Attachment #147508 for bug #88768

View Details Raw Unified Return to Bug 88768

| Differences between



2012-06-14  Kent Tamura  <tkent@chromium.org>

        Validate form state strings in FormController::setStateForNewFormElements()
        https://bugs.webkit.org/show_bug.cgi?id=88768

        Reviewed by NOBODY (OOPS!).

        Test: fast/forms/state-restore-broken-state.html

        * WebCore.exp.in:
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsArray):
        (WebCore):
        * bindings/js/JSDOMBinding.h:
        (WebCore):
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GetNativeType):
        * bindings/scripts/test/TestObj.idl:
        * html/FormController.cpp:
        (WebCore::isNotFormControlTypeCharacter):
        (WebCore):
        (WebCore::FormController::setStateForNewFormElements):
        * testing/Internals.cpp:
        (WebCore::Internals::formControlStateOfPreviousHistoryItem):
        (WebCore):
        (WebCore::Internals::setFormControlStateOfPreviousHistoryItem):
        * testing/Internals.h:
        (WebCore):
        (Internals):
        * testing/Internals.idl:

2012-06-13  Eli Fidler  <efidler@rim.com>

        Fix CMake build with SMOOTH_SCROLLING enabled



__ZN7WebCore11HistoryItem15setIsTargetItemEb
__ZN7WebCore11HistoryItem15setRedirectURLsEN3WTF10PassOwnPtrINS1_6VectorINS1_6StringELm0EEEEE
__ZN7WebCore11HistoryItem16adoptVisitCountsERN3WTF6VectorIiLm0EEES4_
__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS1_6StringELm0EEE
__ZN7WebCore11HistoryItem17setAlternateTitleERKN3WTF6StringE
__ZN7WebCore11HistoryItem18recordInitialVisitEv
__ZN7WebCore11HistoryItem18setLastVisitedTimeEd

__ZN7WebCore15pathGetFileNameERKN3WTF6StringE
__ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
__ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
__ZN7WebCore15toDOMStringListEPN3JSC9ExecStateENS0_7JSValueE
__ZN7WebCore15visitedLinkHashEPKtj
__ZN7WebCore16AbstractDatabase14setIsAvailableEb
__ZN7WebCore16ApplicationCache18diskUsageForOriginEPNS_14SecurityOriginE

__ZN7WebCore4coreEP20NSURLProtectionSpace
__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_10ClientRectE
__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_13DOMStringListE
__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_14ClientRectListE
__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_19CSSStyleDeclarationE
__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_5RangeE

__ZN7WebCore7TextRun21s_allowsRoundingHacksE
__ZN7WebCore7TextRun22setAllowsRoundingHacksEb
__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
__ZN7WebCore7jsArrayEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrINS_13DOMStringListEEE
__ZN7WebCore7replaceERN3WTF6StringERKNS_17RegularExpressionERKS1_
__ZN7WebCore7toRangeEN3JSC7JSValueE
__ZN7WebCore8Document11createRangeEv

__ZNK7WebCore11HistoryItem11scrollPointEv
__ZNK7WebCore11HistoryItem12isTargetItemEv
__ZNK7WebCore11HistoryItem12redirectURLsEv
__ZNK7WebCore11HistoryItem13documentStateEv
__ZNK7WebCore11HistoryItem14alternateTitleEv
__ZNK7WebCore11HistoryItem15lastVisitedTimeEv
__ZNK7WebCore11HistoryItem15pageScaleFactorEv
__ZNK7WebCore11HistoryItem17originalURLStringEv
__ZNK7WebCore11HistoryItem19childItemWithTargetERKN3WTF6StringE
__ZNK7WebCore11HistoryItem20getTransientPropertyERKN3WTF6StringE
__ZNK7WebCore11HistoryItem21encodeBackForwardTreeERN3WTF7EncoderE
__ZNK7WebCore11HistoryItem3urlEv



#include "JSDOMBinding.h"

#include "DOMObjectHashTableMap.h"
#include "DOMStringList.h"
#include "ExceptionCode.h"
#include "ExceptionHeaders.h"
#include "ExceptionInterfaces.h"

    return static_cast<DateInstance*>(value.toObject(exec))->internalNumber();
}

JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<DOMStringList> stringList)
{
    if (!stringList)
        return jsUndefined();
    JSC::MarkedArgumentBuffer list;
    for (unsigned i = 0; i < stringList->length(); ++i)
        list.append(jsString(exec, stringList->item(i)));
    return JSC::constructArray(exec, globalObject, list);
}

void reportException(ExecState* exec, JSValue exception)
{
    if (isTerminatedExecutionException(exception))

Lines 44-49 a/Source/WebCore/bindings/js/JSDOMBinding.h_sec1
- a/Source/WebCore/bindings/js/JSDOMBinding.h +4 lines
44		44
45	namespace WebCore {	45	namespace WebCore {
46		46
		47	class DOMStringList;
		48
47	enum ParameterDefaultPolicy {	49	enum ParameterDefaultPolicy {
48	DefaultIsUndefined,	50	DefaultIsUndefined,
49	DefaultIsNullString	51	DefaultIsNullString
Lines 291-296 enum ParameterDefaultPolicy { a/Source/WebCore/bindings/js/JSDOMBinding.h_sec2
291	return JSC::constructArray(exec, globalObject, list);	293	return JSC::constructArray(exec, globalObject, list);
292	}	294	}
293		295
		296	JSC::JSValue jsArray(JSC::ExecState, JSDOMGlobalObject, PassRefPtr<DOMStringList>);
		297
294	template<>	298	template<>
295	inline JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<String>& iterator)	299	inline JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<String>& iterator)
296	{	300	{

Lines 3072-3078 sub NativeToJSValue a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm_sec1
- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm -1 / +4 lines
3072		3072
3073	my $arrayType = $codeGenerator->GetArrayType($type);	3073	my $arrayType = $codeGenerator->GetArrayType($type);
3074	if ($arrayType) {	3074	if ($arrayType) {
3075	if (!$codeGenerator->SkipIncludeHeader($arrayType)) {	3075	if ($type eq "DOMString[]") {
		3076	AddToImplIncludes("JSDOMStringList.h", $conditional);
		3077	AddToImplIncludes("DOMStringList.h", $conditional);
		3078	} elsif (!$codeGenerator->SkipIncludeHeader($arrayType)) {
3076	AddToImplIncludes("JS$arrayType.h", $conditional);	3079	AddToImplIncludes("JS$arrayType.h", $conditional);
3077	AddToImplIncludes("$arrayType.h", $conditional);	3080	AddToImplIncludes("$arrayType.h", $conditional);
3078	}	3081	}



    # necessary as resolvers could be constructed on fly.
    return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";

    return "RefPtr<DOMStringList>" if $type eq "DOMString[]";
    return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;

    return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";

    return "Vector<float>" if $type eq "float[]";
    return "Vector<double>" if $type eq "double[]";
    return "RefPtr<DOMStringList>" if $type eq "DOMStringList";
    return "RefPtr<DOMStringList>" if $type eq "DOMString[]";

    # Default, assume native type is a pointer with same type name as idl type
    return "${type}*";

    'CompareHow' => 1,
    'DOMObject' => 1,
    'DOMString' => 1,
    'DOMString[]' => 1,
    'DOMTimeStamp' => 1,
    'Date' => 1,
    'Dictionary' => 1,

Lines 197-202 module test { a/Source/WebCore/bindings/scripts/test/TestObj.idl_sec1
- a/Source/WebCore/bindings/scripts/test/TestObj.idl +3 lines
197	attribute float[] floatArray;	197	attribute float[] floatArray;
198	attribute double[] doubleArray;	198	attribute double[] doubleArray;
199	#endif	199	#endif
		200	#if defined(TESTING_V8) \|\| defined(TESTING_JS)
		201	DOMString[] stringArrayFunction(in DOMString[] values) raises(DOMException);
		202	#endif
200		203
201	#if defined(TESTING_JS)	204	#if defined(TESTING_JS)
202	void methodWithUnsignedLongArray(in unsigned long[] unsignedLongArray);	205	void methodWithUnsignedLongArray(in unsigned long[] unsignedLongArray);

Lines 55-60 Vector<String> FormController::formElementsState() const a/Source/WebCore/html/FormController.cpp_sec1
- a/Source/WebCore/html/FormController.cpp -8 / +21 lines
55	return stateVector;	55	return stateVector;
56	}	56	}
57		57
		58	static bool isNotFormControlTypeCharacter(UChar ch)
		59	{
		60	return ch != '-' && (ch > 'z' \|\| ch < 'a');
		61	}
		62
58	void FormController::setStateForNewFormElements(const Vector<String>& stateVector)	63	void FormController::setStateForNewFormElements(const Vector<String>& stateVector)
59	{	64	{
60	// Walk the state vector backwards so that the value to use for each	65	// Walk the state vector backwards so that the value to use for each
Lines 62-79 void FormController::setStateForNewFormElements(const Vector<String>& stateVecto a/Source/WebCore/html/FormController.cpp_sec2
62	// in the FormElementStateMap. We're using them like stacks.	67	// in the FormElementStateMap. We're using them like stacks.
63	typedef FormElementStateMap::iterator Iterator;	68	typedef FormElementStateMap::iterator Iterator;
64	m_formElementsWithState.clear();	69	m_formElementsWithState.clear();
		70
		71	if (stateVector.size() % 3)
		72	return;
		73	for (size_t i = 0; i < stateVector.size(); i += 3) {
		74	if (stateVector[i + 1].find(isNotFormControlTypeCharacter) != notFound)
		75	return;
		76	}
		77
65	for (size_t i = stateVector.size() / 3 * 3; i; i -= 3) {	78	for (size_t i = stateVector.size() / 3 * 3; i; i -= 3) {
66	AtomicString a = stateVector[i - 3];	79	AtomicString name = stateVector[i - 3];
67	AtomicString b = stateVector[i - 2];	80	AtomicString type = stateVector[i - 2];
68	const String& c = stateVector[i - 1];	81	const String& value = stateVector[i - 1];
69	FormElementKey key(a.impl(), b.impl());	82	FormElementKey key(name.impl(), type.impl());
70	Iterator it = m_stateForNewFormElements.find(key);	83	Iterator it = m_stateForNewFormElements.find(key);
71	if (it != m_stateForNewFormElements.end())	84	if (it != m_stateForNewFormElements.end())
72	it->second.append(c);	85	it->second.append(value);
73	else {	86	else {
74	Vector<String> v(1);	87	Vector<String> valueList(1);
75	v[0] = c;	88	valueList[0] = value;
76	m_stateForNewFormElements.set(key, v);	89	m_stateForNewFormElements.set(key, valueList);
77	}	90	}
78	}	91	}
79	}	92	}



#include "ClientRectList.h"
#include "ComposedShadowTreeWalker.h"
#include "DOMNodeHighlighter.h"
#include "DOMStringList.h"
#include "Document.h"
#include "DocumentMarker.h"
#include "DocumentMarkerController.h"

#include "HTMLInputElement.h"
#include "HTMLNames.h"
#include "HTMLTextAreaElement.h"
#include "HistoryItem.h"
#include "InspectorConsoleAgent.h"
#include "InspectorController.h"
#include "InspectorCounters.h"

}
#endif

PassRefPtr<DOMStringList> Internals::formControlStateOfPreviousHistoryItem(ExceptionCode& ec)
{
    if (!frame()->loader()->history()->previousItem()) {
        ec = INVALID_ACCESS_ERR;
        return 0;
    }
    const Vector<String>& state = frame()->loader()->history()->previousItem()->documentState();
    RefPtr<DOMStringList> stringList = DOMStringList::create();
    for (unsigned i = 0; i < state.size(); ++i)
        stringList->append(state[i]);
    return stringList.release();
}

void Internals::setFormControlStateOfPreviousHistoryItem(PassRefPtr<DOMStringList> state, ExceptionCode& ec)
{
    HistoryItem* mainItem = frame()->loader()->history()->previousItem();
    if (!state || !mainItem) {
        ec = INVALID_ACCESS_ERR;
        return;
    }
    String uniqueName = frame()->tree()->uniqueName();
    if (mainItem->target() == uniqueName)
        mainItem->setDocumentState(*state.get());
    else if (HistoryItem* subItem = mainItem->childItemWithTarget(uniqueName))
        subItem->setDocumentState(*state.get());
    else
        ec = INVALID_ACCESS_ERR;
}

PassRefPtr<ClientRect> Internals::absoluteCaretBounds(Document* document, ExceptionCode& ec)
{
    if (!document || !document->frame() || !document->frame()->selection()) {

Lines 37-42 namespace WebCore { a/Source/WebCore/testing/Internals.h_sec1
- a/Source/WebCore/testing/Internals.h +3 lines
37		37
38	class ClientRect;	38	class ClientRect;
39	class ClientRectList;	39	class ClientRectList;
		40	class DOMStringList;
40	class Document;	41	class Document;
41	class DocumentMarker;	42	class DocumentMarker;
42	class Element;	43	class Element;
Lines 97-102 public: a/Source/WebCore/testing/Internals.h_sec2
97	#if ENABLE(INPUT_TYPE_COLOR)	98	#if ENABLE(INPUT_TYPE_COLOR)
98	void selectColorInColorChooser(Element*, const String& colorValue);	99	void selectColorInColorChooser(Element*, const String& colorValue);
99	#endif	100	#endif
		101	PassRefPtr<DOMStringList> formControlStateOfPreviousHistoryItem(ExceptionCode&);
		102	void setFormControlStateOfPreviousHistoryItem(PassRefPtr<DOMStringList>, ExceptionCode&);
100		103
101	PassRefPtr<ClientRect> absoluteCaretBounds(Document*, ExceptionCode&);	104	PassRefPtr<ClientRect> absoluteCaretBounds(Document*, ExceptionCode&);
102		105

Lines 68-73 module window { a/Source/WebCore/testing/Internals.idl_sec1
- a/Source/WebCore/testing/Internals.idl +2 lines
68	#if defined(ENABLE_INPUT_TYPE_COLOR) && ENABLE_INPUT_TYPE_COLOR	68	#if defined(ENABLE_INPUT_TYPE_COLOR) && ENABLE_INPUT_TYPE_COLOR
69	void selectColorInColorChooser(in Element element, in DOMString colorValue);	69	void selectColorInColorChooser(in Element element, in DOMString colorValue);
70	#endif	70	#endif
		71	DOMString[] formControlStateOfPreviousHistoryItem() raises(DOMException);
		72	void setFormControlStateOfPreviousHistoryItem(in DOMString[] values) raises(DOMException);
71		73
72	ClientRect absoluteCaretBounds(in Document document) raises(DOMException);	74	ClientRect absoluteCaretBounds(in Document document) raises(DOMException);
73		75



2012-06-14  Kent Tamura  <tkent@chromium.org>

        Validate form state strings in FormController::setStateForNewFormElements()
        https://bugs.webkit.org/show_bug.cgi?id=88768

        Reviewed by NOBODY (OOPS!).

        * fast/forms/resources/state-restore-broken-state-1.html: Added.
        * fast/forms/resources/state-restore-broken-state-2.html: Added.
        * fast/forms/state-restore-broken-state-expected.txt: Added.
        * fast/forms/state-restore-broken-state.html: Added.

2012-06-13  Kinuko Yasuda  <kinuko@chromium.org>

        [Chromium] Unreviewed: Add rebaseline and update expectations.



<body onload="handleLoad()">
<form action="state-restore-broken-state-2.html" name=f>
  <input name="name1" value="unmodified">
</form>

<script>
function handleLoad() {
    if (!parent.isGoingBack) {
        document.f.name1.value = 'modified';
        setTimeout(function() {
            window.location.href = 'state-restore-broken-state-2.html';
        }, 0);
    } else {
        parent.didSecondLoad();
    }
}
</script>
</body>

Line 0 a/LayoutTests/fast/forms/resources/state-restore-broken-state-2.html_sec1
- a/LayoutTests/fast/forms/resources/state-restore-broken-state-2.html +7 lines
	1	<script>
	2	setTimeout(function() {
	3	internals.setFormControlStateOfPreviousHistoryItem(['name1', 'text', 'modified', '*broken*']);
	4	parent.didLoadAnotherDocument();
	5	}, 0);
	6	</script>
	7



The value was modified in the first load of state-restore-broken-state-1.html, but it should not be restored because the state-restore-broken-state-2.html breaks the state.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS document.getElementsByTagName("iframe")[0].contentDocument.f.name1.value is "unmodified"
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE html>
<html>
<head>
<script src="../js/resources/js-test-pre.js"></script>
</head>
<body>
<iframe name="subframe" src="resources/state-restore-broken-state-1.html">
</iframe>

<script>
var jsTestIsAsync = true;
var isGoingBack = false;

function didLoadAnotherDocument() {
    isGoingBack = true;
    history.back();
}

function didSecondLoad() {
    description('The value was modified in the first load of state-restore-broken-state-1.html, but it should not be restored because the state-restore-broken-state-2.html breaks the state.');
    shouldBe('document.getElementsByTagName("iframe")[0].contentDocument.f.name1.value', '"unmodified"');
    finishJSTest();
}

</script>
<script src="../js/resources/js-test-post.js"></script>
</body>

Return to Bug 88768

Lines 22-27 a/Source/WebCore/bindings/js/JSDOMBinding.cpp_sec1
- a/Source/WebCore/bindings/js/JSDOMBinding.cpp +11 lines
22	#include "JSDOMBinding.h"	22	#include "JSDOMBinding.h"
23		23
24	#include "DOMObjectHashTableMap.h"	24	#include "DOMObjectHashTableMap.h"
		25	#include "DOMStringList.h"
25	#include "ExceptionCode.h"	26	#include "ExceptionCode.h"
26	#include "ExceptionHeaders.h"	27	#include "ExceptionHeaders.h"
27	#include "ExceptionInterfaces.h"	28	#include "ExceptionInterfaces.h"
Lines 146-151 double valueToDate(ExecState* exec, JSValue value) a/Source/WebCore/bindings/js/JSDOMBinding.cpp_sec2
146	return static_cast<DateInstance*>(value.toObject(exec))->internalNumber();	147	return static_cast<DateInstance*>(value.toObject(exec))->internalNumber();
147	}	148	}
148		149
		150	JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<DOMStringList> stringList)
		151	{
		152	if (!stringList)
		153	return jsUndefined();
		154	JSC::MarkedArgumentBuffer list;
		155	for (unsigned i = 0; i < stringList->length(); ++i)
		156	list.append(jsString(exec, stringList->item(i)));
		157	return JSC::constructArray(exec, globalObject, list);
		158	}
		159
149	void reportException(ExecState* exec, JSValue exception)	160	void reportException(ExecState* exec, JSValue exception)
150	{	161	{
151	if (isTerminatedExecutionException(exception))	162	if (isTerminatedExecutionException(exception))

Lines 3506-3511 sub GetNativeType a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm_sec1
- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm -1 / +2 lines
3506	# necessary as resolvers could be constructed on fly.	3506	# necessary as resolvers could be constructed on fly.
3507	return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";	3507	return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";
3508		3508
		3509	return "RefPtr<DOMStringList>" if $type eq "DOMString[]";
3509	return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;	3510	return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;
3510		3511
3511	return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";	3512	return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";
Lines 3514-3520 sub GetNativeType a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm_sec2
3514	return "Vector<float>" if $type eq "float[]";	3515	return "Vector<float>" if $type eq "float[]";
3515	return "Vector<double>" if $type eq "double[]";	3516	return "Vector<double>" if $type eq "double[]";
3516	return "RefPtr<DOMStringList>" if $type eq "DOMStringList";	3517	return "RefPtr<DOMStringList>" if $type eq "DOMStringList";
3517	return "RefPtr<DOMStringList>" if $type eq "DOMString[]";
3518		3518
3519	# Default, assume native type is a pointer with same type name as idl type	3519	# Default, assume native type is a pointer with same type name as idl type
3520	return "${type}*";	3520	return "${type}*";
Lines 3746-3751 my %non_wrapper_types = ( a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm_sec3
3746	'CompareHow' => 1,	3746	'CompareHow' => 1,
3747	'DOMObject' => 1,	3747	'DOMObject' => 1,
3748	'DOMString' => 1,	3748	'DOMString' => 1,
		3749	'DOMString[]' => 1,
3749	'DOMTimeStamp' => 1,	3750	'DOMTimeStamp' => 1,
3750	'Date' => 1,	3751	'Date' => 1,
3751	'Dictionary' => 1,	3752	'Dictionary' => 1,

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +33 lines
		1	2012-06-14 Kent Tamura <tkent@chromium.org>
		2
		3	Validate form state strings in FormController::setStateForNewFormElements()
		4	https://bugs.webkit.org/show_bug.cgi?id=88768
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Test: fast/forms/state-restore-broken-state.html
		9
		10	* WebCore.exp.in:
		11	* bindings/js/JSDOMBinding.cpp:
		12	(WebCore::jsArray):
		13	(WebCore):
		14	* bindings/js/JSDOMBinding.h:
		15	(WebCore):
		16	* bindings/scripts/CodeGeneratorJS.pm:
		17	(NativeToJSValue):
		18	* bindings/scripts/CodeGeneratorV8.pm:
		19	(GetNativeType):
		20	* bindings/scripts/test/TestObj.idl:
		21	* html/FormController.cpp:
		22	(WebCore::isNotFormControlTypeCharacter):
		23	(WebCore):
		24	(WebCore::FormController::setStateForNewFormElements):
		25	* testing/Internals.cpp:
		26	(WebCore::Internals::formControlStateOfPreviousHistoryItem):
		27	(WebCore):
		28	(WebCore::Internals::setFormControlStateOfPreviousHistoryItem):
		29	* testing/Internals.h:
		30	(WebCore):
		31	(Internals):
		32	* testing/Internals.idl:
		33
1	2012-06-13 Eli Fidler <efidler@rim.com>	34	2012-06-13 Eli Fidler <efidler@rim.com>
2		35
3	Fix CMake build with SMOOTH_SCROLLING enabled	36	Fix CMake build with SMOOTH_SCROLLING enabled

Lines 122-127 __ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE a/Source/WebCore/WebCore.exp.in_sec1
- a/Source/WebCore/WebCore.exp.in +6 lines
122	__ZN7WebCore11HistoryItem15setIsTargetItemEb	122	__ZN7WebCore11HistoryItem15setIsTargetItemEb
123	__ZN7WebCore11HistoryItem15setRedirectURLsEN3WTF10PassOwnPtrINS1_6VectorINS1_6StringELm0EEEEE	123	__ZN7WebCore11HistoryItem15setRedirectURLsEN3WTF10PassOwnPtrINS1_6VectorINS1_6StringELm0EEEEE
124	__ZN7WebCore11HistoryItem16adoptVisitCountsERN3WTF6VectorIiLm0EEES4_	124	__ZN7WebCore11HistoryItem16adoptVisitCountsERN3WTF6VectorIiLm0EEES4_
		125	__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS1_6StringELm0EEE
125	__ZN7WebCore11HistoryItem17setAlternateTitleERKN3WTF6StringE	126	__ZN7WebCore11HistoryItem17setAlternateTitleERKN3WTF6StringE
126	__ZN7WebCore11HistoryItem18recordInitialVisitEv	127	__ZN7WebCore11HistoryItem18recordInitialVisitEv
127	__ZN7WebCore11HistoryItem18setLastVisitedTimeEd	128	__ZN7WebCore11HistoryItem18setLastVisitedTimeEd
Lines 382-387 __ZN7WebCore15originalURLDataEP5NSURL a/Source/WebCore/WebCore.exp.in_sec2
382	__ZN7WebCore15pathGetFileNameERKN3WTF6StringE	383	__ZN7WebCore15pathGetFileNameERKN3WTF6StringE
383	__ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE	384	__ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
384	__ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi	385	__ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
		386	__ZN7WebCore15toDOMStringListEPN3JSC9ExecStateENS0_7JSValueE
385	__ZN7WebCore15visitedLinkHashEPKtj	387	__ZN7WebCore15visitedLinkHashEPKtj
386	__ZN7WebCore16AbstractDatabase14setIsAvailableEb	388	__ZN7WebCore16AbstractDatabase14setIsAvailableEb
387	__ZN7WebCore16ApplicationCache18diskUsageForOriginEPNS_14SecurityOriginE	389	__ZN7WebCore16ApplicationCache18diskUsageForOriginEPNS_14SecurityOriginE
Lines 688-693 __ZN7WebCore4PathD1Ev a/Source/WebCore/WebCore.exp.in_sec3
688	__ZN7WebCore4coreEP20NSURLProtectionSpace	690	__ZN7WebCore4coreEP20NSURLProtectionSpace
689	__ZN7WebCore4coreEP28NSURLAuthenticationChallenge	691	__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
690	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_10ClientRectE	692	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_10ClientRectE
		693	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_13DOMStringListE
691	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_14ClientRectListE	694	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_14ClientRectListE
692	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_19CSSStyleDeclarationE	695	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_19CSSStyleDeclarationE
693	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_5RangeE	696	__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_5RangeE
Lines 807-812 __ZN7WebCore7TextRun19allowsRoundingHacksEv a/Source/WebCore/WebCore.exp.in_sec4
807	__ZN7WebCore7TextRun21s_allowsRoundingHacksE	810	__ZN7WebCore7TextRun21s_allowsRoundingHacksE
808	__ZN7WebCore7TextRun22setAllowsRoundingHacksEb	811	__ZN7WebCore7TextRun22setAllowsRoundingHacksEb
809	__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE	812	__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
		813	__ZN7WebCore7jsArrayEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrINS_13DOMStringListEEE
810	__ZN7WebCore7replaceERN3WTF6StringERKNS_17RegularExpressionERKS1_	814	__ZN7WebCore7replaceERN3WTF6StringERKNS_17RegularExpressionERKS1_
811	__ZN7WebCore7toRangeEN3JSC7JSValueE	815	__ZN7WebCore7toRangeEN3JSC7JSValueE
812	__ZN7WebCore8Document11createRangeEv	816	__ZN7WebCore8Document11createRangeEv
Lines 1065-1074 __ZNK7WebCore11HistoryItem11originalURLEv a/Source/WebCore/WebCore.exp.in_sec5
1065	__ZNK7WebCore11HistoryItem11scrollPointEv	1069	__ZNK7WebCore11HistoryItem11scrollPointEv
1066	__ZNK7WebCore11HistoryItem12isTargetItemEv	1070	__ZNK7WebCore11HistoryItem12isTargetItemEv
1067	__ZNK7WebCore11HistoryItem12redirectURLsEv	1071	__ZNK7WebCore11HistoryItem12redirectURLsEv
		1072	__ZNK7WebCore11HistoryItem13documentStateEv
1068	__ZNK7WebCore11HistoryItem14alternateTitleEv	1073	__ZNK7WebCore11HistoryItem14alternateTitleEv
1069	__ZNK7WebCore11HistoryItem15lastVisitedTimeEv	1074	__ZNK7WebCore11HistoryItem15lastVisitedTimeEv
1070	__ZNK7WebCore11HistoryItem15pageScaleFactorEv	1075	__ZNK7WebCore11HistoryItem15pageScaleFactorEv
1071	__ZNK7WebCore11HistoryItem17originalURLStringEv	1076	__ZNK7WebCore11HistoryItem17originalURLStringEv
		1077	__ZNK7WebCore11HistoryItem19childItemWithTargetERKN3WTF6StringE
1072	__ZNK7WebCore11HistoryItem20getTransientPropertyERKN3WTF6StringE	1078	__ZNK7WebCore11HistoryItem20getTransientPropertyERKN3WTF6StringE
1073	__ZNK7WebCore11HistoryItem21encodeBackForwardTreeERN3WTF7EncoderE	1079	__ZNK7WebCore11HistoryItem21encodeBackForwardTreeERN3WTF7EncoderE
1074	__ZNK7WebCore11HistoryItem3urlEv	1080	__ZNK7WebCore11HistoryItem3urlEv

Lines 31-36 a/Source/WebCore/testing/Internals.cpp_sec1
- a/Source/WebCore/testing/Internals.cpp +31 lines
31	#include "ClientRectList.h"	31	#include "ClientRectList.h"
32	#include "ComposedShadowTreeWalker.h"	32	#include "ComposedShadowTreeWalker.h"
33	#include "DOMNodeHighlighter.h"	33	#include "DOMNodeHighlighter.h"
		34	#include "DOMStringList.h"
34	#include "Document.h"	35	#include "Document.h"
35	#include "DocumentMarker.h"	36	#include "DocumentMarker.h"
36	#include "DocumentMarkerController.h"	37	#include "DocumentMarkerController.h"
Lines 43-48 a/Source/WebCore/testing/Internals.cpp_sec2
43	#include "HTMLInputElement.h"	44	#include "HTMLInputElement.h"
44	#include "HTMLNames.h"	45	#include "HTMLNames.h"
45	#include "HTMLTextAreaElement.h"	46	#include "HTMLTextAreaElement.h"
		47	#include "HistoryItem.h"
46	#include "InspectorConsoleAgent.h"	48	#include "InspectorConsoleAgent.h"
47	#include "InspectorController.h"	49	#include "InspectorController.h"
48	#include "InspectorCounters.h"	50	#include "InspectorCounters.h"
Lines 411-416 void Internals::selectColorInColorChooser(Element* element, const String& colorV a/Source/WebCore/testing/Internals.cpp_sec3
411	}	413	}
412	#endif	414	#endif
413		415
		416	PassRefPtr<DOMStringList> Internals::formControlStateOfPreviousHistoryItem(ExceptionCode& ec)
		417	{
		418	if (!frame()->loader()->history()->previousItem()) {
		419	ec = INVALID_ACCESS_ERR;
		420	return 0;
		421	}
		422	const Vector<String>& state = frame()->loader()->history()->previousItem()->documentState();
		423	RefPtr<DOMStringList> stringList = DOMStringList::create();
		424	for (unsigned i = 0; i < state.size(); ++i)
		425	stringList->append(state[i]);
		426	return stringList.release();
		427	}
		428
		429	void Internals::setFormControlStateOfPreviousHistoryItem(PassRefPtr<DOMStringList> state, ExceptionCode& ec)
		430	{
		431	HistoryItem* mainItem = frame()->loader()->history()->previousItem();
		432	if (!state \|\| !mainItem) {
		433	ec = INVALID_ACCESS_ERR;
		434	return;
		435	}
		436	String uniqueName = frame()->tree()->uniqueName();
		437	if (mainItem->target() == uniqueName)
		438	mainItem->setDocumentState(*state.get());
		439	else if (HistoryItem* subItem = mainItem->childItemWithTarget(uniqueName))
		440	subItem->setDocumentState(*state.get());
		441	else
		442	ec = INVALID_ACCESS_ERR;
		443	}
		444
414	PassRefPtr<ClientRect> Internals::absoluteCaretBounds(Document* document, ExceptionCode& ec)	445	PassRefPtr<ClientRect> Internals::absoluteCaretBounds(Document* document, ExceptionCode& ec)
415	{	446	{
416	if (!document \|\| !document->frame() \|\| !document->frame()->selection()) {	447	if (!document \|\| !document->frame() \|\| !document->frame()->selection()) {

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +12 lines
		1	2012-06-14 Kent Tamura <tkent@chromium.org>
		2
		3	Validate form state strings in FormController::setStateForNewFormElements()
		4	https://bugs.webkit.org/show_bug.cgi?id=88768
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* fast/forms/resources/state-restore-broken-state-1.html: Added.
		9	* fast/forms/resources/state-restore-broken-state-2.html: Added.
		10	* fast/forms/state-restore-broken-state-expected.txt: Added.
		11	* fast/forms/state-restore-broken-state.html: Added.
		12
1	2012-06-13 Kinuko Yasuda <kinuko@chromium.org>	13	2012-06-13 Kinuko Yasuda <kinuko@chromium.org>
2		14
3	[Chromium] Unreviewed: Add rebaseline and update expectations.	15	[Chromium] Unreviewed: Add rebaseline and update expectations.

Line 0 a/LayoutTests/fast/forms/resources/state-restore-broken-state-1.html_sec1
- a/LayoutTests/fast/forms/resources/state-restore-broken-state-1.html +18 lines
	1	<body onload="handleLoad()">
	2	<form action="state-restore-broken-state-2.html" name=f>
	3	<input name="name1" value="unmodified">
	4	</form>
	5
	6	<script>
	7	function handleLoad() {
	8	if (!parent.isGoingBack) {
	9	document.f.name1.value = 'modified';
	10	setTimeout(function() {
	11	window.location.href = 'state-restore-broken-state-2.html';
	12	}, 0);
	13	} else {
	14	parent.didSecondLoad();
	15	}
	16	}
	17	</script>
	18	</body>

Line 0 a/LayoutTests/fast/forms/state-restore-broken-state-expected.txt_sec1
- a/LayoutTests/fast/forms/state-restore-broken-state-expected.txt +10 lines
	1	The value was modified in the first load of state-restore-broken-state-1.html, but it should not be restored because the state-restore-broken-state-2.html breaks the state.
	2
	3	On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
	4
	5
	6	PASS document.getElementsByTagName("iframe")[0].contentDocument.f.name1.value is "unmodified"
	7	PASS successfullyParsed is true
	8
	9	TEST COMPLETE
	10

Line 0 a/LayoutTests/fast/forms/state-restore-broken-state.html_sec1
- a/LayoutTests/fast/forms/state-restore-broken-state.html +27 lines
	1	<!DOCTYPE html>
	2	<html>
	3	<head>
	4	<script src="../js/resources/js-test-pre.js"></script>
	5	</head>
	6	<body>
	7	<iframe name="subframe" src="resources/state-restore-broken-state-1.html">
	8	</iframe>
	9
	10	<script>
	11	var jsTestIsAsync = true;
	12	var isGoingBack = false;
	13
	14	function didLoadAnotherDocument() {
	15	isGoingBack = true;
	16	history.back();
	17	}
	18
	19	function didSecondLoad() {
	20	description('The value was modified in the first load of state-restore-broken-state-1.html, but it should not be restored because the state-restore-broken-state-2.html breaks the state.');
	21	shouldBe('document.getElementsByTagName("iframe")[0].contentDocument.f.name1.value', '"unmodified"');
	22	finishJSTest();
	23	}
	24
	25	</script>
	26	<script src="../js/resources/js-test-post.js"></script>
	27	</body>