Timeline
Jan 14, 2005:
- 3:55 PM Changeset in webkit [8381] by
-
- 5 edits in trunk/WebCore
- khtml/css/cssproperties.c: Regenerated with gperf 3.0.1.
- khtml/css/cssvalues.c: Regenerated with gperf 3.0.1.
- khtml/misc/htmlattrs.c: Regenerated with gperf 3.0.1.
- khtml/misc/htmltags.c: Regenerated with gperf 3.0.1.
- 12:09 PM Changeset in webkit [8380] by
-
- 5 edits in trunk/WebCore
Fixed: <rdar://problem/3886415> arrow keys don't work when the user hits Back to return to RSS page
Reviewed by hyatt.
(KWQKHTMLPart::openURLFromPageCache): restore mousePressNode
(KWQKHTMLPart::mousePressNode): new
- kwq/KWQPageState.h:
- kwq/KWQPageState.mm: (-[KWQPageState initWithDocument:URL:windowProperties:locationProperties:interpreterBuiltins:]): save the mousePressNode (-[KWQPageState clear]): clear the mousePressNode (-[KWQPageState dealloc]): deref the mousePressNode (-[KWQPageState mousePressNode]): new
Jan 13, 2005:
- 6:14 PM Changeset in webkit [8379]
-
- 25 copies2 deletes in tags/WebKit-85~8~5
This commit was manufactured by cvs2svn to create tag
'WebKit-85~8~5'.
- 6:14 PM Changeset in webkit [8378] by
-
- 2 edits in branches/Safari-1-0-branch/WebKit
fixed mismatched_CFBundleShortVersionStrings verification failure by correcting
version string to 1.0.3
- 5:40 PM Changeset in webkit [8377] by
-
- 2 edits in branches/Safari-1-0-branch/WebKit
- bump WebKit version number to 85.8.5; the tag "WebKit-85~8~3" is already taken, and
version numbers with a "4" are not allowed because of Netscape 4 compatibility
- 5:30 PM Changeset in webkit [8376] by
-
- 2 edits in branches/Safari-1-0-branch/WebKit
versioning for January 2005 Security Update, WebKit-85.8.3
- 5:24 PM Changeset in webkit [8375]
-
- 23 copies2 deletes in tags/WebCore-85~6~6
This commit was manufactured by cvs2svn to create tag
'WebCore-85~6~6'.
- 5:24 PM Changeset in webkit [8374] by
-
- 3 edits in branches/Safari-1-0-branch/WebCore
versioning for January 2005 Security Update, WebCore-85.6.6
- 5:01 PM Changeset in webkit [8373] by
-
- 6 edits in trunk/WebKit
Fixed: <rdar://problem/3932107> Safari does not load QT Cocoa plug-in if the WebPluginMIMETypes key is not in the info.plist
Fixing this bug required that we allow WebKit plug-ins (as well as Netscape plug-ins) support BP_CreatePluginMIMETypesPreferences
which allows plug-ins create an auxiliary MIME types file.
Reviewed by adele.
- Plugins.subproj/WebBasePluginPackage.h:
- Plugins.subproj/WebBasePluginPackage.m: (+[WebBasePluginPackage preferredLocalizationName]): moved from WebNetscapePluginPackage (-[WebBasePluginPackage pListForPath:createFile:]): ditto (-[WebBasePluginPackage getPluginInfoFromPLists]): ditto (-[WebBasePluginPackage isLoaded]): return isLoaded ivar (-[WebBasePluginPackage load]): if loaded, get BP_CreatePluginMIMETypesPreferences symbol
- Plugins.subproj/WebNetscapePluginPackage.h:
- Plugins.subproj/WebNetscapePluginPackage.m: (-[WebNetscapePluginPackage load]): call super when done so BP_CreatePluginMIMETypesPreferences can be initialized
- Plugins.subproj/WebPluginPackage.m: (-[WebPluginPackage initWithPath:]): call getPluginInfoFromPLists (-[WebPluginPackage load]): call super when done so BP_CreatePluginMIMETypesPreferences can be initialized
- 4:29 PM Changeset in webkit [8372] by
-
- 12 edits in branches/Safari-1-0-branch
WebCore:
<rdar://problem/3939323> frame naming allows malicious site to bring up a window when you click on a link in another
<rdar://problem/3939484> scripts can cause other frames/windows to execute arbitrary script using javascript: URLs
<rdar://problem/3943552> WebKit needs to restrict access to certain window operations by domain
merged these fixes from Tiger:
2004-12-21 Maciej Stachowiak <mjs@apple.com>
Reviewed by Darin.
<rdar://problem/3888931> frame naming allows malicious site to bring up a window when you click on a link in another
Added opener bridge method to help WebKit implement security check
for named frame visibility.
- khtml/khtml_part.h:
- kwq/WebCoreBridge.h:
- kwq/WebCoreBridge.mm: (-[WebCoreBridge opener]):
2004-12-06 Maciej Stachowiak <mjs@apple.com>
Reviewed by John.
- fixed <rdar://problem/3903797> scripts can cause other frames/windows to execute arbitrary script using javascript: URLs
I changed all unprotected places that can navigate a different
window or frame from script to check for a javascript: URL, and if
found, to check for safety using cross-site-script rules.
I considered a few other possible exploits and made no change:
- document.location is already protected because the document object itself is protected
- frame.src, frame.location, iframe.src and targetted links are all safe because setting the URL of a frame to a javascript: URL executes the script in the context of the parent
- khtml/ecma/kjs_window.cpp: (WindowFunc::tryCall): (Location::put): (LocationFunc::tryCall):
2004-12-21 Maciej Stachowiak <mjs@apple.com>
Reviewed by John.
<rdar://problem/3929187> WebKit needs to restrict access to certain window operations by domain
- khtml/ecma/kjs_window.cpp: (Window::get): Change most window functions to be restricted by XSS domain check.
The following files were changed to complete the merge. Added compareIgnoringCaseForASCIIOnly and startsWith functions
to match how it is in later versions.
- kwq/KWQString.h:
- kwq/KWQString.mm: (compareIgnoringCaseForASCIIOnly): (QString::startsWith): (QString::find):
WebKit:
<rdar://problem/3939323> frame naming allows malicious site to bring up a window when you click on a link in another
merged fix for this from Tiger:
2004-12-21 Maciej Stachowiak <mjs@apple.com>
Reviewed by Darin.
<rdar://problem/3888931> frame naming allows malicious site to bring up a window when you click on a link in another
Implement a security check on name frame visbility. This is the
same rule as mozilla. You can only target frames by name if you
are in the same window, have the same domain as the frame or an
ancestor, or if it's a top level window have the same domain as
the opener.
- WebView.subproj/WebFrame.m: (-[WebFrame _shouldAllowAccessFrom:]): (-[WebFrame _descendantFrameNamed:sourceFrame:]): (-[WebFrame findFrameNamed:]):
- WebView.subproj/WebFramePrivate.h:
- WebView.subproj/WebView.m: (-[WebView _findFrameInThisWindowNamed:sourceFrame:]): (-[WebView _findFrameNamed:sourceFrame:]):
- WebView.subproj/WebViewPrivate.h:
- 4:17 PM Changeset in webkit [8371] by
-
- 1 edit in trunk/WebKit/Plugins.subproj/WebJavaPlugIn.h
Changed another place where the method name was incorrect in
the comment.
Reviewed (and found) by Darin.
- 4:11 PM Changeset in webkit [8370] by
-
- 2 edits in trunk/WebKit
Fixed <rdar://problem/3952809> WebJavaPlugIn.h comments need method name corrected (webPlugInCallJava)
Reviewed by Maciej.
- Plugins.subproj/WebJavaPlugIn.h:
- 4:05 PM Changeset in webkit [8369] by
-
- 3 edits in trunk
Safari-179+ for TOT. The tree is open!
- 3:58 PM Changeset in webkit [8368]
-
- 1 copy in tags/Safari-179
This commit was manufactured by cvs2svn to create tag 'Safari-179'.
- 3:58 PM Changeset in webkit [8367] by
-
- 6 edits in trunk
Safari-179 stamp
- 3:54 PM Changeset in webkit [8366] by
-
- 6 edits in trunk
Reviewed by Adele.
- fix <rdar://problem/3946836> Safari about box lists 2004 instead of 2005
- 2:13 PM Changeset in webkit [8365] by
-
- 2 edits in trunk/WebKit
Fixed <rdar://problem/3951911> REGRESSION: Animated GIF images with loop counts no longer update
Draw last image after animation loop terminates. (We
were drawing the image at index+1, which doesn't exist!)
Reviewed by Darin.
- WebCoreSupport.subproj/WebImageData.m: (-[WebImageData _nextFrame:]):
- 2:02 PM Changeset in webkit [8364] by
-
- 2 edits in trunk/WebKit
Fixed <rdar://problem/3952084> REGRESSION: Links at projectseven.com now draw and update incorrectly during hover
Turn off use of new CGContextStrokeLineSegments API. We should
turn back on when 3952944 is fixed.
Reviewed by Darin.
- WebCoreSupport.subproj/WebTextRenderer.m: (-[WebTextRenderer drawLineForCharacters:yOffset:width:color:thickness:]):
- 1:17 PM Changeset in webkit [8363] by
-
- 1 edit in trunk/WebCore/ChangeLog-2005-08-23
fixed incorrect check-in date
- 11:45 AM Changeset in webkit [8362] by
-
- 2 edits in trunk/WebCore
Reviewed by Ken Kocienda.
Better fix for 3905066.
- khtml/editing/htmlediting.cpp: (khtml::InsertParagraphSeparatorCommand::doApply):
- 11:41 AM Changeset in webkit [8361] by
-
- 4 edits in trunk/WebKit
Fixed: <rdar://problem/3937663> repro assertion failure and crash dragging image that has PDF source
Reviewed by adele.
- Misc.subproj/WebNSViewExtras.m: (-[NSView _web_dragImage:rect:event:pasteboard:source:offset:]): if [WebImageRenderer image] returns nil, fallback to code that uses a file icon as the drag image
- WebCoreSupport.subproj/WebImageRendererFactory.m: (-[WebImageRendererFactory supportedMIMETypes]): removed code that omits PDF and PostScript from the list since this omission is only needed in WebImageView
- WebView.subproj/WebImageView.m: (+[WebImageView supportedImageMIMETypes]): added code that omits PDF and PostScript since we don't want WebImageView to render these types
- 11:09 AM Changeset in webkit [8360] by
-
- 12 edits in trunk
WebCore:
Reviewed by Darin.
<rdar://problem/3758033> REGRESSION (Mail): Support attributes in marked text (International input)
- khtml/rendering/render_text.cpp: (InlineTextBox::paint): Support painting custom underline markers for marked text in place of generic yellow. (InlineTextBox::paintMarkedTextUnderline): New method that handles this.
- khtml/rendering/render_text.h:
- kwq/KWQKHTMLPart.h: Declare new methods and structs.
- kwq/KWQKHTMLPart.mm: (KWQKHTMLPart::clear): Clear marked test underlines. (KWQKHTMLPart::setMarkedTextRange): Takes attributes and ranges now. (convertAttributesToUnderlines): Converts NSAttributedString attributes to simplified and C++-friendly form. (KWQKHTMLPart::markedTextUsesUnderlines): New method. (KWQKHTMLPart::markedTextUnderlines): New method.
- kwq/KWQPainter.mm: (QPainter::drawLineForText): Handle pen width.
- kwq/WebCoreBridge.h:
- kwq/WebCoreBridge.mm: (-[WebCoreBridge setMarkedTextDOMRange:customAttributes:ranges:]): Take attributes and ranges.
- kwq/WebCoreTextRenderer.h:
WebKit:
Reviewed by Darin.
<rdar://problem/3758033> REGRESSION (Mail): Support attributes in marked text (International input)
- WebCoreSupport.subproj/WebTextRenderer.m: (-[WebTextRenderer drawLineForCharacters:yOffset:width:color:thickness:]): Changed to support underline thickness. Also added a bit of a hack here to move thickness 2 underlines down by .5 pixels, since the rendering engine can't give a fractional pixel offset.
- WebView.subproj/WebHTMLView.m: (-[WebHTMLView validAttributesForMarkedText]): Support underline, underline color and marked clause attributes. Others that NSText supports are unimplemented for now. (-[WebHTMLView firstRectForCharacterRange:]): Remove needless logging. (-[WebHTMLView unmarkText]): Updated for new WebCore SPI. (-[WebHTMLView _extractAttributes:ranges:fromAttributedString:]): New method to pull the attributes and ranges out of an attributed string. (-[WebHTMLView setMarkedText:selectedRange:]): Extract attributes and pass to WebCore. (-[WebHTMLView insertText:]): Add comment noting that we don't really handle attributed strings here.
Jan 12, 2005:
- 9:19 PM Changeset in webkit [8359]
-
- 71 copies2 deletes in tags/WebCore-125~8~13
This commit was manufactured by cvs2svn to create tag
'WebCore-125~8~13'.
- 9:19 PM Changeset in webkit [8358] by
-
- 2 edits in branches/Safari-1-2-branch/WebCore
Versioning for WebCore-125.8.13 for the Security Update
- 9:18 PM Changeset in webkit [8357]
-
- 27 copies3 deletes in tags/WebKit-125~5~6
This commit was manufactured by cvs2svn to create tag
'WebKit-125~5~6'.
- 9:18 PM Changeset in webkit [8356] by
-
- 2 edits in branches/Safari-1-2-branch/WebKit
Versioning for WebKit-125.5.6 for the Security Update
- 8:24 PM Changeset in webkit [8355] by
-
- 2 edits in branches/Safari-1-2-branch/WebCore
- fix for the following bug was incomplete, fixed error in one particular case
<rdar://problem/3939324> *SecUpd: Panther* frame naming allows malicious site to bring up a window when you click on a link in another
- 5:42 PM Changeset in webkit [8354] by
-
- 2 edits in branches/Safari-1-2-branch/WebKit
Missing part of last change.
- 5:31 PM Changeset in webkit [8353] by
-
- 2 edits in trunk/WebCore
Reviewed by Dave Hyatt.
<rdar://problem/3888973> AX: Parent AXWebArea of nested AXWebAreas is messed up
- kwq/KWQAccObject.mm: (-[KWQAccObject addChildrenToArray:]): Use the widget's outer view.
- 5:19 PM Changeset in webkit [8352] by
-
- 3 edits in trunk/WebCore
Reviewed by Darin Adler.
- khtml/xml/dom_nodeimpl.cpp: (NodeImpl::displayNode): Add quotes around text node content. (NodeBaseImpl::childNode): Add nil check to return nil rather than crash when child node not found.
- kwq/KWQAccObject.mm: (-[KWQAccObject doAXStringForTextMarkerRange:]): Pass range compliant positions to TextIterator.
- 4:51 PM Changeset in webkit [8351] by
-
- 8 edits in branches/Safari-1-2-branch
WebCore:
<rdar://problem/3939324> *SecUpd: Panther* frame naming allows malicious site to bring up a window when you click on a link in another
- merged fix for this from Tiger:
2004-12-21 Maciej Stachowiak <mjs@apple.com>
Reviewed by Darin.
<rdar://problem/3888931> frame naming allows malicious site to bring up a window when you click on a link in another
Added opener bridge method to help WebKit implement security check
for named frame visibility.
- khtml/khtml_part.h:
- kwq/WebCoreBridge.h:
- kwq/WebCoreBridge.mm: (-[WebCoreBridge opener]):
WebKit:
<rdar://problem/3939324> *SecUpd: Panther* frame naming allows malicious site to bring up a window when you click on a link in another
- merged fix for this from Tiger:
2004-12-21 Maciej Stachowiak <mjs@apple.com>
Reviewed by Darin.
<rdar://problem/3888931> frame naming allows malicious site to bring up a window when you click on a link in another
Implement a security check on name frame visbility. This is the
same rule as mozilla. You can only target frames by name if you
are in the same window, have the same domain as the frame or an
ancestor, or if it's a top level window have the same domain as
the opener.
- WebView.subproj/WebFrame.m: (-[WebFrame _shouldAllowAccessFrom:]): (-[WebFrame _descendantFrameNamed:sourceFrame:]): (-[WebFrame findFrameNamed:]):
- WebView.subproj/WebFramePrivate.h:
- WebView.subproj/WebView.m: (-[WebView _findFrameInThisWindowNamed:sourceFrame:]): (-[WebView _findFrameNamed:sourceFrame:]):
- WebView.subproj/WebViewPrivate.h:
- 4:39 PM Changeset in webkit [8350] by
-
- 2 edits in branches/Safari-1-2-branch/WebCore
<rdar://problem/3943553> *SecUpd: Panther* WebKit needs to restrict access to certain window operations by domain
- merged the following fix from Tiger to fix this
2004-12-21 Maciej Stachowiak <mjs@apple.com>
Reviewed by John.
<rdar://problem/3929187> WebKit needs to restrict access to certain window operations by domain
- khtml/ecma/kjs_window.cpp: (Window::get): Change most window functions to be restricted by XSS domain check.
- 4:08 PM Changeset in webkit [8349] by
-
- 2 edits in branches/Safari-1-2-branch/WebCore
<rdar://problem/3939485> *SecUpd: Panther* scripts can cause other frames/windows to execute arbitrary script using javascript: URLs
- merged the following fix from Tiger to fix this
2004-12-06 Maciej Stachowiak <mjs@apple.com>
Reviewed by John.
- fixed <rdar://problem/3903797> scripts can cause other frames/windows to execute arbitrary script using javascript: URLs
I changed all unprotected places that can navigate a different
window or frame from script to check for a javascript: URL, and if
found, to check for safety using cross-site-script rules.
I considered a few other possible exploits and made no change:
- document.location is already protected because the document object itself is protected
- frame.src, frame.location, iframe.src and targetted links are all safe because setting the URL of a frame to a javascript: URL executes the script in the context of the parent
- khtml/ecma/kjs_window.cpp: (WindowFunc::tryCall): (Location::put): (LocationFunc::tryCall):
- 3:55 PM Changeset in webkit [8348] by
-
- 4 edits in trunk/WebKit
Reviewed by Ken.
- fixed <rdar://problem/3848257> WebView will draw more than AppKit asks it to, so views behind won't redraw enough (transparent WebView)
- WebView.subproj/WebHTMLView.m: (-[WebHTMLView _propagateDirtyRectsToOpaqueAncestors]): As recommended by Troy Stephens, do the layouts here in this call, since it's before propagating the dirty rects to our ancestors. This fixes the bug, but we only do it if the WebView is not opaque, because otherwise we can optimize by only doing layouts you really need, and doing them later on is safe because we know we don't need to draw any of the views behind us. (-[WebHTMLView _layoutIfNeeded]): Added. Factored out from the method below. (-[WebHTMLView _web_layoutIfNeededRecursive]): Added. Like the other "layout if needed" call, but unconditional. (-[WebHTMLView _web_layoutIfNeededRecursive:testDirtyRect:]): Factored out the guts into the _layoutIfNeeded method above. Otherwise unchanged. (-[NSView _web_layoutIfNeededRecursive]): Added.
- WebView.subproj/WebFrame.m: (-[WebFrame _updateDrawsBackground]): Call setDrawsBackground:NO on the scroll view when changing the frame to no longer be in "draws background" mode. This is needed because the frame manages the "draws background" mode of the scroll view. It won't have any effect if you call setDrawsBackground:NO before starting to use a WebView, but without it calling setDrawsBackground:NO later won't have an immediate effect (easily visible in Safari). This was hidden before because the HTML view was filling with transparent color, which blew away the fill that was done by NSScrollView.
- fixed <rdar://problem/3921129> reproducible crash at www.funnychristmas.com in CFSet manipulation in WebImageData
- WebCoreSupport.subproj/WebImageData.m: (-[WebImageData _imageSourceOptions]): Changed types so we don't need a cast. (+[WebImageData stopAnimationsInView:]): Instead of building a set of sets, by putting in the sets with addObject, build a single set using unionSet, and then iterate the objects instead of having to iterate the sets and then the objects in each set. The old code ended up sharing the sets with the live code, when the whole idea was to gather all the renderers because the process of stopping modifies the active sets.
- 3:41 PM Changeset in webkit [8347] by
-
- 2 edits in trunk/JavaScriptCore
Avoid additional work on dealloc by adding early out to
removeNativeReference(). (This will save time on dealloc
for all ObjC DOM objects.)
Reviewed by Darin.
- bindings/runtime_root.cpp: (KJS::Bindings::removeNativeReference):
- 3:33 PM Changeset in webkit [8346] by
-
- 2 edits in trunk/WebCore
Fix for 3951203, CSS border style incorrectly clipped on inline elements. Make sure the repaint rect set during
line layout is smarter about including the overflow for both old states and new states.
Reviewed by john
- khtml/rendering/bidi.cpp: (khtml::RenderBlock::layoutInlineChildren):
- 3:24 PM Changeset in webkit [8345] by
-
- 2 edits in trunk/JavaScriptCore
Fixed <rdar://problem/3923356> REGRESSION: Java/JavaScript security checks working incorrectly
We were always returning the first "root" object for all runtime
objects. Changed 0 in loop to i, the index.
Reviewed by David Harrison.
- bindings/runtime_root.cpp: (KJS::Bindings::rootForImp):
- 2:03 PM Changeset in webkit [8344] by
-
- 5 edits in trunk/JavaScriptCore
Fixed <rdar://problem/3887930> Must use new Java plug-in API to get/set fields so exception handling works (fixes many LiveConnect crashes)
Use the new dispatching API to invoke JNI, rather than calling JNI
directly.
Reviewed by David Harrison.
- bindings/jni/jni_instance.cpp: (JavaInstance::invokeMethod):
- bindings/jni/jni_runtime.cpp: (JavaField::dispatchValueFromInstance): (JavaField::valueFromInstance): (JavaField::dispatchSetValueToInstance): (JavaField::setValueToInstance):
- bindings/jni/jni_runtime.h:
- bindings/jni/jni_utility.cpp: (KJS::Bindings::convertValueToJValue):
- 1:41 PM Changeset in webkit [8343] by
-
- 3 edits in trunk/WebKit
Fixed <rdar://problem/3926825> Safari ignores GIF loop count
Get loop count from file properties, not image properties.
Reviewed by Ken Kocienda.
- WebCoreSupport.subproj/WebImageData.h:
- WebCoreSupport.subproj/WebImageData.m: (-[WebImageData _commonTermination]): (-[WebImageData fileProperties]): (-[WebImageData _floatProperty:type:at:]): (-[WebImageData _floatFileProperty:type:]): (-[WebImageData _repetitionCount]):
- 11:13 AM Changeset in webkit [8342] by
-
- 4 edits in trunk/WebCore
Fix for bug 3937608, versiontracker.com flashes and displays the right column below content. Make sure to move
tables/overflows that dont fit within a block only in strict mode.
Fix for bug 3931049, characters dont show up when typing. Make sure to dirty the right lines when this specific
case in editing is hit.
Reviewed by darin (first one), kocienda (second one)
- khtml/rendering/render_block.cpp: (khtml::RenderBlock::getClearDelta):
- khtml/rendering/render_flow.cpp: (RenderFlow::dirtyLinesFromChangedChild):
- khtml/rendering/render_line.cpp: (khtml::InlineFlowBox::verticallyAlignBoxes):
- 9:55 AM Changeset in webkit [8341] by
-
- 7 edits8 adds in trunk
Reviewed by John
Fix for this bug:
<rdar://problem/3926142> REGRESSION (Mail): Deleting text decreases quote level
- khtml/editing/htmlediting.cpp: (khtml::DeleteSelectionCommand::initializePositionData): Change test that will prevent block merging. End-of-line test was just wrong. Call new start-of and end-of paragraph functions added to visible_position files. (khtml::DeleteSelectionCommand::moveNodesAfterNode): Add tests for BR elements, which makes tests to determine when to stop moving nodes more complete and correct. Also improved comments.
- khtml/editing/visible_position.cpp: (khtml::isFirstVisiblePositionInParagraph): New function. (khtml::isLastVisiblePositionInParagraph): New function.
- khtml/editing/visible_position.h: Update header accordingly.
- layout-tests/editing/deleting/delete-block-merge-contents-002-expected.txt: New results, slightly different from former results but still correct.
- layout-tests/editing/deleting/delete-block-merge-contents-007-expected.txt: Ditto.
- layout-tests/editing/deleting/delete-block-merge-contents-018-expected.txt: Added.
- layout-tests/editing/deleting/delete-block-merge-contents-018.html: Added.
- layout-tests/editing/deleting/delete-block-merge-contents-019-expected.txt: Added.
- layout-tests/editing/deleting/delete-block-merge-contents-019.html: Added.
- layout-tests/editing/deleting/delete-block-merge-contents-020-expected.txt: Added.
- layout-tests/editing/deleting/delete-block-merge-contents-020.html: Added.
- layout-tests/editing/deleting/delete-block-merge-contents-021-expected.txt: Added.
- layout-tests/editing/deleting/delete-block-merge-contents-021.html: Added.
- layout-tests/editing/deleting/delete-line-014-expected.txt: These new results are actually better, and fix a bug.
