Merge WebKit at branches/chromium/742 r88085: Initial merge by git.

Change-Id: I0501b484b9528e31b0026e5ad64416dd6541cdde

6 files changed, 20 insertions, 10 deletions

diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index ce664ac..91511ac 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -132,6 +132,8 @@ namespace WebCore {
         virtual bool shouldInterruptJavaScript() = 0;
         virtual KeyboardUIMode keyboardUIMode() = 0;
 
+        virtual void* webView() const = 0;
+
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
         virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) = 0;
 #endif
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index fda46df..c7f162a 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -1742,14 +1742,21 @@ bool DOMWindow::isInsecureScriptAccess(DOMWindow* activeWindow, const String& ur
     if (!protocolIsJavaScript(urlString))
         return false;
 
-    // FIXME: Is there some way to eliminate the need for a separate "activeWindow == this" check?
-    if (activeWindow == this)
-        return false;
+    // If m_frame->domWindow() != this, then |this| isn't the DOMWindow that's
+    // currently active in the frame and there's no way we should allow the
+    // access.
+    // FIXME: Remove this check if we're able to disconnect DOMWindow from
+    // Frame on navigation: https://bugs.webkit.org/show_bug.cgi?id=62054
+    if (m_frame->domWindow() == this) {
+        // FIXME: Is there some way to eliminate the need for a separate "activeWindow == this" check?
+        if (activeWindow == this)
+            return false;
 
-    // FIXME: The name canAccess seems to be a roundabout way to ask "can execute script".
-    // Can we name the SecurityOrigin function better to make this more clear?
-    if (activeWindow->securityOrigin()->canAccess(securityOrigin()))
-        return false;
+        // FIXME: The name canAccess seems to be a roundabout way to ask "can execute script".
+        // Can we name the SecurityOrigin function better to make this more clear?
+        if (activeWindow->securityOrigin()->canAccess(securityOrigin()))
+            return false;
+    }
 
     printErrorMessage(crossDomainAccessErrorMessage(activeWindow));
     return true;
diff --git a/Source/WebCore/page/History.cpp b/Source/WebCore/page/History.cpp
index 1d1e77a..f8ec7d0 100644
--- a/Source/WebCore/page/History.cpp
+++ b/Source/WebCore/page/History.cpp
@@ -120,8 +120,7 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
         return;
     
     KURL fullURL = urlForState(urlString);
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(fullURL);
-    if (!fullURL.isValid() || !m_frame->document()->securityOrigin()->isSameSchemeHostPort(origin.get())) {
+    if (!fullURL.isValid() || !m_frame->document()->securityOrigin()->canRequest(fullURL)) {
         ec = SECURITY_ERR;
         return;
     }
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index 1136371..e2312a9 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -164,7 +164,7 @@ Settings::Settings(Page* page)
     , m_loadDeferringEnabled(true)
     , m_tiledBackingStoreEnabled(false)
     , m_paginateDuringLayoutEnabled(false)
-    , m_dnsPrefetchingEnabled(false)
+    , m_dnsPrefetchingEnabled(true)
 #if ENABLE(FULLSCREEN_API)
     , m_fullScreenAPIEnabled(false)
 #endif
diff --git a/Source/WebCore/page/animation/CompositeAnimation.cpp b/Source/WebCore/page/animation/CompositeAnimation.cpp
index 29b32eb..07e5584 100644
--- a/Source/WebCore/page/animation/CompositeAnimation.cpp
+++ b/Source/WebCore/page/animation/CompositeAnimation.cpp
@@ -151,6 +151,7 @@ void CompositeAnimation::updateTransitions(RenderObject* renderer, RenderStyle*
                             implAnim->blendPropertyValueInStyle(prop, modifiedCurrentStyle.get());
                         }
     #endif
+                        animationController()->animationWillBeRemoved(implAnim);
                         m_transitions.remove(prop);
                         equal = false;
                     }
diff --git a/Source/WebCore/page/brew/ChromeClientBrew.h b/Source/WebCore/page/brew/ChromeClientBrew.h
index d1fac2d..2d27a73 100644
--- a/Source/WebCore/page/brew/ChromeClientBrew.h
+++ b/Source/WebCore/page/brew/ChromeClientBrew.h
@@ -42,6 +42,7 @@ class PopupMenuClient;
 // things here that don't make sense for other ports.
 class ChromeClientBrew : public ChromeClient {
 public:
+    virtual void* webView() const { return 0; }
     virtual void createSelectPopup(PopupMenuClient*, int selected, const IntRect& rect) = 0;
     virtual bool destroySelectPopup() = 0;
 };