<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[172787] branches/safari-600.1-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/172787">172787</a></dd>
<dt>Author</dt> <dd>dburkart@apple.com</dd>
<dt>Date</dt> <dd>2014-08-19 16:49:01 -0700 (Tue, 19 Aug 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/172709">r172709</a>. &lt;rdar://problem/17850158&gt;</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari6001branchLayoutTestsChangeLog">branches/safari-600.1-branch/LayoutTests/ChangeLog</a></li>
<li><a href="#branchessafari6001branchSourceWebCoreChangeLog">branches/safari-600.1-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari6001branchSourceWebCoreWebCoreexpin">branches/safari-600.1-branch/Source/WebCore/WebCore.exp.in</a></li>
<li><a href="#branchessafari6001branchSourceWebCoreloaderFrameLoadercpp">branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.cpp</a></li>
<li><a href="#branchessafari6001branchSourceWebCoreloaderFrameLoaderh">branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.h</a></li>
<li><a href="#branchessafari6001branchSourceWebCoreloaderFrameLoaderTypesh">branches/safari-600.1-branch/Source/WebCore/loader/FrameLoaderTypes.h</a></li>
<li><a href="#branchessafari6001branchSourceWebCoreloaderNavigationSchedulercpp">branches/safari-600.1-branch/Source/WebCore/loader/NavigationScheduler.cpp</a></li>
<li><a href="#branchessafari6001branchSourceWebCorepageContextMenuControllercpp">branches/safari-600.1-branch/Source/WebCore/page/ContextMenuController.cpp</a></li>
<li><a href="#branchessafari6001branchSourceWebCorepageSettingsin">branches/safari-600.1-branch/Source/WebCore/page/Settings.in</a></li>
<li><a href="#branchessafari6001branchSourceWebKitmacChangeLog">branches/safari-600.1-branch/Source/WebKit/mac/ChangeLog</a></li>
<li><a href="#branchessafari6001branchSourceWebKitmacMiscWebKitVersionChecksh">branches/safari-600.1-branch/Source/WebKit/mac/Misc/WebKitVersionChecks.h</a></li>
<li><a href="#branchessafari6001branchSourceWebKitmacWebViewWebPDFViewmm">branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebPDFView.mm</a></li>
<li><a href="#branchessafari6001branchSourceWebKitmacWebViewWebViewmm">branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebView.mm</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptcallspolicydelegateexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptcallspolicydelegatehtml">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptdisallowedexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptdisallowedhtml">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshcallspolicydelegateexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshcallspolicydelegatehtml">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshdisallowedexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshdisallowedhtml">branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurlcallspolicydelegateexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurlcallspolicydelegatehtml">branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurldisallowedexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurldisallowedhtml">branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed.html</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingjavascriptexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingjavascripthtml">branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingmetarefreshexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingmetarefreshhtml">branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingjavascriptexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingjavascripthtml">branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingmetarefreshexpectedtxt">branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh-expected.txt</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingmetarefreshhtml">branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderresourcesredirecttoinvalidurlusingjavascripthtml">branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-javascript.html</a></li>
<li><a href="#branchessafari6001branchLayoutTestsfastloaderresourcesredirecttoinvalidurlusingmetarefreshhtml">branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-meta-refresh.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari6001branchLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/LayoutTests/ChangeLog (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/ChangeLog        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/ChangeLog        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,5 +1,39 @@
</span><span class="cx"> 2014-08-19  Dana Burkart  &lt;dburkart@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Merge r172709. &lt;rdar://problem/17850158&gt;
+
+    2014-08-18  Andy Estes  &lt;aestes@apple.com&gt;
+    
+            REGRESSION (r167856): adobe.com no longer able to launch Create Cloud app using a URL with a custom scheme
+            https://bugs.webkit.org/show_bug.cgi?id=136010
+    
+            Reviewed by Darin Adler.
+    
+            Removed tests that verified the behavior of setAllowNavigationToInvalidURL(true), which no longer exists:
+            * fast/loader/allow-redirect-to-invalid-url-using-javascript-expected.txt: Removed.
+            * fast/loader/allow-redirect-to-invalid-url-using-javascript.html: Removed.
+            * fast/loader/allow-redirect-to-invalid-url-using-meta-refresh-expected.txt: Removed.
+            * fast/loader/allow-redirect-to-invalid-url-using-meta-refresh.html: Removed.
+    
+            Added tests that verify the policy delegate is executed on some navigations to invalid URLs:
+            * fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate-expected.txt: Added.
+            * fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate.html: Added.
+            * fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate-expected.txt: Added.
+            * fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate.html: Added.
+            * fast/loader/window-open-to-invalid-url-calls-policy-delegate-expected.txt: Added.
+            * fast/loader/window-open-to-invalid-url-calls-policy-delegate.html: Added.
+    
+            Renamed some existing tests added in r170120, modified them to log willPerformClientRedirectToURL and
+            didCancelClientRedirectForFrame, and added a test to verify navigations in existing frames via window.open:
+            * fast/loader/redirect-to-invalid-url-using-javascript-disallowed-expected.txt: Renamed from fast/loader/disallow-redirect-to-invalid-url-using-javascript-expected.txt.
+            * fast/loader/redirect-to-invalid-url-using-javascript-disallowed.html: Renamed from fast/loader/disallow-redirect-to-invalid-url-using-javascript.html.
+            * fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed-expected.txt: Renamed from fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh-expected.txt.
+            * fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed.html: Renamed from fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh.html.
+            * fast/loader/window-open-to-invalid-url-disallowed-expected.txt: Added.
+            * fast/loader/window-open-to-invalid-url-disallowed.html: Added.
+    
+2014-08-19  Dana Burkart  &lt;dburkart@apple.com&gt;
+
</ins><span class="cx">         Merge r172656. &lt;rdar://problem/17961698&gt;
</span><span class="cx"> 
</span><span class="cx">     2014-08-15  Zalan Bujtas  &lt;zalan@apple.com&gt;
</span></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingjavascriptexpectedtxt"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript-expected.txt (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript-expected.txt        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,13 +0,0 @@
</span><del>-frame &quot;frame&quot; - didStartProvisionalLoadForFrame
-main frame - didFinishDocumentLoadForFrame
-frame &quot;frame&quot; - didCommitLoadForFrame
-frame &quot;frame&quot; - willPerformClientRedirectToURL: x-dummy://A=a&amp;B=b 
-frame &quot;frame&quot; - didFinishDocumentLoadForFrame
-main frame - didHandleOnloadEventsForFrame
-frame &quot;frame&quot; - didFinishLoadForFrame
-main frame - didFinishLoadForFrame
-Tests that we allow redirection to an invalid URL initiated by JavaScript when setting allowNavigationToInvalidURL is true. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;B=b&quot;.
-
-Note, this test must be run in DumpRenderTree.
-
-
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingjavascripthtml"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript.html (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript.html        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-javascript.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script&gt;
-if (window.testRunner) {
-    testRunner.dumpAsText();
-    testRunner.dumpFrameLoadCallbacks();
-    testRunner.waitUntilDone();
-}
-
-if (window.internals)
-    window.internals.settings.setAllowNavigationToInvalidURL(true);
-&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;p&gt;Tests that we allow redirection to an invalid URL initiated by JavaScript when setting allowNavigationToInvalidURL is true. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;amp;B=b&amp;quot;.&lt;/p&gt;
-&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
-&lt;iframe id=&quot;frame&quot; src=&quot;resources/redirect-to-invalid-url-using-javascript.html&quot;&gt;&lt;/iframe&gt;
-&lt;script&gt;
-function done()
-{
-    if (window.testRunner)
-        testRunner.notifyDone();
-}
-
-window.setTimeout(done, 0);
-&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingmetarefreshexpectedtxt"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh-expected.txt (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh-expected.txt        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,14 +0,0 @@
</span><del>-frame &quot;frame&quot; - didStartProvisionalLoadForFrame
-main frame - didFinishDocumentLoadForFrame
-frame &quot;frame&quot; - didCommitLoadForFrame
-frame &quot;frame&quot; - didFinishDocumentLoadForFrame
-frame &quot;frame&quot; - didHandleOnloadEventsForFrame
-main frame - didHandleOnloadEventsForFrame
-frame &quot;frame&quot; - willPerformClientRedirectToURL: x-dummy://A=a&amp;B=b 
-frame &quot;frame&quot; - didFinishLoadForFrame
-main frame - didFinishLoadForFrame
-Tests that we allow redirection to an invalid URL initiated by &lt;meta http-equiv=&quot;refresh&quot;&gt; when setting allowNavigationToInvalidURL is true. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;B=b&quot;.
-
-Note, this test must be run in DumpRenderTree.
-
-
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderallowredirecttoinvalidurlusingmetarefreshhtml"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh.html (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh.html        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/allow-redirect-to-invalid-url-using-meta-refresh.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script&gt;
-if (window.testRunner) {
-    testRunner.dumpAsText();
-    testRunner.dumpFrameLoadCallbacks();
-    testRunner.waitUntilDone();
-}
-
-if (window.internals)
-    window.internals.settings.setAllowNavigationToInvalidURL(true);
-&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;p&gt;Tests that we allow redirection to an invalid URL initiated by &amp;lt;meta http-equiv=&amp;quot;refresh&amp;quot;&amp;gt; when setting allowNavigationToInvalidURL is true. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;amp;B=b&amp;quot;.&lt;/p&gt;
-&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
-&lt;iframe id=&quot;frame&quot; src=&quot;resources/redirect-to-invalid-url-using-meta-refresh.html&quot;&gt;&lt;/iframe&gt;
-&lt;script&gt;
-function done()
-{
-    if (window.testRunner)
-        testRunner.notifyDone();
-}
-
-window.setTimeout(done, 0);
-&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingjavascriptexpectedtxt"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript-expected.txt (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript-expected.txt        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,13 +0,0 @@
</span><del>-frame &quot;frame&quot; - didStartProvisionalLoadForFrame
-main frame - didFinishDocumentLoadForFrame
-frame &quot;frame&quot; - didCommitLoadForFrame
-frame &quot;frame&quot; - didFinishDocumentLoadForFrame
-frame &quot;frame&quot; - didHandleOnloadEventsForFrame
-main frame - didHandleOnloadEventsForFrame
-frame &quot;frame&quot; - didFinishLoadForFrame
-main frame - didFinishLoadForFrame
-Tests that we do not redirect to an invalid URL initiated by JavaScript when setting allowNavigationToInvalidURL is false. This test PASSED if you do not see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;B=b&quot;.
-
-Note, this test must be run in DumpRenderTree.
-
-
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingjavascripthtml"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript.html (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript.html        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-javascript.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script&gt;
-if (window.testRunner) {
-    testRunner.dumpAsText();
-    testRunner.dumpFrameLoadCallbacks();
-    testRunner.waitUntilDone();
-}
-
-if (window.internals)
-    window.internals.settings.setAllowNavigationToInvalidURL(false);
-&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;p&gt;Tests that we do not redirect to an invalid URL initiated by JavaScript when setting allowNavigationToInvalidURL is false. This test PASSED if you do not see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;amp;B=b&amp;quot;.&lt;/p&gt;
-&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
-&lt;iframe id=&quot;frame&quot; src=&quot;resources/redirect-to-invalid-url-using-javascript.html&quot;&gt;&lt;/iframe&gt;
-&lt;script&gt;
-function done()
-{
-    if (window.testRunner)
-        testRunner.notifyDone();
-}
-
-window.setTimeout(done, 0);
-&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingmetarefreshexpectedtxt"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh-expected.txt (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh-expected.txt        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,13 +0,0 @@
</span><del>-frame &quot;frame&quot; - didStartProvisionalLoadForFrame
-main frame - didFinishDocumentLoadForFrame
-frame &quot;frame&quot; - didCommitLoadForFrame
-frame &quot;frame&quot; - didFinishDocumentLoadForFrame
-frame &quot;frame&quot; - didHandleOnloadEventsForFrame
-main frame - didHandleOnloadEventsForFrame
-frame &quot;frame&quot; - didFinishLoadForFrame
-main frame - didFinishLoadForFrame
-Tests that we do not redirect to an invalid URL initiated by &lt;meta http-equiv=&quot;refresh&quot;&gt; when setting allowNavigationToInvalidURL is false. This test PASSED if you do not see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;B=b&quot;.
-
-Note, this test must be run in DumpRenderTree.
-
-
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderdisallowredirecttoinvalidurlusingmetarefreshhtml"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh.html (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh.html        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/disallow-redirect-to-invalid-url-using-meta-refresh.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script&gt;
-if (window.testRunner) {
-    testRunner.dumpAsText();
-    testRunner.dumpFrameLoadCallbacks();
-    testRunner.waitUntilDone();
-}
-
-if (window.internals)
-    window.internals.settings.setAllowNavigationToInvalidURL(false);
-&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;p&gt;Tests that we do not redirect to an invalid URL initiated by &amp;lt;meta http-equiv=&amp;quot;refresh&amp;quot;&amp;gt; when setting allowNavigationToInvalidURL is false. This test PASSED if you do not see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: x-dummy://A=a&amp;amp;B=b&amp;quot;.&lt;/p&gt;
-&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
-&lt;iframe id=&quot;frame&quot; src=&quot;resources/redirect-to-invalid-url-using-meta-refresh.html&quot;&gt;&lt;/iframe&gt;
-&lt;script&gt;
-function done()
-{
-    if (window.testRunner)
-        testRunner.notifyDone();
-}
-
-window.setTimeout(done, 0);
-&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptcallspolicydelegateexpectedtxtfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptcallspolicydelegateexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate-expected.txt (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate-expected.txt) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate-expected.txt                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+Policy delegate: attempt to load http://A=a&amp;B=b with navigation type 'other'
+Tests that we do not redirect to an invalid URL initiated by JavaScript. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: http://A=a&amp;B=b&quot; followed by &quot;didCancelClientRedirectForFrame&quot;.
+
+Note, this test must be run in DumpRenderTree.
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptcallspolicydelegatehtmlfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptcallspolicydelegatehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate.html (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate.html) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate.html                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.setCustomPolicyDelegate(true, false);
+    testRunner.waitUntilDone();
+}
+&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;p&gt;Tests that we do not redirect to an invalid URL initiated by JavaScript. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: http://A=a&amp;amp;B=b&amp;quot; followed by &amp;quot;didCancelClientRedirectForFrame&amp;quot;.&lt;/p&gt;
+&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
+&lt;script&gt;
+window.location.href = &quot;http://A=a&amp;B=b&quot;;
+window.setTimeout(function() {
+    if (window.testRunner)
+        testRunner.notifyDone();
+}, 0);
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptdisallowedexpectedtxtfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptdisallowedexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed-expected.txt (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed-expected.txt) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed-expected.txt                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,7 @@
</span><ins>+main frame - willPerformClientRedirectToURL: http://A=a&amp;B=b 
+main frame - didFinishDocumentLoadForFrame
+main frame - didFinishLoadForFrame
+main frame - didCancelClientRedirectForFrame
+Tests that we do not redirect to an invalid URL initiated by JavaScript. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: http://A=a&amp;B=b&quot; followed by &quot;didCancelClientRedirectForFrame&quot;.
+
+Note, this test must be run in DumpRenderTree.
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptdisallowedhtmlfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingjavascriptdisallowedhtml"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed.html (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed.html) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed.html                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-javascript-disallowed.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.dumpFrameLoadCallbacks();
+    testRunner.waitUntilDone();
+}
+&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;p&gt;Tests that we do not redirect to an invalid URL initiated by JavaScript. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: http://A=a&amp;amp;B=b&amp;quot; followed by &amp;quot;didCancelClientRedirectForFrame&amp;quot;.&lt;/p&gt;
+&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
+&lt;script&gt;
+window.location.href = &quot;http://A=a&amp;B=b&quot;;
+window.setTimeout(function() {
+    if (window.testRunner)
+        testRunner.notifyDone();
+}, 0);
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshcallspolicydelegateexpectedtxtfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshcallspolicydelegateexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate-expected.txt (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate-expected.txt) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate-expected.txt                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+Policy delegate: attempt to load http://A=a&amp;B=b with navigation type 'other'
+Tests that we do not redirect to an invalid URL initiated by &lt;meta http-equiv=&quot;refresh&quot;&gt;. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: http://A=a&amp;B=b&quot; followed by &quot;didCancelClientRedirectForFrame&quot;.
+
+Note, this test must be run in DumpRenderTree.
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshcallspolicydelegatehtmlfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshcallspolicydelegatehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate.html (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate.html) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate.html                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,27 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;meta http-equiv=&quot;refresh&quot; content=&quot;0; url=http://A=a&amp;B=b&quot;&gt;
+&lt;script&gt;
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.setCustomPolicyDelegate(true, false);
+    testRunner.waitUntilDone();
+}
+&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;p&gt;Tests that we do not redirect to an invalid URL initiated by &amp;lt;meta http-equiv=&amp;quot;refresh&amp;quot;&amp;gt;. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: http://A=a&amp;amp;B=b&amp;quot; followed by &amp;quot;didCancelClientRedirectForFrame&amp;quot;.&lt;/p&gt;
+&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
+&lt;script&gt;
+// This ugly double-timeout ensures that the scheduled meta-refresh, whose timer isn't even started until the frame finishes loading,
+// fires before notifyDone() is called, ensuring that didCancelClientRedirectForFrame is logged by DumpRenderTree.
+window.setTimeout(function() {
+    window.setTimeout(function() {
+        if (window.testRunner)
+            testRunner.notifyDone();
+    }, 0);
+}, 0);
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshdisallowedexpectedtxtfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshdisallowedexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed-expected.txt (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed-expected.txt) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed-expected.txt                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,8 @@
</span><ins>+main frame - didFinishDocumentLoadForFrame
+main frame - didHandleOnloadEventsForFrame
+main frame - willPerformClientRedirectToURL: http://A=a&amp;B=b 
+main frame - didFinishLoadForFrame
+main frame - didCancelClientRedirectForFrame
+Tests that we do not redirect to an invalid URL initiated by &lt;meta http-equiv=&quot;refresh&quot;&gt;. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: http://A=a&amp;B=b&quot; followed by &quot;didCancelClientRedirectForFrame&quot;.
+
+Note, this test must be run in DumpRenderTree.
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshdisallowedhtmlfromrev172709trunkLayoutTestsfastloaderredirecttoinvalidurlusingmetarefreshdisallowedhtml"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed.html (from rev 172709, trunk/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed.html) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed.html                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,27 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;meta http-equiv=&quot;refresh&quot; content=&quot;0; url=http://A=a&amp;B=b&quot;&gt;
+&lt;script&gt;
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.dumpFrameLoadCallbacks();
+    testRunner.waitUntilDone();
+}
+&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;p&gt;Tests that we do not redirect to an invalid URL initiated by &amp;lt;meta http-equiv=&amp;quot;refresh&amp;quot;&amp;gt;. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: http://A=a&amp;amp;B=b&amp;quot; followed by &amp;quot;didCancelClientRedirectForFrame&amp;quot;.&lt;/p&gt;
+&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
+&lt;script&gt;
+// This ugly double-timeout ensures that the scheduled meta-refresh, whose timer isn't even started until the frame finishes loading,
+// fires before notifyDone() is called, ensuring that didCancelClientRedirectForFrame is logged by DumpRenderTree.
+window.setTimeout(function() {
+    window.setTimeout(function() {
+        if (window.testRunner)
+            testRunner.notifyDone();
+    }, 0);
+}, 0);
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderresourcesredirecttoinvalidurlusingjavascripthtml"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-javascript.html (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-javascript.html        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-javascript.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,4 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;script&gt;
-window.location.href = &quot;x-dummy://A=a&amp;B=b&quot;;
-&lt;/script&gt;
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderresourcesredirecttoinvalidurlusingmetarefreshhtml"></a>
<div class="delfile"><h4>Deleted: branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-meta-refresh.html (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-meta-refresh.html        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/resources/redirect-to-invalid-url-using-meta-refresh.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,6 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;head&gt;
-    &lt;meta http-equiv=&quot;refresh&quot; content=&quot;0; url=x-dummy://A=a&amp;B=b&quot;&gt;
-&lt;/head&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurlcallspolicydelegateexpectedtxtfromrev172709trunkLayoutTestsfastloaderwindowopentoinvalidurlcallspolicydelegateexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate-expected.txt (from rev 172709, trunk/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate-expected.txt) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate-expected.txt                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+Policy delegate: attempt to load http://A=a&amp;B=b with navigation type 'other'
+Tests that we call the navigation policy delegate when opening a new window to an invalid URL.
+
+Note, this test must be run in DumpRenderTree.
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurlcallspolicydelegatehtmlfromrev172709trunkLayoutTestsfastloaderwindowopentoinvalidurlcallspolicydelegatehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate.html (from rev 172709, trunk/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate.html) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate.html                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-calls-policy-delegate.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.setCustomPolicyDelegate(true, false);
+    testRunner.waitUntilDone();
+    testRunner.setCanOpenWindows();
+}
+&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;p&gt;Tests that we call the navigation policy delegate when opening a new window to an invalid URL.&lt;/p&gt;
+&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
+&lt;script&gt;
+window.open(&quot;http://A=a&amp;B=b&quot;, &quot;_top&quot;);
+window.setTimeout(function() {
+    if (window.testRunner)
+        testRunner.notifyDone();
+}, 0);
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurldisallowedexpectedtxtfromrev172709trunkLayoutTestsfastloaderwindowopentoinvalidurldisallowedexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed-expected.txt (from rev 172709, trunk/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed-expected.txt) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed-expected.txt                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed-expected.txt        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,7 @@
</span><ins>+main frame - willPerformClientRedirectToURL: http://A=a&amp;B=b 
+main frame - didFinishDocumentLoadForFrame
+main frame - didFinishLoadForFrame
+main frame - didCancelClientRedirectForFrame
+Tests that we do not open a new window to an invalid URL. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &quot;willPerformClientRedirectToURL: http://A=a&amp;B=b&quot; followed by &quot;didCancelClientRedirectForFrame&quot;.
+
+Note, this test must be run in DumpRenderTree.
</ins></span></pre></div>
<a id="branchessafari6001branchLayoutTestsfastloaderwindowopentoinvalidurldisallowedhtmlfromrev172709trunkLayoutTestsfastloaderwindowopentoinvalidurldisallowedhtml"></a>
<div class="copfile"><h4>Copied: branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed.html (from rev 172709, trunk/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed.html) (0 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed.html                                (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/loader/window-open-to-invalid-url-disallowed.html        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.dumpFrameLoadCallbacks();
+    testRunner.waitUntilDone();
+    testRunner.setCanOpenWindows();
+}
+&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;p&gt;Tests that we do not open a new window to an invalid URL. This test PASSED if you see an entry in the dumped frame load callbacks of the form: &amp;quot;willPerformClientRedirectToURL: http://A=a&amp;amp;B=b&amp;quot; followed by &amp;quot;didCancelClientRedirectForFrame&amp;quot;.&lt;/p&gt;
+&lt;p&gt;Note, this test must be run in DumpRenderTree.&lt;/p&gt;
+&lt;script&gt;
+window.open(&quot;http://A=a&amp;B=b&quot;, &quot;_top&quot;);
+window.setTimeout(function() {
+    if (window.testRunner)
+        testRunner.notifyDone();
+}, 0);
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchessafari6001branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/ChangeLog (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/ChangeLog        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/ChangeLog        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,5 +1,71 @@
</span><span class="cx"> 2014-08-19  Dana Burkart  &lt;dburkart@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Merge r172709. &lt;rdar://problem/17850158&gt;
+
+    2014-08-18  Andy Estes  &lt;aestes@apple.com&gt;
+    
+            REGRESSION (r167856): adobe.com no longer able to launch Create Cloud app using a URL with a custom scheme
+            https://bugs.webkit.org/show_bug.cgi?id=136010
+    
+            Reviewed by Darin Adler.
+    
+            r167856 caused WebKit to stop scheduling certain kinds of navigations (window.location changes, meta-refresh,
+            and some calls to window.open) when the request URL is invalid. Adobe.com performs one of these navigations to
+            an invalid URL with an external scheme (aam:), relying on Safari's navigation policy delegate to ignore the
+            navigation and launch the external app registered to handle aam: URLs. Since the navigation is no longer
+            scheduled, the policy delegate is never executed and the external app never launches.
+    
+            Instead of not scheduling the navigation, allow it to proceed until the client's policy delegate has executed
+            and made a decision. Only disallow the navigation if the policy delegate told WebKit to proceed with the load.
+            This exposes these navigations to clients via the policy delegate and via willPerformClientRedirectToURL and
+            didCancelClientRedirectForFrame on the frame load delegate.
+            
+            To constrain this check only to the navigation types covered by r167856, only two NavigationSchedulers
+            (ScheduledRedirect and ScheduledLocationChange) enable the invalid URL check.
+    
+            Note that r167856 also caused an iOS regression, and this was resolved in r170120 by adding a linked-on-or-after
+            check and a WebCore setting. Since the iOS regression is also resolved by the approach described above, this
+            patch reverts r170120 (but keeps some of its tests).
+    
+            Tests: fast/loader/redirect-to-invalid-url-using-javascript-calls-policy-delegate.html
+                   fast/loader/redirect-to-invalid-url-using-javascript-disallowed.html
+                   fast/loader/redirect-to-invalid-url-using-meta-refresh-calls-policy-delegate.html
+                   fast/loader/redirect-to-invalid-url-using-meta-refresh-disallowed.html
+                   fast/loader/window-open-to-invalid-url-calls-policy-delegate.html
+                   fast/loader/window-open-to-invalid-url-disallowed.html
+    
+            * WebCore.exp.in: Updated the symbol FrameLoader::loadFrameRequest.
+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::changeLocation): Added an AllowNavigationToInvalidURL argument; passed down to urlSelected.
+            (WebCore::FrameLoader::urlSelected): Added an AllowNavigationToInvalidURL argument; passed down to loadFrameRequest.
+            (WebCore::FrameLoader::loadURLIntoChildFrame): Passed AllowNavigationToInvalidURL::Yes to loadURL.
+            (WebCore::FrameLoader::loadFrameRequest): Added an AllowNavigationToInvalidURL argument; passed down to loadURL and loadPostRequest.
+            (WebCore::FrameLoader::loadURL): Added an AllowNavigationToInvalidURL argument; passed down to continueLoadAfterNewWindowPolicy and loadWithNavigationAction.
+            (WebCore::FrameLoader::loadPostRequest): Ditto.
+            (WebCore::FrameLoader::load): Passed AllowNavigationToInvalidURL::Yes to continueLoadAfterNewWindowPolicy.
+            (WebCore::FrameLoader::loadWithNavigationAction): Added an AllowNavigationToInvalidURL argument; passed down to loadWithDocumentLoader.
+            (WebCore::FrameLoader::loadWithDocumentLoader): Added an AllowNavigationToInvalidURL argument; passed down to continueLoadAfterNavigationPolicy.
+            (WebCore::FrameLoader::reloadWithOverrideEncoding): Passed AllowNavigationToInvalidURL::Yes to loadWithDocumentLoader.
+            (WebCore::FrameLoader::reload): Ditto.
+            (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+                Added an AllowNavigationToInvalidURL argument; if its value is No and the request's URL is invalid, do not continue.
+                Added a FIXME about calling clientRedirectCancelledOrFinished on non-quick redirect cancellations.
+            (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Added an AllowNavigationToInvalidURL argument; passed down to loadWithNavigationAction.
+            (WebCore::FrameLoader::loadDifferentDocumentItem): Passed AllowNavigationToInvalidURL::Yes to either loadWithDocumentLoader or loadWithNavigationAction.
+            * loader/FrameLoader.h:
+            * loader/FrameLoaderTypes.h: Defined AllowNavigationToInvalidURL to have values of Yes and No.
+            * loader/NavigationScheduler.cpp:
+            (WebCore::ScheduledRedirect::fire): Passed AllowNavigationToInvalidURL::No to FrameLoader::changeLocation.
+            (WebCore::ScheduledLocationChange::fire): Ditto.
+            (WebCore::NavigationScheduler::shouldScheduleNavigation): Removed the URL::isValid check.
+            (WebCore::NavigationScheduler::scheduleLocationChange): Passed AllowNavigationToInvalidURL::No to FrameLoder::changeLocation during fragment navigations.
+            * page/ContextMenuController.cpp:
+            (WebCore::openNewWindow): Passed AllowNavigationToInvalidURL::Yes to FrameLoader::loadFrameRequest.
+            (WebCore::ContextMenuController::contextMenuItemSelected): Ditto.
+            * page/Settings.in: Removed allowNavigationToInvalidURL.
+    
+2014-08-19  Dana Burkart  &lt;dburkart@apple.com&gt;
+
</ins><span class="cx">         Merge r172705. &lt;rdar://problem/17767169&gt;
</span><span class="cx"> 
</span><span class="cx">     2014-08-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebCoreWebCoreexpin"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/WebCore.exp.in (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/WebCore.exp.in        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/WebCore.exp.in        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -140,7 +140,7 @@
</span><span class="cx"> __ZN7WebCore11FrameLoader14detachChildrenEv
</span><span class="cx"> __ZN7WebCore11FrameLoader14stopAllLoadersENS_26ClearProvisionalItemPolicyE
</span><span class="cx"> __ZN7WebCore11FrameLoader16detachFromParentEv
</span><del>-__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestENS_11LockHistoryENS_19LockBackForwardListEN3WTF10PassRefPtrINS_5EventEEENS7_INS_9FormStateEEENS_18ShouldSendReferrerE
</del><ins>+__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestENS_11LockHistoryENS_19LockBackForwardListEN3WTF10PassRefPtrINS_5EventEEENS7_INS_9FormStateEEENS_18ShouldSendReferrerENS_27AllowNavigationToInvalidURLE
</ins><span class="cx"> __ZN7WebCore11FrameLoader17stopForUserCancelEb
</span><span class="cx"> __ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_3URLERKN3WTF6StringEPNS_5FrameE
</span><span class="cx"> __ZN7WebCore11FrameLoader22findFrameForNavigationERKN3WTF12AtomicStringEPNS_8DocumentE
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebCoreloaderFrameLoadercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.cpp (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.cpp        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.cpp        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -320,21 +320,21 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void FrameLoader::changeLocation(SecurityOrigin* securityOrigin, const URL&amp; url, const String&amp; referrer, LockHistory lockHistory, LockBackForwardList lockBackForwardList, bool refresh)
</del><ins>+void FrameLoader::changeLocation(SecurityOrigin* securityOrigin, const URL&amp; url, const String&amp; referrer, LockHistory lockHistory, LockBackForwardList lockBackForwardList, bool refresh, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     urlSelected(FrameLoadRequest(securityOrigin, ResourceRequest(url, referrer, refresh ? ReloadIgnoringCacheData : UseProtocolCachePolicy), &quot;_self&quot;),
</span><del>-        0, lockHistory, lockBackForwardList, MaybeSendReferrer, ReplaceDocumentIfJavaScriptURL);
</del><ins>+        0, lockHistory, lockBackForwardList, MaybeSendReferrer, ReplaceDocumentIfJavaScriptURL, allowNavigationToInvalidURL);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::urlSelected(const URL&amp; url, const String&amp; passedTarget, PassRefPtr&lt;Event&gt; triggeringEvent, LockHistory lockHistory, LockBackForwardList lockBackForwardList, ShouldSendReferrer shouldSendReferrer)
</span><span class="cx"> {
</span><span class="cx">     urlSelected(FrameLoadRequest(m_frame.document()-&gt;securityOrigin(), ResourceRequest(url), passedTarget),
</span><del>-        triggeringEvent, lockHistory, lockBackForwardList, shouldSendReferrer, DoNotReplaceDocumentIfJavaScriptURL);
</del><ins>+        triggeringEvent, lockHistory, lockBackForwardList, shouldSendReferrer, DoNotReplaceDocumentIfJavaScriptURL, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // The shouldReplaceDocumentIfJavaScriptURL parameter will go away when the FIXME to eliminate the
</span><span class="cx"> // corresponding parameter from ScriptController::executeIfJavaScriptURL() is addressed.
</span><del>-void FrameLoader::urlSelected(const FrameLoadRequest&amp; passedRequest, PassRefPtr&lt;Event&gt; triggeringEvent, LockHistory lockHistory, LockBackForwardList lockBackForwardList, ShouldSendReferrer shouldSendReferrer, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL)
</del><ins>+void FrameLoader::urlSelected(const FrameLoadRequest&amp; passedRequest, PassRefPtr&lt;Event&gt; triggeringEvent, LockHistory lockHistory, LockBackForwardList lockBackForwardList, ShouldSendReferrer shouldSendReferrer, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(!m_suppressOpenerInNewFrame);
</span><span class="cx"> 
</span><span class="lines">@@ -351,7 +351,7 @@
</span><span class="cx">         m_suppressOpenerInNewFrame = true;
</span><span class="cx">     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
</span><span class="cx"> 
</span><del>-    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0, shouldSendReferrer);
</del><ins>+    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0, shouldSendReferrer, allowNavigationToInvalidURL);
</ins><span class="cx"> 
</span><span class="cx">     m_suppressOpenerInNewFrame = false;
</span><span class="cx"> }
</span><span class="lines">@@ -923,7 +923,7 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    childFrame-&gt;loader().loadURL(url, referer, &quot;_self&quot;, LockHistory::No, FrameLoadType::RedirectWithLockedBackForwardList, 0, 0);
</del><ins>+    childFrame-&gt;loader().loadURL(url, referer, &quot;_self&quot;, LockHistory::No, FrameLoadType::RedirectWithLockedBackForwardList, 0, 0, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEB_ARCHIVE) || ENABLE(MHTML)
</span><span class="lines">@@ -1202,7 +1202,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::loadFrameRequest(const FrameLoadRequest&amp; request, LockHistory lockHistory, LockBackForwardList lockBackForwardList,
</span><del>-    PassRefPtr&lt;Event&gt; event, PassRefPtr&lt;FormState&gt; formState, ShouldSendReferrer shouldSendReferrer)
</del><ins>+    PassRefPtr&lt;Event&gt; event, PassRefPtr&lt;FormState&gt; formState, ShouldSendReferrer shouldSendReferrer, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {    
</span><span class="cx">     // Protect frame from getting blown away inside dispatchBeforeLoadEvent in loadWithDocumentLoader.
</span><span class="cx">     Ref&lt;Frame&gt; protect(m_frame);
</span><span class="lines">@@ -1232,9 +1232,9 @@
</span><span class="cx">         loadType = FrameLoadType::Standard;
</span><span class="cx"> 
</span><span class="cx">     if (request.resourceRequest().httpMethod() == &quot;POST&quot;)
</span><del>-        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
</del><ins>+        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), lockHistory, loadType, event, formState.get(), allowNavigationToInvalidURL);
</ins><span class="cx">     else
</span><del>-        loadURL(request.resourceRequest().url(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
</del><ins>+        loadURL(request.resourceRequest().url(), referrer, request.frameName(), lockHistory, loadType, event, formState.get(), allowNavigationToInvalidURL);
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: It's possible this targetFrame will not be the same frame that was targeted by the actual
</span><span class="cx">     // load if frame names have changed.
</span><span class="lines">@@ -1249,7 +1249,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::loadURL(const URL&amp; newURL, const String&amp; referrer, const String&amp; frameName, LockHistory lockHistory, FrameLoadType newLoadType,
</span><del>-    PassRefPtr&lt;Event&gt; event, PassRefPtr&lt;FormState&gt; prpFormState)
</del><ins>+    PassRefPtr&lt;Event&gt; event, PassRefPtr&lt;FormState&gt; prpFormState, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     if (m_inStopAllLoaders)
</span><span class="cx">         return;
</span><span class="lines">@@ -1278,7 +1278,7 @@
</span><span class="cx">     // The search for a target frame is done earlier in the case of form submission.
</span><span class="cx">     Frame* targetFrame = isFormSubmission ? 0 : findFrameForNavigation(frameName);
</span><span class="cx">     if (targetFrame &amp;&amp; targetFrame != &amp;m_frame) {
</span><del>-        targetFrame-&gt;loader().loadURL(newURL, referrer, &quot;_self&quot;, lockHistory, newLoadType, event, formState.release());
</del><ins>+        targetFrame-&gt;loader().loadURL(newURL, referrer, &quot;_self&quot;, lockHistory, newLoadType, event, formState.release(), allowNavigationToInvalidURL);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1288,8 +1288,8 @@
</span><span class="cx">     NavigationAction action(request, newLoadType, isFormSubmission, event);
</span><span class="cx"> 
</span><span class="cx">     if (!targetFrame &amp;&amp; !frameName.isEmpty()) {
</span><del>-        policyChecker().checkNewWindowPolicy(action, request, formState.release(), frameName, [this](const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, const String&amp; frameName, const NavigationAction&amp; action, bool shouldContinue) {
-            continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue);
</del><ins>+        policyChecker().checkNewWindowPolicy(action, request, formState.release(), frameName, [this, allowNavigationToInvalidURL](const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, const String&amp; frameName, const NavigationAction&amp; action, bool shouldContinue) {
+            continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue, allowNavigationToInvalidURL);
</ins><span class="cx">         });
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -1315,7 +1315,7 @@
</span><span class="cx"> 
</span><span class="cx">     // must grab this now, since this load may stop the previous load and clear this flag
</span><span class="cx">     bool isRedirect = m_quickRedirectComing;
</span><del>-    loadWithNavigationAction(request, action, lockHistory, newLoadType, formState.release());
</del><ins>+    loadWithNavigationAction(request, action, lockHistory, newLoadType, formState.release(), allowNavigationToInvalidURL);
</ins><span class="cx">     if (isRedirect) {
</span><span class="cx">         m_quickRedirectComing = false;
</span><span class="cx">         if (m_provisionalDocumentLoader)
</span><span class="lines">@@ -1358,7 +1358,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (request.shouldCheckNewWindowPolicy()) {
</span><span class="cx">         policyChecker().checkNewWindowPolicy(NavigationAction(request.resourceRequest(), NavigationTypeOther), request.resourceRequest(), nullptr, request.frameName(), [this](const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, const String&amp; frameName, const NavigationAction&amp; action, bool shouldContinue) {
</span><del>-            continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue);
</del><ins>+            continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx">         });
</span><span class="cx"> 
</span><span class="cx">         return;
</span><span class="lines">@@ -1371,7 +1371,7 @@
</span><span class="cx">     load(loader.get());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void FrameLoader::loadWithNavigationAction(const ResourceRequest&amp; request, const NavigationAction&amp; action, LockHistory lockHistory, FrameLoadType type, PassRefPtr&lt;FormState&gt; formState)
</del><ins>+void FrameLoader::loadWithNavigationAction(const ResourceRequest&amp; request, const NavigationAction&amp; action, LockHistory lockHistory, FrameLoadType type, PassRefPtr&lt;FormState&gt; formState, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     RefPtr&lt;DocumentLoader&gt; loader = m_client.createDocumentLoader(request, defaultSubstituteDataForURL(request.url()));
</span><span class="cx">     if (lockHistory == LockHistory::Yes &amp;&amp; m_documentLoader)
</span><span class="lines">@@ -1381,7 +1381,7 @@
</span><span class="cx">     if (m_documentLoader)
</span><span class="cx">         loader-&gt;setOverrideEncoding(m_documentLoader-&gt;overrideEncoding());
</span><span class="cx"> 
</span><del>-    loadWithDocumentLoader(loader.get(), type, formState);
</del><ins>+    loadWithDocumentLoader(loader.get(), type, formState, allowNavigationToInvalidURL);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::load(DocumentLoader* newDocumentLoader)
</span><span class="lines">@@ -1418,10 +1418,10 @@
</span><span class="cx">         type = FrameLoadType::Reload;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    loadWithDocumentLoader(newDocumentLoader, type, 0);
</del><ins>+    loadWithDocumentLoader(newDocumentLoader, type, 0, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType type, PassRefPtr&lt;FormState&gt; prpFormState)
</del><ins>+void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType type, PassRefPtr&lt;FormState&gt; prpFormState, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     // Retain because dispatchBeforeLoadEvent may release the last reference to it.
</span><span class="cx">     Ref&lt;Frame&gt; protect(m_frame);
</span><span class="lines">@@ -1475,13 +1475,13 @@
</span><span class="cx">         // a new URL, the parent frame shouldn't learn the URL.
</span><span class="cx">         if (!m_stateMachine.committedFirstRealDocumentLoad()
</span><span class="cx">             &amp;&amp; !ownerElement-&gt;dispatchBeforeLoadEvent(loader-&gt;request().url().string())) {
</span><del>-            continueLoadAfterNavigationPolicy(loader-&gt;request(), formState, false);
</del><ins>+            continueLoadAfterNavigationPolicy(loader-&gt;request(), formState, false, allowNavigationToInvalidURL);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    policyChecker().checkNavigationPolicy(loader-&gt;request(), loader, formState, [this](const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, bool shouldContinue) {
-        continueLoadAfterNavigationPolicy(request, formState, shouldContinue);
</del><ins>+    policyChecker().checkNavigationPolicy(loader-&gt;request(), loader, formState, [this, allowNavigationToInvalidURL](const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, bool shouldContinue) {
+        continueLoadAfterNavigationPolicy(request, formState, shouldContinue, allowNavigationToInvalidURL);
</ins><span class="cx">     });
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1563,7 +1563,7 @@
</span><span class="cx"> 
</span><span class="cx">     loader-&gt;setOverrideEncoding(encoding);
</span><span class="cx"> 
</span><del>-    loadWithDocumentLoader(loader.get(), FrameLoadType::Reload, 0);
</del><ins>+    loadWithDocumentLoader(loader.get(), FrameLoadType::Reload, 0, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::reload(bool endToEndReload)
</span><span class="lines">@@ -1597,7 +1597,7 @@
</span><span class="cx"> 
</span><span class="cx">     loader-&gt;setOverrideEncoding(m_documentLoader-&gt;overrideEncoding());
</span><span class="cx">     
</span><del>-    loadWithDocumentLoader(loader.get(), endToEndReload ? FrameLoadType::ReloadFromOrigin : FrameLoadType::Reload, 0);
</del><ins>+    loadWithDocumentLoader(loader.get(), endToEndReload ? FrameLoadType::ReloadFromOrigin : FrameLoadType::Reload, 0, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::stopAllLoaders(ClearProvisionalItemPolicy clearProvisionalItemPolicy)
</span><span class="lines">@@ -2616,7 +2616,7 @@
</span><span class="cx">     request.setHTTPOrigin(origin);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void FrameLoader::loadPostRequest(const ResourceRequest&amp; inRequest, const String&amp; referrer, const String&amp; frameName, LockHistory lockHistory, FrameLoadType loadType, PassRefPtr&lt;Event&gt; event, PassRefPtr&lt;FormState&gt; prpFormState)
</del><ins>+void FrameLoader::loadPostRequest(const ResourceRequest&amp; inRequest, const String&amp; referrer, const String&amp; frameName, LockHistory lockHistory, FrameLoadType loadType, PassRefPtr&lt;Event&gt; event, PassRefPtr&lt;FormState&gt; prpFormState, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     RefPtr&lt;FormState&gt; formState = prpFormState;
</span><span class="cx"> 
</span><span class="lines">@@ -2644,19 +2644,19 @@
</span><span class="cx">     if (!frameName.isEmpty()) {
</span><span class="cx">         // The search for a target frame is done earlier in the case of form submission.
</span><span class="cx">         if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName)) {
</span><del>-            targetFrame-&gt;loader().loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
</del><ins>+            targetFrame-&gt;loader().loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release(), allowNavigationToInvalidURL);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        policyChecker().checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName, [this](const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, const String&amp; frameName, const NavigationAction&amp; action, bool shouldContinue) {
-            continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue);
</del><ins>+        policyChecker().checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName, [this, allowNavigationToInvalidURL](const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, const String&amp; frameName, const NavigationAction&amp; action, bool shouldContinue) {
+            continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue, allowNavigationToInvalidURL);
</ins><span class="cx">         });
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // must grab this now, since this load may stop the previous load and clear this flag
</span><span class="cx">     bool isRedirect = m_quickRedirectComing;
</span><del>-    loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
</del><ins>+    loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release(), allowNavigationToInvalidURL);
</ins><span class="cx">     if (isRedirect) {
</span><span class="cx">         m_quickRedirectComing = false;
</span><span class="cx">         if (m_provisionalDocumentLoader)
</span><span class="lines">@@ -2889,7 +2889,7 @@
</span><span class="cx">     return chrome.runBeforeUnloadConfirmPanel(text, &amp;m_frame);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&amp;, PassRefPtr&lt;FormState&gt; formState, bool shouldContinue)
</del><ins>+void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&amp; request, PassRefPtr&lt;FormState&gt; formState, bool shouldContinue, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     // If we loaded an alternate page to replace an unreachableURL, we'll get in here with a
</span><span class="cx">     // nil policyDataSource because loading the alternate page will have passed
</span><span class="lines">@@ -2898,15 +2898,19 @@
</span><span class="cx"> 
</span><span class="cx">     bool isTargetItem = history().provisionalItem() ? history().provisionalItem()-&gt;isTargetItem() : false;
</span><span class="cx"> 
</span><del>-    // Two reasons we can't continue:
</del><ins>+    bool urlIsDisallowed = allowNavigationToInvalidURL == AllowNavigationToInvalidURL::No &amp;&amp; !request.url().isValid();
+
+    // Three reasons we can't continue:
</ins><span class="cx">     //    1) Navigation policy delegate said we can't so request is nil. A primary case of this 
</span><span class="cx">     //       is the user responding Cancel to the form repost nag sheet.
</span><span class="cx">     //    2) User responded Cancel to an alert popped up by the before unload event handler.
</span><del>-    bool canContinue = shouldContinue &amp;&amp; shouldClose();
</del><ins>+    //    3) The request's URL is invalid and navigation to invalid URLs is disallowed.
+    bool canContinue = shouldContinue &amp;&amp; shouldClose() &amp;&amp; !urlIsDisallowed;
</ins><span class="cx"> 
</span><span class="cx">     if (!canContinue) {
</span><span class="cx">         // If we were waiting for a quick redirect, but the policy delegate decided to ignore it, then we 
</span><span class="cx">         // need to report that the client redirect was cancelled.
</span><ins>+        // FIXME: The client should be told about ignored non-quick redirects, too.
</ins><span class="cx">         if (m_quickRedirectComing)
</span><span class="cx">             clientRedirectCancelledOrFinished(false);
</span><span class="cx"> 
</span><span class="lines">@@ -2964,7 +2968,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest&amp; request,
</span><del>-    PassRefPtr&lt;FormState&gt; formState, const String&amp; frameName, const NavigationAction&amp; action, bool shouldContinue)
</del><ins>+    PassRefPtr&lt;FormState&gt; formState, const String&amp; frameName, const NavigationAction&amp; action, bool shouldContinue, AllowNavigationToInvalidURL allowNavigationToInvalidURL)
</ins><span class="cx"> {
</span><span class="cx">     if (!shouldContinue)
</span><span class="cx">         return;
</span><span class="lines">@@ -2983,7 +2987,7 @@
</span><span class="cx">         mainFrame-&gt;loader().setOpener(&amp;frame.get());
</span><span class="cx">         mainFrame-&gt;document()-&gt;setReferrerPolicy(frame-&gt;document()-&gt;referrerPolicy());
</span><span class="cx">     }
</span><del>-    mainFrame-&gt;loader().loadWithNavigationAction(request, NavigationAction(request), LockHistory::No, FrameLoadType::Standard, formState);
</del><ins>+    mainFrame-&gt;loader().loadWithNavigationAction(request, NavigationAction(request), LockHistory::No, FrameLoadType::Standard, formState, allowNavigationToInvalidURL);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::requestFromDelegate(ResourceRequest&amp; request, unsigned long&amp; identifier, ResourceError&amp; error)
</span><span class="lines">@@ -3162,7 +3166,7 @@
</span><span class="cx">     history().setProvisionalItem(item);
</span><span class="cx"> 
</span><span class="cx">     if (CachedPage* cachedPage = pageCache()-&gt;get(item)) {
</span><del>-        loadWithDocumentLoader(cachedPage-&gt;documentLoader(), loadType, 0);   
</del><ins>+        loadWithDocumentLoader(cachedPage-&gt;documentLoader(), loadType, 0, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -3237,7 +3241,7 @@
</span><span class="cx">         action = NavigationAction(requestForOriginalURL, loadType, false);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    loadWithNavigationAction(request, action, LockHistory::No, loadType, 0);
</del><ins>+    loadWithNavigationAction(request, action, LockHistory::No, loadType, 0, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // Loads content into this frame, as specified by history item
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebCoreloaderFrameLoaderh"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.h (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.h        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/loader/FrameLoader.h        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -108,7 +108,7 @@
</span><span class="cx">     // FIXME: These are all functions which start loads. We have too many.
</span><span class="cx">     void loadURLIntoChildFrame(const URL&amp;, const String&amp; referer, Frame*);
</span><span class="cx">     void loadFrameRequest(const FrameLoadRequest&amp;, LockHistory, LockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
</span><del>-        PassRefPtr&lt;Event&gt;, PassRefPtr&lt;FormState&gt;, ShouldSendReferrer);
</del><ins>+        PassRefPtr&lt;Event&gt;, PassRefPtr&lt;FormState&gt;, ShouldSendReferrer, AllowNavigationToInvalidURL);
</ins><span class="cx"> 
</span><span class="cx">     void load(const FrameLoadRequest&amp;);
</span><span class="cx"> 
</span><span class="lines">@@ -118,7 +118,7 @@
</span><span class="cx">     unsigned long loadResourceSynchronously(const ResourceRequest&amp;, StoredCredentials, ClientCredentialPolicy, ResourceError&amp;, ResourceResponse&amp;, Vector&lt;char&gt;&amp; data);
</span><span class="cx"> 
</span><span class="cx">     void changeLocation(SecurityOrigin*, const URL&amp;, const String&amp; referrer, LockHistory = LockHistory::Yes,
</span><del>-        LockBackForwardList = LockBackForwardList::Yes, bool refresh = false);
</del><ins>+        LockBackForwardList = LockBackForwardList::Yes, bool refresh = false, AllowNavigationToInvalidURL = AllowNavigationToInvalidURL::Yes);
</ins><span class="cx">     void urlSelected(const URL&amp;, const String&amp; target, PassRefPtr&lt;Event&gt;, LockHistory, LockBackForwardList, ShouldSendReferrer);
</span><span class="cx">     void submitForm(PassRefPtr&lt;FormSubmission&gt;);
</span><span class="cx"> 
</span><span class="lines">@@ -320,8 +320,8 @@
</span><span class="cx"> 
</span><span class="cx">     bool handleBeforeUnloadEvent(Chrome&amp;, FrameLoader* frameLoaderBeingNavigated);
</span><span class="cx"> 
</span><del>-    void continueLoadAfterNavigationPolicy(const ResourceRequest&amp;, PassRefPtr&lt;FormState&gt;, bool shouldContinue);
-    void continueLoadAfterNewWindowPolicy(const ResourceRequest&amp;, PassRefPtr&lt;FormState&gt;, const String&amp; frameName, const NavigationAction&amp;, bool shouldContinue);
</del><ins>+    void continueLoadAfterNavigationPolicy(const ResourceRequest&amp;, PassRefPtr&lt;FormState&gt;, bool shouldContinue, AllowNavigationToInvalidURL);
+    void continueLoadAfterNewWindowPolicy(const ResourceRequest&amp;, PassRefPtr&lt;FormState&gt;, const String&amp; frameName, const NavigationAction&amp;, bool shouldContinue, AllowNavigationToInvalidURL);
</ins><span class="cx">     void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&amp;, bool shouldContinue);
</span><span class="cx"> 
</span><span class="cx">     bool shouldPerformFragmentNavigation(bool isFormSubmission, const String&amp; httpMethod, FrameLoadType, const URL&amp;);
</span><span class="lines">@@ -342,18 +342,18 @@
</span><span class="cx"> 
</span><span class="cx">     void dispatchDidCommitLoad();
</span><span class="cx"> 
</span><del>-    void urlSelected(const FrameLoadRequest&amp;, PassRefPtr&lt;Event&gt;, LockHistory, LockBackForwardList, ShouldSendReferrer, ShouldReplaceDocumentIfJavaScriptURL);
</del><ins>+    void urlSelected(const FrameLoadRequest&amp;, PassRefPtr&lt;Event&gt;, LockHistory, LockBackForwardList, ShouldSendReferrer, ShouldReplaceDocumentIfJavaScriptURL, AllowNavigationToInvalidURL);
</ins><span class="cx"> 
</span><del>-    void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr&lt;FormState&gt;); // Calls continueLoadAfterNavigationPolicy
</del><ins>+    void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr&lt;FormState&gt;, AllowNavigationToInvalidURL); // Calls continueLoadAfterNavigationPolicy
</ins><span class="cx">     void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
</span><span class="cx"> 
</span><span class="cx">     void loadWithNavigationAction(const ResourceRequest&amp;, const NavigationAction&amp;,      // Calls loadWithDocumentLoader
</span><del>-        LockHistory, FrameLoadType, PassRefPtr&lt;FormState&gt;);
</del><ins>+        LockHistory, FrameLoadType, PassRefPtr&lt;FormState&gt;, AllowNavigationToInvalidURL);
</ins><span class="cx"> 
</span><span class="cx">     void loadPostRequest(const ResourceRequest&amp;, const String&amp; referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
</span><del>-        const String&amp; frameName, LockHistory, FrameLoadType, PassRefPtr&lt;Event&gt;, PassRefPtr&lt;FormState&gt;);
</del><ins>+        const String&amp; frameName, LockHistory, FrameLoadType, PassRefPtr&lt;Event&gt;, PassRefPtr&lt;FormState&gt;, AllowNavigationToInvalidURL);
</ins><span class="cx">     void loadURL(const URL&amp;, const String&amp; referrer, const String&amp; frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
</span><del>-        LockHistory, FrameLoadType, PassRefPtr&lt;Event&gt;, PassRefPtr&lt;FormState&gt;);
</del><ins>+        LockHistory, FrameLoadType, PassRefPtr&lt;Event&gt;, PassRefPtr&lt;FormState&gt;, AllowNavigationToInvalidURL);
</ins><span class="cx"> 
</span><span class="cx">     bool shouldReload(const URL&amp; currentURL, const URL&amp; destinationURL);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebCoreloaderFrameLoaderTypesh"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/loader/FrameLoaderTypes.h (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/loader/FrameLoaderTypes.h        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/loader/FrameLoaderTypes.h        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -119,6 +119,11 @@
</span><span class="cx">         Yes,
</span><span class="cx">         No
</span><span class="cx">     };
</span><ins>+
+    enum class AllowNavigationToInvalidURL {
+        Yes,
+        No
+    };
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebCoreloaderNavigationSchedulercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/loader/NavigationScheduler.cpp (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/loader/NavigationScheduler.cpp        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/loader/NavigationScheduler.cpp        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -165,7 +165,7 @@
</span><span class="cx">     {
</span><span class="cx">         UserGestureIndicator gestureIndicator(wasUserGesture() ? DefinitelyProcessingUserGesture : DefinitelyNotProcessingUserGesture);
</span><span class="cx">         bool refresh = equalIgnoringFragmentIdentifier(frame.document()-&gt;url(), url());
</span><del>-        frame.loader().changeLocation(securityOrigin(), url(), referrer(), lockHistory(), lockBackForwardList(), refresh);
</del><ins>+        frame.loader().changeLocation(securityOrigin(), url(), referrer(), lockHistory(), lockBackForwardList(), refresh, AllowNavigationToInvalidURL::No);
</ins><span class="cx">     }
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="lines">@@ -173,6 +173,12 @@
</span><span class="cx"> public:
</span><span class="cx">     ScheduledLocationChange(SecurityOrigin* securityOrigin, const URL&amp; url, const String&amp; referrer, LockHistory lockHistory, LockBackForwardList lockBackForwardList, bool duringLoad)
</span><span class="cx">         : ScheduledURLNavigation(0.0, securityOrigin, url, referrer, lockHistory, lockBackForwardList, duringLoad, true) { }
</span><ins>+
+    virtual void fire(Frame&amp; frame) override
+    {
+        UserGestureIndicator gestureIndicator(wasUserGesture() ? DefinitelyProcessingUserGesture : DefinitelyNotProcessingUserGesture);
+        frame.loader().changeLocation(securityOrigin(), url(), referrer(), lockHistory(), lockBackForwardList(), false, AllowNavigationToInvalidURL::No);
+    }
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class ScheduledRefresh : public ScheduledURLNavigation {
</span><span class="lines">@@ -240,7 +246,7 @@
</span><span class="cx">             return;
</span><span class="cx">         FrameLoadRequest frameRequest(requestingDocument-&gt;securityOrigin());
</span><span class="cx">         m_submission-&gt;populateFrameLoadRequest(frameRequest);
</span><del>-        frame.loader().loadFrameRequest(frameRequest, lockHistory(), lockBackForwardList(), m_submission-&gt;event(), m_submission-&gt;state(), MaybeSendReferrer);
</del><ins>+        frame.loader().loadFrameRequest(frameRequest, lockHistory(), lockBackForwardList(), m_submission-&gt;event(), m_submission-&gt;state(), MaybeSendReferrer, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     virtual void didStartTimer(Frame&amp; frame, Timer&lt;NavigationScheduler&gt;&amp; timer) override
</span><span class="lines">@@ -311,8 +317,6 @@
</span><span class="cx">         return false;
</span><span class="cx">     if (protocolIsJavaScript(url))
</span><span class="cx">         return true;
</span><del>-    if (!url.isValid() &amp;&amp; !m_frame.settings().allowNavigationToInvalidURL())
-        return false;
</del><span class="cx">     return NavigationDisablerForBeforeUnload::isNavigationAllowed();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -364,7 +368,7 @@
</span><span class="cx">     // fragment part, we don't need to schedule the location change.
</span><span class="cx">     URL parsedURL(ParsedURLString, url);
</span><span class="cx">     if (parsedURL.hasFragmentIdentifier() &amp;&amp; equalIgnoringFragmentIdentifier(m_frame.document()-&gt;url(), parsedURL)) {
</span><del>-        loader.changeLocation(securityOrigin, m_frame.document()-&gt;completeURL(url), referrer, lockHistory, lockBackForwardList);
</del><ins>+        loader.changeLocation(securityOrigin, m_frame.document()-&gt;completeURL(url), referrer, lockHistory, lockBackForwardList, false, AllowNavigationToInvalidURL::No);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebCorepageContextMenuControllercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/page/ContextMenuController.cpp (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/page/ContextMenuController.cpp        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/page/ContextMenuController.cpp        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -206,7 +206,7 @@
</span><span class="cx">     if (!newPage)
</span><span class="cx">         return;
</span><span class="cx">     newPage-&gt;chrome().show();
</span><del>-    newPage-&gt;mainFrame().loader().loadFrameRequest(request, LockHistory::No, LockBackForwardList::No, 0, 0, MaybeSendReferrer);
</del><ins>+    newPage-&gt;mainFrame().loader().loadFrameRequest(request, LockHistory::No, LockBackForwardList::No, 0, 0, MaybeSendReferrer, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if PLATFORM(GTK)
</span><span class="lines">@@ -405,12 +405,12 @@
</span><span class="cx">         break;
</span><span class="cx">     case ContextMenuItemTagOpenLink:
</span><span class="cx">         if (Frame* targetFrame = m_context.hitTestResult().targetFrame())
</span><del>-            targetFrame-&gt;loader().loadFrameRequest(FrameLoadRequest(frame-&gt;document()-&gt;securityOrigin(), ResourceRequest(m_context.hitTestResult().absoluteLinkURL(), frame-&gt;loader().outgoingReferrer())), LockHistory::No, LockBackForwardList::No, 0, 0, MaybeSendReferrer);
</del><ins>+            targetFrame-&gt;loader().loadFrameRequest(FrameLoadRequest(frame-&gt;document()-&gt;securityOrigin(), ResourceRequest(m_context.hitTestResult().absoluteLinkURL(), frame-&gt;loader().outgoingReferrer())), LockHistory::No, LockBackForwardList::No, 0, 0, MaybeSendReferrer, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx">         else
</span><span class="cx">             openNewWindow(m_context.hitTestResult().absoluteLinkURL(), frame);
</span><span class="cx">         break;
</span><span class="cx">     case ContextMenuItemTagOpenLinkInThisWindow:
</span><del>-        frame-&gt;loader().loadFrameRequest(FrameLoadRequest(frame-&gt;document()-&gt;securityOrigin(), ResourceRequest(m_context.hitTestResult().absoluteLinkURL(), frame-&gt;loader().outgoingReferrer())), LockHistory::No, LockBackForwardList::No, 0, 0, MaybeSendReferrer);
</del><ins>+        frame-&gt;loader().loadFrameRequest(FrameLoadRequest(frame-&gt;document()-&gt;securityOrigin(), ResourceRequest(m_context.hitTestResult().absoluteLinkURL(), frame-&gt;loader().outgoingReferrer())), LockHistory::No, LockBackForwardList::No, 0, 0, MaybeSendReferrer, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx">         break;
</span><span class="cx">     case ContextMenuItemTagBold:
</span><span class="cx">         frame-&gt;editor().command(&quot;ToggleBold&quot;).execute();
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebCorepageSettingsin"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebCore/page/Settings.in (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebCore/page/Settings.in        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebCore/page/Settings.in        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -225,10 +225,6 @@
</span><span class="cx"> 
</span><span class="cx"> useImageDocumentForSubframePDF initial=false
</span><span class="cx"> 
</span><del>-# Allow clients to permit navigation to an invalid URL. Some apps may use invalid URLs
-# as a means to pass data from the web-portion of their app to the native portion.
-allowNavigationToInvalidURL initial=false
-
</del><span class="cx"> # Allow SourceBuffers to store up to 304MB each, enough for approximately five minutes
</span><span class="cx"> # of 1080p video and stereo audio.
</span><span class="cx"> maximumSourceBufferSize type=int, initial=318767104, conditional=MEDIA_SOURCE
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebKit/mac/ChangeLog (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebKit/mac/ChangeLog        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebKit/mac/ChangeLog        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1,3 +1,20 @@
</span><ins>+2014-08-19  Dana Burkart  &lt;dburkart@apple.com&gt;
+
+        Merge r172709. &lt;rdar://problem/17850158&gt;
+
+    2014-08-18  Andy Estes  &lt;aestes@apple.com&gt;
+    
+            REGRESSION (r167856): adobe.com no longer able to launch Create Cloud app using a URL with a custom scheme
+            https://bugs.webkit.org/show_bug.cgi?id=136010
+    
+            Reviewed by Darin Adler.
+    
+            * Misc/WebKitVersionChecks.h: Removed WEBKIT_FIRST_VERSION_WITH_NAVIGATION_URL_VALIDATION.
+            * WebView/WebPDFView.mm:
+            (-[WebPDFView PDFViewWillClickOnLink:withURL:]): Passed AllowNavigationToInvalidURL::Yes to FrameLoader::loadFrameRequest.
+            * WebView/WebView.mm:
+            (-[WebView _preferencesChanged:]): Reverted the linked-on-or-after check added in r170120 since it's no longer necessary.
+    
</ins><span class="cx"> 2014-08-13  Lucas Forschler  &lt;lforschler@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Merge r172526
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebKitmacMiscWebKitVersionChecksh"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebKit/mac/Misc/WebKitVersionChecks.h (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebKit/mac/Misc/WebKitVersionChecks.h        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebKit/mac/Misc/WebKitVersionChecks.h        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -71,7 +71,6 @@
</span><span class="cx"> #define WEBKIT_FIRST_VERSION_WITH_CSS_ATTRIBUTE_SETTERS_IGNORING_PRIORITY 2239 // iOS 6.0
</span><span class="cx"> #define WEBKIT_FIRST_VERSION_WITH_YOUTUBE_EMBED_IFRAME_TRANSFORM 2239 // iOS 6.0
</span><span class="cx"> #define WEBKIT_FIRST_VERSION_WITHOUT_LEGACY_BACKGROUNDSIZE_SHORTHAND_BEHAVIOR 2665 // iOS 7.0
</span><del>-#define WEBKIT_FIRST_VERSION_WITH_NAVIGATION_URL_VALIDATION 3185 // iOS 8.0
</del><span class="cx"> #endif // PLATFORM(IOS)
</span><span class="cx"> 
</span><span class="cx"> #ifdef __cplusplus
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebKitmacWebViewWebPDFViewmm"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebPDFView.mm (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebPDFView.mm        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebPDFView.mm        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -1032,7 +1032,7 @@
</span><span class="cx"> 
</span><span class="cx">     // Call to the frame loader because this is where our security checks are made.
</span><span class="cx">     Frame* frame = core([dataSource webFrame]);
</span><del>-    frame-&gt;loader().loadFrameRequest(FrameLoadRequest(frame-&gt;document()-&gt;securityOrigin(), ResourceRequest(URL)), LockHistory::No, LockBackForwardList::No, event.get(), 0, MaybeSendReferrer);
</del><ins>+    frame-&gt;loader().loadFrameRequest(FrameLoadRequest(frame-&gt;document()-&gt;securityOrigin(), ResourceRequest(URL)), LockHistory::No, LockBackForwardList::No, event.get(), 0, MaybeSendReferrer, AllowNavigationToInvalidURL::Yes);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> - (void)PDFViewOpenPDFInNativeApplication:(PDFView *)sender
</span></span></pre></div>
<a id="branchessafari6001branchSourceWebKitmacWebViewWebViewmm"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebView.mm (172786 => 172787)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebView.mm        2014-08-19 23:45:13 UTC (rev 172786)
+++ branches/safari-600.1-branch/Source/WebKit/mac/WebView/WebView.mm        2014-08-19 23:49:01 UTC (rev 172787)
</span><span class="lines">@@ -2327,8 +2327,6 @@
</span><span class="cx"> #if ENABLE(IOS_TEXT_AUTOSIZING)
</span><span class="cx">     settings.setMinimumZoomFontSize([preferences _minimumZoomFontSize]);
</span><span class="cx"> #endif
</span><del>-
-    settings.setAllowNavigationToInvalidURL(!WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_NAVIGATION_URL_VALIDATION));
</del><span class="cx"> #endif // PLATFORM(IOS)
</span><span class="cx"> 
</span><span class="cx"> #if PLATFORM(MAC)
</span></span></pre>
</div>
</div>

</body>
</html>