Merge 102317 - https://bugs.webkit.org/show_bug.cgi?id=74038

Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 268 matching lines @@
     RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(args[1], false, ListenerFindOnly);
 
     if (listener) {
         imp->removeEventListener(eventType, listener.get(), useCapture);
         removeHiddenDependency(args.Holder(), args[1], eventListenerCacheIndex);
     }
 
     return v8::Undefined();
 }
 
+static bool isLegacyTargetOriginDesignation(v8::Handle<v8::Value> value)
+{
+    if (value->IsString() || value->IsStringObject())
+        return true;
+    return false;
+}
+
+
 static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args, bool extendedTransfer)
 {
     DOMWindow* window = V8DOMWindow::toNative(args.Holder());
 
     DOMWindow* source = V8Proxy::retrieveFrameForCallingContext()->domWindow();
     ASSERT(source->frame());
 
-    // This function has variable arguments and can either be:
-    //   postMessage(message, port, targetOrigin);
-    // or
-    //   postMessage(message, targetOrigin);
+    // This function has variable arguments and can be:
+    // Per current spec:
+    //   postMessage(message, targetOrigin)
+    //   postMessage(message, targetOrigin, {sequence of transferrables})
+    // Legacy non-standard implementations in webkit allowed:
+    //   postMessage(message, {sequence of transferrables}, targetOrigin);
     MessagePortArray portArray;
     ArrayBufferArray arrayBufferArray;
     String targetOrigin;
     {
         v8::TryCatch tryCatch;
+        int targetOriginArgIndex = 1;
         if (args.Length() > 2) {
-            if (!extractTransferables(args[2], portArray, arrayBufferArray))
+            int transferablesArgIndex = 2;
+            if (isLegacyTargetOriginDesignation(args[2])) {
+                targetOriginArgIndex = 2;
+                transferablesArgIndex = 1;
+            }
+            if (!extractTransferables(args[transferablesArgIndex], portArray, arrayBufferArray))
                 return v8::Undefined();
         } 
-        targetOrigin = toWebCoreStringWithNullOrUndefinedCheck(args[1]);
+        targetOrigin = toWebCoreStringWithNullOrUndefinedCheck(args[targetOriginArgIndex]);
 
         if (tryCatch.HasCaught())
             return v8::Undefined();
     }
 
 
     bool didThrow = false;
     RefPtr<SerializedScriptValue> message =
         SerializedScriptValue::create(args[0],
                                       &portArray,
@@ skipping 285 matching lines @@
     v8::Handle<v8::Context> context = V8Proxy::context(frame);
     if (context.IsEmpty())
         return v8::Handle<v8::Object>();
 
     v8::Handle<v8::Object> global = context->Global();
     ASSERT(!global.IsEmpty());
     return global;
 }
 
 } // namespace WebCore