commit 55f653529432df63e7ee547545d92551c283ac0f
author Torne (Richard Coles) <torne@google.com> Tue Feb 03 10:52:55 2015 +0000
committer Torne (Richard Coles) <torne@google.com> Tue Feb 03 10:52:55 2015 +0000
tree 86332307c9c32dc004df98823af1cb320b60bb58
parent 2d50636ba2727b3fb1fb2357fad512d293e307c5

Merge from Chromium at DEPS revision 40.0.2214.107

This commit was generated by merge_to_master.py.

Change-Id: Idd7d090dcb688d44348bcfb27228f15ca9f6614e

Source/bindings/core/v8/V8ThrowException.cpp

diff --git a/Source/bindings/core/v8/V8ThrowException.cpp b/Source/bindings/core/v8/V8ThrowException.cpp
index 060ab6b..9a0d436 100644
--- a/Source/bindings/core/v8/V8ThrowException.cpp
+++ b/Source/bindings/core/v8/V8ThrowException.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "bindings/core/v8/V8ThrowException.h"
 
+#include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8DOMException.h"
 #include "core/dom/DOMException.h"
@@ -62,8 +63,16 @@
     if (ec == V8ReferenceError)
         return V8ThrowException::createReferenceError(isolate, sanitizedMessage);
 
+    v8::Handle<v8::Object> sanitizedCreationContext = creationContext;
+
+    // FIXME: Is the current context always the right choice?
+    Frame* frame = toFrameIfNotDetached(creationContext->CreationContext());
+    if (!frame || !BindingSecurity::shouldAllowAccessToFrame(isolate, frame, DoNotReportSecurityError))
+        sanitizedCreationContext = isolate->GetCurrentContext()->Global();
+
+
     RefPtrWillBeRawPtr<DOMException> domException = DOMException::create(ec, sanitizedMessage, unsanitizedMessage);
-    v8::Handle<v8::Value> exception = toV8(domException, creationContext, isolate);
+    v8::Handle<v8::Value> exception = toV8(domException, sanitizedCreationContext, isolate);
 
     if (exception.IsEmpty())
         return v8Undefined();

Source/core/rendering/InlineTextBox.cpp

diff --git a/Source/core/rendering/InlineTextBox.cpp b/Source/core/rendering/InlineTextBox.cpp
index e3c5bc7..47c4c0c 100644
--- a/Source/core/rendering/InlineTextBox.cpp
+++ b/Source/core/rendering/InlineTextBox.cpp
@@ -526,6 +526,7 @@
     TextRun run(string, textPos(), expansion(), expansionBehavior(), direction(), dirOverride() || style->rtlOrdering() == VisualOrder, !renderer().canUseSimpleFontCodePath());
     run.setTabSize(!style->collapseWhiteSpace(), style->tabSize());
     run.setCharacterScanForCodePath(!renderer().canUseSimpleFontCodePath());
+    run.setUseComplexCodePath(!renderer().canUseSimpleFontCodePath());
 
     // Propagate the maximum length of the characters buffer to the TextRun, even when we're only processing a substring.
     run.setCharactersLength(maximumLength);