Merge WebKit at r75993: Initial merge by git.

Change-Id: I602bbdc3974787a3b0450456a30a7868286921c3

1 files changed, 37 insertions, 0 deletions

diff --git a/Source/WebCore/manual-tests/plug-in-mutates-NSView-hierarchy-during-resize.html b/Source/WebCore/manual-tests/plug-in-mutates-NSView-hierarchy-during-resize.html
new file mode 100644
index 0000000..e43e074
--- /dev/null
+++ b/Source/WebCore/manual-tests/plug-in-mutates-NSView-hierarchy-during-resize.html
@@ -0,0 +1,37 @@
+<style>
+    div { padding: 10px; margin: 8px; }
+    embed { width: 50px; height: 50px; }
+    iframe { width: 50px; height: 50px; }
+</style>
+<script>
+    var callCount = 0;
+
+    function hideFirst()
+    {
+        if (++callCount != 2)
+            return;
+
+        var target = document.getElementById("target");
+        if (!target)
+            return;
+
+        target.parentNode.removeChild(target);
+        document.body.offsetTop;
+    }
+</script>
+<p>
+    Test that plug-ins cannot cause the NSView hierarchy to change beneath <tt>-[NSView _invalidateGStatesForTree]</tt>.
+</p>
+<p>
+    To test, resize the browser window. Reload and repeat a few times. Each time you resize, the orange rectangle and
+    its contents should vanish, and the browser should not crash.
+</p>
+<div id="target" style="border: solid orange;">
+    <embed type="application/x-webkit-test-netscape"></embed>
+    <iframe src=""></iframe>
+    <iframe src=""></iframe>
+    <iframe src=""></iframe>
+</div>
+<div style="border: solid blue;">
+    <embed type="application/x-webkit-test-netscape" onsetwindow="hideFirst()"></embed>
+</div>