for whether the method is
implemented.
(WebKit::NavigationState::LoaderClient::didFinishLoadForFrame): Stopped calling the method
if implemented.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167572 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Cocoa] Crash when setting a bundle parameter to nil
https://bugs.webkit.org/show_bug.cgi?id=131917

Reviewed by Sam Weinig.

* UIProcess/API/Cocoa/WKProcessPool.mm:
(-[WKProcessPool _setObject:forBundleParameter:]): If the object is nil, use
-[NSMutableDictionary removeObjectForKey:] rather than -setObject:forKey:.

* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessBundleParameters.mm:
(-[WKWebProcessBundleParameters setParameter:forKey:]): Ditto.

* WebProcess/InjectedBundle/mac/InjectedBundleMac.mm:
(WebKit::InjectedBundle::setBundleParameter): Unrelatedly, create m_bundleParameters if
needed, as it may have not been created on intialization if no bundle parameters were set
at the time.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167573 268f45cc-cd09-0410-ab3c-d52691b4dbfc