Merge WebKit at branches/chromium/742 r89068: Initial merge by Git.

Take us to top of Chrome 12 release branch (12.0.742.130)

Change-Id: I4408a97e343a118cf4a1bb9d71367bcc2c16ae48

4 files changed, 52 insertions, 16 deletions

diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 7ba603b..638b4ab 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -460,7 +460,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     m_ignoreAutofocus = false;
 
     m_frame = frame;
-    m_documentLoader = frame ? frame->loader()->activeDocumentLoader() : 0;
 
     // We depend on the url getting immediately set in subframes, but we
     // also depend on the url NOT getting immediately set in opened windows.
@@ -601,12 +600,6 @@ void Document::removedLastRef()
 #if ENABLE(FULLSCREEN_API)
         m_fullScreenElement = 0;
 #endif
-        m_styleSelector.clear();
-        m_styleSheets.clear();
-        m_elemSheet.clear();
-        m_mappedElementSheet.clear();
-        m_pageUserSheet.clear();
-        m_pageGroupUserSheets.clear();
 
         // removeAllChildren() doesn't always unregister IDs,
         // so tear down scope information upfront to avoid having stale references in the map.
@@ -2013,11 +2006,21 @@ HTMLElement* Document::body() const
 
 void Document::setBody(PassRefPtr<HTMLElement> newBody, ExceptionCode& ec)
 {
-    if (!newBody || !documentElement()) { 
+    ec = 0;
+
+    if (!newBody || !documentElement() || !newBody->hasTagName(bodyTag)) { 
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }
 
+    if (newBody->document() && newBody->document() != this) {
+        RefPtr<Node> node = importNode(newBody.get(), true, ec);
+        if (ec)
+            return;
+        
+        newBody = toHTMLElement(node.get());
+    }
+
     HTMLElement* b = body();
     if (!b)
         documentElement()->appendChild(newBody, ec);
@@ -3783,7 +3786,9 @@ String Document::lastModified() const
     DateComponents date;
     bool foundDate = false;
     if (m_frame) {
-        String httpLastModified = m_documentLoader->response().httpHeaderField("Last-Modified");
+        String httpLastModified;
+        if (DocumentLoader* documentLoader = loader()) 
+            httpLastModified = documentLoader->response().httpHeaderField("Last-Modified");
         if (!httpLastModified.isEmpty()) {
             date.setMillisecondsSinceEpochForDateTime(parseDate(httpLastModified));
             foundDate = true;
@@ -4264,7 +4269,7 @@ void Document::finishedParsing()
     if (!m_documentTiming.domContentLoadedEventEnd)
         m_documentTiming.domContentLoadedEventEnd = currentTime();
 
-    if (Frame* f = frame()) {
+    if (RefPtr<Frame> f = frame()) {
         // FrameLoader::finishedParsing() might end up calling Document::implicitClose() if all
         // resource loads are complete. HTMLObjectElements can start loading their resources from
         // post attach callbacks triggered by recalcStyle().  This means if we parse out an <object>
@@ -4276,7 +4281,7 @@ void Document::finishedParsing()
 
         f->loader()->finishedParsing();
 
-        InspectorInstrumentation::domContentLoadedEventFired(f, url());
+        InspectorInstrumentation::domContentLoadedEventFired(f.get(), url());
     }
 }
 
@@ -4491,7 +4496,9 @@ void Document::initSecurityContext()
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
         // and https://bugs.webkit.org/show_bug.cgi?id=19760 for further
         // discussion.
-        if (m_documentLoader->substituteData().isValid())
+        
+        DocumentLoader* documentLoader = loader();
+        if (documentLoader && documentLoader->substituteData().isValid())
             securityOrigin()->grantLoadLocalResources();
     }
 
@@ -4572,7 +4579,9 @@ void Document::updateURLForPushOrReplaceState(const KURL& url)
 
     setURL(url);
     f->loader()->setOutgoingReferrer(url);
-    m_documentLoader->replaceRequestURLForSameDocumentNavigation(url);
+
+    if (DocumentLoader* documentLoader = loader())
+        documentLoader->replaceRequestURLForSameDocumentNavigation(url);
 }
 
 void Document::statePopped(SerializedScriptValue* stateObject)
@@ -5038,4 +5047,19 @@ PassRefPtr<TouchList> Document::createTouchList(ExceptionCode&) const
 }
 #endif
 
+DocumentLoader* Document::loader() const
+{
+    if (!m_frame)
+        return 0;
+    
+    DocumentLoader* loader = m_frame->loader()->activeDocumentLoader();
+    if (!loader)
+        return 0;
+    
+    if (m_frame->document() != this)
+        return 0;
+    
+    return loader;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 179293c..7478e6c 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -553,8 +553,7 @@ public:
     void setVisuallyOrdered();
     bool visuallyOrdered() const { return m_visuallyOrdered; }
     
-    void setDocumentLoader(DocumentLoader* documentLoader) { m_documentLoader = documentLoader; }
-    DocumentLoader* loader() const { return m_documentLoader; }
+    DocumentLoader* loader() const;
 
     void open(Document* ownerDocument = 0);
     void implicitOpen();
@@ -1156,7 +1155,6 @@ private:
     mutable RefPtr<CSSPrimitiveValueCache> m_cssPrimitiveValueCache;
 
     Frame* m_frame;
-    DocumentLoader* m_documentLoader;
     OwnPtr<CachedResourceLoader> m_cachedResourceLoader;
     RefPtr<DocumentParser> m_parser;
     bool m_wellFormed;
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 50431aa..eef2419 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -90,7 +90,13 @@ public:
 
         if (!m_pushedStyleSelector)
             return;
+
+        // This tells us that our pushed style selector is in a bad state,
+        // so we should just bail out in that scenario.
         ASSERT(m_pushedStyleSelector == m_parent->document()->styleSelector());
+        if (m_pushedStyleSelector != m_parent->document()->styleSelector())
+            return;
+
         m_pushedStyleSelector->popParent(m_parent); 
     }
 
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 5dd6b7d..55a7949 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -198,6 +198,14 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
     if (!m_element->document()->frame()->script()->canExecuteScripts(AboutToExecuteScript))
         return false;
 
+    // FIXME: This is non-standard. Remove this after https://bugs.webkit.org/show_bug.cgi?id=62412.
+    Node* ancestor = m_element->parentNode();
+    while (ancestor) {
+        if (ancestor->isSVGShadowRoot())
+            return false;
+        ancestor = ancestor->parentNode();
+    }
+
     if (!isScriptForEventSupported())
         return false;