REGRESSION (r139343): WebKit crashes when canceling a load inside

<https://webkit.org/b/119853> webView:resource:didFinishLoadingFromDataSource:

Reviewed by Brady Eidson.

Source/WebCore:

A client implementing webView:resource:didFinishLoadingFromDataSource:
might decide to call stopLoading: for the identifier that just finished
loading. If this happens we re-enter the loader and attempt to cancel a
load that has already finished and been removed from the set of active
loaders. Prevent this by clearing DocumentLoader's
m_identifierForLoadWithoutResourceLoader before calling
dispatchDidFinishLoading().

New API test: WebKit1.StopLoadingFromDidFinishLoading.

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::finishedLoading): Set
m_identifierForLoadWithoutResourceLoader to 0 before calling
dispatchDidFinishLoading().

Tools:

Wrote an API test that verifies -[WebView stopLoading:] can be called
inside webView:resource:didFinishLoadingFromDataSource: without crashing.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/StopLoadingFromDidFinishLoading.mm: Added.
(-[StopLoadingFromDidFinishLoadingDelegate webView:resource:didFinishLoadingFromDataSource:]):
(TestWebKitAPI::TEST):

Change-Id: Ib5da6cfdd74eac0e284a512ee54e74353aba783b
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154115 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
Assertion failure in Range::processContentsBetweenOffsets

https://bugs.webkit.org/show_bug.cgi?id=122777

Reviewed by Darin Adler.

Source/WebCore:

Merge https://chromium.googlesource.com/chromium/blink/+/c15de182774c7859c20d97126eb844ae97b792a4

This patch changes ASSERT statements for checking |endOffset| inbound in Range::processContentsBetweenOffsets()
to limit |endOffset|. This is necessary when DOMNodeRemovedFromDocument event handler splits text nodes,
Range::insertNode() on text node, in the range calling Range::deleteContents().

Test: fast/dom/Range/range-delete-contents-mutation-event-crash.html

* dom/Range.cpp:
(WebCore::Range::processContentsBetweenOffsets):

Change-Id: Ibafd4e42cfc50b0a386f31a0c1b49072cdb220d5
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Fix crash in BitmapImage::destroyDecodedData()

https://bugs.webkit.org/show_bug.cgi?id=116494

Patch by Laszlo Vidacs <lac@inf.u-szeged.hu> on 2013-11-07
Reviewed by Csaba Osztrogonác.

Merge from https://chromium.googlesource.com/chromium/blink/+/6b6887bf53068f8537908e501fdc7317ad2c6d86

* platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::destroyDecodedData):

Change-Id: Ifa093a86c9cf2bfb8df29bc021c58c9c80eeaece
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158840 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>