ChangeLog   [plain text]


2014-05-30  Dana Burkart  <dburkart@apple.com>

        Supplementary build fix for <rdar://problem/16848509>, borrowed from <rdar://problem/16701806>.

        * WebCore.exp.in:

2014-05-29  Jeffrey Pfau  <jpfau@apple.com>

        Build fix for Mavericks

        * WebCore.exp.in:

2014-05-29  Jeffrey Pfau  <jpfau@apple.com>

        Build fix

        * WebCore.exp.in:

2014-05-27  Jeffrey Pfau  <jpfau@apple.com>

        Workaround for <rdar://problem/16848509>

        Reviewed by David Kilzer.

        * platform/network/mac/ResourceRequestMac.mm:
        (WebCore::ResourceRequest::doUpdatePlatformRequest):

2014-05-27  Lucas Forschler  <lforschler@apple.com>

        Fix for <rdar://problem/17020210>
        Fix by Jon Honeycutt.
        
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::filterNeedsRepaint):

2014-05-23  Lucas Forschler  <lforschler@apple.com>

    Rollout r169219

2014-05-23  Dana Burkart  <dburkart@apple.com>

        Merge r165862

        2014-03-18  Jeffrey Pfau  <jpfau@apple.com>

                Unify <media> element callback registration and unregistration
                https://bugs.webkit.org/show_bug.cgi?id=130417

                Reviewed by Eric Carlson.

                * html/HTMLMediaElement.cpp:
                (WebCore::HTMLMediaElement::HTMLMediaElement):
                (WebCore::HTMLMediaElement::~HTMLMediaElement):
                (WebCore::HTMLMediaElement::registerWithDocument):
                (WebCore::HTMLMediaElement::unregisterWithDocument):
                (WebCore::HTMLMediaElement::didMoveToNewDocument):
                * html/HTMLMediaElement.h:

2014-05-23  Dana Burkart  <dburkart@apple.com>

        Merge r160847

    2013-12-19  Ryosuke Niwa  <rniwa@webkit.org>

            overflowchanged event could cause a crash
            https://bugs.webkit.org/show_bug.cgi?id=125978

            Reviewed by Tim Horton.

            Made the event asynchrnous by re-using Document's event queuing ability. Also removed
            the infrastructure to queue up events in FrameView.

            Test: fast/events/overflowchanged-inside-selection-collapse-crash.html

            * dom/Document.cpp:
            (WebCore::Document::recalcStyle):
            (WebCore::Document::enqueueOverflowEvent):
            * dom/Document.h:
            * page/FrameView.cpp:
            (WebCore::FrameView::FrameView):
            (WebCore::FrameView::~FrameView):
            (WebCore::FrameView::layout):
            (WebCore::FrameView::performPostLayoutTasks):
            (WebCore::FrameView::updateOverflowStatus):
            * page/FrameView.h:
            * rendering/RenderBlock.cpp:
            (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::scrollRectToVisible):
            * rendering/RenderMarquee.cpp:
            (WebCore::RenderMarquee::start):

2014-05-22  Lucas Forschler  <lforschler@apple.com>

        Merge r168915

    2014-05-15  Daniel Bates  <dabates@apple.com>

            SVG element may reference arbitrary DOM element before running its insertion logic
            https://bugs.webkit.org/show_bug.cgi?id=132757
            <rdar://problem/15703817>

            Reviewed by Ryosuke Niwa.

            Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
            inserted in the tree.

            Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
            element B it references (if any). If A is inserted before B and B has the same id as a later element in
            the document then A can find B before B is notified that its been inserted into the document (i.e. before
            Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
            cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
            processed their insertion-specific logic.

            Tests: svg/custom/reparent-animate-element.html
                   svg/custom/reparent-feimage-element.html
                   svg/custom/reparent-mpath-element.html
                   svg/custom/reparent-textpath-element.html
                   svg/custom/reparent-tref-element.html
                   svg/custom/reparent-use-element.html

            * svg/SVGFEImageElement.cpp:
            (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
            we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
            after the subtree we're in is inserted.
            (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
            * svg/SVGFEImageElement.h:
            * svg/SVGMPathElement.cpp:
            (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
            we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
            after the subtree we're in is inserted.
            (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
            * svg/SVGMPathElement.h:
            * svg/SVGTRefElement.cpp:
            (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
            we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
            after the subtree we're in is inserted.
            (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
            * svg/SVGTRefElement.h:
            * svg/SVGTextPathElement.cpp:
            (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
            we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
            after the subtree we're in is inserted.
            (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
            * svg/SVGTextPathElement.h:
            * svg/SVGUseElement.cpp:
            (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
            we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
            inserted.
            (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
            * svg/SVGUseElement.h:
            * svg/animation/SVGSMILElement.cpp:
            (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
            we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
            after the subtree we're in is inserted.
            (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
            * svg/animation/SVGSMILElement.h:

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r169007

    2014-05-17  Maciej Stachowiak  <mjs@apple.com>

            Don't attempt to update id or name for nodes that are already removed
            https://bugs.webkit.org/show_bug.cgi?id=133041

            Reviewed by Sam Weinig.

            Tests: fast/dom/remove-element-with-id-that-was-inserted-on-DOMNodeRemoved.html
                   fast/dom/remove-element-with-name-that-was-inserted-on-DOMNodeRemoved.html

            * dom/Element.cpp:
            (WebCore::Element::removedFrom): Skip updating ids and names for an element not
            in a treescope, as we already do for elements not in a document.

2014-05-22  Lucas Forschler  <lforschler@apple.com>

        Merge r168636

    2014-05-12  Martin Hock  <mhock@apple.com>

            Disallow drag and drop of non-displayable resources.
            https://bugs.webkit.org/show_bug.cgi?id=132745
            <rdar://problem/10562662>

            Reviewed by Alexey Proskuryakov.

            Test: http/tests/security/drag-drop-local-file.html

            * page/DragController.cpp:
            (WebCore::DragController::startDrag):

2014-05-22  Lucas Forschler  <lforschler@apple.com>

        Merge r166741

    2014-04-02  Simon Fraser  <simon.fraser@apple.com>

            Harden FilterOperation type casting
            https://bugs.webkit.org/show_bug.cgi?id=131142

            Reviewed by Sam Weinig.

            DefaultFilterOperation had an error-prone behavior where it set the base class
            OperationType to the type of some other filter class, but overrode isDefault(). 
            This made it very easy to write incorrect code that casted incorrectly based on type().

            Fix by making adding a DEFAULT filter operation type, and storing the represented
            type on DefaultFilterOperation().

            Also remove the OperationType argument for constructors of FilterOperations that
            can only be of one type, to avoid possible mistakes.

            Make the type cast macros a bit more normal, and use them in a few places.

            Fixed PlatformCAFiltersMac to handle the default filter case more cleanly.

            * WebCore.exp.in:
            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::valueForFilter):
            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::createFilterOperations):
            * platform/graphics/ca/PlatformCAFilters.h:
            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
            (PlatformCAFilters::filterValueForOperation):
            (PlatformCAFilters::colorMatrixValueForFilter):
            * platform/graphics/filters/FilterOperation.cpp:
            (WebCore::DefaultFilterOperation::operator==):
            (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
            (WebCore::ReferenceFilterOperation::operator==):
            (WebCore::BlurFilterOperation::operator==):
            (WebCore::BlurFilterOperation::blend):
            (WebCore::DropShadowFilterOperation::operator==):
            (WebCore::DropShadowFilterOperation::blend):
            * platform/graphics/filters/FilterOperation.h:
            (WebCore::FilterOperation::blend):
            (WebCore::FilterOperation::type):
            (WebCore::FilterOperation::isBasicColorMatrixFilterOperation):
            (WebCore::FilterOperation::isBasicComponentTransferFilterOperation):
            (WebCore::FilterOperation::isSameType):
            (WebCore::DefaultFilterOperation::create):
            (WebCore::DefaultFilterOperation::representedType):
            (WebCore::DefaultFilterOperation::DefaultFilterOperation):
            (WebCore::ReferenceFilterOperation::create):
            (WebCore::BlurFilterOperation::create):
            (WebCore::BlurFilterOperation::BlurFilterOperation):
            (WebCore::DropShadowFilterOperation::create):
            (WebCore::DropShadowFilterOperation::DropShadowFilterOperation):
            (WebCore::FilterOperation::isDefault): Deleted.
            * platform/graphics/filters/FilterOperations.cpp:
            (WebCore::FilterOperations::outsets):
            * rendering/FilterEffectRenderer.cpp:
            (WebCore::FilterEffectRenderer::build):
            * rendering/RenderLayerFilterInfo.cpp:
            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r167851

    2014-04-26  Darin Adler  <darin@apple.com>

            Frame and page lifetime fixes in WebCore::createWindow
            https://bugs.webkit.org/show_bug.cgi?id=132089

            Reviewed by Sam Weinig.

            Speculative fix because I was unable to reproduce the crash that was
            reported with the test case attached to this bug.

            * loader/FrameLoader.cpp:
            (WebCore::createWindow): Changed code to remove the assumption that calls
            out will not destroy the page or frame. Use RefPtr for the frame, and
            added early exits if frame->page() becomes null at any point before we
            use a page pointer.

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r168641

    2014-05-09  Jon Honeycutt  <jhoneycutt@apple.com>

            REGRESSION (r167818): editing/inserting/typing-space-to-trigger-smart-link.html fails on WebKit1 bots

            <https://bugs.webkit.org/show_bug.cgi?id=132207>
            <rdar://problem/16730393>

            Reverts the previous workaround in favor of a more specific fix for the
            null dereference.

            Reviewed by Darin Adler.

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
            Check whether the run's start and end are still in the document, as
            removeConflictingInlineStyleFromRun() may have removed them.

            * editing/CompositeEditCommand.cpp:
            (WebCore::CompositeEditCommand::apply):
            Reverted previous workaround.
            (WebCore::ApplyEditCommand::ReentrancyGuard::isRecursiveCall): Deleted.
            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::Scope): Deleted.
            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::~Scope): Deleted.

2014-05-22  Lucas Forschler  <lforschler@apple.com>

        Merge r167635

    2014-04-21  Dan Bernstein  <mitz@apple.com>

            WebCore part of <rdar://problem/16631323> Page::setDefersLoading doesn’t do anything when using the Network process
            https://bugs.webkit.org/show_bug.cgi?id=131939

            Reviewed by David Kilzer.

            * WebCore.exp.in: Exported WebCore::ResourceHandle::setDefersLoading.

            * loader/ResourceLoadScheduler.cpp:
            (WebCore::ResourceLoadScheduler::setDefersLoading): Added a no-op implementation.
            * loader/ResourceLoadScheduler.h: Declared new virtual member function setDefersLoading.

            * loader/ResourceLoader.cpp:
            (WebCore::ResourceLoader::setDefersLoading): Added a call to the above function.

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r167818

    2014-04-23  Jon Honeycutt  <jhoneycutt@apple.com>

            Crash applying editing commands from iframe onload event

            <https://bugs.webkit.org/show_bug.cgi?id=132103>
            <rdar://problem/15696351>

            This patch merges the Chromium bug workaround from
            <http://src.chromium.org/viewvc/blink?revision=162080&view=revision>,
            which prevents reentrancy in CompositeEditCommand::apply().

            Reviewed by Darin Adler.

            Test: editing/apply-style-iframe-crash.html

            * editing/CompositeEditCommand.cpp:
            (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
            (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
            (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
            (WebCore::CompositeEditCommand::apply):
            If this is a recursive call, return early.

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r167264

    2014-04-14  Jer Noble  <jer.noble@apple.com>

            Use after free in WebCore::CachedResourceHandleBase::~CachedResourceHandleBase / WebCore::removeDetachedChildrenInContainer
            https://bugs.webkit.org/show_bug.cgi?id=131169

            Reviewed by Eric Carlson.

            Invalidate the WebCoreAVFResourceLoader owned by MediaPlayerPrivateAVFoundationObjC
            in its destructor, to prevent a private function being called in response to the
            WebCoreAVFResourceLoader being stopped.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC):
            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
            (WebCore::WebCoreAVFResourceLoader::invalidate):

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r166628

    2014-04-13  Darin Adler  <darin@apple.com>

            userVisibleString should not try to "encode" host names
            https://bugs.webkit.org/show_bug.cgi?id=131587
            rdar://problem/14686849

            Reviewed by Alexey Proskuryakov.

            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.

            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
            Objective-C++ header compile in plain C++ files, which we never need to do.
            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
            to the correct type, CFURLComponentType.

            * platform/mac/WebCoreNSURLExtras.mm:
            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
            more lookalike characters from the Mozilla list referenced here.
            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
            (WebCore::dataForURLComponentType): Ditto.
            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
            needed; no encoding here.

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r166628

    2014-04-01  Jon Honeycutt  <jhoneycutt@apple.com>

            Crash in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients

            <https://bugs.webkit.org/show_bug.cgi?id=121887>
            <rdar://problem/15073043>

            Reviewed by Dean Jackson.

            Test: svg/filters/first-letter-crash.html

            * rendering/FilterEffectRenderer.cpp:
            (WebCore::FilterEffectRenderer::buildReferenceFilter):
            Added a null check to prevent crashes for anonymous RenderObjects.

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::filterNeedsRepaint):
            Get the enclosing element, if there is one, and recalculate its style.
            We use the enclosing element so that we recalculate style for the
            ancestor of an anonymous RenderElement.
            (WebCore::RenderLayer::enclosingElement):
            Remove an assertion; we may now reach this condition if loading a
            cached SVG document results in RenderLayer::filterNeedsRepaint() being
            called before the object has been inserted into the render tree.

            * rendering/RenderLayerFilterInfo.cpp:
            (WebCore::RenderLayer::FilterInfo::notifyFinished):
            Tell the RenderLayer that the filter needs repainting.
            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
            Get the Element from the renderer rather than asking the renderer's
            Element, which will be null for anonymous RenderObjects.

            * rendering/RenderLayerFilterInfo.h:
            Removed declaration for the old workaround function, layerElement().

2014-05-22  Dana Burkart  <dburkart@apple.com>

        Merge r165206

    2014-03-05  Jon Honeycutt  <jhoneycutt@apple.com>

            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()

            <https://bugs.webkit.org/show_bug.cgi?id=121887>
            <rdar://problem/15073043>

            Clang appears to be optimizing out a branch in RenderObject::node()
            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
            We'll work around this by factoring out the code in question into a
            separate member function marked NEVER_INLINE.

            No test possible due to <https://bugs.webkit.org/show_bug.cgi?id=129757>.

            Reviewed by David Kilzer.

            * rendering/RenderLayerFilterInfo.cpp:
            (WebCore::RenderLayer::FilterInfo::layerElement):
            Code moved from updateReferenceFilterClients(). Returns the Element*
            for m_layer.
            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
            Use layerElement().

            * rendering/RenderLayerFilterInfo.h:
            Declared layerElement().

2014-05-22  Lucas Forschler  <lforschler@apple.com>

        Merge r164950

    2014-03-02  Dean Jackson  <dino@apple.com>

            Add protected casting to FilterOperation classes.
            https://bugs.webkit.org/show_bug.cgi?id=124062

            Reviewed by Sam Weinig.

            Use the type cast macro generators to produce some toFilterOperation-style
            functions, and then use them in our PlatformCA filter code.

            Test: css3/filters/animation-from-initial-values-with-color-matrix.html

            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm: Use the toFilterOperation methods, in
            some cases removing the unnecessary double cast.
            (PlatformCAFilters::filterValueForOperation):
            (PlatformCAFilters::colorMatrixValueForFilter):
            * platform/graphics/filters/FilterOperation.cpp:
            (WebCore::BasicColorMatrixFilterOperation::blend):
            (WebCore::BasicColorMatrixFilterOperation::operator==): Move this to the .cpp file so it can use the casting methods.
            (WebCore::BasicComponentTransferFilterOperation::blend):
            (WebCore::BasicComponentTransferFilterOperation::operator==): Ditto.
            * platform/graphics/filters/FilterOperation.h: Add the casting macros.

2014-05-22  Lucas Forschler  <lforschler@apple.com>

        Merge r157816

    2013-10-22  Tim Horton  <timothy_horton@apple.com>

            GammaFilterOperation seems to be dead code
            https://bugs.webkit.org/show_bug.cgi?id=123173

            Reviewed by Simon Fraser.

            * platform/graphics/filters/FilterOperation.cpp:
            * platform/graphics/filters/FilterOperation.h:
            Remove dead code.

2014-05-22  Lucas Forschler  <lforschler@apple.com>

        Merge r155315

    2013-09-08  Andreas Kling  <akling@apple.com>

            FrameView::scheduleEvent() is over-engineered.
            <https://webkit.org/b/121004>

            Reviewed by Antti Koivisto.

            Remove gratuitous FrameActionScheduler class that was really only being used
            to defer the occassional "overflowchanged" event until layout had finished.

            * CMakeLists.txt:
            * GNUmakefile.list.am:
            * Target.pri:
            * WebCore.vcxproj/WebCore.vcxproj:
            * WebCore.vcxproj/WebCore.vcxproj.filters:
            * WebCore.xcodeproj/project.pbxproj:
            * page/FrameActionScheduler.cpp:
            * page/FrameActionScheduler.h:

                Removed FrameActionScheduler.

            * page/FrameView.h:
            * page/FrameView.cpp:
            (WebCore::FrameView::FrameView):
            (WebCore::FrameView::~FrameView):
            (WebCore::FrameView::layout):
            (WebCore::FrameView::ScheduledEvent::ScheduledEvent):
            (WebCore::FrameView::scheduleEvent):
            (WebCore::FrameView::pauseScheduledEvents):
            (WebCore::FrameView::resumeScheduledEvents):
            (WebCore::FrameView::performPostLayoutTasks):
            (WebCore::FrameView::updateOverflowStatus):

                Replaced it with a Vector<ScheduledEvent> and a suppression counter.
                A ScheduledEvent is just a { Node, Event } pair.

2014-05-19  Lucas Forschler  <lforschler@apple.com>

        erge r169098

    2013-09-19  Bear Travis  <betravis@adobe.com>

            CSS_SHAPES not supported on AppleWin port
            https://bugs.webkit.org/show_bug.cgi?id=118810

            Reviewed by Brent Fulgham.

            Enabling fast/shapes on windows.

            * WebCore.vcxproj/WebCore.vcxproj: Add missing shape includes.
            * WebCore.vcxproj/WebCoreCommon.props: Include shapes source folder.
            * WebCore.vcxproj/copyForwardingHeaders.cmd: Copy shapes headers.
            * css/CSSPropertyNames.in: Tweak to ensure shapes properties are regenerated.

2014-05-08  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r168034.

2014-05-07  Lucas Forschler  <lforschler@apple.com>

    Rollout r168104

2014-05-05  Andy Estes  <aestes@apple.com>

        Fix the Mountain Lion build.

        Some versions of Clang on Mountain Lion do not set __cplusplus to 201103L when compiling with -std=gnu++11,
        which causes CF_ENUMs to be weakly-typed. Detect this case and export the correct symbols.

        On Lion, CFURLComponentType is not defined using CF_ENUM, so it will always be a weakly-typed enum.

        * WebCore.exp.in:

2014-05-03  Babak Shafiei  <bshafiei@apple.com>

        Follow-up fix for the merge of r167480.
        
        Rubber stamped by Tim Horton.

        * platform/KURL.cpp:
        (WebCore::KURL::host): Return empty string instead of null string.

2014-05-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r166420.

    2014-03-28  Myles C. Maxfield  <mmaxfield@apple.com>
    
            Clear SVGInlineTextBox fragments when the text changes.
            https://bugs.webkit.org/show_bug.cgi?id=130879
    
            Reviewed by Darin Adler.
    
            Ported from Blink: https://src.chromium.org/viewvc/blink?revision=150456&view=revision
    
            This patch modifies SVGInlineTextBox::dirtyLineBoxes to clear all
            following text boxes when invoked. Typically this method is called
            when the underlying text string changes, and that change needs to
            be propagated to all the boxes that use the text beyond the point
            where the text is first modified.
            
            Also cleans up final function keywords for SVGRootInlineBox.
    
            Test: svg/custom/unicode-in-tspan-multi-svg-crash.html
    
            * rendering/InlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
            (WebCore::InlineTextBox::dirtyOwnLineBoxes): Calls dirtyLineBoxes()
            * rendering/svg/SVGInlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes):
            * rendering/svg/SVGInlineTextBox.cpp:
            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes): Non-recursive part of dirtyLineBoxes()
            (WebCore::SVGInlineTextBox::dirtyLineBoxes): Calls dirtyOwnLineBoxes() in a loop
            * rendering/svg/SVGRootInlineBox.h:
    
2014-05-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165053.

    2014-03-03  David Kilzer  <ddkilzer@apple.com>
    
            SVGPropertyTearOffs should detachChildren before deleting its value.
            <http://webkit.org/b/129618>
            <rdar://problem/15661617>
    
            Reviewed by Maciej Stachowiak.
    
            Merged from Blink (patch by kouhei@chromium.org):
            https://src.chromium.org/viewvc/blink?revision=158563&view=revision
            http://crbug.com/296276
    
            Test: svg/transforms/svg-matrix-tearoff-crash.html
    
            NOTE: The test does not reproduce a crash on WebKit using
            JavaScriptCore.
    
            * svg/properties/SVGPropertyTearOff.h:
            (WebCore::SVGPropertyTearOff::setValue):
            (WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
            - Call detachChildren() if m_value is a copy.  The original
              Blink patch did not modify the destructor code path, although
              that seems obvious via code inspection.
    
2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r164917.

    2014-03-01  David Kilzer  <ddkilzer@apple.com>
    
            Fix lifetime handling of SVGPropertyTearOffs
            <http://webkit.org/b/129211>
            <rdar://problem/15696025>
    
            Reviewed by Maciej Stachowiak.
    
            Merged from Blink (patch by Ojan Vafai):
            https://src.chromium.org/viewvc/blink?revision=157801&view=revision
            http://crbug.com/288771
    
                -Replace SVGStaticPropertyWithParentTearOff with SVGMatrixTearOff
                since it's only used in that one place. This means we can get rid
                of the templatizing and the method pointer.
                -Change SVGPropertyTearOff to keep track of it's child tearoffs
                and call detachWrapper on its child tearoffs when it's destroyed
                or when it's wrapper is detached.
                -Have SVGPropertyTearOff hold WeakPtrs to the child tearoffs
                to avoid having a cycle.
    
            Test: svg/transforms/svg-matrix-tearoff-crash.html
    
            * GNUmakefile.list.am:
            * WebCore.vcxproj/WebCore.vcxproj:
            * WebCore.vcxproj/WebCore.vcxproj.filters:
            * WebCore.xcodeproj/project.pbxproj:
            * bindings/scripts/CodeGeneratorJS.pm:
            (NativeToJSValue):
            * svg/properties/SVGMatrixTearOff.h: Renamed from Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h.
            (WebCore::SVGMatrixTearOff::create):
            (WebCore::SVGMatrixTearOff::commitChange):
            (WebCore::SVGMatrixTearOff::SVGMatrixTearOff):
            * svg/properties/SVGPropertyTearOff.h:
            (WebCore::SVGPropertyTearOff::addChild):
            (WebCore::SVGPropertyTearOff::detachChildren):
    
2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r167295.

    2014-04-14  Jon Honeycutt  <jhoneycutt@apple.com>
    
            Assertion failure under FEImage::determineAbsolutePaintRect()
    
            <https://bugs.webkit.org/show_bug.cgi?id=131660>
            <rdar://problem/15669294>
    
            This patch merges Chromium r149536 (see
            <https://chromiumcodereview.appspot.com/14701012>), which moves
            m_absoluteTransform out of SVGFilter and into the base Filter class, so
            that it isn't necessary to cast a Filter to SVGFilter to get the
            absolute transform.
    
            Reviewed by Geoffrey Garen.
    
            Test: svg/filters/feImage-filter-assertion.html
    
            * platform/graphics/filters/Filter.h:
            (WebCore::Filter::Filter):
            Changed to take the absolute transform.
            (WebCore::Filter::absoluteTransform):
            Moved from SVGFilter.
            (WebCore::Filter::mapAbsolutePointToLocalPoint):
            Ditto.
    
            * rendering/FilterEffectRenderer.cpp:
            (WebCore::FilterEffectRenderer::FilterEffectRenderer):
            Pass a default AffineTransform() to the Filter base class.
    
            * svg/graphics/filters/SVGFEImage.cpp:
            (WebCore::FEImage::determineAbsolutePaintRect):
            Use the Filter without casting it to SVGFilter.
            (WebCore::FEImage::platformApplySoftware):
            Ditto.
    
            * svg/graphics/filters/SVGFilter.cpp:
            (WebCore::SVGFilter::SVGFilter):
            Pass the transform to the base class, and remove initialization of a
            removed member var.
    
            * svg/graphics/filters/SVGFilter.h:
            Member var moved to Filter.h.
    
2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r166736.

    2014-04-03  David Hyatt  <hyatt@apple.com>
    
            Continuations casting issue.
            https://bugs.webkit.org/show_bug.cgi?id=130057
            <rdar://problem/16283406>
    
            Reviewed by Simon Fraser.
    
            The code to update relative positioned anonymous block continuations should not
            have assumed that all siblings were RenderBlocks. Make the code smarter and
            make it bail when it hits something that isn't part of the block continuation
            chain.
    
            Added fast/block/continuation-crash.html
    
            * rendering/RenderInline.cpp:
            (WebCore::updateStyleOfAnonymousBlockContinuations):
    
2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r167480.

    2014-04-17  Darin Adler  <darin@apple.com>
    
            origin spoofing possible (HTTP Origin, postMessage event.origin) due to inappropriate URL escape sequence decoding
            https://bugs.webkit.org/show_bug.cgi?id=131837
            rdar://problem/15211936
    
            Reviewed by Anders Carlsson and Dave Hyatt.
    
            Tests: fast/dom/DOMURL/parsing.html
                   fast/dom/HTMLAnchorElement/anchor-element-href-parsing.html
    
            * platform/URL.cpp:
            (WebCore::URL::host): Removed unnecessary call to decodeURLEscapeSequences, which caused
            problems and was not needed.
    
2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r167524.

    2014-04-18  Jon Honeycutt  <jhoneycutt@apple.com>
    
            Harden RenderInline::inlineElementContinuation()
    
            <https://bugs.webkit.org/show_bug.cgi?id=131858>
    
            Reviewed by Sam Weinig.
    
            No new tests, as there are no known cases of this happening.
    
            * rendering/RenderInline.cpp:
            (WebCore::RenderInline::inlineElementContinuation):
            Return nullptr if the continuation is neither a RenderInline nor a
            RenderBlock.
    
2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r167672.

    2014-04-22  Brent Fulgham  <bfulgham@apple.com>
    
            Check (rather than assume) element is a RenderTableSection before using it
            https://bugs.webkit.org/show_bug.cgi?id=121858
    
            Reviewed by David Kilzer.
    
            Test: fast/table/table-insert-object-before-td-crash.html
    
            * rendering/RenderTable.cpp:
            (WebCore::RenderTable::addChild): Check that lastBox is a table section before
            using the node as if it was one.
    
2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r167569 (committing on behalf of Dana Burkart.)

    2014-04-19  Alexey Proskuryakov  <ap@apple.com>

            Crashes in HTMLFormElement::submit.
            https://bugs.webkit.org/show_bug.cgi?id=131910
            <rdar://problem/15661790>

            Based on a patch by Kent Tamura.

            Reviewed by Anders Carlsson.

            Tests: fast/forms/form-submission-crash-2.html
                  fast/forms/form-submission-crash.html

            Code that executes arbitrary JS needs to protect objects that it uses afterwards.

            * html/HTMLFormElement.cpp:
            (WebCore::HTMLFormElement::prepareForSubmission):
            (WebCore::HTMLFormElement::submit):
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::submitForm):

2014-05-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r166650.

    2014-04-02  David Kilzer  <ddkilzer@apple.com>
    
            Use outermost containing isolate when constructing bidi runs
            <http://webkit.org/b/131107>
            <rdar://problem/15690021>
    
            Reviewed by Darin Adler.
    
            Merged from Blink (patch by jww@chromium.org):
            https://src.chromium.org/viewvc/blink?revision=157268&view=revision
            http://crbug.com/279277
    
                Update containingIsolate to go back all the way to top
                isolate from current root, rather than stopping at the first
                isolate it finds. This works because the current root is
                always updated with each isolate run.
    
            Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
                   fast/text/international/unicode-bidi-isolate-nested-with-removes.html
    
            * rendering/InlineIterator.h:
            (WebCore::highestContainingIsolateWithinRoot):
            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::constructBidiRunsForSegment):
    
2014-04-30  Lucas Forschler  <lforschler@apple.com>

    Rollout r168020.
    This causes build failures on Lion/ML.  

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r166049

    2014-03-21  Andreas Kling  <akling@apple.com>

            HTMLFrameOwnerElement should obey the SubframeLoadingDisabler when creating subframes
            <rdar://problem/15675780>

            Merge Blink r156744 by Adam Klein.

            Test: fast/frames/set-iframe-src-in-pagehide-crash.html

            * loader/SubframeLoader.cpp:
            (WebCore::SubframeLoader::loadSubframe):

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r167278

    2014-04-14  Jon Honeycutt  <jhoneycutt@apple.com>

            Assertion failure !node || node->isElementNode() in
            WebCore::RenderBlock::inlineElementContinuation

            https://bugs.webkit.org/show_bug.cgi?id=108829
            <rdar://problem/13666405>

            I can't reproduce this assertion failure, but there seems to be an
            invalid assumption in RenderBlock::inlineElementContinuation() that
            anything with the "isInline()" bit set is a RenderInline.

            No new test because the test case in the bug does not repro for me.

            Reviewed by Brent Fulgham.

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::inlineElementContinuation):
            Dave Hyatt says that this function should only return RenderInline
            objects (not non-RenderInline inline objects), so update the checks
            from isInline() to isRenderInline() before casting with
            toRenderInline().

            * rendering/RenderInline.cpp:
            (WebCore::RenderInline::inlineElementContinuation):
            Ditto.

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r167211

    2014-04-13  Darin Adler  <darin@apple.com>

            userVisibleString should not try to "encode" host names
            https://bugs.webkit.org/show_bug.cgi?id=131587
            rdar://problem/14686849

            Reviewed by Alexey Proskuryakov.

            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.

            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
            Objective-C++ header compile in plain C++ files, which we never need to do.
            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
            to the correct type, CFURLComponentType.

            * platform/mac/WebCoreNSURLExtras.mm:
            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
            more lookalike characters from the Mozilla list referenced here.
            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
            (WebCore::dataForURLComponentType): Ditto.
            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
            needed; no encoding here.

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r167167

    2014-04-11  Jon Honeycutt  <jhoneycutt@apple.com>

            Assertion failure changing select element size during focus event
            dispatch
            <https://bugs.webkit.org/show_bug.cgi?id=131566>
            <rdar://problem/16400735>

            Reviewed by Andy Estes.

            Test: fast/forms/select-change-size-during-focus.html

            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
            Adopt the fix from Chromium r171216; check that the renderer is still
            of the expected type, and return early if it is not.

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r167135

    2014-04-10  Chris Fleizach  <cfleizach@apple.com>

            Heap-use-after-free in WebCore::SpeechSynthesisUtterance::startTime
            https://bugs.webkit.org/show_bug.cgi?id=131482

            Reviewed by David Kilzer.

            Hold onto the utterance until it has time to fire, in case other references have been removed.

            Merged from Blink r171077 by <dmazzoni@chromium.org>

            Test: platform/mac/fast/speechsynthesis/speech-synthesis-gc-utterance-crash.html

            * Modules/speech/SpeechSynthesis.cpp:
            (WebCore::SpeechSynthesis::handleSpeakingCompleted):

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r167093

    2014-04-08  Jon Honeycutt  <jhoneycutt@apple.com>

            Assertion failure in WebCore::FlexBoxIterator::next()
            <https://bugs.webkit.org/show_bug.cgi?id=117176>
            <rdar://problem/14054549>

            Code added in r115687 began removing anonymous wrappers when children
            become inline. However, there are some objects, like
            RenderDeprecatedFlexBox, whose children should always be blocks.

            Reviewed by Tim Horton.

            * rendering/RenderBlock.h:
            (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
            Made public.

            * rendering/RenderObject.cpp:
            (WebCore::RenderObject::removeAnonymousWrappersForInlinesIfNecessary):
            Return early if we can't collapse anonymous block children.

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r167092

    2014-04-07  Jon Honeycutt  <jhoneycutt@apple.com>

            Assertion failure, !node || node->isElementNode(), in
            WebCore::RenderBlock::clone()
            <https://bugs.webkit.org/show_bug.cgi?id=110489>
            <rdar://problem/13666425>

            Reviewed by Antti Koivisto.

            We're ending up in RenderBlock::splitBlocks() with |this| ==
            |fromBlock|.  We then try to climb the ancestor block chain from
            this->parent() to |fromBlock|, but this->parent() is already above
            |fromBlock|, so we end up climbing up to the RenderView and trying to
            clone it, causing the assertion failure.

            Adopt Chromium's mitigation for this from
            <https://codereview.chromium.org/13852041>. This is not intended as a
            fix for the underlying issue.

            Also, fix another issue that occurs with this fuzzed test case that's
            not handled by the Chromium fix.

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::splitBlocks):
            Ensure while we're in the loop that |curr| is a descendant of
            |fromBlock|. From the Chromium patch:

                We need to check in every iteration of the loop because
                moveChildrenTo could have moved |curr|. This is a mitigation and
                not really a fix against a class of tree craziness.

            Finally, before moving children from |fromBlock| to |toBlock|, ensure
            that the children are children of |fromBlock|. If we never entered the
            loop, they will be siblings of |fromBlock|, not children.

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r166601

    2014-04-01  Daniel Bates  <dabates@apple.com>

            RenderQuote must destroy remaining text renderer before first letter renderer
            https://bugs.webkit.org/show_bug.cgi?id=78023
            <rdar://problem/10830009>

            Reviewed by Brent Fulgham.

            Merged from Blink (patch by Abhishek Arya):
            https://src.chromium.org/viewvc/blink?view=rev&revision=151270

            Following the fix for <https://bugs.webkit.org/show_bug.cgi?id=114586>, a
            RenderQuote may have child render objects for the first letter of its text
            and everything following the first letter so as to support the CSS first-
            letter property. The latter renderer is responsible for destroying the former
            on destruction. It's sufficient to reverse the destruction of the children of
            RenderQuote to ensure that we destroy the remaining text renderer before we
            destroy the first letter renderer.

            Test: fast/css-generated-content/quote-first-letter-crash.html

            * rendering/RenderQuote.cpp:
            (WebCore::RenderQuote::updateText):

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r166457

    2014-03-29  David Kilzer  <ddkilzer@apple.com>

            Preserve selection end positions in directionOfSelection
            <http://webkit.org/b/104813>
            <rdar://problem/13666417>

            Reviewed by Brent Fulgham.

            Merged from Blink (patch by kenrb@chromium.org):
            https://src.chromium.org/viewvc/blink?revision=150621&view=revision
            http://crbug.com/164263

                VisibleSelection::visibleStart() and VisibleSelection::visibleEnd()
                can both cause layouts, which has the potential to invalidate any
                rendertree-based objects. This was causing a problem in
                FrameSelection::directionOfSelection(), where a reference to a
                lineBox was being held across a call to visibleEnd().

                This patch ensures that the any layout is completed before linebox
                references are retrieved.

            Test: editing/selection/layout-during-move-selection-crash.html

            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::directionOfSelection):

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r166428

    2014-03-28  Radu Stavila  <stavila@adobe.com>

            In some situations, partial layouts of floating elements produce incorrect results.
            https://bugs.webkit.org/show_bug.cgi?id=122668

            Reviewed by David Hyatt.

            When performing partial layout of float elements and checking if other float
            elements are encountered, incorrect results were obtained by not checking
            the size of the existing floats vector.

            Test: fast/block/float/floats-in-clean-line-crash.html

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlockFlow::checkFloatsInCleanLine):

2014-04-30  Lucas Forschler  <lforschler@apple.com>

        Merge r166236

    2014-03-25  David Kilzer  <ddkilzer@apple.com>

            Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
            <http://webkit.org/b/130713>
            <rdar://problem/15661876>

            Reviewed by Darin Adler.

            Merged from Blink (patch by Ian Beer):
            http://crbug.com/303657
            https://src.chromium.org/viewvc/blink?view=rev&revision=158938

            Test: fast/forms/form-submission-crash-successful-submit-button.html

            * html/HTMLFormElement.cpp:
            (WebCore::HTMLFormElement::submit):

2014-03-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r160010.

    2013-12-03  László Langó  <lango@inf.u-szeged.hu>

            ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
            https://bugs.webkit.org/show_bug.cgi?id=125146

            Reviewed by Darin Adler.

            Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
            An implicit y-value can become explicit if specified as a separate longhand.
            At the same time, its new value can be non-primitive.

            Backported from Blink:
            http://src.chromium.org/viewvc/blink?view=rev&rev=153678

            Test: fast/css/webkit-mask-crash-implicit.html

            * css/StyleProperties.cpp:
            (WebCore::StyleProperties::getLayeredShorthandValue):

2014-03-26  Matthew Hanson  <matthew_hanson@apple.com>

        Remove extraneous ! from merge of r166304.

2014-03-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r166304.

    2014-03-26  Jer Noble  <jer.noble@apple.com>

            REGRESSION(r162679): Poster image visible under the video
            https://bugs.webkit.org/show_bug.cgi?id=130783

            Reviewed by Simon Fraser.

            In the listed revision, we started checking for isRenderImage()
            instead of isImage(). RenderMedias return 'true' for the first
            but 'false' for the second. Change the if() statement to check
            for isRenderMedia() in addition to !isRenderImage().

            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):

2014-03-24  Matthew Hanson  <matthew_hanson@apple.com>

        Remove a commented line of code introduced by r166104.

        Reviewed by Babak Shafiei.

        A line was commented out when it should have been deleted. This patch
        corrects that oversight.

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::location):

2014-03-22  Matthew Hanson  <matthew_hanson@apple.com>

        Finish merge of r160065. The changes from Source/WebCore/rendering/RenderView.cpp were incorrectly
        omitted from the original merge in r165142.

    2013-12-03  Ryosuke Niwa  <rniwa@webkit.org>
    
            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
            https://bugs.webkit.org/show_bug.cgi?id=125207
    
            Reviewed by Simon Fraser.
            
            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440
    
            Update style in FrameSelection instead of RenderView's member functions. These are the last two
            member functions of RenderView that updates the style.
    
            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::focusedOrActiveStateChanged):
            (WebCore::FrameSelection::bounds):
            * rendering/RenderView.cpp:
            (WebCore::RenderView::selectionBounds):
            (WebCore::RenderView::repaintSelection):
    
2014-03-21  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r166090.

    2014-03-21  Oliver Hunt  <oliver@apple.com>
    
            Fix a crash when assigning an object to document.location
            https://bugs.webkit.org/show_bug.cgi?id=130213
    
            Reviewed by Geoffrey Garen.
    
            Convert location to string before we make use the document.
            This prevents us from attempting to navigate a frame that
            has already been removed.
    
            Test: fast/dom/navigation-with-sideeffects-crash.html
    
            * bindings/js/JSDocumentCustom.cpp:
            (WebCore::JSDocument::location):
            (WebCore::JSDocument::setLocation):
    
2014-03-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165821.

    2014-03-18  Antti Koivisto  <antti@apple.com>
    
            Mutating rules returned by getMatchedCSSRules can result in crash
            https://bugs.webkit.org/show_bug.cgi?id=130209
    
            Reviewed by Andreas Kling.
            
            The non-standard getMatchedCSSRules API returns CSSStyleRule objects that don't
            have parent stylesheet pointer (as we don't know which sheet the rule originated from).
            Mutating the rule via such wrapper can lead to crashes later as we fail to invalidate
            the underlying stylesheet.
            
            Fix by disallowing mutation of style rules that don't have parent sheet pointer. CSSStyleRule
            has two mutable properties selectorText and style. The latter gives back CSSStyleDeclaration.
            This patch disallows mutations in both cases for CSSStyleRules that don't have parent stylesheet
            pointer.
            
            While it is technically possible to have CSSRules that are legitimately disconnected
            from stylesheet (by removing rule from sheet while holding a reference to it) it never
            makes sense to mutate such rule as there is no way to do anything with it afterwards.
    
            Tests: fast/css/getMatchedCSSProperties-rule-mutation.html
                   fast/css/getMatchedCSSRules-crash.html
    
            * css/CSSStyleRule.cpp:
            (WebCore::CSSStyleRule::setSelectorText):
    
                Bail out if parent stylesheet is null.
    
            * css/PropertySetCSSStyleDeclaration.cpp:
            (WebCore::PropertySetCSSStyleDeclaration::setCssText):
            (WebCore::PropertySetCSSStyleDeclaration::setProperty):
            (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
            (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
            
                Allow StyleRuleCSSStyleDeclaration subclass cancel the mutation via
                boolean return value from willMutate.
    
            (WebCore::StyleRuleCSSStyleDeclaration::willMutate):
            
                Disallow mutation if the owning CSSStyleRule is null or has null stylesheet.
    
            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
            
                We never get here with null rule or stylesheet anymore.
    
            * css/PropertySetCSSStyleDeclaration.h:
            (WebCore::PropertySetCSSStyleDeclaration::willMutate):
    
2014-03-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165921.

    2014-03-19  Antti Koivisto  <antti@apple.com>
    
            Crash with long selector list
            https://bugs.webkit.org/show_bug.cgi?id=123006
    
            Reviewed by Andreas Kling.
    
            Test: fast/css/long-selector-list-crash.html
    
            * css/CSSSelectorList.cpp:
            (WebCore::CSSSelectorList::CSSSelectorList):
            (WebCore::CSSSelectorList::adoptSelectorVector):
            (WebCore::CSSSelectorList::operator=):
            * css/StyleRule.cpp:
            (WebCore::StyleRule::create):
    
                Add a bunch of asserts.
    
            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
            
                This could produce a zero-length selector list.
    
2014-03-18  Jer Noble  <jer.noble@apple.com>

        Unreviewed Win64 build fix; explicit operators are not valid in VS2010.

        With the 'explicit bool' operator removed, just test weakThis.get() explicitly.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):

2014-03-18  Jer Noble  <jer.noble@apple.com>

        Merge r165478.

    2014-03-12  Jer Noble  <jer.noble@apple.com>

            [Mac] Crash when running media/fallback.html test in MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification()
            https://bugs.webkit.org/show_bug.cgi?id=130136

            Reviewed by Eric Carlson.

            MediaPlayerPrivateAVFoundation is trying to lock its m_queueMutex from an async thread after
            while being destroyed in the main thread. To resolve this race condition, redispatch from
            the async thread to the main thread, and use a WeakPtr to determine whether the object has
            been destroyed or not.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):

2014-03-18  Matthew Hanson  <matthew_hanson@apple.com>

        Follow-up fix for the merge of r163579.

    2014-03-17  Jeffrey Pfau  <jpfau@apple.com>

            Merge parts from Blink CLs 169865acce3b6bc85ac1adf07b2798aaf9aad67a and 04f613e7f0c35f444d5a9bd42da55c69df65cf64 that weren't merged to trunk
            <rdar://problem/16307742>

            Unreviewed Layout Test fix.

            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::insert):
            (WebCore::executeInsertTask):
            (WebCore::executeReparentTask):
            (WebCore::executeInsertAlreadyParsedChildTask):

2014-03-17  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165753.

    2014-03-16  Brent Fulgham  <bfulgham@apple.com>
    
            Provide preference to enable additional AVFoundation options
            https://bugs.webkit.org/show_bug.cgi?id=130275
    
            Reviewed by Eric Carlson.
    
            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::doesHaveAttribute): Added.
            * html/HTMLMediaElement.h:
            * page/Settings.in: Add new attribute.
            * platform/graphics/MediaPlayer.cpp:
            (WebCore::MediaPlayer::doesHaveAttribute): Added stub to call private player object's
            implementation of doesHaveAttribute.
            * platform/graphics/MediaPlayer.h:
            (WebCore::MediaPlayerClient::doesHaveAttribute):
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::MediaPlayerPrivateAVFoundationCF::AVFWrapper::createAssetForURL): Check the <media> object,
            and notify AVFoundationCF to use URI option if relevant.
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Check the <media> object,
            and notify AVFoundation to use URI option if relevant.
    
2014-03-17  Joseph Pecoraro  <pecoraro@apple.com>

        Merge r165583.

    2014-03-13  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Network.loadResource should include the response status code
            https://bugs.webkit.org/show_bug.cgi?id=130216

            Reviewed by Timothy Hatcher.

            * inspector/InspectorResourceAgent.cpp:
            Record and send the http status code.

            * inspector/protocol/Network.json:
            Include status code property in the success callback.

2014-03-17  Joseph Pecoraro  <pecoraro@apple.com>

        Merge r165582.

    2014-03-13  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Network.loadResource XHR crash if page reloaded while request is ongoing
            https://bugs.webkit.org/show_bug.cgi?id=130211

            Reviewed by Timothy Hatcher.

            Merged from Blink with changes, (patch by vsevik@chromium.org):
            http://src.chromium.org/viewvc/blink?view=revision&revision=152712

            Using an XMLHttpRequest to download resources had a few issues. Being an
            Active DOM Object the load could be paused. Without an extra retain,
            when the load was cancelled (e.g. a page reload) the XHR would get
            destructed and could cause a crash if the list of active DOM objects
            was actively being iterated.

            Switch to a DocumentThreadableLoader to manage the load ourselves.
            This still uses the Memory cache, but we have a little more control.

            * inspector/InspectorResourceAgent.h:
            * inspector/InspectorResourceAgent.cpp:
            (WebCore::InspectorResourceAgent::InspectorResourceAgent):
            (WebCore::InspectorResourceAgent::loadResource):
            Switch from XHR to DocumentThreadableLoader.

            * xml/XMLHttpRequest.h:
            * xml/XMLHttpRequest.cpp:
            (WebCore::XMLHttpRequest::XMLHttpRequest):
            (WebCore::XMLHttpRequest::createRequest):
            (WebCore::XMLHttpRequest::sendForInspector):
            Remove the now unnecessary XHR sendForInspector path.

2014-03-17  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165548.

    2014-03-13  Andreas Kling  <akling@apple.com>
    
            Don't send synchronous resize events when FrameView has auto-sizing enabled.
            <https://webkit.org/b/130198>
            <rdar://problem/15991333>
    
            Reviewed by Dan Bernstein.
    
            * page/FrameView.cpp:
            (WebCore::FrameView::sendResizeEventIfNeeded):
    
2014-03-17  Matthew Hanson  <matthew_hanson@apple.com>

        Reverse merge r165286.

    2014-03-07  Matthew Hanson  <matthew_hanson@apple.com>

            Merge r165206.

        2014-03-05  Jon Honeycutt  <jhoneycutt@apple.com>

                Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()

                <https://bugs.webkit.org/show_bug.cgi?id=121887>
                <rdar://problem/15073043>

                Clang appears to be optimizing out a branch in RenderObject::node()
                when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
                We'll work around this by factoring out the code in question into a
                separate member function marked NEVER_INLINE.

                No test possible due to <https://bugs.webkit.org/show_bug.cgi?id=129757>.

                Reviewed by David Kilzer.

                * rendering/RenderLayerFilterInfo.cpp:
                (WebCore::RenderLayer::FilterInfo::layerElement):
                Code moved from updateReferenceFilterClients(). Returns the Element*
                for m_layer.
                (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
                Use layerElement().

                * rendering/RenderLayerFilterInfo.h:
                Declared layerElement().

2014-03-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165331.

    2014-03-10  Timothy Hatcher  <timothy@apple.com>

            Load source maps and their resources asynchronously.

            https://bugs.webkit.org/show_bug.cgi?id=112071

            Reviewed by Joseph Pecoraro.

            * inspector/InspectorPageAgent.cpp:
            (WebCore::InspectorPageAgent::buildObjectForFrameTree):
            Honor the hiddenFromInspector flag.

            * inspector/InspectorResourceAgent.cpp:
            (WebCore::InspectorResourceAgent::willSendRequest):
            (WebCore::InspectorResourceAgent::markResourceAsCached):
            (WebCore::InspectorResourceAgent::didReceiveResponse):
            (WebCore::InspectorResourceAgent::didReceiveData):
            (WebCore::InspectorResourceAgent::didFinishLoading):
            (WebCore::InspectorResourceAgent::didFailLoading):
            (WebCore::InspectorResourceAgent::replayXHR):
            (WebCore::InspectorResourceAgent::loadResource):
            * inspector/InspectorResourceAgent.h:
            Honor the hiddenFromInspector flag by keeping track of
            hidden identifiers in a HashSet.

            * inspector/protocol/Network.json:
            (Network.loadResource): Added.

            * platform/network/ResourceRequestBase.h:
            (WebCore::ResourceRequestBase::hiddenFromInspector): Added.
            (WebCore::ResourceRequestBase::setHiddenFromInspector): Added.
            (WebCore::ResourceRequestBase::ResourceRequestBase):
            Add a flag to hide the request from the Inspector.

            * xml/XMLHttpRequest.cpp:
            (WebCore::XMLHttpRequest::XMLHttpRequest):
            (WebCore::XMLHttpRequest::sendForInspector): Added.
            (WebCore::XMLHttpRequest::sendForInspectorXHRReplay): Renamed.
            (WebCore::XMLHttpRequest::createRequest):
            * xml/XMLHttpRequest.h:
            Make Inspector loads allow cross-origins and hide their request
            from the Inspector itself.

2014-03-10  Brent Fulgham  <bfulgham@apple.com>

        [Win] Build fix after r165379.

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::SerializedScriptValue): Revert to older-style C++ iteration
        for Windows compatibility. This can be reverted when we use VS2013 on this branch.

2014-03-07  Myles C. Maxfield  <mmaxfield@apple.com>

        Merge r162972 and r163007.

    2014-03-07  Myles C. Maxfield  <mmaxfield@apple.com>

            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
            https://bugs.webkit.org/show_bug.cgi?id=114586

            Reviewed by Dave Hyatt.

            Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8

            If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
            Instead, we should make it a subclass of RenderElement, so that it can be split properly.

            Test: fast/css-generated-content/quote-first-letter.html

            * dom/PseudoElement.cpp:
            (WebCore::PseudoElement::didRecalcStyle):
            * rendering/RenderQuote.cpp:
            (WebCore::RenderQuote::RenderQuote):
            (WebCore::RenderQuote::willBeDestroyed):
            (WebCore::RenderQuote::willBeRemovedFromTree):
            (WebCore::RenderQuote::styleDidChange):
            (WebCore::RenderQuote::updateText):
            (WebCore::RenderQuote::computeText):
            (WebCore::RenderQuote::updateDepth):
            * rendering/RenderQuote.h:
            * rendering/style/ContentData.cpp:
            (WebCore::QuoteContentData::createContentRenderer):

2014-03-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165339.

    2014-03-08  Oliver Hunt  <oliver@apple.com>

            SerializedScriptValue may move Identifiers between worlds
            https://bugs.webkit.org/show_bug.cgi?id=129979

            Reviewed by Andreas Kling.

            Test: fast/workers/worker-copy-shared-blob-url.html

            Don't use Strings to store blob URLs as String's may be Identifiers
            and they can only exist in one world/thread at a time.

            * Modules/indexeddb/IDBObjectStore.cpp:
            (WebCore::IDBObjectStore::put):
            * bindings/js/SerializedScriptValue.cpp:
            (WebCore::CloneDeserializer::deserializeString):
            (WebCore::SerializedScriptValue::addBlobURL):
            (WebCore::SerializedScriptValue::SerializedScriptValue):
            * bindings/js/SerializedScriptValue.h:

2014-03-07  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165138.

    2014-03-05  David Kilzer  <ddkilzer@apple.com>

            Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
            <http://webkit.org/b/129751>
            <rdar://problem/16237965>

            Reviewed by Jon Honeycutt.

            Merged from Blink (patch by Yuta Kitamura):
            https://src.chromium.org/viewvc/blink?revision=168160&view=revision
            http://crbug.com/345005

                The root cause is CompositeEditCommand::moveParagraphWithClones() passing
                two positions |start| and |end| which do not follow the document order,
                i.e. in some situations |start| is located after |end| because of
                the difference in affinity.

                This patch fixes this crash by normalizing |end| to |start| in such situations.
                It also adds an ASSERT that checks the relationship between |start| and |end|.

            Test: editing/execCommand/format-block-crash.html

            * editing/CompositeEditCommand.cpp:
            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
            (WebCore::CompositeEditCommand::moveParagraphWithClones):
            * editing/CompositeEditCommand.h:

2014-03-07  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r164876.

    2014-02-28  Bem Jones-Bey  <bjonesbe@adobe.com>

            Properly clear m_logicallyLastRun to remove use-after-free possibility
            https://bugs.webkit.org/show_bug.cgi?id=129489

            Reviewed by David Hyatt.

            A use-after-free issue was caught in Blink because m_logicallyLastRun
            is not cleared when the item it points to is deleted. Clearing it
            turns the use-after-free into a segfault, and prevents any future
            use-after-frees from happening.

            * platform/text/BidiRunList.h:
            (WebCore::BidiRunList<Run>::deleteRuns):

2014-03-07  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165206.

    2014-03-05  Jon Honeycutt  <jhoneycutt@apple.com>

            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()

            <https://bugs.webkit.org/show_bug.cgi?id=121887>
            <rdar://problem/15073043>

            Clang appears to be optimizing out a branch in RenderObject::node()
            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
            We'll work around this by factoring out the code in question into a
            separate member function marked NEVER_INLINE.

            No test possible due to <https://bugs.webkit.org/show_bug.cgi?id=129757>.

            Reviewed by David Kilzer.

            * rendering/RenderLayerFilterInfo.cpp:
            (WebCore::RenderLayer::FilterInfo::layerElement):
            Code moved from updateReferenceFilterClients(). Returns the Element*
            for m_layer.
            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
            Use layerElement().

            * rendering/RenderLayerFilterInfo.h:
            Declared layerElement().

2014-03-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r164249.

    2014-02-17  Chris Fleizach  <cfleizach@apple.com>

            AX: Invalid cast in WebCore::AccessibilityTable::isDataTable (CRBug 280352)
            <https://webkit.org/b/128925>
            <rdar://problem/16087351>

            Merged from Blink (patch by Dominic Mazzoni):
            https://src.chromium.org/viewvc/blink?revision=159711&view=revision

            Reviewed by Oliver Hunt.

            Don't cast to a table cell element unless we are sure it is one.

            Test: accessibility/display-table-cell-causes-crash.html

            * accessibility/AccessibilityTable.cpp:
            (WebCore::AccessibilityTable::isDataTable):

2014-03-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r159489.

    2013-11-19  Ryosuke Niwa  <rniwa@webkit.org>

            Add more assertions with security implications in DocumentOrderedMap
            https://bugs.webkit.org/show_bug.cgi?id=124559

            Reviewed by Antti Koivisto.

            Assert that newly added elements and existing elements in the document ordered map are in the same tree scope
            as the document ordered map. Also exit early if we're about to add an element in a wrong document to the map.
            We don't exit early in get() because the damage has already been done at that point (the element may have been
            deleted already).

            * dom/Document.cpp:
            (WebCore::Document::addImageElementByLowercasedUsemap):
            * dom/DocumentOrderedMap.cpp:
            (WebCore::DocumentOrderedMap::add): Assert that the newly added element is in the current tree scope.
            Also exit early if either the element is not in the tree scope or not in the right document.
            While this doesn't make the function completely fault safe, it'll catch when we try to add a detached node.
            (WebCore::DocumentOrderedMap::remove): Convert existing assertions to ones with security implication.
            (WebCore::DocumentOrderedMap::get): Assert with security implication that the element we're about to return
            is in the current tree scope. The element may have already been deleted if we ever hit these assertions.
            (WebCore::DocumentOrderedMap::getAllElementsById):  Convert an existing assertion to an assertion with security
            implication.
            * dom/DocumentOrderedMap.h:
            * dom/TreeScope.cpp:
            (WebCore::TreeScope::addElementById):
            (WebCore::TreeScope::addElementByName):
            (WebCore::TreeScope::addImageMap):
            (WebCore::TreeScope::addLabel):
            * html/HTMLDocument.cpp:
            (WebCore::HTMLDocument::addDocumentNamedItem):
            (WebCore::HTMLDocument::addWindowNamedItem):
            * html/HTMLImageElement.cpp:
            (WebCore::HTMLImageElement::insertedInto): Set InTreeScope flag before calling addImageElementByLowercasedUsemap.
            * html/HTMLMapElement.cpp:
            (WebCore::HTMLMapElement::insertedInto): Ditto for addImageMap.

2014-03-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r165145.

    2014-03-05  Daniel Bates  <dabates@apple.com>
                And Alexey Proskuryakov  <ap@apple.com>

            ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
            https://bugs.webkit.org/show_bug.cgi?id=129753
            <rdar://problem/12069835>

            Reviewed by Alexey Proskuryakov.

            Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
            app cache doesn't contain a manifest resource.

            For some reason an app cache for a web site may be partially written to disk. In particular, the
            app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
            may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
            and hence have been unable to create such an app cache. We were able to reproduce this issue using
            an app cache database file that was provided by a person that was affected by this issue.

            No test included because it's not straightforward to write a test for this change.

            * loader/appcache/ApplicationCacheGroup.cpp:
            (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated->manifestResource()
            is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
            expression into two assertion expressions to make it straightforward to identify the failing sub-expression
            on failure.
            * loader/appcache/ApplicationCacheStorage.cpp:
            (WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
            to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
            This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
            (WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
            have a manifest resource.
            (WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
            (WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
            ApplicationCacheStorage::deleteCacheGroupRecord().
            * loader/appcache/ApplicationCacheStorage.h:

2014-03-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r156716.

    2013-10-01  Myles C. Maxfield  <mmaxfield@apple.com>

            Center misspelling dots across width of word
            https://bugs.webkit.org/show_bug.cgi?id=122046

            Reviewed by Darin Adler.

            Test: editing/spelling/spelling.html

            * platform/graphics/GraphicsContext.h:
            * platform/graphics/mac/GraphicsContextMac.mm:
            (WebCore::GraphicsContext::drawLineForDocumentMarker):

2014-03-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r153788.

    2013-08-07  Antti Koivisto  <antti@apple.com>

            2.5% regression on page cycler moz
            https://bugs.webkit.org/show_bug.cgi?id=102822

            Reviewed by Andreas Kling.

            DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache() triggers a style recalc for quirks mode
            documents in the beginning of document parsing via Document::setCompatibilityMode. This often coalesces 
            with style recalc triggered by stylesheet loading. However on very simple documents it can generate genuinely
            unnecessary work.

            * dom/DocumentStyleSheetCollection.cpp:
            (WebCore::DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache):
            
                Check that we actually have cached injected stylesheets before triggering style recalc.
                
            * page/PageGroup.cpp:
            (WebCore::PageGroup::addUserStyleSheetToWorld):
            (WebCore::PageGroup::removeUserStyleSheetFromWorld):
            (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
            (WebCore::PageGroup::removeAllUserContent):
            
                Fix a misspelling.

            (WebCore::PageGroup::invalidateInjectedStyleSheetCacheInAllFrames):
            
                Always invalidate style when user sheets change since we don't do that in
                DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache anymore.

            * page/PageGroup.h:

2014-03-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r155071.

    2013-09-04  Pratik Solanki  <psolanki@apple.com>

            Document::updateHoverActiveState() should allow for deferred style recalcs
            https://bugs.webkit.org/show_bug.cgi?id=120700

            Reviewed by Simon Fraser.

            Add an extra argument to Document::updateHoverActiveState() to specify if a style recalc
            should be done. The default value keeps the current behavior of doing a style recalc. iOS
            touch handling code will pass in DeferRecalcStyleIfNeeded to avoid the work.

            No new tests because no functional changes.

            * dom/Document.cpp:
            (WebCore::Document::updateHoverActiveState):
            * dom/Document.h:

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r158802.

    2013-11-06  Ryosuke Niwa  <rniwa@webkit.org>

            Crash in SliderThumbElement::dragFrom
            https://bugs.webkit.org/show_bug.cgi?id=123873

            Reviewed by Sam Weinig.

            Moved Ref.

            * html/RangeInputType.cpp:
            (WebCore::RangeInputType::handleMouseDownEvent):
            * html/shadow/SliderThumbElement.cpp:
            (WebCore::SliderThumbElement::dragFrom):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r158724.

    2013-11-05  Ryosuke Niwa  <rniwa@webkit.org>

            Use-after-free in SliderThumbElement::dragFrom
            https://bugs.webkit.org/show_bug.cgi?id=123873

            Reviewed by Andreas Kling.

            Ref the SliderThumbElement since it could go away inside dragFrom.

            Test: fast/forms/range/range-type-change-onchange-2.html

            * html/RangeInputType.cpp:
            (WebCore::RangeInputType::handleMouseDownEvent):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r163599.

    2014-02-06  Jeffrey Pfau  <jpfau@apple.com>

            loadSubframe can return null in SubframeLoader::loadOrRedirectSubframe
            https://bugs.webkit.org/show_bug.cgi?id=128344

            Reviewed by Ryosuke Niwa.

            * loader/SubframeLoader.cpp:
            (WebCore::SubframeLoader::loadOrRedirectSubframe):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r164170.

    2014-02-15  Renata Hodovan  <rhodovan.u-szeged@partner.samsung.com>

            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
            https://bugs.webkit.org/show_bug.cgi?id=128810

            Reviewed by Ryosuke Niwa.

            Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
            doesn't contain |start|.

            Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
            ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
            patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
            |outerNode| only if |outerNode| contains |start| position.

            Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&view=revision by yosin@chromium.org.

            Test: editing/execCommand/indent-with-uneditable-crash.html

            * editing/CompositeEditCommand.cpp:
            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r160065.

    2013-12-03  Ryosuke Niwa  <rniwa@webkit.org>

            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
            https://bugs.webkit.org/show_bug.cgi?id=125207

            Reviewed by Simon Fraser.
            
            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440

            Update style in FrameSelection instead of RenderView's member functions. These are the last two
            member functions of RenderView that updates the style.

            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::focusedOrActiveStateChanged):
            (WebCore::FrameSelection::bounds):
            * rendering/RenderView.cpp:
            (WebCore::RenderView::selectionBounds):
            (WebCore::RenderView::repaintSelection):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r164367.

    2014-02-19  Daniel Bates  <dabates@apple.com>

            Do not dispatch change event twice in single step action
            https://bugs.webkit.org/show_bug.cgi?id=116936
            <rdar://problem/16086828>

            Reviewed by Ryosuke Niwa.

            Merged from Blink (patch by Kent Tamura):
            https://src.chromium.org/viewvc/blink?view=rev&revision=151175

            Test: fast/forms/number/number-type-update-by-change-event.html

            * html/InputType.cpp:
            (WebCore::InputType::stepUpFromRenderer):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r164204.

    2014-02-16  Andreas Kling  <akling@apple.com>

            Ensure that removing an iframe from the DOM tree disconnects its Frame.
            <https://webkit.org/b/128889>
            <rdar://problem/15671221>

            Merged from Blink (patch by Adam Klein):
            https://src.chromium.org/viewvc/blink?revision=156174&view=revision

            SubframeLoadingDisabler wasn't catching the case when an <iframe> was,
            in its unload handler, removed and re-added to the same parent.
            Fix this by using a count of SubframeLoadingDisablers that are on the
            stack for a given root, rather than a simple boolean.

            Test: fast/frames/reattach-in-unload.html

            * html/HTMLFrameOwnerElement.h:
            (WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r157957.

    2013-10-24  Daniel Bates  <dabates@apple.com>

            Crash in WebCore::NavigationScheduler::startTimer()
            https://bugs.webkit.org/show_bug.cgi?id=123288
            <rdar://problem/14055644>

            Reviewed by Alexey Proskuryakov.

            Currently NavigationScheduler::startTimer() synchronously notifies the client
            before the Web Inspector of a scheduled redirect. If a client cancels this
            redirect then NavigationScheduler::m_redirect will become null and we'll
            subsequently crash when informing the Web Inspector of this formerly scheduled
            redirect. Instead, NavigationScheduler::startTimer() should notify the Web
            Inspector before it notifies the client of a scheduled redirect.

            As a side benefit of this change, the Web Inspector is notified of a scheduled
            redirect before being notified of it being canceled when a client chooses to cancel
            a scheduled redirect.

            * loader/NavigationScheduler.cpp:
            (WebCore::NavigationScheduler::startTimer):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r153829

    2013-08-08  Andreas Kling  <akling@apple.com>

            Inserting multiple rules into an empty style sheet should avoid style recalc if possible.
            <http://webkit.org/b/119568>

            Reviewed by Antti Koivisto.

            As a follow-up to <http://webkit.org/b/119475>, where I added a hack for inserting
            a single rule into an empty style sheet, this broadens the optimization to support
            any number of rules.

            This optimizes the scenario where a style sheet is added to the DOM and then populated
            rule-by-rule via CSSOM insertRule()/addRule() calls. Previously we'd do a full style
            recalc for this case, but now we'll treat it the same as a full sheet added at once.

            * css/CSSStyleSheet.h:
            * css/CSSStyleSheet.cpp:
            (WebCore::CSSStyleSheet::willMutateRules):

                Made willMutateRules() return whether the style sheet contents were cloned by the
                copy-on-write mechanism.

            * dom/Document.h:
            (WebCore::CSSStyleSheet::didMutateRules):
            (WebCore::CSSStyleSheet::insertRule):

                Replaced the InsertionIntoEmptySheet mutation type by a general RuleInsertion.
                The mutation callback checks if we're inserting into a rule that's not (yet) part
                of the document's active sheet set. In that case, we defer doing the style sheet
                until all the insertions are done (or something forces us to style+layout.)

                Note that this optimization only happens if the style sheet had a single client.
                Shared style sheets that just got cloned before mutation may have pointers into
                them from the Document's StyleResolver, so we're forced to do an immediate sheet
                update in that case.

            (WebCore::CSSStyleSheet::RuleMutationScope::RuleMutationScope):
            (WebCore::CSSStyleSheet::RuleMutationScope::~RuleMutationScope):

                Moved these out-of-line.

            (WebCore::CSSStyleSheet::didMutateRuleFromCSSStyleDeclaration):
            * css/PropertySetCSSStyleDeclaration.cpp:
            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):

                Made a separate mutation callback for CSSStyleDeclaration since its needs are
                so simple compared to the mutation callback from CSSStyleSheet. Seems better
                than adding yet another mode to the enum.

            * dom/Document.cpp:
            (WebCore::Document::Document):
            (WebCore::Document::recalcStyle):
            (WebCore::Document::styleResolverChanged):
            (WebCore::Document::optimizedStyleSheetUpdateTimerFired):
            (WebCore::Document::scheduleOptimizedStyleSheetUpdate):

                Added mechanism to defer doing a RecalcStyleIfNeeded.

            (WebCore::Document::updateStyleIfNeeded):

                Synchronize the optimized style sheet update if there's one scheduled.
                This ensures that stuff like layout-dependent property access won't operate
                on stale style.

            * dom/DocumentStyleSheetCollection.h:
            (WebCore::DocumentStyleSheetCollection::pendingUpdateType):
            (WebCore::DocumentStyleSheetCollection::setPendingUpdateType):
            (WebCore::DocumentStyleSheetCollection::flushPendingUpdates):
            * dom/DocumentStyleSheetCollection.cpp:
            (WebCore::DocumentStyleSheetCollection::DocumentStyleSheetCollection):
            (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):

                Have DSSC track the kind of style sheet update it needs to do (instead of just
                a boolean "needs update.") This is used by Document::recalcStyle() to make sure
                the right kind of update happens if there's one scheduled.

            (WebCore::DocumentStyleSheetCollection::activeStyleSheetsContains):

                Added helper to check if a CSSStyleSheet is part of the active set.

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r159970.

    2013-12-02  Brady Eidson  <beidson@apple.com>

            Add more CachedPage null checks
            https://bugs.webkit.org/show_bug.cgi?id=125106

            Reviewed by Sam Weinig.

            Only some functions in PageCache.cpp null-check the CachedPages in HistoryItems.

            Every part that manipulates the CachedPage should.

            * history/PageCache.cpp:
            (WebCore::PageCache::markPagesForVistedLinkStyleRecalc):
            (WebCore::PageCache::markPagesForFullStyleRecalc):
            (WebCore::PageCache::markPagesForDeviceScaleChanged):
            (WebCore::PageCache::markPagesForCaptionPreferencesChanged):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r159986.

    2013-12-02  Brady Eidson  <beidson@apple.com> 

            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer<ProgressTracker>*) 
            https://bugs.webkit.org/show_bug.cgi?id=125110 

            Reviewed by Darin Adler. 

            FrameLoader::loadProgressingStatusChanged() might be called while the Frame has a null FrameView. 

            It’s unclear how to reproduce, but there’s no harm in a null check. 

            * loader/FrameLoader.cpp: 
            (WebCore::FrameLoader::loadProgressingStatusChanged): 

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r159974.

    2013-12-02  Brady Eidson  <beidson@apple.com> 

            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer<ProgressTracker>*) 
            https://bugs.webkit.org/show_bug.cgi?id=125110 

            Reviewed by Darin Adler. 

            It’s possible to have a null m_originatingProgressFrame when the heartbeat timer fires. 

            On the surface this seems impossible because the only time m_originatingProgressFrame is cleared 
            out the heartbeat timer is also stopped. 

            But there’s likely still a race condition in multi-threaded environments. 

            There’s no harm in null-checking m_originatingProgressFrame before accessing its loader. 

            * loader/ProgressTracker.cpp: 
            (WebCore::ProgressTracker::progressHeartbeatTimerFired): 

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r162063.

    2014-01-15  Antti Koivisto  <antti@apple.com>

            Suspend resource requests during computedStyle
            https://bugs.webkit.org/show_bug.cgi?id=127034

            Reviewed by Andreas Kling.

            We have some cases where getting computed style leads to crashes in loadPendingImages. 
            This is probably caused by load callbacks resulting in re-entering WebKit and killing the StyleResolver.
            
            As a speculative fix suspend resource loads (and so callbacks) when getting the computed style.
            We do similar suspension during style recalc for the same reason.

            * dom/Document.cpp:
            (WebCore::Document::styleForElementIgnoringPendingStylesheets):
            * loader/ResourceLoadScheduler.h:
            (WebCore::ResourceLoadScheduler::Suspender::Suspender):
            (WebCore::ResourceLoadScheduler::Suspender::~Suspender):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r158697.

    2013-11-05  Enrica Casucci  <enrica@apple.com>

            Full width semicolon is wrong in vertical text.
            https://bugs.webkit.org/show_bug.cgi?id=123814
            <rdar://problem/15312541>

            Reviewed by Benjamin Poulain.

            The full width semicolon should always be upright.
            Adding it to the list of characters that should
            ignore rotation.

            * platform/graphics/FontGlyphs.cpp:
            (WebCore::shouldIgnoreRotation):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r163465.

    2014-02-04  Myles C. Maxfield  <mmaxfield@apple.com>

            Move characterAt index checks from InlineIterator to RenderText
            https://bugs.webkit.org/show_bug.cgi?id=128224

            Reviewed by Simon Fraser.

            Move characterAt index checks from InlineIterator to RenderText
            so that all RenderText calls are covered. Few safe instances are
            now covered with uncheckedCharacterAt.

            Merged from Blink:
            http://src.chromium.org/viewvc/blink?view=revision&revision=150830

            Test: fast/text/character-at-crash.html

            * rendering/InlineIterator.h:
            (WebCore::InlineIterator::characterAt):
            * rendering/RenderText.cpp:
            (WebCore::RenderText::computePreferredLogicalWidths):
            * rendering/RenderText.h:
            (WebCore::RenderText::operator[]):
            (WebCore::RenderText::uncheckedCharacterAt):
            (WebCore::RenderText::characterAt):

2014-03-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r164933.

    2014-03-01  David Kilzer  <ddkilzer@apple.com>

        Ensure keySplines is valid in SMIL animations
        <http://webkit.org/b/129547>
        <rdar://problem/15676128>

        Reviewed by Darin Adler.

        Merged from Blink (patch by Philip Rogers):
        https://src.chromium.org/viewvc/blink?revision=156452&view=revision
        http://crbug.com/276111

            This patch fixes a crash in SMIL animations when keySplines are not
            specified. The SMIL spec is clear on this:
            http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
            "If there are any errors in the keyTimes specification (bad values,
            too many or too few values), the animation will have no effect."

            This patch simply checks that keyTimes is not empty. Previously,
            splinesCount was set to be m_keySplines.size() + 1 in
            SVGAnimationElement.cpp; this patch changes splinesCount to be equal
            to m_keySplines.size() to make the logic easier to follow and to
            match other checks in SVGAnimationElement::startedActiveInterval.

        Test: svg/animations/animate-keysplines-crash.html

        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::startedActiveInterval):

2014-03-04  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix after bad merge of r154146.
        <rdar://problem/16223155>

        Two files were ommitted from the prior commit.

        * platform/win/WebCoreBundleWin.cpp: Added.
        (WebCore::createWebKitBundle):
        (WebCore::webKitBundle):
        * platform/win/WebCoreBundleWin.h: Added.

2014-03-03  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix.
        <rdar://problem/16197002>

        * WebCore.vcxproj/WebCore.vcxproj: Exclude 64-bit assembly code when building
        32-bit DebugSuffix target.

2014-02-28  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix.
        <rdar://problem/16197002>

        * WebCore.vcxproj/WebCore.proj: Remove trailing
        slash from path names, as this was causing multiple arguments
        to be concatenated together (the whitespace was getting escaped
        by the slash.)

2014-02-25  Brent Fulgham  <bfulgham@apple.com>

        Merge r164660

    2014-02-25  Brent Fulgham  <bfulgham@apple.com>

            [Win] Gracefully recover from missing 'naturalSize' parameter for media
            https://bugs.webkit.org/show_bug.cgi?id=129278

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Add declaration for
            missing function call.
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::createMetadataKeyNames):
            (WebCore::MediaPlayerPrivateAVFoundationCF::assetStatus): Don't treat missing 'naturalSize'
            as a fatal error.
            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged): Handle case of asset track
            not being available yet.
            (WebCore::MediaPlayerPrivateAVFoundationCF::sizeChanged): If the 'naturalSize' is empty,
            use the Player Item's 'presentationSize' instead.
            (WebCore::AVFWrapper::processNotification): Add missing handler for duration changed.

2014-02-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r163579.

    2014-02-04  Jeffrey Pfau  <jpfau@apple.com>

            Make adoption agency use the task queue
            https://bugs.webkit.org/show_bug.cgi?id=109445

            Reviewed by Ryosuke Niwa.

            Tests: fast/parser/adoption-agency-crash-01.html
                   fast/parser/adoption-agency-crash-02.html
                   fast/parser/adoption-agency-crash-03.html

            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::insert):
            (WebCore::executeInsertTask):
            (WebCore::executeReparentTask):
            (WebCore::executeInsertAlreadyParsedChildTask):
            (WebCore::executeTakeAllChildrenTask):
            (WebCore::executeTask):
            (WebCore::HTMLConstructionSite::attachLater):
            (WebCore::HTMLConstructionSite::executeQueuedTasks):
            (WebCore::HTMLConstructionSite::insertTextNode):
            (WebCore::HTMLConstructionSite::reparent):
            (WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
            (WebCore::HTMLConstructionSite::takeAllChildren):
            (WebCore::HTMLConstructionSite::fosterParent):
            * html/parser/HTMLConstructionSite.h:
            (WebCore::HTMLConstructionSiteTask::HTMLConstructionSiteTask):
            (WebCore::HTMLConstructionSiteTask::oldParent):
            * html/parser/HTMLTreeBuilder.cpp:
            (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2014-02-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r162820.

    2014-01-26  David Kilzer  <ddkilzer@apple.com>

            Part 2: Assertion failure in WebCore::PseudoElement::didRecalcStyle()
            <https://bugs.webkit.org/show_bug.cgi?id=126761>
            <rdar://problem/15793540>

            Reviewed by Simon Fraser.

            * bindings/objc/DOM.mm:
            (-[DOMElement image]):
            (-[DOMElement _imageTIFFRepresentation]):
            * platform/gtk/PasteboardGtk.cpp:
            (WebCore::Pasteboard::writeImage):
            * platform/win/PasteboardWin.cpp:
            (WebCore::Pasteboard::writeImage):
            (WebCore::getCachedImage):
            * rendering/HitTestResult.cpp:
            (WebCore::HitTestResult::image):
            - More places where toRenderImage() should be used instead of
              toImage().
            - Fixed last two places where static_cast<WebCore::RenderImage*>
              was being used instead of toRenderImage().

2014-02-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r162679.

    2014-01-23  Jon Honeycutt  <jhoneycutt@apple.com>

            Assertion failure in WebCore::PseudoElement::didRecalcStyle()
            <https://bugs.webkit.org/show_bug.cgi?id=126761>
            <rdar://problem/15793540>

            Reviewed by Andy Estes.

            Test: fast/images/animate-list-item-image-assertion.html

            * dom/PseudoElement.cpp:
            (WebCore::PseudoElement::didRecalcStyle):
            Check isRenderImage() rather than isImage() before casting to
            RenderImage.

            * editing/ios/EditorIOS.mm:
            (WebCore::getImage):
            Ditto.

            * editing/mac/EditorMac.mm:
            (WebCore::getImage):
            Ditto.

            * html/HTMLImageElement.cpp:
            (WebCore::HTMLImageElement::parseAttribute):
            (WebCore::HTMLImageElement::didAttachRenderers):
            Ditto.

            * loader/ImageLoader.cpp:
            (WebCore::ImageLoader::renderImageResource):
            Ditto.

            * page/DragController.cpp:
            (WebCore::getCachedImage):
            Ditto.

            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
            (WebCore::RenderLayerBacking::updateImageContents):
            Ditto.

2014-02-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r161925.

    2014-01-13  Myles C. Maxfield  <mmaxfield@apple.com>

            Highlighting password field then making a Sticky Note via Safari Services exposes password
            https://bugs.webkit.org/show_bug.cgi?id=126946

            Reviewed by Enrica Casucci.

            Using the Services menu has a slightly different codepath than Editor::copy() does. This
            patch duplicates the canCopy() check that Editor::copy() does.

            Testing is not possible because the Services menu is not accessible to our tests.

            * editing/mac/EditorMac.mm:
            (WebCore::Editor::stringSelectionForPasteboard):
            (WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
            (WebCore::Editor::dataSelectionForPasteboard):

2014-02-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r158739.

    2013-11-06  Ryosuke Niwa  <rniwa@webkit.org>

            Notify nodes removal to Range/Selection after dispatching blur and mutation event
            https://bugs.webkit.org/show_bug.cgi?id=123880

            Reviewed by Andreas Kling.

            Merge https://chromium.googlesource.com/chromium/blink/+/b60576a0560d14f8757e58d55d37b7cefa48a6ac

            In willRemoveChildren in ContainerNode.cpp, call Document::nodeChildrenWillBeRemoved after instead of
            before dispatching mutation events because we need to update ranges created by those mutation event
            listeners. willRemoveChild was fixed in r115686.

            Tests: editing/selection/selection-change-in-blur-event-by-remove-children.html
                   editing/selection/selection-change-in-mutation-event-by-remove-children.html
                   fast/dom/Range/range-created-during-remove-children.html

            * dom/ContainerNode.cpp:
            (WebCore::willRemoveChildren):

2014-02-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r158719.

    2013-11-05  Ryosuke Niwa  <rniwa@webkit.org>

            Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()
            https://bugs.webkit.org/show_bug.cgi?id=123861

            Reviewed by Benjamin Poulain.

            Merge https://chromium.googlesource.com/chromium/blink/+/297442eb539a2b764fdad323de79099a70179186 partially.

            * editing/IndentOutdentCommand.cpp:
            (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Make selectedListItem, previousList, and nextList
            RefPtr since they're are used after calling insertNodeBefore.

2014-02-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r158058.

    2013-10-25  Mark Lam  <mark.lam@apple.com>

            DatabaseManager's ProposedDatabases need to be thread-safe.
            https://bugs.webkit.org/show_bug.cgi?id=123313.

            Reviewed by Geoffrey Garen.

            No new tests.

            * Modules/webdatabase/DatabaseManager.cpp:
            (WebCore::DatabaseManager::DatabaseManager):
            (WebCore::DatabaseManager::existingDatabaseContextFor):
            (WebCore::DatabaseManager::registerDatabaseContext):
            (WebCore::DatabaseManager::unregisterDatabaseContext):
            (WebCore::DatabaseManager::didConstructDatabaseContext):
            (WebCore::DatabaseManager::didDestructDatabaseContext):
            (WebCore::DatabaseManager::openDatabaseBackend):
            (WebCore::DatabaseManager::addProposedDatabase):
            (WebCore::DatabaseManager::removeProposedDatabase):
            (WebCore::DatabaseManager::fullPathForDatabase):
            (WebCore::DatabaseManager::detailsForNameAndOrigin):
            * Modules/webdatabase/DatabaseManager.h:

2014-02-10  Lucas Forschler  <lforschler@apple.com>

        Merge r162486

    2014-01-21  Tim Horton  <timothy_horton@apple.com>

            REGRESSION (r161580): Some PDFs render outside their <img>
            https://bugs.webkit.org/show_bug.cgi?id=127381
            <rdar://problem/15872168>

            Reviewed by Simon Fraser.

            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::transformContextForPainting):
            Only try to make the scale uniform if it isn't already, and use the minimum
            of the two original scales when doing so, so that it is absolutely certain
            to fit inside space allocated for the image during layout.

2014-02-10  Lucas Forschler  <lforschler@apple.com>

        Merge r158870

    2013-11-07  Ryosuke Niwa  <rniwa@webkit.org>

            Crash in HTMLMediaElement::contextDestroyed
            https://bugs.webkit.org/show_bug.cgi?id=123963

            Reviewed by Eric Carlson.

            Merge https://chromium.googlesource.com/chromium/blink/+/177999cdb34b707465670f0feff723922939f278

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::~HTMLMediaElement):

2014-02-10  Lucas Forschler  <lforschler@apple.com>

        Merge r154036

    2013-08-12  Ryosuke Niwa  <rniwa@webkit.org>

            Fix orphan needsLayout state in RenderTextControlSingleLine
            https://bugs.webkit.org/show_bug.cgi?id=119726

            Reviewed by Kent Tamura.

            Merge https://chromium.googlesource.com/chromium/blink/+/c0aec52ef348b2be0c882f8646fe3cf537831f59

            We should mark the renderer for containerElement, which wraps innerTextElement and innerBlockElement
            in cases of input[type=search] and input[type=number], dirty.

            * rendering/RenderTextControlSingleLine.cpp:
            (WebCore::setNeedsLayoutOnAncestors):
            (WebCore::RenderTextControlSingleLine::layout):

2014-02-10  Lucas Forschler  <lforschler@apple.com>

        Merge r156082

    2013-09-18  Mihnea Ovidenie  <mihnea@adobe.com>

            [CSSRegions] Failed to retrieve named flow ranges for content with inline svg
            https://bugs.webkit.org/show_bug.cgi?id=121489

            Reviewed by David Hyatt.

            The inline SVG element behaves like a replaced element in HTML context. When computing the ranges
            that are displayed inside a region for a named flow that contains an inline SVG element, we have
            to treat the SVG as a replaced and run the checks only for the SVG root element, skipping the
            other SVG elements inside.

            Test: fast/regions/get-region-flow-ranges-inline-svg.html

            * rendering/RenderNamedFlowThread.cpp:
            (WebCore::nextNodeInsideContentNode): Add function to retrieve the next node in traversal
            under the contentNode subtree that should be used for getRanges inspection.
            (WebCore::RenderNamedFlowThread::getRanges): Replace NodeTravesal::next with nextNodeInsideContentNode.

2014-02-10  Lucas Forschler  <lforschler@apple.com>

        Merge r153507

    2013-07-30  Chris Fleizach  <cfleizach@apple.com>

            Don't post accessibility notification on object in detached document.
            https://bugs.webkit.org/show_bug.cgi?id=119286

            Reviewed by Ryosuke Niwa.

            Merge https://chromium.googlesource.com/chromium/blink/+/ef9fc9e70202dcf33e5cf2f0f0a2135945ffe17e%5E%21/#F0

            Don't post accessibility notification on object in detached document.

            This can happen if an accessibility notification is queued on a node,
            then that node is reparented to a different document that's not attached
            anywhere before the accessibility notification is fired.

            * accessibility/AXObjectCache.cpp:
            (WebCore::AXObjectCache::notificationPostTimerFired):

2014-02-10  Lucas Forschler  <lforschler@apple.com>

        Merge r158676

    2013-11-05  Daniel Bates  <dabates@apple.com>

            XSSAuditor should catch reflected srcdoc properties even without a <frame> tag injection

            From Blink r160615 by <tsepez@chromium.org>
            https://src.chromium.org/viewvc/blink?view=rev&revision=160615

            Test: http/tests/security/xssAuditor/iframe-srcdoc-property-blocked.html

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::filterIframeToken):

2014-02-05  Brent Fulgham  <bfulgham@apple.com>

        Merge r154146, r155828, r156145

    2013-08-15  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Consolidate WebKit Bundle Handling 
            https://bugs.webkit.org/show_bug.cgi?id=119869 

            Reviewed by Tim Horton. 

            * WebCore.vcxproj/WebCore.vcxproj: Add new WebCoreBundleWin files. 
            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto. 
            * platform/network/curl/ResourceHandleManager.cpp: 
            (WebCore::certificatePath): Use correct bundle handling logic. 
            * platform/win/LocalizedStringsWin.cpp: Move bundle implementation to 
            new WebCoreBundleWin.cpp file. 
            * platform/win/WebCoreBundleWin.cpp: Added. 
            (WebCore::createWebKitBundle): 
            (WebCore::webKitBundle): 
            * platform/win/WebCoreBundleWin.h: Added. 

2014-02-04  Brent Fulgham  <bfulgham@apple.com>

        Build fix after last branch merge.

        * WebCore.vcxproj/WebCore.vcxproj: Correct bad merge of media build steps.

2014-02-03  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix after r162860.

        * platform/graphics/MediaPlayer.cpp: Prevent 64-bit build from using QuickTime SDK.
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp: Ditto.
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h: Ditto.

2014-01-27  Brent Fulgham  <bfulgham@apple.com>

        Merge r162723.

    2014-01-24  Brent Fulgham  <bfulgham@apple.com>

            [Win] Convert some NMake files to MSBuild project files 
            https://bugs.webkit.org/show_bug.cgi?id=127579 

            Reviewed by Tim Horton.

            * WebCore.vcxproj/WebCore.make: Removed.
            * WebCore.vcxproj/WebCore.proj: Added.

2014-01-27  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix after r162631.

        * WebCore.vcxproj/WebCore.submit.sln: Do not build QTMovieWin for 64-bit architecture.

2014-01-23  Brent Fulgham  <bfulgham@apple.com>

        Merge r154470.

    2013-08-22  Simon Fraser  <simon.fraser@apple.com>

            compositing/geometry/bounds-ignores-hidden-dynamic.html has incorrect initial rendering
            https://bugs.webkit.org/show_bug.cgi?id=119825

            Reviewed by Tim Horton.
            
            r137526 and some earlier commits attempted to avoid unconditionally
            repainting layers when their size changes, because this was causing
            TiledBacking layers to repaint when the document size changed.
            
            However, the approach required that we have good information about
            whether size changes require a repaint, which in some cases is hard
            to determine, especially when RenderLayer changes affect our
            decisions about which layers are composited.
            
            Fix by pushing the decision about whether to repaint on size change
            into GraphicsLayer. The default is to repaint on size change,
            but GraphicsLayer provides a function that can be overridden to
            modify this behavior; GraphicsLayerCA does so to avoid repaints
            when layers with TiledBackings get resized.

            Test: compositing/repaint/repaint-on-layer-grouping-change.html

            * WebCore.exp.in: WebKit2 needs GraphicsLayer::setSize, which is no longer inline.
            * platform/graphics/GraphicsLayer.cpp:
            (WebCore::GraphicsLayer::setOffsetFromRenderer):
            (WebCore::GraphicsLayer::setSize):
            * platform/graphics/GraphicsLayer.h:
            (WebCore::GraphicsLayer::shouldRepaintOnSizeChange):
            * platform/graphics/ca/GraphicsLayerCA.cpp:
            (WebCore::GraphicsLayerCA::shouldRepaintOnSizeChange):
            * platform/graphics/ca/GraphicsLayerCA.h:
            * rendering/RenderLayerBacking.h: No longer need m_boundsConstrainedByClipping
            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::RenderLayerBacking):
            (WebCore::RenderLayerBacking::updateCompositedBounds):
            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): setSize takes
            care of repainting for us now, so we can remove all the conditional code.

2014-01-23  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix after last commit. We haven't completely removed
        QTMovieWin uses.

        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Build for 32-bit.
        * WebCore.vcxproj/WebCore.submit.sln: Build QTMovieWin for 32-bit.

2014-01-23  Brent Fulgham  <bfulgham@apple.com>

        Merge r162621

    2014-01-22  Brent Fulgham  <bfulgham@apple.com>

            [Win] Update project and solution files for 64-bit builds
            https://bugs.webkit.org/show_bug.cgi?id=127457

            Reviewed by Eric Carlson.

            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Specify v100 target
            * WebCore.vcxproj/WebCore.submit.sln: Add x64 targets
            * WebCore.vcxproj/WebCore.vcxproj: Specify v100 target for all builds
            on this branch. Also exclude 32-bit specific assembly when building
            64-bit target, and correct bad merge from branch.
            * WebCore.vcxproj/WebCore.vcxproj.filters: Correct branch merge
            * config.h: Handle 64-bit type definitions.
            * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
            (PlatformCAAnimation::setFromValue): Use CGFloat to support 64-bit builds
            (PlatformCAAnimation::setToValue): Ditto
            (PlatformCAAnimation::setValues): Ditto
            * platform/graphics/win/FontCustomPlatformData.cpp:
            (WebCore::FontCustomPlatformData::fontPlatformData): Add cast to
            support 32- and 64-bit targets.
            * platform/graphics/win/GraphicsContextCGWin.cpp:
            (WebCore::GraphicsContext::drawLineForDocumentMarker): Use CGFloat to
            support 64-bit builds.
            * platform/win/PasteboardWin.cpp:
            (WebCore::Pasteboard::writeURLToDataObject): Specialize std::min to
            work on 32- and 64-bit code.
            (WebCore::createGlobalImageFileDescriptor): Ditto
            * platform/win/StructuredExceptionHandlerSuppressor.cpp:
            (WebCore::StructuredExceptionHandlerSuppressor::StructuredExceptionHandlerSuppressor):
            Comment out 32-bit inline assembly.
            (WebCore::StructuredExceptionHandlerSuppressor::~StructuredExceptionHandlerSuppressor):
            Ditto

2014-01-22  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix for branch.

        * WebCore.vcxproj/WebCore.vcxproj: Correct merged files.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * platform/graphics/cg/GraphicsContextCG.cpp: Remove work-around implementation (from branch)
        now that WKSI provides the method.

2014-01-22  Brent Fulgham  <bfulgham@apple.com>

        Merge r154526

    2014-01-22  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Unreviewed build correction. Need to force environment variable
            to be escaped when running nmake command.

            * WebCore.vcxproj/WebCoreGenerated.make:

2014-01-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r161568: <rdar://problem/15784802>

    2014-01-09  Tim Horton  <timothy_horton@apple.com>

            PDFDocumentImage can be very slow to do the initial paint
            https://bugs.webkit.org/show_bug.cgi?id=126633
            <rdar://problem/15770980>

            Reviewed by Simon Fraser.

            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::PDFDocumentImage::PDFDocumentImage):
            (WebCore::PDFDocumentImage::size):
            (WebCore::transformContextForPainting):
            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
            (WebCore::applyRotationForPainting):
            (WebCore::PDFDocumentImage::drawPDFPage):
            * platform/graphics/cg/PDFDocumentImage.h:
            * platform/graphics/mac/PDFDocumentImageMac.mm:
            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
            Store rotation from the PDF in degrees, since it can
            only be 0, 90, 180, or 270, and don't do any trig to
            perform the rotation, to avoid introducing minor rounding
            issues in the size.

            Once we're going to paint, if the difference between the
            computed scale for each axis is due only to integer rounding
            of the image size, use the same scale for both axes, to avoid
            a CG slow-path which occurs whenever the scale is nonuniform.

2014-01-07  Lucas Forschler  <lforschler@apple.com>

        Merge r160479

    2013-12-11  Darin Adler  <darin@apple.com>

            StylePendingImage needs to correctly manage the CSSValue pointer lifetime
            https://bugs.webkit.org/show_bug.cgi?id=125468

            Reviewed by Andreas Kling.

            Test: fast/css/pending-image-crash.xhtml

            Disconnect the reference counted StylePendingImage from the CSSValue that owns
            it when it's not needed any more, otherwise we could end up using a pointer
            that might no longer be valid.

            * css/CSSCursorImageValue.cpp:
            (WebCore::CSSCursorImageValue::detachPendingImage): Added. Calls detachFromCSSValue
            on the current image if it is a StylePendingImage.
            (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Call detachPendingImage.
            (WebCore::CSSCursorImageValue::cachedImage): Call detachPendingImage before changing
            m_image to a new value.
            (WebCore::CSSCursorImageValue::clearCachedImage): Ditto.
            * css/CSSCursorImageValue.h: Added detachPendingImage.

            * css/CSSImageSetValue.cpp:
            (WebCore::CSSImageSetValue::detachPendingImage): Added. Calls detachFromCSSValue
            on the current image set if it is a StylePendingImage.
            (WebCore::CSSImageSetValue::~CSSImageSetValue): Call detachPendingImage.
            (WebCore::CSSImageSetValue::cachedImageSet): Call detachPendingImage before changing
            m_imageSet to a new value.
            * css/CSSImageSetValue.h: Added detachPendingImage.

            * css/CSSImageValue.cpp:
            (WebCore::CSSImageValue::detachPendingImage): Added. Calls detachFromCSSValue on the
            current image if it is a StylePendingImage.
            (WebCore::CSSImageValue::~CSSImageValue): Call detachPendingImage.
            (WebCore::CSSImageValue::cachedImage): Call detachPendingImage before changing m_image
            to a new value.
            * css/CSSImageValue.h: Added detachPendingImage.

            * rendering/style/StylePendingImage.h:
            (WebCore::StylePendingImage::cssImageValue): Added a null check.
            (WebCore::StylePendingImage::cssImageGeneratorValue): Added a null check.
            (WebCore::StylePendingImage::cssCursorImageValue): Added a null check.
            (WebCore::StylePendingImage::cssImageSetValue): Added a null check.
            (WebCore::StylePendingImage::detachFromCSSValue): Added. Sets m_value to null since
            the style is no longer using this StylePendingImage.
            (WebCore::StylePendingImage::data): Changed to use the "this" pointer since all we
            need is some arbitrary pointer uniquely identifying the image. Before loading the image,
            we have no suitable weak identifier, so it suffices to use the unique pointer to each
            StylePendingImage object. This function is used only in a limited way; it would be nice
            to find a way to make the code less strange long term.

2013-12-23  Matthew Hanson  <matthew_hanson@apple.com>

        Merge 161050: <rdar://problem/15754482>

    2013-12-23  Ryosuke Niwa  <rniwa@webkit.org>

            Crash in ReplaceSelectionCommand
            https://bugs.webkit.org/show_bug.cgi?id=126107

            Reviewed by Benjamin Poulain.

            Merge https://chromium.googlesource.com/chromium/blink/+/c1ebe5c1e808daf9db5e348a8d0ab32570b9f7a5
            except the test since it doesn't reproduce the crash in WebKit.

            * editing/ReplaceSelectionCommand.cpp:
            (WebCore::ReplaceSelectionCommand::doApply):

2013-12-23  Matthew Hanson  <matthew_hanson@apple.com>

        Merge 161003: <rdar://problem/15719584>

    2013-12-23  Lucas Forschler  <lforschler@apple.com>

            <rdar://problem/15682948> Update copyright strings

            Reviewed by Dan Bernstein

            * Info.plist:

2013-12-19  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r160898: <rdar://problems/15709940>

    2013-12-19  Beth Dakin  <bdakin@apple.com>

            REGRESSION: cnn.com will continue to reveal 1 px of overhang after rubber-banding 
            at the top
            https://bugs.webkit.org/show_bug.cgi?id=126054

            Reviewed by Simon Fraser.

            This regression was caused by http://trac.webkit.org/changeset/160791 It turns out 
            that the line of code I removed was not always a no-op. In some instances, like on 
            cnn.com, it would ensure that our final scroll position after a rubber-band was 
            not something within the overhang area. It was still wrong in its assumption that 
            rubber-band is always bouncing back the spot it originated from. So this patch 
            continues to ignore the rubber-bands origin, and instead finds the nearest point 
            that is not in the overhang area, and scrolls to that point instead of the origin.

            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
            (WebCore::ScrollingTreeScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
            * platform/mac/ScrollAnimatorMac.h:
            * platform/mac/ScrollAnimatorMac.mm:
            (WebCore::ScrollAnimatorMac::adjustScrollPositionToBoundsIfNecessary):
            * platform/mac/ScrollElasticityController.h:
            * platform/mac/ScrollElasticityController.mm:
            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):

2013-12-19  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r159463: <rdar://problems/15701094>

    2013-11-18  Simon Fraser  <simon.fraser@apple.com>

            At some scales, opaque compositing layers have garbage pixels around the edges
            ​https://bugs.webkit.org/show_bug.cgi?id=124541

            Reviewed by Dean Jackson.

            Layers get marked as having opaque contents when their background is
            known to paint the entire layer. However, this failed to take into
            account two reasons why every pixel may not get painted.

            First, subpixel layout can result in non-integral RenderLayer
            bounds, which will get rounded up to an integral GraphicsLayer
            size. When this happens we may not paint edge pixels.

            Second, at non-integral scale factors, graphics context scaling
            may cause us to not paint edge pixels.

            Fix by only marking PlatformCALayers as having opaque contents
            when the contentsScale of the layer is integral.

            Not testable, because we can't guarantee to get garbage pixels
            in a ref test, and layer dumps show GraphicsLayer's notion of
            content opaqueness, not the one we set on the PlatformCALayer.

            * platform/graphics/ca/GraphicsLayerCA.cpp:
            (WebCore::isIntegral):
            (WebCore::clampedContentsScaleForScale):
            (WebCore::GraphicsLayerCA::updateRootRelativeScale):
            (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
            (WebCore::GraphicsLayerCA::updateContentsOpaque):
            (WebCore::GraphicsLayerCA::getTransformFromAnimationsWithMaxScaleImpact):
            Drive-by typo fix.
            (WebCore::GraphicsLayerCA::noteChangesForScaleSensitiveProperties):
            * platform/graphics/ca/GraphicsLayerCA.h:
            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):

2013-12-19  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r160791: <rdar://problems/15694289>

    2013-12-18  Beth Dakin  <bdakin@apple.com>

            Starting a momentum scroll while rubber banding can cause scrolling to jump back 
            when the rubberband snaps
            https://bugs.webkit.org/show_bug.cgi?id=119507
            -and corresponding-
            <rdar://problem/14655893>

            Reviewed by Simon Fraser.

            This line of code was added with the very first implementation of rubber-banding. 
            As far as I can tell, it was always a belt-and-suspenders line of code that is a 
            no-op in all normal rubber-banding. In this J-shaped scrolling case, this line of 
            code is what causes the bug to occur because this line of code assumes that your 
            rubber-band is always trying to take you back to the origin. 
            * platform/mac/ScrollElasticityController.mm:
            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):

2013-12-19  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r160819: <rdar://problems/15701133>

    2013-12-18  Ryosuke Niwa  <rniwa@webkit.org>

            Crash in WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches
            https://bugs.webkit.org/show_bug.cgi?id=125970

            Reviewed by Antti Koivisto.

            The bug was caused by containingBlockForAbsolutePosition returning a non-RenderBlock render object.
            Fixed the bug by obtaining its containg block.

            Also changed the return type of containingBlockForFixedPosition, containingBlockForAbsolutePosition,
            containingBlockForObjectInFlow from RenderElement to RenderBlock as all callers of these functions
            had assumed the return value to be an instance of RenderBlock.

            Test: svg/text/select-text-inside-non-static-position.html

            * rendering/LogicalSelectionOffsetCaches.h:
            (WebCore::containingBlockForFixedPosition):
            (WebCore::containingBlockForAbsolutePosition):
            (WebCore::containingBlockForObjectInFlow):
            (WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):

2013-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merged patch from <rdar://problems/15474133>.  This patch is a port of r157821.

    2013-10-22  Samuel White  <samuel_white@apple.com>

            AX: Add paramAttrs to fetch start and end text markers in a given rect.
            https://bugs.webkit.org/show_bug.cgi?id=122164

            Unreviewed change.

            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
            like VoiceOver a way to retrieve the text markers for a specified column of page text.

            Test: platform/mac/accessibility/text-marker-for-bounds.html

            * accessibility/AccessibilityObject.cpp:
            (WebCore::AccessibilityObject::mainFrame):
            (WebCore::AccessibilityObject::topDocument):
            (WebCore::AccessibilityObject::visiblePositionForBounds):
            * accessibility/AccessibilityObject.h:
            * accessibility/AccessibilityRenderObject.cpp:
            * accessibility/AccessibilityRenderObject.h:
            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (-[WebAccessibilityObjectWrapper screenToContents:]):
            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

2013-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r154513

    2013-08-23  Alex Christensen  <achristensen@apple.com>

            Re-separating Win32 and Win64 builds.
            https://bugs.webkit.org/show_bug.cgi?id=120178

            Reviewed by Brent Fulgham.

            * WebCore.vcxproj/WebCoreGenerated.make:
            * WebCore.vcxproj/WebCoreGeneratedWinCairo.make:
            Pass PlatformArchitecture as a command line parameter to bash scripts
            and use PlatformArchitecture to determine which directory to delete
            while cleaning (obj32 or obj64).
            * WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props:
            Export PlatformArchitecture to be used by make and cmd scripts.
            * WebCore.vcxproj/build-generated-files.sh:
            Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
            * WebCore.vcxproj/copyForwardingHeaders.cmd:
            * WebCore.vcxproj/copyWebCoreResourceFiles.cmd:
            Use PlatformArchitecture to determine which directory to copy to (obj32 or obj64).

2013-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r160469.  Not rolling out from trunk because r160469 was
        applied on the branch from a patch file.

2013-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r157821

    2013-10-22  Samuel White  <samuel_white@apple.com> 

            AX: Add paramAttrs to fetch start and end text markers in a given rect. 
            https://bugs.webkit.org/show_bug.cgi?id=122164 

            Reviewed by Chris Fleizach. 

            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
            like VoiceOver a way to retrieve the text markers for a specified column of page text.

            Test: platform/mac/accessibility/text-marker-for-bounds.html

            * accessibility/AccessibilityObject.cpp:
            (WebCore::AccessibilityObject::mainFrame):
            (WebCore::AccessibilityObject::topDocument):
            (WebCore::AccessibilityObject::visiblePositionForBounds):
            * accessibility/AccessibilityObject.h:
            * accessibility/AccessibilityRenderObject.cpp:
            * accessibility/AccessibilityRenderObject.h:
            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (-[WebAccessibilityObjectWrapper screenToContents:]):
            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

2013-12-11  Lucas Forschler  <lforschler@apple.com>

        Merge r159691

    2013-11-22  Brent Fulgham  <bfulgham@apple.com>

            [Win] Avoid deadlock when interacting with some AVFoundationCF content
            <rdar://problem/15482977> and https://bugs.webkit.org/show_bug.cgi?id=124752

            Prevent deadlock caused by conflict over the "mapLock" mutex. Notification handling in the file,
            which modify assets and make other changes, are required to happen on the main thread. This
            patch enforces this requirement.

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::NotificationCallbackData::NotificationCallbackData): Added
            (WebCore::AVFWrapper::processNotification): Moved logic from 'notificationCallback', which was
            sometimes happening on a background thread.
            (WebCore::AVFWrapper::notificationCallback): Dispatch calls to main thread.

2013-12-11  Lucas Forschler  <lforschler@apple.com>

        Merge r159460

    2013-11-18  David Hyatt  <hyatt@apple.com>

            Add a quirk to not respect center text-align when positioning

            <rdar://problem/15427571>
            https://bugs.webkit.org/show_bug.cgi?id=124522

            Reviewed by Simon Fraser.

            Added fast/block/legacy-text-align-position-quirk.html

            * page/Settings.in:
            Add the quirk setting.

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlock::startAlignedOffsetForLine):
            Don't pay attention to center text-align when the quirk is set.

2013-12-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge 154333

    2013-08-20  Alex Christensen  <achristensen@apple.com>

            Use PlatformArchitecture to distinguish between 32-bit and 64-bit builds on Windows.
            https://bugs.webkit.org/show_bug.cgi?id=119512

            Reviewed by Brent Fulgham.

            * WebCore.vcxproj/WebCore.vcxproj:
            * WebCore.vcxproj/WebCore.vcxproj.filters:
            * WebCore.vcxproj/WebCoreCommon.props:
            * WebCore.vcxproj/WebCoreGeneratedCommon.props:
            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
            * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters:
            Replaced obj32, bin32, and lib32 with macros for 64-bit build.

2013-12-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge 152982

    2013-07-22  Alex Christensen  <achristensen@apple.com>

            Added assembly files to Windows 64-bit builds.
            https://bugs.webkit.org/show_bug.cgi?id=118931

            Reviewed by Brent Fulgham.

            * WebCore.vcxproj/WebCore.vcxproj: Added PaintHooks.asm for x64 and enabled MASM.
            * WebCore.vcxproj/WebCore.vcxproj.filters: Added PaintHooks.asm.

2013-12-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge 152921

    2013-07-19  Alex Christensen  <achristensen@apple.com>

            Added x64 configuration to Visual Studio build.
            https://bugs.webkit.org/show_bug.cgi?id=118888

            Reviewed by Brent Fulgham.

            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj:
            * WebCore.vcxproj/WebCore.vcxproj:
            * WebCore.vcxproj/WebCoreGenerated.vcxproj:
            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:

2013-11-20  Lucas Forschler  <lforschler@apple.com>

        Merge r159481

    2013-11-18  Zalan Bujtas  <zalan@apple.com>

            use after free in WebCore::DocumentOrderedMap::remove / WebCore::TreeScope::removeElementById
            https://bugs.webkit.org/show_bug.cgi?id=121324

            Reviewed by Ryosuke Niwa.

            Update the document ordered map for an image element before dispatching load or error events
            when it's inserted into a document.

            Test: fast/dom/modify-node-and-while-in-the-callback-too-crash.html

            * dom/DocumentOrderedMap.cpp: defensive fix to avoid use after free issues.
            (WebCore::DocumentOrderedMap::remove):
            * html/HTMLImageElement.cpp:
            (WebCore::HTMLImageElement::insertedInto):
            * loader/ImageLoader.cpp:
            (WebCore::ImageLoader::updateFromElement): setting m_failedLoadURL makes
            repeated updateFromElement calls return early.

2013-11-13  Dean Jackson  <dino@apple.com>

        <rdar://problem/15292359>
        Fix incorrect merge of r157299 made in r158605.

        * platform/graphics/DisplayRefreshMonitor.cpp:
        (WebCore::DisplayRefreshMonitor::removeClient): Remember to remove clients
        from m_clientsToBeNotified.
        * platform/graphics/DisplayRefreshMonitor.h: Might as well make the code
        more consistent with ToT while I'm here.

2013-11-08  Lucas Forschler  <lforschler@apple.com>

        Merge r152867

    2013-07-18  Jer Noble  <jer.noble@apple.com>

            New PDFPlugin doesn't support WebKitOmitPDFSupport, acts as if Plug-ins are off
            https://bugs.webkit.org/show_bug.cgi?id=118858

            Reviewed by Eric Carlson.

            Expand the scope of rejecting non video/ or audio/ MIME types when
            filling the MIME type cache.

            * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
            (WebCore::shouldRejectMIMEType): Added utility function.

2013-11-07  Chris Fleizach  <cfleizach@apple.com>

        Merge r158743

    2013-11-06  Chris Fleizach  <cfleizach@apple.com> 
 
        AX: Audio and Video attachments are not output to VoiceOver 
        https://bugs.webkit.org/show_bug.cgi?id=123479 

        Reviewed by Mario Sanchez Prada. 

        Video and audio elements don't appear as distinct objects in the AX hierarchy, 
        nor are they treated as replaceable objects when emitting the text. We should 
        treat these characters like attachments, for one. On the Mac platform, we should 
        also identify them with special subroles. 

        Tests: platform/mac/accessibility/media-emits-object-replacement.html 
              platform/mac/accessibility/media-role-descriptions.html 
 
        * accessibility/AccessibilityNodeObject.cpp: 
        (WebCore::AccessibilityNodeObject::isGenericFocusableElement): 
        * accessibility/AccessibilityObject.h: 
        * accessibility/AccessibilityRenderObject.cpp: 
        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored): 
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): 
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm: 
        (createAccessibilityRoleMap): 
        (-[WebAccessibilityObjectWrapper subrole]): 
        (-[WebAccessibilityObjectWrapper roleDescription]): 
        * editing/TextIterator.cpp: 
        (WebCore::isRendererReplacedElement): 

2013-11-06  Lucas Forschler  <lforschler@apple.com>

        Merge r158617

    2013-11-04  Chris Fleizach  <cfleizach@apple.com>

            AX: Mail attachments at the start of an email are not output by VoiceOver
            https://bugs.webkit.org/show_bug.cgi?id=123697

            Reviewed by Ryosuke Niwa.

            VoiceOver is expecting that "replaced elements" (attachments in a Mail message in this case) to be
            represented by the replacement character when asking for a stringForRange.

            However, when that replaced element is at the beginning of the document, the logic does not work because
            there is a few code places that will take that first Position and advance it forward, not accounting for replaced elements.
            When using the TextIterator normally, it does account for these, so that's why it's only affecting as at the beginning of the document.

            Also a "replaced element" can be more than just renderer->isReplaced(), hence the externing of the isRendererReplacedElement method
            and using that it in pertinent places.

            Tests: platform/mac/accessibility/object-replacement-with-no-rendered-children-at-node-start.html
                   platform/mac/accessibility/object-replacement-with-rendered-children-at-node-start.html

            * accessibility/AccessibilityObject.cpp:
            (WebCore::replacedNodeNeedsCharacter):
            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (nsStringForReplacedNode):
            * dom/Position.cpp:
            (WebCore::Position::isCandidate):
            * dom/PositionIterator.cpp:
            * dom/Range.cpp:
            (WebCore::Range::firstNode):
            * editing/TextIterator.cpp:
            (WebCore::isRendererReplacedElement):
            * editing/TextIterator.h:

2013-11-06  Lucas Forschler  <lforschler@apple.com>

        Merge r158629

    2013-11-04  Samuel White  <samuel_white@apple.com>

            AX: AXShowMenu doesn't always work.
            https://bugs.webkit.org/show_bug.cgi?id=123649

            Reviewed by Chris Fleizach.

            No new tests, the change occurs in a code path that forces the context menu to show which
            locks up DRT if we try to test it (platform menu is shown). The change itself gives the mouse
            event handler a chance to handle our platform mouse event BEFORE the event ends up in the show
            context menu machinery. This is necessary because without it, the element will not become
            focused. Without focus, accessibility shows different/less menu items than a mouse click. The
            end result is that context menus shown via accessibility are consistent with menus shown via click.

            * page/ContextMenuController.cpp:
            (WebCore::ContextMenuController::showContextMenuAt):

2013-11-06  Lucas Forschler  <lforschler@apple.com>

        Merge r154391

    2013-08-21  Brent Fulgham  <bfulgham@apple.com>

            <https://webkit.org/b/120113> [Windows] Enable CSS_IMAGE_SET

            Reviewed by Anders Carlsson.

            We can now activate:
            fast/css/image-set-parsing.html
            fast/css/image-set-parsing-invalid.html

            * WebCore.vcxproj/WebCore.vcxproj: Add missing image set implementation files.
            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
            * css/CSSAllInOne.cpp: Add missing CSSImageSetValue.cpp
            * rendering/style/StyleAllInOne.cpp: Add missing StyeCachedImageSet.cpp

2013-11-04  Lucas Forschler  <lforschler@apple.com>

        Merge r155130

    2013-09-05  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Unreviewed build/link improvement after r155127 to be
            consistent about using debug-build support libraries.

            Now that <rdar://problem/9898937> is resolved, we should be linking
            to debug AVFoundationCF as well.

            * page/CaptionUserPreferencesMediaAF.cpp: Link to AVFoundationCF_debug
            when building with the DEBUG_ALL target.
            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Ditto.
            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Ditto.

2013-11-04  Brent Fulgham  <bfulgham@apple.com>

        Merge r157773

2013-10-21  Brent Fulgham  <bfulgham@apple.com>

        [WIN] Properly support reverse animations without needing software fallback.
        https://bugs.webkit.org/show_bug.cgi?id=85121

        Reviewed by Dean Jackson.

        Testing is provided by existing animation tests.

        * platform/animation/TimingFunction.h:
        (WebCore::CubicBezierTimingFunction::createReversed): Added.
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::addAnimation): The early return when performing a reverse or
        autoreverse animation is no longer needed.
        * platform/graphics/ca/PlatformCAAnimation.h:
        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
        (toCAMediaTimingFunction): Use new reversed function.
        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
        (toCACFTimingFunction): Ditto.
        (PlatformCAAnimation::setTimingFunction): Pass 'reverse' flag.
        (PlatformCAAnimation::setTimingFunctions): Ditto.

2013-11-04  Lucas Forschler  <lforschler@apple.com>

        Merge r154180

    2013-08-15  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Prevent dangling CACFLayer when switching to/from Tiled backing.
            https://bugs.webkit.org/show_bug.cgi?id=119818

            Reviewed by Darin Adler.

            Covered by existing: compositing/tiling/empty-to-tiled.html

            * platform/graphics/ca/win/PlatformCALayerWin.cpp:
            (PlatformCALayer::~PlatformCALayer): Remove deleted layer from its
            parent layer 

2013-11-04  Dean Jackson  <dino@apple.com>

        <rdar://problem/15292359>
        Merge r157299

    2013-10-10  Darin Adler  <darin@apple.com>

            Use after free in WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded
            https://bugs.webkit.org/show_bug.cgi?id=121033

            Reviewed by Dean Jackson.

            For safe iteration, use a set rather than a vector, and remove the clients from
            the set if they are removed during iteration.

            Test: fast/animation/request-animation-frame-remove-client.html

            * platform/graphics/DisplayRefreshMonitor.cpp:
            (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor): Initialize the
            m_clientsToBeNotified pointer to null.
            (WebCore::DisplayRefreshMonitor::removeClient): If there is a m_clientsToBeNotified
            set, remove from it as well as the real m_clients set.
            (WebCore::DisplayRefreshMonitor::displayDidRefresh): Use a HashSet instead of a
            vector for the copy of the clients set we iterate.

            * platform/graphics/DisplayRefreshMonitor.h: Moved some of the BlackBerry-specific
            part of this out of the header. Added a new HashSet pointer, m_clientsToBeNotified,
            to be used to remove clients during the notification process. Also added a FIXME.

            * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp: Moved the
            DisplayAnimationClient class in here.

2013-11-04  Lucas Forschler  <lforschler@apple.com>

        Merge r157436

    2013-10-14  Ryosuke Niwa  <rniwa@webkit.org>

            Crash in WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::createBidiRunsForLine
            https://bugs.webkit.org/show_bug.cgi?id=122776

            Reviewed by Darin Adler.

            Merge https://chromium.googlesource.com/chromium/blink/+/aca89bc4d984705a1f94b623dae0ab03e239a248

            Fix modification of whitespace endpoints to not assume it's operating on RenderTexts

            During line layout, we use midpoints to identify RenderObjects, or parts of
            RenderObjects, that don't need InlineBoxes, usually because of collapsed whitespace.

            Prior to actually creating BidiRuns (the precursor to InlineBoxes), we use
            checkMidpoints to fix up our lineMidpointState to handle the case where we start
            ignoring spaces in our line, but don't stop until somewhere on the following line.
            Previously, this function assumed that the final midpoint (called an endpoint)
            was a RenderText, but this assumption is wrong if we have a beginning midpoint
            created by shouldSkipWhitespaceAfterStartObject (which handles inlines and list
            markers) and no endpoint on that line. In that case, we'd instead adjust the
            position backwards on the beginning midpoint, which would cause us to fail to
            create an InlineBox for the inline or list marker. In the new test added, this
            would actually trigger a crash due to an assumption when visually re-ordering
            BidiRuns that a non-empty line would actually contain at least one such run.

            Test: fast/text/whitespace/whitespace-and-margin-wrap-after-list-marker-crash.html

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::checkMidpoints):

2013-11-01  Brent Fulgham  <bfulgham@apple.com>

        Merge r157070

    2013-10-04  Ojan Vafai  <ojan@chromium.org> and Martin Robinson  <mrobinson@igalia.com>

            [MathML] Remove RenderTree modification during layout and refactor the StretchyOp code
            https://bugs.webkit.org/show_bug.cgi?id=121416

            Reviewed by David Hyatt.

            Tests: mathml/presentation/mo-minus.html
                mathml/presentation/mo-stacked-glyphs.html
                mathml/presentation/mo-stretchy-vertical-bar.html
                mathml/very-large-stretchy-operators.html

            MathML stretched operators by both modifying the width of the operator
            and adding children to the operator node in the render tree.

            Instead we make the operator width equal to the widest glyph possible that we use
            to represent the operator.  Additionally instead of rendering stretchy glyphs via
            stacked operator pieces in separate render tree nodes, keep only one node for the
            glyph, and use a custom paint method to paint the stacked representation.

            With this patch, rendering seems roughly equivalent on Mac and markedly better
            on Linux.

            * css/mathml.css:
            Not sure what this line-height:0 was here for, but it caused bugs with the new code

            * mathml/MathMLTextElement.cpp:
            (WebCore::MathMLTextElement::attach):
            (WebCore):
            (WebCore::MathMLTextElement::childrenChanged):
            Need to update the anonymous render tree below <mo> elements when their
            children change or when the renderer is first attached.

            * mathml/MathMLTextElement.h:
            (MathMLTextElement):
            * rendering/mathml/RenderMathMLBlock.cpp:
            (WebCore::RenderMathMLBlock::RenderMathMLBlock):
            * rendering/mathml/RenderMathMLBlock.h:
            Now that the preferred width doesn't depend on the height, we don't
            need to override computePreferredLogicalWidths at all.

            * rendering/mathml/RenderMathMLFenced.cpp:
            (WebCore::RenderMathMLFenced::makeFences):
            (WebCore::RenderMathMLFenced::styleDidChange):
            Need to update the anonymous renderers for the anonymous RenderMathMLOperators.

            * rendering/mathml/RenderMathMLOperator.cpp:
            (WebCore::RenderMathMLOperator::expandedStretchHeight):
            Store the non-expanded stretch height so that we can detect when the height
            actually changed.

            (WebCore::RenderMathMLOperator::stretchToHeight):
            Only update the style on the anonymous render tree since this is called
            from RenderMathMLRow::layout

            (WebCore::RenderMathMLOperator::styleDidChange):
            (WebCore::RenderMathMLOperator::glyphBoundsForCharacter): A helper to get glyph boundaries.
            (WebCore::RenderMathMLOperator::glyphHeightForCharacter): Ditto for glyph width.
            (WebCore::RenderMathMLOperator::advanceForCharacter): The advance is different from the width,
            and we want the width of the operator to be the advance instead of the tight bounding width.
            (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Use the max of all possible glyphs
            we can use to render this operator.
            (WebCore::RenderMathMLOperator::computeLogicalHeight): Return the stretched operator height, if appropriate.
            (WebCore::RenderMathMLOperator::updateFromElement): We add a child for rendering the non-scaled
            version of the glyph.
            (WebCore::RenderMathMLOperator::firstCharacterForStretching): Helper to figure out what character
            is the character used for stretching operations.
            (WebCore::RenderMathMLOperator::findAcceptableStretchyCharacter): Helper to find an acceptable set
            of glyph pieces for stretching characters.
            (WebCore::RenderMathMLOperator::updateStyle): Resize the operator to the appropriate height and hide
            the child if we are using the stretchy style.
            (WebCore::RenderMathMLOperator::firstLineBoxBaseline):
            (WebCore::RenderMathMLOperator::paintCharacter): Helper to paint a single character component of the
            stretchy glyph.
            (WebCore::RenderMathMLOperator::fillWithExtensionGlyph): Helper to paint the extender glue between
            features of the stretchy glyph.
            (WebCore::RenderMathMLOperator::paint): Properly paint stretchy glyphs.
            * rendering/mathml/RenderMathMLOperator.h: Update method declarations.

2013-11-01  Lucas Forschler  <lforschler@apple.com>

        Merge r158334

    2013-10-30  Brent Fulgham  <bfulgham@apple.com>

            [Win] Legible Output callbacks should happen on notification queue
            https://bugs.webkit.org/show_bug.cgi?id=123545

            Reviewed by Eric Carlson.

            Modify the callback creation for Legible Output items so that they
            are made on our notification queue. The use of the main queue was a
            holdover from some temporary code used during earlier development.

            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::AVFWrapper::AVFWrapper): Assert this happens on the main thread.
            (WebCore::AVFWrapper::~AVFWrapper): Ditto.
            (WebCore::destroyAVFWrapper): Ditto.
            (WebCore::AVFWrapper::createPlayer): Ditto.
            (WebCore::AVFWrapper::createPlayerItem): Ditto.
            Also, instruct LegibleOutput callbacks to happen on our notification
            queue, rather than the main thread.
            (WebCore::AVFWrapper::createAVCFVideoLayer): Assert this happens on the main thread.
            (WebCore::AVFWrapper::destroyVideoLayer): Ditto.
            (WebCore::AVFWrapper::createImageGenerator): Ditto.
            (WebCore::AVFWrapper::destroyImageGenerator): Ditto.

2013-10-31  Lucas Forschler  <lforschler@apple.com>

        Merge r157183

    2013-10-09  Chris Fleizach  <cfleizach@apple.com>

            AX: VoiceOver double speaks all items in <li> nodes
            https://bugs.webkit.org/show_bug.cgi?id=122564

            Reviewed by Brent Fulgham.

            Test: platform/mac/accessibility/native-list-item-should-not-expose-label.html

            * accessibility/AccessibilityNodeObject.cpp:
            (WebCore::AccessibilityNodeObject::visibleText):

2013-10-31  Lucas Forschler  <lforschler@apple.com>

        Merge r157056

    2013-10-07  Tim Horton  <timothy_horton@apple.com>

            Animated images are not restarted when page visibility changes
            https://bugs.webkit.org/show_bug.cgi?id=122464
            <rdar://problem/14293474>

            Reviewed by Simon Fraser.

            Always kickstart animated images when the page visibility changes,
            which can occur via window occlusion, and which is independent of in-window
            state, which we were previously using to advance animation.

            No new tests; attempts to make a test have resulted only in a flaky, timing-dependent test.

            * page/Frame.cpp:
            (WebCore::Frame::resumeActiveDOMObjectsAndAnimations):
            Move this call to resumeAnimatingImages() up to Page.

            * page/FrameView.cpp:
            (WebCore::FrameView::setIsInWindow):
            Move this call to resumeAnimatingImages() up to Page.

            * WebCore.exp.in
            * page/FrameView.h:
            * page/Page.h:
            Move resumeAnimatingImages() itself up to Page.

            * page/Page.cpp:
            (WebCore::Page::setIsInWindow):
            Resume animated images when we move in-window.

            (WebCore::Page::setVisibilityState):
            Resume animated images when we become visible.
            This is the one we were previously missing.

            (WebCore::Page::resumeActiveDOMObjectsAndAnimations):
            Resume animated images when we're told to.

            (WebCore::Page::resumeAnimatingImages):
            Kickstart any animated images in all frames.

2013-10-28  Brent Fulgham  <bfulgham@apple.com>

        
        Merge r155221.

 
    2013-09-06  Brent Fulgham  <bfulgham@apple.com>

            [Windows] StructuredExceptionHandlerSuppressor Causes Bad Interactions with Support Libraries
            https://bugs.webkit.org/show_bug.cgi?id=120901

            Reviewed by Anders Carlsson.

            Change from old "crash on any exception" implementation to a new version that leaves normal
            exception handling infrastructure in place for use by support libraries. We check exceptions
            and decide whether to abort or not based on the failure type.

            * WebCore.vcxproj/WebCore.vcxproj: Add new implementation files.
            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
            * platform/graphics/ca/win/LayerChangesFlusher.cpp:
            (WebCore::LayerChangesFlusher::hookCallback): Allocate handler struct on stack.
            * platform/win/StructuredExceptionHandlerSuppressor.cpp: Added.
            (exceptionShouldTerminateProgram): New.
            (exceptionHandler): New.
            (WebCore::StructuredExceptionHandlerSuppressor::StructuredExceptionHandlerSuppressor): Moved
            from header, and updated to add our new exception handler.
            (WebCore::StructuredExceptionHandlerSuppressor::~StructuredExceptionHandlerSuppressor): Moved
            from header.
            * platform/win/StructuredExceptionHandlerSuppressor.h: Move implementation of constructor and
            destructor from header file.
            * platform/win/makesafeseh.asm: Added.

2013-10-28  Brent Fulgham  <bfulgham@apple.com>

        Merge r155215.

     2013-09-06  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Unreviewed gardening: Spell 'Suppressor' properly

            * WebCore.vcxproj/WebCore.vcxproj: Change StructuredExceptionHandlerSupressor to StructuredExceptionHandlerSuppressor
            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto
            * platform/graphics/ca/win/LayerChangesFlusher.cpp:
            (WebCore::LayerChangesFlusher::hookCallback): Ditto
            * platform/win/StructuredExceptionHandlerSuppressor.h: Copied from platform/win/StructuredExceptionHandlerSupressor.h.
            * platform/win/StructuredExceptionHandlerSupressor.h: Removed.

2013-10-28  Lucas Forschler  <lforschler@apple.com>

        Merge r157298

    2013-10-10  Dean Jackson  <dino@apple.com>

            Use after free in WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded
            http://webkit.org/b/121033

            Reviewed by Darin Adler.

            Add an ASSERT to detect if an animation client will be removed
            during the callback dispatch.

            Test: fast/animation/request-animation-frame-remove-client.html

            * platform/graphics/DisplayRefreshMonitor.cpp:
            (WebCore::DisplayRefreshMonitor::displayDidRefresh):

2013-10-28  Lucas Forschler  <lforschler@apple.com>

        Merge r155554

    2013-09-11  Myles C. Maxfield  <mmaxfield@apple.com>

            Fix nested unicode-bidi: isolate
            https://bugs.webkit.org/show_bug.cgi?id=120504

            Reviewed by Darin Adler.

            When we have a nested isolate renderer if the outer isolate has a text
            and this text is not the first child, the isolated chain is not
            rendered correctly. This happens because constructBidiRunsForSegment
            uses always the first inner isolated renderer as isolated inline
            container. This patch fixes the behavior described changing
            containingIsolate to find the right isolated container.

            Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/840a57050eade39dd04dde0c6603e129b783151c

            Tests: fast/text/international/unicode-bidi-isolate-nested-first-child-text.html
                   fast/text/international/unicode-bidi-isolate-nested-simple.html

            * rendering/InlineIterator.h:
            (WebCore::containingIsolate):
            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::constructBidiRunsForSegment):

2013-10-28  Lucas Forschler  <lforschler@apple.com>

        Merge r155665

    2013-09-12  Tim Horton  <timothy_horton@apple.com>

            [mac] Cache rendered image in PDFDocumentImage
            https://bugs.webkit.org/show_bug.cgi?id=121207

            Reviewed by Simon Fraser.

            Tests: fast/images/pdf-as-image-too-big.html

            * loader/cache/CachedImage.cpp:
            (WebCore::CachedImage::createImage):
            PDFDocumentImage takes a ImageObserver now so that it can report
            decoded data size changes to the memory cache.

            * platform/graphics/Image.h:
            (WebCore::Image::isPDFDocumentImage): Added.

            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::PDFDocumentImage::PDFDocumentImage):
            PDFDocumentImage takes a ImageObserver now so that it can report
            decoded data size changes to the memory cache.

            (WebCore::PDFDocumentImage::applyRotationForPainting):
            Fix up some comments, and use GraphicsContext instead of CG API.

            (WebCore::PDFDocumentImage::cacheParametersMatch):
            Determine whether our cached image is still valid, given the new
            destination's size, CTM scale, and source rect.

            (WebCore::transformContextForPainting): Added.

            (WebCore::PDFDocumentImage::updateCachedImageIfNeeded):
            Cache a rendered bitmap of the PDF. Invalidate the cache if cacheParametersMatch
            decides that the parameters don't match, unless we're painting in low quality mode,
            in which case we'll scale the existing image (and then fully repaint when the
            high-quality repaint timer fires).
            Inform the memory cache of our new size.

            (WebCore::PDFDocumentImage::draw):
            Update the cached image if needed.
            Paint the cached image into the context if it's available (which it might not be,
            if the image is way too big and the allocation fails). Otherwise, paint straight
            into the context as we previously did.

            (WebCore::PDFDocumentImage::destroyDecodedData):
            Throw away the cached image if requested.

            (WebCore::PDFDocumentImage::decodedSize):
            (WebCore::PDFDocumentImage::drawPDFPage):
            Drive-by use GraphicsContext instead of CG directly.

            * platform/graphics/cg/PDFDocumentImage.h:
            (WebCore::PDFDocumentImage::create):
            Override isPDFDocumentImage().
            Add storage for the cached image buffer and various cache parameters.

            * rendering/ImageQualityController.cpp:
            (WebCore::ImageQualityController::shouldPaintAtLowQuality):
            PDFDocumentImage is also interested in/capable of low-quality painting now.

2013-10-28  Lucas Forschler  <lforschler@apple.com>

        Merge r155664

    2013-09-12  Tim Horton  <timothy_horton@apple.com>

            Image doesn't always repaint at high quality in all tiles after a live resize
            https://bugs.webkit.org/show_bug.cgi?id=121244

            Reviewed by Darin Adler.

            Currently, ImageQualityController removes an image from its low-quality-images
            list from inside shouldPaintAtLowQuality, if this is the first paint outside
            of a live resize, but does not force the renderer to repaint in its entirety.

            However, there's no guarantee we've invalidated the whole renderer, so this can
            leave some parts of the image painted in low-quality.

            This just removes a short-circuit, instead using the ordinary high-quality-repaint
            timer to ensure that the entire renderer is repainted.

            No new test; all attempts have failed, as this depends on tiled drawing
            and a live resize occurring.

            * rendering/ImageQualityController.cpp:
            (WebCore::ImageQualityController::shouldPaintAtLowQuality):

2013-10-28  Lucas Forschler  <lforschler@apple.com>

    Rollout 158067.

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r155608

    2013-09-12  Zalan Bujtas  <zalan@apple.com>

            Crash in ScrollingStateStickyNode::updateConstraints
            https://bugs.webkit.org/show_bug.cgi?id=119638

            Reviewed by Simon Fraser.

            Ensure when a scrolling state node is removed from the state tree,
            we remove both the current node and all its children from the
            associated m_stateNodeMap lookup table.

            Test: fast/css/sticky/multiple-layers-sticky-crash.html

            * page/scrolling/ScrollingStateNode.cpp:
            (WebCore::ScrollingStateNode::removeChild):
            (WebCore::ScrollingStateNode::willBeRemovedFromStateTree):
            * page/scrolling/ScrollingStateNode.h:

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r155546

    2013-09-10  Simon Fraser  <simon.fraser@apple.com>

            REGRESSION (143483): overflow:hidden doesn't quash big repaints from text-indent: -9999px
            https://bugs.webkit.org/show_bug.cgi?id=121137

            Reviewed by Ryosuke Niwa.

            The change in r143483 made it so that negative text-indent gets added
            to visual oveflow even when we have overflow:hidden, which is really bad
            because it causes large repaints (and large layers) for a common-on-the-web
            pattern.

            Revert the change, and add a new test to make sure it doesn't regress.

            I can't reproduce the bug it was trying to fix with the change reverted.

            Tests: compositing/geometry/negative-text-indent-with-overflow-hidden-layer.html
                   fast/repaint/negative-text-indent-with-overflow-hidden.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::computeOverflow):

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r155468

    2013-09-10  Tim Horton  <timothy_horton@apple.com>

            [mac] PDFDocumentImage should use PDFKit to draw
            https://bugs.webkit.org/show_bug.cgi?id=120651
            <rdar://problem/12810731>

            Unreviewed hopeful build fix.

            * platform/graphics/mac/PDFDocumentImageMac.mm:

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r155461

    2013-09-10  Tim Horton  <timothy_horton@apple.com>

            [mac] PDFDocumentImage should use PDFKit to draw
            https://bugs.webkit.org/show_bug.cgi?id=120651
            <rdar://problem/12810731>

            Reviewed by Alexey Proskuryakov.

            Use PDFKit to draw PDF-in-<img> on Mac, so that annotations in PDF are painted.

            Test: fast/images/pdf-as-image-with-annotations.html

            * WebCore.xcodeproj/project.pbxproj:
            Add PDFDocumentImageMac.mm.

            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::PDFDocumentImage::PDFDocumentImage):
            We don't need to initialize m_document anymore because it's now a RetainPtr.
            Initialize m_hasPage to false.

            (WebCore::PDFDocumentImage::~PDFDocumentImage):
            We don't need to manually release our CGPDFDocumentRef anymore because it's now a RetainPtr.

            (WebCore::PDFDocumentImage::size):
            Use expandedIntSize for explicitness.

            (WebCore::PDFDocumentImage::applyRotationForPainting):
            Rename adjustCTM to applyRotationForPainting, and move the one non-rotation related transformation out.
            We need to do this because PDFKit applies the rotation transformation itself, so we don't need to.
            Also, explicitly use std::min instead of importing the whole std namespace.

            (WebCore::PDFDocumentImage::dataChanged):
            Assert that we don't re-enter dataChanged after we've created a document,
            because it seems like that shouldn't happen - we only create a document when
            we've supposedly received all data, and it would be nice if we didn't have
            all this varying code to deal with SharedBuffers changing out from under each other.
            Factor the code to create a CGPDFDocumentRef out into createPDFDocument, so we can
            replace it with a different implementation that creates a PDFDocument.

            (WebCore::PDFDocumentImage::setCurrentPage):
            Make all page-number-related things unsigned, since they are in CG and PDFKit,
            and add m_hasPage to denote whether we've acquired a valid page yet.
            Factor code to retrieve the PDF box bounds into computeBoundsForCurrentPage.
            Remove setCurrentPage itself, as we never use a page other than the first page;
            we will call computeBoundsForCurrentPage and set hasPage in dataChanged, now.

            (WebCore::PDFDocumentImage::draw):
            Fix a weird comment.
            Factor code that actually draws the PDF out into drawPDFPage.

            The rest of the functions in this file are only built for USE(CG) && !PLATFORM(MAC):

            (WebCore::PDFDocumentImage::createPDFDocument):
            Factored out of dataChanged(). Use the PLATFORM(MAC) way of making a
            CGDataProvider from a SharedBuffer everywhere; we're already using it on
            iOS, and it should also work for Windows, the only other USE(CG) platform.
            Since we only createPDFDocument() after all data has been received, remove
            the comment about the SharedBuffer being secretly written to behind its back.

            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
            Factored out of setCurrentPage().
            Use deg2rad since we have it.

            (WebCore::PDFDocumentImage::pageCount):
            (WebCore::PDFDocumentImage::drawPDFPage):
            Factored out of draw().
            Reduced an unnecessary transform (we were effectively doing mediaBox.origin - cropBox.origin - mediaBox.origin).

            * platform/graphics/cg/PDFDocumentImage.h:
            Unindent all the things, as we don't indent the first level inside a namespace scope.
            Forward-declare PDFDocument.
            Make m_currentPage unsigned as it should be.
            Add m_hasPage.
            Make m_document a PDFDocument on PLATFORM(MAC) and a CGPDFDocumentRef on other platforms.

            * platform/graphics/mac/PDFDocumentImageMac.mm: Added.
            Soft-link in PDFKit and specifically the PDFDocument class.

            (WebCore::PDFDocumentImage::createPDFDocument):
            Create our PDFDocument from the SharedBuffer's NSData directly. This shouldn't be a problem
            (with respect to the SharedBuffer's data being appended to in secret), because we've waited
            for the document to finish loading before getting here.

            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
            Ask PDFKit for the page's media and crop boxes; it automatically performs the correct fallback.
            Ask PDFKit for the page's rotation.

            (WebCore::PDFDocumentImage::pageCount):
            Ask PDFKit for the page count.

            (WebCore::PDFDocumentImage::drawPDFPage):
            Paint the current page of the PDF. Note that we do not apply the rotation here
            via applyRotationForPainting because PDFKit will do it itself.
            Save and restore two bits of CG state which aren't saved and restored with the
            graphics state, as PDFKit can mutate them above us (<rdar://problem/14951759>).

            * platform/mac/SoftLinking.h:
            I couldn't find any clients of SOFT_LINK_FRAMEWORK_IN_CORESERVICES_UMBRELLA,
            so I made it the more generic SOFT_LINK_FRAMEWORK_IN_UMBRELLA, taking the name
            of the umbrella framework and the subframework, so I could use it to soft link
            Quartz.framework's PDFKit.framework.

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r155127

    2013-09-04  Anders Carlsson  <andersca@apple.com>

            Vector::releaseBuffer should return an OwnPtr
            https://bugs.webkit.org/show_bug.cgi?id=120718

            Reviewed by Andreas Kling.

            Change FormStreamFields::currentData to an OwnPtr.

            * platform/network/cf/FormDataStreamCFNet.cpp:
            (WebCore::closeCurrentStream):
            (WebCore::advanceCurrentStream):
            (WebCore::formCreate):

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r154915

    2013-08-30  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Update to incorporate additional suggestions
            https://bugs.webkit.org/show_bug.cgi?id=120448

            Reviewed by Darin Adler

            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: Add
            notes as to why AVFoundationCF needs this extra method call.
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h: Use OVERRIDE
            * rendering/RenderVideo.cpp: Replace ternary operator with logical &&.

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r154914

    2013-08-30  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Vide element in page always uses non-hw accelerated mode.
            https://bugs.webkit.org/show_bug.cgi?id=120448

            Reviewed by Darin Adler

            This patch is unfortunately larger than my original idea, but seems to make the
            layout system happier. Instead of switching into composited mode when building
            the media player, we now build the original layout tree with compositing active
            if the underlying media element requires it. The AVFoundationCF player needs to
            have the compositor available at construction time so it can attach to the
            rendering device. Otherwise it falls back to CPU-only mode.

            * platform/graphics/MediaPlayer.cpp:
            (WebCore::MediaPlayer::requiresImmediateCompositing): Added
            * platform/graphics/MediaPlayer.h:
            * platform/graphics/MediaPlayerPrivate.h:
            (WebCore::MediaPlayerPrivateInterface::requiresImmediateCompositing): Added
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::MediaPlayerPrivateAVFoundationCF::createAVPlayer): Added
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
            (WebCore::MediaPlayerPrivateAVFoundationCF::requiresImmediateCompositing):
            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::requiresCompositingForVideo): Uses new
            'requiresImmediateCompositing' to short-circuit check for whether a
            compositor is required.
            * rendering/RenderVideo.cpp:
            (WebCore::RenderVideo::requiresImmediateCompositing):
            * rendering/RenderVideo.h:

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r154890

    2013-08-30  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Video inside page always uses non-hardware accelerated playback
            https://bugs.webkit.org/show_bug.cgi?id=120448

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::MediaPlayerPrivateAVFoundationCF::createAVPlayer): Check for
            D3D device. If it doesn't exist, switch to compositing mode and try again.

2013-10-25  Lucas Forschler  <lforschler@apple.com>

        Merge r154856

    2013-08-29  Tim Horton  <timothy_horton@apple.com>

            SVG clipping, masking, and gradients-on-text do not respect the device scale factor
            https://bugs.webkit.org/show_bug.cgi?id=120377
            <rdar://problem/14777944>

            Reviewed by Simon Fraser.

            Tests: svg/custom/masking-clipping-hidpi.svg

            calculateTransformationToOutermostCoordinateSystem should include the page's
            device scale factor in its transform.

            * rendering/svg/SVGRenderingContext.cpp:
            (WebCore::SVGRenderingContext::calculateTransformationToOutermostCoordinateSystem):

2013-10-24  Lucas Forschler  <lforschler@apple.com>

        Merge r154694

    2013-08-27  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Correct method call for characteristic update.

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged):
            [Windows] Correct method call (should have been "characteristicsChanged", not
            "player()->characteristicChanged()"

2013-10-24  Lucas Forschler  <lforschler@apple.com>

        Merge r154693

    2013-08-26  Brent Fulgham  <bfulgham@apple.com>

            [Windows] some track language tags are not recognized
            https://bugs.webkit.org/show_bug.cgi?id=120335

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: Revise implementation
            to match logic in platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjc.mm

2013-10-24  Lucas Forschler  <lforschler@apple.com>

        Merge r154681

    2013-08-27  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Column Breakpoint not working, may be off by 1
            https://bugs.webkit.org/show_bug.cgi?id=120334

            Reviewed by David Kilzer.

            JavaScriptCore changed to 1-based column numbers at some point. We
            need to update the ScriptDebugger assumption that they were 0-based.

            Test: inspector-protocol/debugger/column-breakpoint.html

            * bindings/js/ScriptDebugServer.cpp:
            (WebCore::ScriptDebugServer::createCallFrame):
            (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
2013-10-24  Lucas Forschler  <lforschler@apple.com>

        Merge r154647

    2013-08-23  Andy Estes  <aestes@apple.com>

            Fix issues found by the Clang Static Analyzer
            https://bugs.webkit.org/show_bug.cgi?id=120230

            Reviewed by Darin Adler.

            * WebCore.xcodeproj/project.pbxproj: Removed FoundationExtras.h.
            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm: Removed CFAutoreleaseHelper().
            (AXTextMarkerRange): Used HardAutorelease() instead of
            CFAutoreleaseHelper().
            (AXTextMarkerRangeStart): Ditto.
            (AXTextMarkerRangeEnd): Ditto.
            (textMarkerForVisiblePosition): Ditto.
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (-[WebCoreAVFMovieObserver initWithCallback:]): Called [super init]
            first so that we don't later use ivars from the wrong self.
            (-[WebCoreAVFLoaderDelegate initWithCallback:]): Ditto.
            * platform/mac/FoundationExtras.h: Removed.
            * platform/mac/KURLMac.mm:
            (WebCore::KURL::operator NSURL *): Used WTF's HardAutorelease().
            * platform/mac/WebCoreNSURLExtras.mm:
            (WebCore::mapHostNameWithRange): Used HardAutorelease() instead of
            WebCoreCFAutorelease().
            (WebCore::URLWithData): Ditto.
            (WebCore::userVisibleString): Ditto.
            (WebCore::URLByRemovingComponentAndSubsequentCharacter): Used Vector<>
            with an inline capacity rather than heap-allocating a buffer.
            * platform/mac/WebCoreObjCExtras.h: Used HardAutorelease() instead of
            WebCoreCFAutorelease().
            * platform/text/mac/StringImplMac.mm:
            (WTF::StringImpl::operator NSString *): Used WTF's HardAutorelease().

2013-10-24  Lucas Forschler  <lforschler@apple.com>

        Merge r154527

    2013-08-23  Eric Carlson  <eric.carlson@apple.com>

            [Mac] some track language tags are not recognized
            https://bugs.webkit.org/show_bug.cgi?id=119643

            Reviewed by Jere Noble.

            No new tests, existing tests updated.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_captionDisplayMode from settings
                if possible.
            (WebCore::HTMLMediaElement::configureTextTrackGroup): Don't enable a default track when preferences
                say captions should be disabled. Don't disable an already visible track if we don't find
                a match unless preferences say captions should be disabled. m_forcedOrAutomaticSubtitleTrackLanguage ->
                m_subtitleTrackLanguage.
            (WebCore::HTMLMediaElement::mediaPlayerCharacteristicChanged): If the language of the primary
                audio track changes, only kick off a text track recalc if caption preference are set to "automatic".
            * html/HTMLMediaElement.h:

            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
            (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation): Initialize m_characteristicsChanged
                and m_delayCharacteristicsChangedNotification.
            (WebCore::MediaPlayerPrivateAVFoundation::setHasVideo): Call characteristicsChanged.
            (WebCore::MediaPlayerPrivateAVFoundation::setHasAudio): Ditto.
            (WebCore::MediaPlayerPrivateAVFoundation::setHasClosedCaptions): Ditto.
            (WebCore::MediaPlayerPrivateAVFoundation::characteristicsChanged): New, allows us to coalesce 
                calls to the media player when we know several characteristics may change.
            (WebCore::MediaPlayerPrivateAVFoundation::setDelayCharacteristicsChangedNotification): Enable or
                disable notification delay.
            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Always call languageOfPrimaryAudioTrack(),
                a track may have changed so we may have a new language.
            (WebCore::MediaPlayerPrivateAVFoundationObjC::languageOfPrimaryAudioTrack): Call [AVAssetTrack languageCode]
                if [AVAssetTrack extendedLanguageTag] returns NULL in case the media file has an old
                QuickTime language code.

2013-10-24  Lucas Forschler  <lforschler@apple.com>

        Merge r154308

    2013-08-19  Ryosuke Niwa  <rniwa@webkit.org>

            <https://webkit.org/b/119930> input[type=range]: Fix a crash by changing input type in 'input' event handler

            Reviewed by Kent Tamura.

            Merge https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5

            In SliderThumbElement::setPositionFromPoint, renderer() can be NULL after HTMLInputElement::setValueFromRenderer,
            which dispatches 'input' event. Also, make a local vairable 'input' a RefPtr just in case.

            Also add null-poinetr checks for the host element as SliderThumbElement only weakly holds onto the host element.

            Test: fast/forms/range/range-type-change-oninput.html

            * html/shadow/SliderThumbElement.cpp:
            (WebCore::SliderThumbElement::isDisabledFormControl):
            (WebCore::SliderThumbElement::matchesReadOnlyPseudoClass):
            (WebCore::SliderThumbElement::matchesReadWritePseudoClass):
            (WebCore::SliderThumbElement::setPositionFromPoint):
            (WebCore::SliderThumbElement::hostInput):

2013-10-21  Lucas Forschler  <lforschler@apple.com>

        Merge r154289

    2013-08-19  Ryosuke Niwa  <rniwa@webkit.org>

            ASSERTION FAILED: !node || node->isShadowRoot() in WebCore::EventRetargeter::eventTargetRespectingTargetRules
            https://bugs.webkit.org/show_bug.cgi?id=119720

            Reviewed by Andy Estes.

            Merge https://chromium.googlesource.com/chromium/blink/+/4ce9bfbf54410179cd0f18b3d1a912045fc0ec3d

            * dom/EventRetargeter.h:
            (WebCore::EventRetargeter::eventTargetRespectingTargetRules):

2013-10-21  Lucas Forschler  <lforschler@apple.com>

        Merge r154183

    2013-08-16  Brady Eidson  <beidson@apple.com>

            (NetworkProcess)  Sync XHRs should load using async ResourceHandles, not ResourceHandle::loadResourceSynchronously
            https://bugs.webkit.org/show_bug.cgi?id=119493

            Reviewed by Alexey Proskuryakov.

            No new tests (Covered by plenty of existing tests).

            * WebCore.exp.in:
            * WebCore.xcodeproj/project.pbxproj:

            * platform/network/SynchronousLoaderClient.h: Make platformBadResponseError public

            * platform/network/mac/ResourceHandleMac.mm:
            (WebCore::ResourceHandle::platformLoadResourceSynchronously): Add comments/FIXMEs spelling out how wrong this code is.

2013-10-21  Lucas Forschler  <lforschler@apple.com>

        Merge r153975

    2013-08-12  Ryosuke Niwa  <rniwa@webkit.org>

            Fix NULL de-refernce in HTMLAnchorElement::sendPings when settings doesn't exist
            https://bugs.webkit.org/show_bug.cgi?id=119716

            Reviewed by Darin Adler.

            Merge https://chromium.googlesource.com/chromium/blink/+/d5783da353ab783e9994b8fbecd91880be5192a1

            No new tests since the test in the Blink change doesn't reproduce crash on WebKit.

            * html/HTMLAnchorElement.cpp:
            (WebCore::HTMLAnchorElement::sendPings):

2013-10-21  Lucas Forschler  <lforschler@apple.com>

        Merge r153920

    2013-08-09  Jer Noble  <jer.noble@apple.com>

            Crash in com.apple.WebKit.WebContent at com.apple.MediaToolbox.
            https://bugs.webkit.org/show_bug.cgi?id=119645

            Reviewed by Eric Carlson.

            Work around crash caused by <rdar://problem/14688471> by releasing
            m_request as soon as keys have been added to it.

            * Modules/encryptedmedia/CDMPrivateAVFoundation.mm:
            (WebCore::CDMSessionAVFoundation::update):

2013-10-21  Lucas Forschler  <lforschler@apple.com>

        Merge r153913

    2013-08-09  Alexey Proskuryakov  <ap@apple.com>

            REGRESSION (r142755): window.open creates an invisible window when width and height are 0
            https://bugs.webkit.org/show_bug.cgi?id=119633

            Reviewed by Darin Adler.

            Test: fast/dom/Window/open-zero-size-as-default.html

            Relying on each WebKit to refuse setting size to zero was fragile - because this
            required each one to have the check, and because by the time the client was called,
            the initially zero size was not necessarily zero.

            * loader/FrameLoader.cpp: (WebCore::createWindow): When sizes are zero, keep the
            size the window was created with, because that's the default one by definition.

            * page/DOMWindow.cpp: (WebCore::DOMWindow::adjustWindowRect): It's too late to
            check for zero size now, it's been mangled to adjust for the difference between
            window and viewport size.

2013-10-21  Lucas Forschler  <lforschler@apple.com>

        Merge r153909

    2013-08-09  Dean Jackson  <dino@apple.com>

            Captions menu needs to reset text-align
            https://bugs.webkit.org/show_bug.cgi?id=119637

            Reviewed by Eric Carlson.

            Reset the text-align property on the menu so that it
            doesn't get the inherited value. The full fix for all
            controls is http://webkit.org/b/116100.

            * css/mediaControlsQuickTime.css:
            (video::-webkit-media-controls-closed-captions-container):

2013-10-21  Lucas Forschler  <lforschler@apple.com>

        Merge r153877

    2013-08-08  Tim Horton  <timothy_horton@apple.com>

            navigator.plugins has plugins in it when plugins are disabled
            https://bugs.webkit.org/show_bug.cgi?id=119607
            <rdar://problem/14678030>

            Reviewed by Anders Carlsson.

            Test: plugins/navigator-plugins-disabled.html

            * page/Settings.cpp:
            (WebCore::Settings::setPluginsEnabled):
            Refresh the plugin database when plugins are enabled or disabled.
            This is necessary to ensure that navigator.plugins will have the
            correct set of plugins after dynamically changing whether plugins
            are enabled, which makes the test for this patch possible (but it
            makes sense in the browser as well).

2013-09-06  Lucas Forschler  <lforschler@apple.com>

        Merge r155203

    2013-09-06  Mike West  <mkwst@chromium.org>

            Revalidation header blacklisting should be case-insensitive.
            https://bugs.webkit.org/show_bug.cgi?id=120832

            Reviewed by Alexey Proskuryakov.

            Headers like 'content-type' should be ignored for 304 responses,
            even if they are delivered as 'Content-Type', or 'CoNtEnT-TyPe', etc.

            I broke this behavior in http://trac.webkit.org/changeset/142068
            ("Entity-header extension headers honored on 304 responses"). Pages like
            https://learndev.unm.edu/ currently break on reload, as they incorrectly
            send 'Content-Type: text/plain' for 304 responses for resources like
            CSS and JavaScript. The browser should drop these headers, but because
            we're comparing in a case-sensitive fashion, we don't.

            https://code.google.com/p/chromium/issues/detail?id=246875 documents the
            Blink-side fix; this patch is a port of that patch.

            Test: http/tests/cache/content-type-ignored-during-revalidation.html

            * loader/cache/CachedResource.cpp:
            (WebCore::shouldUpdateHeaderAfterRevalidation):
            Compare the provided AtomicString 'header' to the revalidation
            blacklists in a case-insensitive fashion.

2013-09-05  Lucas Forschler  <lforschler@apple.com>

        Merge r154037

    2013-08-13  Ryosuke Niwa  <rniwa@webkit.org>

            REGRESSION(r150187): Safari fails to render allrecipe.com comment popups
            https://bugs.webkit.org/show_bug.cgi?id=119780

            Reviewed by Benjamin Poulain.

            The bug was caused by SelectorDataList::executeFastPathForIdSelector not verifying that
            elements found by getAllElementsById are descendents of rootNode when there are multiple
            elements of the same id. This resulted in querySelector and querySelectorAll of an element
            returning nodes outside of the element.

            Fixed the bug by checking this condition when we have multiple elements of the same id.

            Test: fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html

            * dom/SelectorQuery.cpp:
            (WebCore::SelectorDataList::executeFastPathForIdSelector):

2013-09-04  Dean Jackson  <dino@apple.com>

        <rdar://problem/14910916> Disable CSS_SHAPES on safari-537-branch

        Reviewed by Beth Dakin.

        * Configurations/FeatureDefines.xcconfig:

2013-09-04  Lucas Forschler  <lforschler@apple.com>

        Merge r155014

    2013-09-03  Enrica Casucci  <enrica@apple.com>

            Can't select Katakana word by double-clicking.
            <rdar://problem/14654926>

            Reviewed by Alexey Proskuryakov and Ryosuke Niwa.

            For some languages, like Japanese we need
            to use more context for word breaking.

            New test: editing/selection/doubleclick-japanese-text.html

            * platform/text/TextBoundaries.h:
            (WebCore::requiresContextForWordBoundary):

2013-09-02  Lucas Forschler  <lforschler@apple.com>

        Merge r154785

    2013-08-28  Simon Fraser  <simon.fraser@apple.com>

            Fix compositing layers in columns
            https://bugs.webkit.org/show_bug.cgi?id=120436

            Reviewed by Dave Hyatt.

            Remove the old hack in RenderLayer::updateLayerPosition() for placing
            layers in columns, which changed the layer position for composited
            layers; this broke hit-testing.

            Fix a better way by moving compositing layers to the correct
            positions that take column offsets into account, by fixing
            RenderLayer::convertToLayerCoords() to optionally apply column
            adjustment, and using this in the code which positions compositing layers.

            Tests: compositing/columns/ancestor-clipped-in-paginated.html
                   compositing/columns/clipped-in-paginated.html
                   compositing/columns/composited-columns-vertical-rl.html
                   compositing/columns/composited-columns.html
                   compositing/columns/composited-in-paginated-rl.html
                   compositing/columns/composited-in-paginated-writing-mode-rl.html
                   compositing/columns/composited-lr-paginated-repaint.html
                   compositing/columns/composited-rl-paginated-repaint.html
                   compositing/columns/hittest-composited-in-paginated.html
                   compositing/columns/rotated-in-paginated.html
                   compositing/columns/untransformed-composited-in-paginated.html

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::updateLayerPosition):
            (WebCore::RenderLayer::convertToPixelSnappedLayerCoords):
            (WebCore::accumulateOffsetTowardsAncestor):
            (WebCore::RenderLayer::convertToLayerCoords):
            * rendering/RenderLayer.h:
            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::updateCompositedBounds):
            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):

2013-08-26  Lucas Forschler  <lforschler@apple.com>

        Merge r154528

    2013-08-23  Beth Dakin  <bdakin@apple.com>

            REGRESSION (r132545): Some PDFs generated by WebKit are blank when viewed in 
            Adobe Reader
            https://bugs.webkit.org/show_bug.cgi?id=120240
            -and corresponding-
            <rdar://problem/14634453>

            Reviewed by Anders Carlsson.

            This patch makes it so that we don’t use the infinite rect for the PDF context, 
            and it adds WebCoreSystemInterface API to find out if the current content is the 
            PDF context. 

            * WebCore.exp.in:
            * platform/graphics/cg/GraphicsContextCG.cpp:
            (WebCore::GraphicsContext::clipOut):
            * platform/mac/WebCoreSystemInterface.h:
            * platform/mac/WebCoreSystemInterface.mm:

2013-08-26  Lucas Forschler  <lforschler@apple.com>

        Merge r154529

    2013-08-23  Jer Noble  <jer.noble@apple.com>

            REGRESSION (r150516): Media controls are messed up on right-to-left webpages
            https://bugs.webkit.org/show_bug.cgi?id=120234

            Reviewed by Dan Bernstein.

            Test: media/video-rtl.html

            Make the media control panel explicitly direction:ltr. The captions menu and captions
            display are unaffected, so rtl content will continue to appear rtl there.

            * css/mediaControls.css:
            (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):

2013-08-26  Lucas Forschler  <lforschler@apple.com>

        Merge r154535

    2013-08-23  Simon Fraser  <simon.fraser@apple.com>

            Improve scrolling behavior in iTunes
            https://bugs.webkit.org/show_bug.cgi?id=120241
            <rdar://problem/14825344>

            Reviewed by Sam Weinig.

            When vertically scrolling a page with horizontally scrollable overflow areas,
            vertical scroll gestures would be interrupted when wheel events with non-zero
            X deltas were intercepted by the overflow areas.

            Fix by storing a small history of wheel events deltas and using
            it to determine of the scroll gesture is primarily vertical or horizontal.
            When this is detected, avoid dispatching scroll events on the on the
            non-dominant axis.

            Currently this behavior is conditionalized to only apply in iTunes.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::EventHandler):
            (WebCore::EventHandler::recordWheelEventDelta):
            (WebCore::deltaIsPredominantlyVertical):
            (WebCore::EventHandler::dominantScrollGestureDirection):
            (WebCore::EventHandler::handleWheelEvent):
            (WebCore::EventHandler::defaultWheelEventHandler):
            * page/EventHandler.h:
            * platform/RuntimeApplicationChecks.cpp:
            (WebCore::applicationIsITunes):
            * platform/RuntimeApplicationChecks.h:

2013-08-21  Lucas Forschler  <lforschler@apple.com>

        Merge r154378

    2013-08-20  Jer Noble  <jer.noble@apple.com>

            <https://webkit.org/b/120101> [Mac] Suspended HTMLMediaElements can still hold power assertion after playback stops.

            Reviewed by Eric Carlson.

            Call updateDisplaySleep() when we clear our MediaPlayer, as doing so may kill any in-flight
            rateChanged() notifications.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::clearMediaPlayer):
            (WebCore::HTMLMediaElement::stop):

2013-08-16  Lucas Forschler  <lforschler@apple.com>

        Merge r154147

    2013-08-15  Simon Fraser  <simon.fraser@apple.com>

            <https://webkit.org/b/119871> Flash of garbage pixels when playing a show on Hulu

            Reviewed by Tim Horton.

            When starting a show on Hulu, there's a layer that gets marked as
            opaque because it has a child RenderLayer whose background fills the
            compositing layer. That child RenderLayer was recently position:fixed
            but outside the viewport, so its viewportConstrainedNotCompositedReason
            was set to a non-zero value.

            However, we failed to clear the viewportConstrainedNotCompositedReason
            when the layer became non-fixed. This caused painting the opaque
            layer to bail in RenderLayer::paintLayer(), leaving garbage.

            Test: compositing/contents-opaque/fixed-to-nonfixed.html

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::paintLayer): Add an assertion to catch this error in future.
            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::updateBacking): Make sure we clear the
            ViewportConstrainedNotCompositedReason if the layer is no longer fixed.

2013-08-15  Lucas Forschler  <lforschler@apple.com>

        Merge r154115

    2013-08-15  Andy Estes  <aestes@apple.com>

            <https://webkit.org/b/119853> REGRESSION (r139343): WebKit crashes when canceling a load inside webView:resource:didFinishLoadingFromDataSource:

            Reviewed by Brady Eidson.

            A client implementing webView:resource:didFinishLoadingFromDataSource:
            might decide to call stopLoading: for the identifier that just finished
            loading. If this happens we re-enter the loader and attempt to cancel a
            load that has already finished and been removed from the set of active
            loaders. Prevent this by clearing DocumentLoader's
            m_identifierForLoadWithoutResourceLoader before calling
            dispatchDidFinishLoading().

            New API test: WebKit1.StopLoadingFromDidFinishLoading.

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::finishedLoading): Set
            m_identifierForLoadWithoutResourceLoader to 0 before calling
            dispatchDidFinishLoading().

2013-08-15  Lucas Forschler  <lforschler@apple.com>

        Merge r154123

    2013-08-15  Chris Fleizach  <cfleizach@apple.com>

            <https://webkit.org/b/119824> AX: WKView does not become first responder when the voiceover cursor lands on it

            Reviewed by Darin Adler.

            Incorporate review feedback from Darin.

            * accessibility/AccessibilityScrollView.cpp:
            (WebCore::AccessibilityScrollView::canSetFocusAttribute):
            (WebCore::AccessibilityScrollView::isFocused):
            * accessibility/AccessibilityScrollView.h:

2013-08-15  Lucas Forschler  <lforschler@apple.com>

        Merge r154083

    2013-08-14  Chris Fleizach  <cfleizach@apple.com>

            <https://webkit.org/b/119824> AX: WKView does not become first responder when the voiceover cursor lands on it

            Reviewed by Tim Horton.

            VoiceOver lands on Scroll views by default. It expects that the scroll view will be able to handle the focus calls. 
            We should forward scroll view focus requests to the web area to handle, which will trigger a becomeFirstResponder on WKView.

            There's not a great way to test this unfortunately, since it requires having focus comes from outside the webview into the webview.

            * accessibility/AccessibilityScrollView.cpp:
            (WebCore::AccessibilityScrollView::canSetFocusAttribute):
            (WebCore::AccessibilityScrollView::isFocused):
            (WebCore::AccessibilityScrollView::setFocused):
            * accessibility/AccessibilityScrollView.h:

2013-08-14  Lucas Forschler  <lforschler@apple.com>

        Merge r154030

    2013-08-13  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Windows is incorrectly using a LayerTypeTiledBackingLayer
            https://bugs.webkit.org/show_bug.cgi?id=119772

            Reviewed by Simon Fraser.

            * platform/graphics/ca/GraphicsLayerCA.cpp:
            (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer): Ensure that we use
            the correct (supported) tiled layer type for Windows.
            * platform/graphics/ca/win/PlatformCALayerWin.cpp:
            (PlatformCALayer::PlatformCALayer): Add an assertion to notify us if
            we introduce this mistake again in the future.

2013-08-12  Lucas Forschler  <lforschler@apple.com>

        Merge r153917

    2013-08-09  Anders Carlsson  <andersca@apple.com>

            Artifacts seen sometimes with layer backed WebKit1 plug-in
            https://bugs.webkit.org/show_bug.cgi?id=119647
            <rdar://problem/14002715>

            Reviewed by Beth Dakin.

            Don't try to paint layer backed views - they will be painted by Core Animation.

            * platform/mac/WidgetMac.mm:
            (WebCore::Widget::paint):

2013-08-09  Lucas Forschler  <lforschler@apple.com>

        Merge r153907

    2013-08-09  Beth Dakin  <bdakin@apple.com>

            AX: Not able to use arrow keys to read text in a WK2 app
            https://bugs.webkit.org/show_bug.cgi?id=119605
            -and corresponding-
            <rdar://problem/14281275>

            Reviewed by Darin Adler.

            This code from defaultKeyboardEventHandler() is the magic that makes this AX 
            functionality work. This patch moves that into a separate function so that we can 
            call it from WK2.
            * WebCore.exp.in:
            * page/EventHandler.cpp:
            (WebCore::EventHandler::handleKeyboardSelectionMovementForAccessibility):
            (WebCore::EventHandler::defaultKeyboardEventHandler):
            * page/EventHandler.h:

2013-08-09  Lucas Forschler  <lforschler@apple.com>

        Merge r153809

    2013-08-07  Simon Fraser  <simon.fraser@apple.com>

            Be more aggressive about sending fake mouse events less frequently
            https://bugs.webkit.org/show_bug.cgi?id=119563
            <rdar://problem/14669029>

            Reviewed by Tim Horton.

            r109151 added code that throttles back the fake mouse events that we
            send during scrolling, but in such a way that a page could take up to
            100ms to handle a single mousemove, and we'd still send fake mousemove
            events every 100ms. This could cause serious scrolling stutter.

            Fix by changing when we drop back to sending events every 250ms, rather than every
            100ms: if the slowest mousemove takes 10ms or more (less than one frame), drop back
            to a 250ms fake move interval.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon):

2013-08-08  Lucas Forschler  <lforschler@apple.com>

        Merge r153867

    2013-08-08  Jer Noble  <jer.noble@apple.com>

            [EME] MediaKey APIs should be prefixed.
            https://bugs.webkit.org/show_bug.cgi?id=119606

            Reviewed by Anders Carlsson.

            No new tests; updated exsisting tests with new names.

            Prefix all new classes with "WebKit" and new methods on existing unprefixed
            classes with "webkit"

            * Modules/encryptedmedia/MediaKeyMessageEvent.idl: MediaKeyMessageEvent -> WebKitMediaKeyMessageEvent
            * Modules/encryptedmedia/MediaKeySession.idl: MediaKeySession -> WebKitMediaKeySession
            * Modules/encryptedmedia/MediaKeys.idl: MediaKeys -> WebKitMediaKeys
            * html/HTMLMediaElement.idl: keys -> webkitKeys, setMediaKeys -> webkitSetMediaKeys
            * html/MediaKeyError.idl: MediaKeyError -> WebKitMediaKeyError

2013-08-08  Lucas Forschler  <lforschler@apple.com>

        Merge r153851

    2013-08-08  Jer Noble  <jer.noble@apple.com>

            [EME] setMediaKeys function as defined in the EME specification does not work
            https://bugs.webkit.org/show_bug.cgi?id=119597

            Reviewed by Anders Carlsson.

            No new tests; updated media/encrypted-media/encrypted-media-v2-syntax.html

            Rename the mediaKeys attribute 'keys' and make readonly, and add an explicit
            setMediaKeys() method in HTMLMediaElement's IDL.

            * html/HTMLMediaElement.h:
            (WebCore::HTMLMediaElement::keys):
            * html/HTMLMediaElement.idl:

2013-08-08  Lucas Forschler  <lforschler@apple.com>

        Merge r153838

    2013-08-08  Jer Noble  <jer.noble@apple.com>

            [EME] Implement MediaKeys.isTypeSupported()
            https://bugs.webkit.org/show_bug.cgi?id=119586

            Reviewed by Eric Carlson.

            Test: media/encrypted-media/encrypted-media-is-type-supported.html

            The EME spec has removed the extra keySystem parameter from
            HTMLMediaElement.canPlayType() in favor of a new isTypeSupported()
            method on MediaKeys.

            To implement this method, the CDMFactory needs to know whether the
            registered CDM supports the specified mime type.  CDMs must register
            this new factory method, which requires changes to CDMPrivateAVFoundation
            and MockCDM.

            Add the new MediaKeys.isTypeSupported() method:
            * Modules/encryptedmedia/MediaKeys.cpp:
            (WebCore::MediaKeys::isTypeSupported):
            * Modules/encryptedmedia/MediaKeys.h:
            * Modules/encryptedmedia/MediaKeys.idl:

            Add the new factory CDMSupportsKeySystemAndMimeType method:
            * Modules/encryptedmedia/CDM.cpp:
            (WebCore::CDMFactory::CDMFactory): Now takes a third parameter.
            (WebCore::installedCDMFactories): When adding the AVFoundation CDM, pass its new method.
            (WebCore::CDM::registerCDMFactory): Now takes a third parameter.
            (WebCore::CDM::keySystemSupportsMimeType): Added.
            * Modules/encryptedmedia/CDM.h:
            * WebCore.exp.in:

            Register this new method with the factory for all concrete CDMs:
            * Modules/encryptedmedia/CDMPrivateAVFoundation.h:
            * Modules/encryptedmedia/CDMPrivateAVFoundation.mm:
            (WebCore::CDMPrivateAVFoundation::supportsKeySystem):
            (WebCore::CDMPrivateAVFoundation::supportsKeySystemAndMimeType):
            * testing/Internals.cpp:
            (WebCore::Internals::initializeMockCDM):
            * testing/MockCDM.cpp:
            (WebCore::MockCDM::supportsKeySystem):
            (WebCore::MockCDM::supportsKeySystemAndMimeType):
            * testing/MockCDM.h:

2013-08-08  Lucas Forschler  <lforschler@apple.com>

        Merge r153810

    2013-08-07  Simon Fraser  <simon.fraser@apple.com>

            Avoid spurious "all repaint" layouts when scrolling WebViews on Retina displays
            https://bugs.webkit.org/show_bug.cgi?id=119564

            Reviewed by Beth Dakin.

            When scrolling WebViews on Macs with Retina displays, AppKit uses
            device pixels for the scroll offset, so [scrollView() documentVisibleRect]
            can return a CGRect with non-integral origin. This rect is used by layout,
            via layoutSize(), to decide whether the view size changed, which prompts
            a full repaint. However, FrameView gets a value which has been rounded
            by enclosingIntRect(), which increases the height or width by 1px if the 
            y or x offset is on a half-pixel, causing spurious full repaints.

            Fix by plumbing through platformVisibleContentSize(), which just
            gets the size of the -documentVisibleRect.

            * page/FrameView.cpp:
            (WebCore::FrameView::layout): Don't get layoutHeight and layoutWidth
            separately, since that is two calls down into platformVisibleContentSize.
            * platform/ScrollView.cpp:
            (WebCore::ScrollView::unscaledVisibleContentSize):
            (WebCore::ScrollView::platformVisibleContentSize):
            * platform/ScrollView.h:
            * platform/mac/ScrollViewMac.mm:
            (WebCore::ScrollView::platformVisibleContentSize):

2013-08-08  Lucas Forschler  <lforschler@apple.com>

        Merge r153845

    2013-08-08  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Improper Caption Button Displayed to Users
            https://bugs.webkit.org/show_bug.cgi?id=119593 

            Reviewed by Eric Carlson.

            Remove the custom drawing code for the Windows port, and
            have it render using the CSS/SVG markup like we do on OS X.

            * rendering/RenderThemeWin.cpp: Remove drawing code.
            * rendering/RenderThemeWin.h: Remove declaration.

2013-08-07  Lucas Forschler  <lforschler@apple.com>

        Merge r153775

    2013-08-06  Stephanie Lewis  <slewis@apple.com>

            Update Order Files for Safari
            <rdar://problem/14517392>

            Unreviewed.

            No change in functionality.

            * WebCore.order:

2013-08-06  Lucas Forschler  <lforschler@apple.com>

        Merge r153758

    2013-08-06  Brent Fulgham  <bfulgham@apple.com>

            Improper Calculation of In-band Cue Colors
            https://bugs.webkit.org/show_bug.cgi?id=119523

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
            (WebCore::makeRGBA32FromARGBCFArray): Remove redundant multiplication by
            255.  The internal conversion logic already converts to bytes.

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153725

    2013-08-05  Alexey Proskuryakov  <ap@apple.com>

            <rdar://problem/14637103> REGRESSION (r153060?): Microphone appears in the way
            of text when dictating an e-mail
            https://bugs.webkit.org/show_bug.cgi?id=119496

            Reviewed by Ryosuke Niwa.

            Test: platform/mac/editing/input/firstrectforcharacterrange-caret-in-br.html

            * rendering/RenderObject.cpp: (WebCore::RenderObject::absoluteBoundingBoxRectForRange):
            FloatRect::unite() doesn't preserve empty rects, which we need here.
            We alrady handle the case of collapsed range in Editor::firstRectForRange(), and
            this is similar, but we can't currently cover both with one simple fix.

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r152884

    2013-07-18  Ryosuke Niwa  <rniwa@webkit.org>

            Build fix after r152876.

            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
            (WebCore::MediaPlayerPrivateAVFoundation::processNewAndRemovedTextTracks):

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r152876

    2013-07-18  Brent Fulgham  <bfulgham@apple.com>

            [Media] Share more code between Mac and Windows implementation files.
            https://bugs.webkit.org/show_bug.cgi?id=118801

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
            (WebCore::MediaPlayerPrivateAVFoundation::clearTextTracks): Move
            implementation from ObjC file to parent file.
            (WebCore::MediaPlayerPrivateAVFoundation::processNewAndRemovedTextTracks):
            Ditto.
            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
            Remove duplicate implementation.
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            Ditto.
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
            Ditto.
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
            Ditto.
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            Ditto.

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153628

    2013-08-01  Brent Fulgham  <bfulgham@apple.com>

            [Windows] WebKit1 Fullscreen Video Play is Broken
            https://bugs.webkit.org/show_bug.cgi?id=119415

            Reviewed by Jer Noble.

            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Add
            call for ACFPlayerLayerSetFrame
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::MediaPlayerPrivateAVFoundationCF::platformSetVisible):
            Tear down video player when leaving Fullscreen mode and not using
            the newer Fullscreen feature.
            (WebCore::AVFWrapper::disconnectAndDeleteAVFWrapper):
            Disconnect from notifications for AVCFPlayerItemPresentationSizeChangedNotification,
            AVCFPlayerItemDuratoinChangedNotification, and disconnect any
            LegibleOutput items added to the player item.
            (WebCore::AVFWrapper::createPlayerItem): Add notifications for
            AVCFPlayerItemPresentationSizeChanged. 
            (WebCore::LayerClient::platformCALayerLayoutSublayersOfLayer): Notify
            the AVCFPLayerLayer when the display size has changed.
            * platform/graphics/ca/win/CACFLayerTreeHost.h:
            (WebCore::CACFLayerTreeHost::manualCreateRenderer): Added.
            * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:
            (WebCore::WKCACFViewLayerTreeHost::manualCreateRenderer): Added.
            * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
            (WebCore::MediaPlayerPrivateFullscreenWindow::createWindow): Minor
            cleanups.
            (WebCore::MediaPlayerPrivateFullscreenWindow::setRootChildLayer):
            Make sure a Direct3D renderer is created when building the full screen
            window for Video playback.

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153377

    2013-07-26  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Remove workarounds now that rdar://problem/14390466 is fixed.
            https://bugs.webkit.org/show_bug.cgi?id=119150

            Reviewed by Anders Carlsson.

            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::AVFWrapper::createPlayer): Remove workaround to add legible output
            after player is created.
            (WebCore::AVFWrapper::createPlayerItem): Remove workaround to delay adding
            legible output until player is created.
            (WebCore::AVFWrapper::platformLayer): Get rid of unused temporary.

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r152861

    2013-07-17  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Support in-band text tracks.
            https://bugs.webkit.org/show_bug.cgi?id=103770

            Reviewed by Eric Carlson.

            Existing media tests cover these features.

            * WebCore.vcxproj/WebCore.vcxproj: Add new files for Windows captions
            * WebCore.vcxproj/WebCore.vcxproj.filters: ditto.
            * config.h: Make sure proper buid flags are turned on when building
            with AVCF_LEGIBLE_OUTPUT.
            * page/CaptionUserPreferencesMediaAF.cpp: Revise to reduce soft linking
            duplication between Mac and Windows.
            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Update
            to support Windows platform by removing compiler guards and adding
            Windows declarations for soft-link functions.
            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h: Ditto.
            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
            Remove build guards preventing Windows from using LegibleOutput
            features.
            (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
            (WebCore::MediaPlayerPrivateAVFoundation::seek):
            (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted):
            (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification):
            (WebCore::MediaPlayerPrivateAVFoundation::trackModeChanged):
            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
            (WebCore::MediaPlayerPrivateAVFoundation::contentsNeedsDisplay): Ditto
            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h:
            Add new LegibleOutput support functions, and try to reduce duplication
            between Windows and Mac soft link declarations.
            * platform/graphics/avfoundation/cf/CoreMediaSoftLinking.h: Ditto.
            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.cpp: Added.
            (WebCore::InbandTextTrackPrivateAVCF::InbandTextTrackPrivateAVCF):
            (WebCore::InbandTextTrackPrivateAVCF::disconnect):
            (WebCore::InbandTextTrackPrivateAVCF::kind):
            (WebCore::InbandTextTrackPrivateAVCF::isClosedCaptions):
            (WebCore::InbandTextTrackPrivateAVCF::isSDH):
            (WebCore::InbandTextTrackPrivateAVCF::containsOnlyForcedSubtitles):
            (WebCore::InbandTextTrackPrivateAVCF::isMainProgramContent):
            (WebCore::InbandTextTrackPrivateAVCF::isEasyToRead):
            (WebCore::InbandTextTrackPrivateAVCF::label):
            (WebCore::InbandTextTrackPrivateAVCF::language):
            (WebCore::InbandTextTrackPrivateAVCF::isDefault):
            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.h: Added.
            (WebCore::InbandTextTrackPrivateAVCF::create):
            (WebCore::InbandTextTrackPrivateAVCF::~InbandTextTrackPrivateAVCF):
            (WebCore::InbandTextTrackPrivateAVCF::mediaSelectionOption):
            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateLegacyAVCF.cpp: Added.
            (WebCore::InbandTextTrackPrivateLegacyAVCF::InbandTextTrackPrivateLegacyAVCF):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::disconnect):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::kind):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::isClosedCaptions):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::containsOnlyForcedSubtitles):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::isMainProgramContent):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::isEasyToRead):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::label):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::language):
            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateLegacyAVCF.h: Added.
            (WebCore::InbandTextTrackPrivateLegacyAVCF::create):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::~InbandTextTrackPrivateLegacyAVCF):
            (WebCore::InbandTextTrackPrivateLegacyAVCF::avPlayerItemTrack):
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            Update to support LegibleOutput features for the Windows port.
            (WebCore::AVFWrapper::currentTrack): Added.
            (WebCore::AVFWrapper::legibleOutput): Added.
            (WebCore::createMetadataKeyNames): Added missing key names.
            (WebCore::avLegibleOutput): Added.
            (WebCore::safeMediaSelectionGroupForLegibleMedia): Added.
            (WebCore::MediaPlayerPrivateAVFoundationCF::cancelLoad): Clear text
            tracks when cancelling.
            (WebCore::MediaPlayerPrivateAVFoundationCF::setCurrentTrack): Added.
            (WebCore::MediaPlayerPrivateAVFoundationCF::currentTrack): Added.
            (WebCore::MediaPlayerPrivateAVFoundationCF::platformDuration): Revised
            to match logic in Objective C implementation.
            (WebCore::MediaPlayerPrivateAVFoundationCF::currentTime): Revised
            to match logic in Objective C implementation.
            (WebCore::MediaPlayerPrivateAVFoundationCF::paintCurrentFrameInContext):
            Check presence of metadata before proceeding. Revised to match logic
            in Objective C implementation.
            (WebCore::MediaPlayerPrivateAVFoundationCF::paint): Ditto.
            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged): Update for
            in-band text tracks.
            (WebCore::MediaPlayerPrivateAVFoundationCF::clearTextTracks): Added.
            (WebCore::MediaPlayerPrivateAVFoundationCF::processLegacyClosedCaptionsTracks):
            Added.
            (WebCore::MediaPlayerPrivateAVFoundationCF::processNewAndRemovedTextTracks):
            Added.
            (WebCore::MediaPlayerPrivateAVFoundationCF::processMediaSelectionOptions):
            Added.
            (WebCore::AVFWrapper::setCurrentTrack): Added.
            (WebCore::MediaPlayerPrivateAVFoundationCF::languageOfPrimaryAudioTrack):
            Added.
            (WebCore::AVFWrapper::AVFWrapper): Add new initializers.
            (WebCore::AVFWrapper::~AVFWrapper): Clean up text track information.
            (WebCore::AVFWrapper::createPlayer): Add Legible Output support.
            (WebCore::AVFWrapper::createPlayerItem): Ditto.
            (WebCore::LegibleOutputData::LegibleOutputData): Added.
            (WebCore::AVFWrapper::processCue): Added.
            (WebCore::AVFWrapper::legibleOutputCallback): Added.
            (WebCore::AVFWrapper::safeMediaSelectionGroupForLegibleMedia): Added.
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
            Update to support LegibleOutput features for the Windows port.
            * platform/win/SoftLinking.h: Change signature of variable accessor
            to match Mac so reduce duplicate code.

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153706

    2013-08-03  Jer Noble  <jer.noble@apple.com>

            Loading a video with a custom URL scheme will result in stalling playback
            https://bugs.webkit.org/show_bug.cgi?id=119469

            Reviewed by Eric Carlson.

            Break the assumption that only one AVAssetResourceRequest will be outstanding simultaneously
            by storing a HashMap of AVAssetResourceRequests and their resulting WebCoreAVFResourceLoader.
            When loading is stopped (due to completion or error), notify the MediaPlayerPrivateAVFoundation
            parent so that the map can be emptied.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::shouldWaitForLoadingOfResource): Store the request
                in m_resourceLoaderMap.
            (WebCore::MediaPlayerPrivateAVFoundationObjC::didCancelLoadingRequest): Pull the request from
                m_resourceLoaderMap.
            (WebCore::MediaPlayerPrivateAVFoundationObjC::didStopLoadingRequest): Remove the requset from
                m_resourceLoaderMap.
            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
            (WebCore::WebCoreAVFResourceLoader::create): Return a PassRefPtr, rather than a PassOwnPtr.
            (WebCore::WebCoreAVFResourceLoader::stopLoading): Call didStopLoadingRequest.

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153699

    2013-08-04  Andreas Kling  <akling@apple.com>

            Inserting a rule into an empty style sheet shouldn't trigger style recalc unless necessary.
            <http://webkit.org/b/119475>
            <rdar://problem/14643481>

            Reviewed by Antti Koivisto.

            This is kind of a cheesy optimization, but it turns out that the use case is quite common.
            The pattern goes like this:

                (1) Create <style> element.
                (2) Add it to the document's <head>.
                (3) .addRule() one rule through the CSSOM API.

            Prior to this patch, (3) would always cause a full (deferred) style recalc.

            Now that we exclude empty style sheets from the document's (effective) active set,
            we can piggyback on the style invalidation analysis when transitioning from an empty
            sheet to a single-rule sheet.

            In other words, add a special code path for the first rule insertion into an empty,
            in-document style sheet to minimize the amount of invalidation that happens.

            * css/CSSStyleSheet.cpp:
            (WebCore::CSSStyleSheet::didMutateRules):
            (WebCore::CSSStyleSheet::insertRule):
            * css/CSSStyleSheet.h:
            (WebCore::CSSStyleSheet::RuleMutationScope::RuleMutationScope):
            (WebCore::CSSStyleSheet::RuleMutationScope::~RuleMutationScope):

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153696

    2013-08-04  Andreas Kling  <akling@apple.com>

            [Mac] Disable screen font substitution at WebCore-level in OS X 10.9+
            <http://webkit.org/b/119474>
            <rdar://problem/14643349>

            Reviewed by Dan Bernstein.

            Disable screen font substitution by default in Settings so internal WebCore clients
            such as SVG-as-image will get the right default setting.

            * page/Settings.cpp:
            (WebCore::Settings::Settings):
            (WebCore::Settings::shouldEnableScreenFontSubstitutionByDefault):
            (WebCore::Settings::setScreenFontSubstitutionEnabled):
            * page/Settings.h:
            (WebCore::Settings::screenFontSubstitutionEnabled):
            * page/Settings.in:
            * page/mac/SettingsMac.mm:
            (WebCore::Settings::shouldEnableScreenFontSubstitutionByDefault):

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153695

    2013-08-03  Tim Horton  <timothy_horton@apple.com>

            Refine the unavailable plug-in indicator
            https://bugs.webkit.org/show_bug.cgi?id=119400
            <rdar://problem/14616012>

            Reviewed by Oliver Hunt.

            Add a border, flip the text and background colors, and make the indicator
            much higher contrast, to be more visible on a variety of sites.
            Also, refine the arrow to be less blocky and inlaid inside a circle.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::replacementTextRoundedRectPressedColor):
            (WebCore::replacementTextRoundedRectColor):
            (WebCore::replacementTextColor):
            (WebCore::unavailablePluginBorderColor):
            (WebCore::drawReplacementArrow):
            (WebCore::RenderEmbeddedObject::paintReplaced):
            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
            (WebCore::RenderEmbeddedObject::unavailablePluginIndicatorBounds):
            (WebCore::RenderEmbeddedObject::isInUnavailablePluginIndicator):
            * rendering/RenderEmbeddedObject.h:

2013-08-05  Lucas Forschler  <lforschler@apple.com>

        Merge r153591

    2013-08-01  Tim Horton  <timothy_horton@apple.com>

            Unavailable plug-in indicator arrow should be inside the rounded rect, not in its own circle
            https://bugs.webkit.org/show_bug.cgi?id=119400
            <rdar://problem/14616012>

            Reviewed by Anders Carlsson.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
            Shift the arrow in by 9px, and make the text's rounded rect include it,
            instead of having the arrow in a separate circle.

2013-08-05  Filip Pizlo  <fpizlo@apple.com>

        DFG optimizations don't handle neutered arrays properly
        https://bugs.webkit.org/show_bug.cgi?id=119409

        Reviewed by Mark Hahnenberg and Oliver Hunt.
        
        This just neuters view wrappers also.

        Test: fast/js/dfg-typed-array-neuter.

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::neuterView):
        (WebCore::SerializedScriptValue::transferArrayBuffers):
        (WebCore::SerializedScriptValue::create):
        * bindings/js/SerializedScriptValue.h:

2013-08-02  Lucas Forschler  <lforschler@apple.com>

        Merge r153681

    2013-08-02  Dean Jackson  <dino@apple.com>

            Force elements with perspective or preserve-3d to disallow direct composited backgrounds
            https://bugs.webkit.org/show_bug.cgi?id=119462
            <rdar://problem/14607548>

            Reviewed by Simon Fraser.

            Bug 119461 (http://wkb.ug/119461) describes how a directly composited
            background color can intersect with its children. It's not clear exactly
            what the best way to fix that is, but for the moment we should disallow
            any element that has perspective or a preserve-3d transform style from
            getting a directly composited background.

            Test: compositing/background-color/no-composited-background-color-when-perspective.html

            * rendering/RenderLayerBacking.cpp:
            (WebCore::hasPerspectiveOrPreserves3D): New static helper.
            (WebCore::supportsDirectBoxDecorationsComposition): Return false if the above function is true.

2013-08-02  Lucas Forschler  <lforschler@apple.com>

        Merge r153672

    2013-08-02  Andreas Kling  <akling@apple.com>

            Removing a <link> element with an empty stylesheet shouldn't trigger style recalc.
            <http://webkit.org/b/119442>
            <rdar://problem/14631785>

            Reviewed by Antti Koivisto.

            Let Document decide whether or not to do a style recalc after a <link> element is removed.
            This avoids unnecessary work when removing a <link> that refers to an empty style sheet.

            Some Facebook pages have a <link rel="stylesheet" href="data:text/css;base64,"> that gets
            removed during the initial page load, causing style recalc.

            * html/HTMLLinkElement.cpp:
            (WebCore::HTMLLinkElement::removedFrom):

                Use DeferRecalcStyleIfNeeded. Since the style sheet is being removed, it will either
                cause a recalc (because it's no longer in the set of active sheets) or do nothing.

2013-08-02  Lucas Forschler  <lforschler@apple.com>

        Merge r153632

    2013-07-31  Ryosuke Niwa  <rniwa@webkit.org>

            FormAssociatedElement shouldn't create out-of-tree FormAttributeTargetObserver
            https://bugs.webkit.org/show_bug.cgi?id=119309

            Reviewed by Kent Tamura.

            Merge https://chromium.googlesource.com/chromium/blink/+/6fbdcbf311de539107bc28711b3f7a527176e97b.

            I'm not merging the test since the attached test case only works when the shadow DOM API is enabled.

            * html/FormAssociatedElement.cpp:
            (WebCore::FormAssociatedElement::formAttributeChanged):
            (WebCore::FormAssociatedElement::resetFormAttributeTargetObserver):

2013-08-02  Lucas Forschler  <lforschler@apple.com>

        Merge r153641

    2013-08-01  Andreas Kling  <akling@apple.com>

            Removing an empty style sheet shouldn't trigger style recalc.
            <http://webkit.org/b/119248>
            <rdar://problem/14629045>

            Reviewed by Antti Koivisto.

            Teach DocumentStyleSheetCollection to filter out empty style sheets when deciding whether
            or not to trigger a style recalc. We can then be clever when an empty style sheet is removed
            from the document, and avoid causing extra work.

            Some pages use this pattern:

                (1) Create a <style> element.
                (2) Add it to the document's <head> element.
                (3) Insert some CSS as a text child of the <style> element.

            Since the <style> element is already inside the document at (3), we had to treat this as an
            old style sheet being removed, even though it was just an empty sheet of nothing.

            With this patch, Document gains enough smarts to know that removing/adding an empty sheet
            won't affect layout/rendering in any meaningful way, thus a style recalc can be avoided.

            * dom/Document.h:
            * dom/Document.cpp:
            (WebCore::Document::styleResolverChanged):

                Add a DeferRecalcStyleIfNeeded mode to styleResolverChanged().

            * css/CSSStyleSheet.h:
            * css/CSSStyleSheet.cpp:
            (WebCore::CSSStyleSheet::clearOwnerNode):

                Use DeferRecalcStyleIfNeeded when saying bye from a CSSStyleSheet and let Document decide
                if removing the sheet should trigger style recalc instead of always assuming it should.

            * dom/DocumentStyleSheetCollection.cpp:
            (WebCore::filterEnabledNonemptyCSSStyleSheets):
            (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):

                Exclude empty sheets from the activeAuthorStyleSheets() collection. They are still
                visible through CSSOM's document.styleSheets.

2013-08-02  Lucas Forschler  <lforschler@apple.com>

        Merge r153649

    2013-08-02  Brady Eidson  <beidson@apple.com>

            REGRESSION (r130783): Scrolling is broken going back to a cached page from a page that still has outstanding subresources.
            <rdar://problem/14601124> and https://bugs.webkit.org/show_bug.cgi?id=119416

            Reviewed by Darin Adler.

            Test: http/tests/loading/unfinished-load-back-to-cached-page-callbacks.html

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::stopLoading): Always explicitly cancel the Document parser when stopLoading is called.

2013-08-01  Lucas Forschler  <lforschler@apple.com>

        Merge r153595

    2013-08-01  Andreas Kling  <akling@apple.com>

            Layout should force a StyleResolver rebuild if there isn't one at all.
            <http://webkit.org/b/119378>

            Reviewed by Antti Koivisto.

            We can't tell if viewport-dependent media queries have been invalidated at layout,
            unless we have a StyleResolver to ask about this.
            In case there isn't one, take the same path as we would with an invalidated query
            instead of relying on ensureStyleResolver() to build it.

            * page/FrameView.cpp:
            (WebCore::FrameView::layout):

2013-08-01  Lucas Forschler  <lforschler@apple.com>

        Merge r153553

    2013-07-31  Ryosuke Niwa  <rniwa@webkit.org>

            Reuse of XMLHttpRequests causes character corruption in response text
            https://bugs.webkit.org/show_bug.cgi?id=119358

            Reviewed by Anders Carlsson.

            Merge https://chromium.googlesource.com/chromium/blink/+/6496e7bb9a0b46bc79032b86d5993b25f127a4cb

            Test: http/tests/xmlhttprequest/reopen-encoding.html

            * xml/XMLHttpRequest.cpp:
            (WebCore::XMLHttpRequest::clearResponseBuffers):
            (WebCore::XMLHttpRequest::didFinishLoading):

2013-08-01  Lucas Forschler  <lforschler@apple.com>

        Merge r153494

    2013-07-30  Andreas Kling  <akling@apple.com>

            Inactive style sheets should not trigger style recalc when loaded.
            <http://webkit.org/b/119236>
            <rdar://problem/14588132>

            Reviewed by Antti Koivisto.

            Style sheets that are either alternate sheets or are excluded by their media query should not trigger
            a full style recalc when they finish loading, since the end result will not be observably different.

            The sheets are still inspectable through document.styleSheets.

            Changed enums from Blocking/NonBlocking to ActiveSheet/InactiveSheet to clarify what's going on.

            * html/HTMLLinkElement.h:
            * html/HTMLLinkElement.cpp:
            (WebCore::HTMLLinkElement::HTMLLinkElement):
            (WebCore::HTMLLinkElement::setDisabledState):
            (WebCore::HTMLLinkElement::process):
            (WebCore::HTMLLinkElement::startLoadingDynamicSheet):
            (WebCore::HTMLLinkElement::addPendingSheet):
            (WebCore::HTMLLinkElement::removePendingSheet):

2013-08-01  Beth Dakin  <bdakin@apple.com>

        <rdar://problem/14616729> REGRESSION (r144350): Overflow bounding boxes are way 
        too big; prevents VoiceOver taps from activating the right elements

        Reviewed by Darin Adler.

        This is a partial-rollout of http://trac.webkit.org/changeset/144350 which is the 
        change that caused this regression. This patch rolls out most of that patch, and 
        it only leaves in the part that added a paintContainer variable to PaintInfo since 
        that is now used in other places in the code. All uses of the paintContainer that 
        were added with this patch have been removed since they contribute to the 
        regression.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintObject):
        (WebCore::RenderBlock::paintContinuationOutlines):
        (WebCore::RenderBlock::addFocusRingRects):
        * rendering/RenderBlock.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::addFocusRingRects):
        * rendering/RenderBox.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::addFocusRingRects):
        (WebCore::RenderInline::paintOutline):
        * rendering/RenderInline.h:
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::paint):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::addFocusRingRects):
        * rendering/RenderListBox.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::paintFocusRing):
        (WebCore::RenderObject::paintOutline):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::addFocusRingRects):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::paint):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paintObject):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::paintOutlineForRowIfNeeded):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::addFocusRingRects):
        * rendering/RenderTextControl.h:
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::paint):
        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::paint):
        (WebCore::RenderSVGContainer::addFocusRingRects):
        * rendering/svg/RenderSVGContainer.h:
        * rendering/svg/RenderSVGImage.cpp:
        (WebCore::RenderSVGImage::paint):
        (WebCore::RenderSVGImage::addFocusRingRects):
        * rendering/svg/RenderSVGImage.h:
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::paint):
        (WebCore::RenderSVGShape::addFocusRingRects):
        * rendering/svg/RenderSVGShape.h:

2013-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r153511

    2013-07-30  Tim Horton  <timothy_horton@apple.com>

            DHTML drag can result in a null-deref under WebDragClient::startDrag
            https://bugs.webkit.org/show_bug.cgi?id=119297
            <rdar://problem/14213012>

            Reviewed by Simon Fraser.

            Test: fast/events/setDragImage-in-document-element-crash.html

            * page/mac/FrameSnapshottingMac.mm:
            (WebCore::snapshotDragImage):
            We shouldn't waste time painting an empty image, nor should we return
            an image with no size.

2013-07-29  Lucas Forschler  <lforschler@apple.com>

        Merge r153447

    2013-07-26  Ryosuke Niwa  <rniwa@webkit.org>

            Fix crash due to unexpected Node deletion during MutationObserver registration book-keeping
            https://bugs.webkit.org/show_bug.cgi?id=119124

            Reviewed by Sam Weinig.

            Merge https://chromium.googlesource.com/chromium/blink/+/b6afb927695b3acf2c75c25f05e99682660993e2

            No new tests since I could not reproduce the crash with the test attached in the Blink change.

            The bug was caused by Node::unregisterMutationObserver removing the MutationObserverRegistration
            that holds the last ref to the node. Avoid that by explicitly allocating a local RefPtr to the node
            in MutationObserverRegistration::unregister. Also rename it to unregisterAndDelete to clarify
            the semantics and make it a static member function to be even safer.

            * dom/MutationObserver.cpp:
            (WebCore::MutationObserver::disconnect):
            * dom/MutationObserverRegistration.cpp:
            (WebCore::MutationObserverRegistration::unregisterAndDelete):
            * dom/MutationObserverRegistration.h:

2013-07-29  Lucas Forschler  <lforschler@apple.com>

        Merge r153418

    2013-07-28  Andreas Kling  <akling@apple.com>

            Don't update the text track override CSS every time a media element is created.
            <http://webkit.org/b/119199>
            <rdar://problem/14572855>

            Reviewed by Darin Adler.

            We should only have to update the CSS if the accessibility caption preferences are changed.
            This was forcing a full style recalc in every Document any time a media element is instantiated.

            * page/CaptionUserPreferencesMediaAF.cpp:
            (WebCore::CaptionUserPreferencesMediaAF::setInterestedInCaptionPreferenceChanges):

2013-07-28  Lucas Forschler  <lforschler@apple.com>

        Merge r153399

    2013-07-26  Sam Weinig  <sam@webkit.org>

            Stop pretending to support <string> for text-align.
            https://bugs.webkit.org/show_bug.cgi?id=119107

            Reviewed by Andreas Kling.

            Test: fast/css/text-align-string-crash.html

            * css/CSSParser.cpp:
            (WebCore::CSSParser::parseValue):
            Stop pretending to support <string> for text-align.

            * css/DeprecatedStyleBuilder.cpp:
            (WebCore::ApplyPropertyTextAlign::applyValue):
            ASSERT that only value IDs get passed.

2013-07-26  Lucas Forschler  <lforschler@apple.com>

        Merge r153378

    2013-07-26  Tim Horton  <timothy_horton@apple.com>

            Add a mode where autosizing fixes the FrameView height to at least the WKView height
            https://bugs.webkit.org/show_bug.cgi?id=119104
            <rdar://problem/14549021>

            Reviewed by Anders Carlsson.

            * WebCore.exp.in: Export FrameView::setAutoSizeFixedMinimumHeight.
            * page/FrameView.cpp:
            (WebCore::FrameView::FrameView):
            Initialize m_autoSizeFixedMinimumHeight to 0.

            (WebCore::FrameView::autoSizeIfEnabled):
            Increase the FrameView height to m_autoSizeFixedMinimumHeight if necessary,
            and do another layout. Store the computed intrinsic content size.

            (WebCore::FrameView::setAutoSizeFixedMinimumHeight): Added.

            * page/FrameView.h:
            (WebCore::FrameView::autoSizingIntrinsicContentSize): Added.

2013-07-26  Lucas Forschler  <lforschler@apple.com>

        Merge r153349

    2013-07-25  Tim Horton  <timothy_horton@apple.com>

            Null check m_frame in maximum and minimumScrollPosition
            https://bugs.webkit.org/show_bug.cgi?id=119109
            <rdar://problem/14545393>

            Reviewed by Darin Adler.

            * page/FrameView.cpp:
            (WebCore::FrameView::minimumScrollPosition):
            (WebCore::FrameView::maximumScrollPosition):
            Null-check m_frame (and move the early-return after the clamp-to-0
            as the revert in r152911 should have).

2013-07-26  Lucas Forschler  <lforschler@apple.com>

        Merge r153366

    2013-07-25  Ryosuke Niwa  <rniwa@webkit.org>

            Fix document leak when selection is created inside the document
            https://bugs.webkit.org/show_bug.cgi?id=119122

            Reviewed by Andreas Kling.

            Merge https://chromium.googlesource.com/chromium/blink/+/b908cb4c8da93316d787de31c93f2a43de332a10

            The bug was caused by FrameSelection::m_previousCaretNode holding onto a Node, leaking its document.
            Fixed the bug by explicitly clearing it in FrameSelection::prepareForDestruction.

            Test: editing/selection/leak-document-with-selection-inside.html

            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::prepareForDestruction):

2013-07-26  Lucas Forschler  <lforschler@apple.com>

        Merge r153344

    2013-07-25  Sam Weinig  <sam@webkit.org>

            -[WebHTMLView attributedSubstringForProposedRange:actualRange:] does not include strikethrough attribute in the returned attributed string
            https://bugs.webkit.org/show_bug.cgi?id=119099
            <rdar://problem/13439291>

            Reviewed by Enrica Casucci.

            Tests:
                API Test: AttributedStringTest_Strikethrough

            * platform/mac/HTMLConverter.mm:
            (+[WebHTMLConverter editingAttributedStringFromRange:]):
            Set the NSStrikethroughStyleAttributeName attribute when text-decoration: line-through is seen.

2013-07-26  Lucas Forschler  <lforschler@apple.com>

        Merge r153102

    2013-07-24  Ryosuke Niwa  <rniwa@webkit.org>

            Use-after-free in ApplyStyleCommand::removeInlineStyle
            https://bugs.webkit.org/show_bug.cgi?id=118627

            Reviewed by Oliver Hunt.

            Merge https://chromium.googlesource.com/chromium/blink/+/b6471d077e012b05ccba14d0ce8e6d616106c8e6

            Unfortunately, there is no test case for this bug.

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::removeInlineStyle):

2013-07-26  Lucas Forschler  <lforschler@apple.com>

        Merge r152905

    2013-07-19  Geoffrey Garen  <ggaren@apple.com>

            TrailingObjects shouldn't shrink vector capacity in a loop
            https://bugs.webkit.org/show_bug.cgi?id=118322

            Reviewed by Darin Adler.

            This seems to take about 3% off the profile of loading a large text file.

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::TrailingObjects::clear): clear() has the built-in side effect
            of throwing away existing capacity. Use shrink(0) to indicate that we
            want to keep our existing capacity.
            
2013-07-24  Lucas Forschler  <lforschler@apple.com>

        Merge r153092

    2013-07-24  Jessie Berlin  <jberlin@apple.com>

            Remove WKPageGetPlugInInformation - it is not used anymore
            https://bugs.webkit.org/show_bug.cgi?id=119047

            Rubber-stamped by Alexey Proskuryakov.

            Revert r152328, which added a key used only in the callback info for
            WKPageGetPlugInInformation.

            * WebCore.exp.in:

2013-07-24  Lucas Forschler  <lforschler@apple.com>

        Merge r153002

    2013-07-22  Chris Fleizach  <cfleizach@apple.com>

            AX: VoiceOver only read the first column in a safari table
            https://bugs.webkit.org/show_bug.cgi?id=118992

            Reviewed by Tim Horton.

            In case the first section has fewer columns than the rest of the table, the AXTable was only reporting the number of
            columns for the first section. We need to take the max number of columns out of all sections.

            Test: accessibility/table-with-mismatch-column-count-in-initial-section.html

            * accessibility/AccessibilityTable.cpp:
            (WebCore::AccessibilityTable::addChildren):

2013-07-23  Lucas Forschler  <lforschler@apple.com>

        Merge r153072

    2013-07-23  Andreas Kling  <akling@apple.com>

            REGRESSION(r150867): FrameView auto-sizing + delegate denied image load may cause StyleResolver to re-enter itself.
            <rdar://problem/14324895>
            <http://webkit.org/b/119023>

            Reviewed by Simon Fraser.

            The bug happened when FrameView::autoSizeIfEnabled() was getting called below FrameLoader::checkCompleted()
            triggered by an incorrect loadDone() callback originating in SubresourceLoader::didCancel().

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::loadPendingResources):

                Add an assertion that this function is not getting re-entered. If a similar bug occurs
                in the future, this will help the lucky person debugging.

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::didCancel):

                Don't notifyDone() if the SubresourceLoader is in Uninitialized state.

2013-07-23  Lucas Forschler  <lforschler@apple.com>

        Merge r153068

    2013-07-23  Tim Horton  <timothy_horton@apple.com>

            Pixel-snap the unavailable plugin indicator arrow for maximum sharpness
            https://bugs.webkit.org/show_bug.cgi?id=119024
            <rdar://problem/14523331>

            Reviewed by Anders Carlsson.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::addReplacementArrowPath):
            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
            Pixel-snap the unavailable plugin indicator arrow. Snapping directions
            were chosen by eye/symmetry to look best on 1x and 2x devices at
            1x and 2x page scale.

2013-07-23  Lucas Forschler  <lforschler@apple.com>

        Merge r153060

    2013-07-23  Alexey Proskuryakov  <ap@apple.com>

            Dictionary hotkey does not work on vertical text
            https://bugs.webkit.org/show_bug.cgi?id=118993
            <rdar://problem/14478260>

            Reviewed by Enrica Casucci.

            Test: platform/mac/editing/input/firstrectforcharacterrange-vertical.html

            * editing/Editor.cpp:
            (WebCore::collapseCaretWidth): A helper function.
            (WebCore::Editor::firstRectForRange): Many changes:
            - use RenderObject::absoluteBoundingBoxRectForRange() in regular case, because
            that's more direct that getting caret rects and computing bounding rect from those.
            - handle collapsed ranges separately, because absoluteBoundingBoxRectForRange()
            doesn't provide the needed result, and because it can be done faster.
            - wherever we use carets to compute the result, account for vertical text (in a hackish
            way, as we don't have layout information at Editor level).

            * rendering/RenderBlock.cpp: (WebCore::RenderBlock::localCaretRect): Removed
            dead code.

2013-07-23  Lucas Forschler  <lforschler@apple.com>

        Merge r153003

    2013-07-22  Zalan Bujtas  <zalan@apple.com>

            segfault in RenderLayerCompositor when the iframe's position attribute is changed and it embeds <object>.
            https://bugs.webkit.org/show_bug.cgi?id=118965

            Reviewed by Simon Fraser.

            Do not change the composition state unless we can reliably figure out the iframe's size.
            If the renderer is not yet attached, its size is not computable.

            Test: compositing/iframes/iframe-position-absolute-with-padding-percentage-crash.html

            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::requiresCompositingForFrame):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r153017

    2013-07-22  Tim Horton  <timothy_horton@apple.com>

            Plug-in unavailability indicator should not be displayed if a blocked plugin's indicator is clipped
            https://bugs.webkit.org/show_bug.cgi?id=118998
            <rdar://problem/14511268>

            Reviewed by Anders Carlsson.

            * html/HTMLEmbedElement.cpp:
            (WebCore::HTMLEmbedElement::updateWidget):
            * html/HTMLObjectElement.cpp:
            (WebCore::HTMLObjectElement::updateWidget):
            * html/HTMLPlugInElement.cpp:
            (WebCore::HTMLPlugInElement::defaultEventHandler):
            (WebCore::HTMLPlugInElement::supportsFocus):
            * html/HTMLPlugInImageElement.cpp:
            (WebCore::HTMLPlugInImageElement::updateWidgetIfNecessary):
            * loader/SubframeLoader.cpp:
            (WebCore::SubframeLoader::createJavaAppletWidget):
            (WebCore::SubframeLoader::loadPlugin):
            * page/FrameView.cpp:
            (WebCore::FrameView::updateWidget):
            Rename showsUnavailablePluginIndicator to isPluginUnavailable, since being unavailable
            and actually showing the indicator are two totally different things.

            * WebCore.exp.in: Expose setUnavailablePluginIndicatorIsHidden.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::RenderEmbeddedObject::RenderEmbeddedObject):
            Rename m_showsUnavailablePluginIndicator to m_isPluginUnavailable.
            Add m_isUnavailablePluginIndicatorHidden, defaulting to false.

            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReasonWithDescription):
            Set m_isPluginUnavailable when we get an unavailability reason.

            (WebCore::RenderEmbeddedObject::paint):
            (WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsHidden): Added.

            * rendering/RenderEmbeddedObject.h:
            (WebCore::RenderEmbeddedObject::isPluginUnavailable): Added.

            (WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):
            Repurpose "showsUnavailablePluginIndicator" to actually represent whether
            the indicator is displayed (i.e. the plugin is unavailable, and the
            indicator is not hidden).

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r153014

    2013-07-22  Tim Horton  <timothy_horton@apple.com>

            RenderEmbeddedObject::isReplacementObscured should include the arrow in its area-of-interest
            https://bugs.webkit.org/show_bug.cgi?id=118995
            <rdar://problem/14516421>

            Reviewed by Anders Carlsson.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::RenderEmbeddedObject::unavailablePluginIndicatorBounds):
            Rename method from replacementTextRect to unavailablePluginIndicatorBounds for accuracy.
            Use the bounding box of the indicator's path, which includes the rounded rect behind
            the text as well as the arrow button.

            (WebCore::RenderEmbeddedObject::isReplacementObscured):
            * rendering/RenderEmbeddedObject.h:

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r153013

    2013-07-22  Tim Horton  <timothy_horton@apple.com>

            <applet> plugins are instantiated post-attach (instead of post-layout like for object and embed)
            https://bugs.webkit.org/show_bug.cgi?id=118994
            <rdar://problem/14511232>

            Reviewed by Anders Carlsson.

            Make <applet> consistent with <object> and <embed>, deferring plugin
            instantiation to post-layout, so that layout is up-to-date if anything
            needs it (like RenderEmbeddedObject::isReplacementObscured) during creation.

            * html/HTMLAppletElement.cpp:
            (WebCore::HTMLAppletElement::updateWidget):
            Copy code from HTMLObjectElement/HTMLEmbedElement that defers plugin
            creation until post-layout tasks. Java is always an NPAPI plugin, so
            we should always defer if requested.

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152989

    2013-07-22  Dean Jackson  <dino@apple.com>

            PlugIn content can disappear after restarting
            https://bugs.webkit.org/show_bug.cgi?id=118982

            Reviewed by Simon Fraser.

            When a snapshotted plug-in is restarted, we inserted its compositing
            layer back into the tree, but didn't recalculate style. This meant
            that a subsequent compositing tree operation (such as any hardware
            animation) could cause the content to disappear.

            * html/HTMLPlugInImageElement.cpp:
            (WebCore::HTMLPlugInImageElement::setDisplayState): Force a style recalc.
            (WebCore::HTMLPlugInImageElement::removeSnapshotTimerFired): Ditto.

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152951

    2013-07-21  Andreas Kling  <akling@apple.com>

            KURL creates duplicate strings when completing data: URIs.
            <http://webkit.org/b/118952>
            <rdar://problem/14504480>

            Reviewed by Anders Carlsson.

            When checking if the original URL input string can be reused, compare against the part
            of the parsing buffer that we would actually return, not the entire buffer.

            632 kB progression on <http://www.nytimes.com/>

            Test: KURLTest.KURLDataURIStringSharing

            * platform/KURL.cpp:
            (WebCore::KURL::parse):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152941

    2013-07-19  Brady Eidson  <beidson@apple.com>

            Pages should not be able to abuse users inside beforeunload handlers.
            <rdar://problem/14475779> and https://bugs.webkit.org/show_bug.cgi?id=118871.

            Reviewed by Alexey Proskuryakov.

            Tests: fast/loader/show-only-one-beforeunload-dialog.html
                   http/tests/misc/iframe-beforeunload-dialog-matching-ancestor-securityorigin.html
                   http/tests/misc/iframe-beforeunload-dialog-not-matching-ancestor-securityorigin.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::FrameLoader):
            (WebCore::FrameLoader::shouldClose):
            (WebCore::FrameLoader::handleBeforeUnloadEvent):
            (WebCore::FrameLoader::shouldCloseFiringBeforeUnloadEvent): Renamed from fireBeforeUnloadEvent.
              Add logic to enforce "1 beforeunload dialog per navigation" as well as "iframes can only show beforeunload 
              dialogs if their entire ancestry's security origins match the navigating frame."
            * loader/FrameLoader.h:
            * loader/FrameLoader.h:

            Add the ability for Page to know when any frame is dispatching beforeunload:
            * page/Page.cpp:
            (WebCore::Page::Page):
            (WebCore::Page::incrementFrameHandlingBeforeUnloadEventCount):
            (WebCore::Page::decrementFrameHandlingBeforeUnloadEventCount):
            (WebCore::Page::isAnyFrameHandlingBeforeUnloadEvent):
            * page/Page.h:

            * page/DOMWindow.cpp:
            (WebCore::DOMWindow::print): Disallow if any frame is in beforeunload dispatch.
            (WebCore::DOMWindow::alert): Ditto.
            (WebCore::DOMWindow::confirm): Ditto.
            (WebCore::DOMWindow::prompt): Ditto.
            (WebCore::DOMWindow::showModalDialog): Ditto.

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152939

    2013-07-19  Chris Fleizach  <cfleizach@apple.com>

            AX: VoiceOver not detecting misspelled words don't work in all cases
            https://bugs.webkit.org/show_bug.cgi?id=118924

            Reviewed by Tim Horton.

            VoiceOver is now looking for a new misspelled attribute.

            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (AXAttributeStringSetSpelling):
            (AXAttributedStringAppendText):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152939

    2013-07-19  Chris Fleizach  <cfleizach@apple.com>

            AX: VoiceOver not detecting misspelled words don't work in all cases
            https://bugs.webkit.org/show_bug.cgi?id=118924

            Reviewed by Tim Horton.

            VoiceOver is now looking for a new misspelled attribute.

            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (AXAttributeStringSetSpelling):
            (AXAttributedStringAppendText):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152911

    2013-07-19  David Hyatt  <hyatt@apple.com>

            OSX: ePub: Unable to select text in vertical Japanese book
            https://bugs.webkit.org/show_bug.cgi?id=118864
            <rdar://problem/14109351>

            Reviewed by Dan Bernstein and Sam Weinig.

            This patch fixes all of the various writing-mode and pagination combinations
            so that the columns are painted in the correct location. The code that sets up
            the initial painting translation offset in the block direction and that advances
            that offset has been pulled into two helper functions, initialBlockOffsetForPainting
            and blockDeltaForPaintingNextColumn, and that code is now shared by the four call
            sites that need it (painting and hit testing in RenderBlock and painting and hit testing
            in RenderLayer).

            This patch also backs out the maximumScrollPosition change, since it only occurred because
            of incorrect sizing of the RenderView, and this sizing issue has now been corrected by
            ensuring that computeLogicalHeight() always makes sure you are the size of the viewport
            and does not shrink you to the column height.

            There was also a race condition that caused pagination to be incorrect if layout occurred
            before the html/body renderer that set the writing-mode were available. When this happened,
            the writing mode got propagated up to the view, but the column styles didn't get
            adjusted to compensate for the writing mode change.

            Added tests for every pagination and writing-mode combination in fast/multicol/pagination.

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::styleForDocument):
            (WebCore::StyleResolver::adjustRenderStyle):
            Move setStylesForPaginationMode into RenderStyle and make it a member function. This is
            necessary so that the style can be adjusted dynamically to fix the race condition mentioned
            above.

            * page/FrameView.cpp:
            (WebCore::FrameView::maximumScrollPosition):
            Back out this change since the symptom it was fixing only occurred because the logical
            height of the view was being set incorrectly.

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::checkForPaginationLogicalHeightChange):
            Patch the column code that sets up the initial page height to use the pagination API's
            page height rather than the viewport logical height. This allows the view to still match
            the viewport in dimensions rather than being incorrectly sized to the column height.

            (WebCore::RenderBlock::initialBlockOffsetForPainting):
            (WebCore::RenderBlock::blockDeltaForPaintingNextColumn):
            Two new helper functions used to set up the block direction paint/hit testing translation.
            The major bug fix that occurred in this code is that the old block axis code didn't handle
            reversal correctly and it also used physical coordinates to try to determine the translation
            offset, when you really need to use logical coordinates in the original writing mode coordinate
            system to determine the offset.

            (WebCore::RenderBlock::paintColumnContents):
            Patched to call the new helper functions.

            (WebCore::ColumnRectIterator::ColumnRectIterator):
            (WebCore::ColumnRectIterator::adjust):
            (WebCore::ColumnRectIterator::update):
            Patched to call the new helper functions.

            * rendering/RenderBlock.h:
            Add the two new helper functions to the RenderBlock header.

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::styleDidChange):
            If the writing mode of the html/body propagates to the viewport and changes its writing mode,
            also change our column styles to match if we're in paginated mode.

            (WebCore::RenderBox::computeLogicalHeight):
            (WebCore::RenderBox::computePercentageLogicalHeight):
            Call the new pageOrViewLogicalHeight function on RenderView instead of
            RenderBox::viewLogicalHeightForPercentages (which is now removed).

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::paintChildLayerIntoColumns):
            (WebCore::RenderLayer::hitTestChildLayerColumns):
            Patched to use the two new helper functions for block direction paint offset setup and
            advancement.

            * rendering/RenderView.cpp:
            (WebCore::RenderView::pageOrViewLogicalHeight):
            New helper function that does what viewLogicalHeightForPercentages used to do but also
            handles returning the page length for block axis column progression. Again, this is to
            allow the view to retain its correct size (matching the viewport).

            (WebCore::RenderView::viewLogicalHeight):
            Back out the code that made the view grow or shrink to the size of the Pagination API page
            length when the progression was block axis. This was the source of most of the scroll origin
            and scrolling issues.

            * rendering/RenderView.h:
            Add the new pageOrViewLogicalHeight() function.

            * rendering/style/RenderStyle.cpp:
            (WebCore::RenderStyle::setColumnStylesFromPaginationMode):
            This is the old StyleResolver function for setting up the column styles. It's in RenderStyle
            now so that it can be called at any time to change a style rather than only at style resolution
            time.

            * rendering/style/RenderStyle.h:
            Declaration of the setColumnStylesFromPaginationMode function.

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152907

    2013-07-19  Radu Stavila  <stavila@adobe.com>

            Hover doesn't work for block elements inside a href element
            https://bugs.webkit.org/show_bug.cgi?id=118907

            Reviewed by David Hyatt.

            Added test for hovering block elements inside a href element.

            Test: fast/css/hover-display-block.html

            * rendering/RenderObject.cpp:
            (WebCore::RenderObject::hoverAncestor):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152858

    2013-07-18  Antoine Quint  <graouts@apple.com>

            Crash in WebCore::createMarkup()
            https://bugs.webkit.org/show_bug.cgi?id=118847

            Reviewed by Ryosuke Niwa.

            Also check that we have a containingBlock() for the renderer() so that we
            may safely call node() on it.

            * editing/markup.cpp:
            (WebCore::highestAncestorToWrapMarkup):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152839

    2013-07-18  Ryosuke Niwa  <rniwa@webkit.org>

            willWriteSelectionToPasteboard and willPerformDragSourceAction editing callbacks are not called for drag and drop
            https://bugs.webkit.org/show_bug.cgi?id=118828

            Reviewed by Gavin Barraclough.

            Call these two callbacks when we start a drag and drop.

            No new tests for now but we should start logging these callbacks in DRT and WTR's EditorClients.

            * page/DragController.cpp:
            (WebCore::DragController::startDrag):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152824

    2013-07-17  Tim Horton  <timothy_horton@apple.com>

            Update blocked/missing plug-in UI
            https://bugs.webkit.org/show_bug.cgi?id=118347
            <rdar://problem/14209318>

            Reviewed by Sam Weinig.

            * WebCore.exp.in:
            Export RenderEmbeddedObject::setPluginUnavailabilityReasonWithDescription.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::replacementTextRoundedRectPressedColor):
            (WebCore::replacementTextRoundedRectColor):
            (WebCore::replacementTextColor):
            Change colors to new design and add some more constants.

            (WebCore::shouldUnavailablePluginMessageBeButton): Added.

            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReasonWithDescription): Added.
            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReason):
            Call through to the -WithDescription variant.

            (WebCore::RenderEmbeddedObject::paintReplaced):
            Fill the background, and otherwise match the new design.

            (WebCore::addReplacementArrowPath):
            Add an arrow to the given path, inside the given rect.

            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
            Add a 1px padding to the bottom of the text.
            Add a circle and an arrow into the indicator as per the new design.

            (WebCore::RenderEmbeddedObject::isInUnavailablePluginIndicator):
            Hit-test the indicator arrow as well; otherwise, the fact that the arrow
            is a hole in the path means it won't be hit.

            * rendering/RenderEmbeddedObject.h:

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Rollout r152701

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152793

    2013-07-17  Zalan Bujtas  <zalan@apple.com>

            Wrong linebox height, when block element parent has vertical-align property defined.
            https://bugs.webkit.org/show_bug.cgi?id=118245

            Reviewed by David Hyatt.

            Do not push the current element to the next, when it is still considered empty, even with
            some object(s) in front. Behave as if it was actually empty.
            Inline elements like <span></span> generate such lines.

            Test: fast/css/empty-span-with-parent-div-and-vertical-align.html

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152788

    2013-07-17  Andreas Kling  <akling@apple.com>

            CSS selector list splitting should be by component, not by selector.
            <http://webkit.org/b/118761>
            <rdar://problem/14421609>

            Reviewed by Antti Koivisto.

            Test (amended): fast/css/rule-selector-overflow.html

            * css/CSSSelectorList.h:
            * css/CSSSelectorList.cpp:
            (WebCore::CSSSelectorList::CSSSelectorList):
            (WebCore::CSSSelectorList::componentCount):
            * css/CSSStyleRule.cpp:
            (WebCore::CSSStyleRule::setSelectorText):

                Renamed CSSSelectorList::length() to componentCount() and made it public.

            * css/RuleSet.h:

                maximumSelectorCount => maximumSelectorComponentCount

            * css/StyleRule.cpp:
            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):

                Make the splits after accumulating 'maximumSelectorComponentCount' components.

            * css/StyleRule.h:
            * css/StyleSheetContents.cpp:
            (WebCore::StyleSheetContents::parserAppendRule):

                splitIntoMultipleRulesWithMaximumSelectorCount => splitIntoMultipleRulesWithMaximumSelectorComponentCount

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152783

    2013-07-17  Chris Fleizach  <cfleizach@apple.com>

            Regression: columnheader/rowheader roles not exposed correctly
            https://bugs.webkit.org/show_bug.cgi?id=113628

            Reviewed by Tim Horton.

            When we determine the row and column headers we look at the ARIA role being returned, but
            since TableCell overrides the determineAccessibilityRole method, the ARIA role is never set.

            Test: platform/mac/accessibility/aria-columnrowheaders.html

            * accessibility/AccessibilityTableCell.cpp:
            (WebCore::AccessibilityTableCell::determineAccessibilityRole):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152743

    2013-07-16  Andreas Kling  <akling@apple.com>

            Atomicize HTMLAnchorElement.hash before passing it to JS.
            <http://webkit.org/b/118748>
            <rdar://problem/14459780>

            Reviewed by Sam Weinig.

            Instead of generating a unique string from '#' + the URL hash every time HTMLAnchorElement.hash
            is queried, turn it into an AtomicString. This prevents massive memory usage in scripts that
            fetch .hash a lot.

            Reduces memory consumption by 4.65 MB when viewing the full HTML5 spec at <http://whatwg.org/c>

            * html/HTMLAnchorElement.cpp:
            (WebCore::HTMLAnchorElement::hash):

2013-07-22  Lucas Forschler  <lforschler@apple.com>

        Merge r152721

    2013-07-16  Eric Carlson  <eric.carlson@apple.com>

            HTMLMediaElement should not add cues for disabled text tracks
            https://bugs.webkit.org/show_bug.cgi?id=118682

            Reviewed by Ryosuke Niwa.

            Merge https://src.chromium.org/viewvc/blink?view=rev&revision=153810

            Tests: media/track/track-disabled-addcue.html
                   media/track/track-disabled.html

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::textTrackAddCues): Do nothing if the track is disabled.
            (WebCore::HTMLMediaElement::textTrackAddCue): Ditto.

2013-07-16  Lucas Forschler  <lforschler@apple.com>

        Merge r152701

    2013-07-15  Tim Horton  <timothy_horton@apple.com>

            Update blocked/missing plug-in UI
            https://bugs.webkit.org/show_bug.cgi?id=118347
            <rdar://problem/14209318>

            Reviewed by Sam Weinig.
            Patch by Anders Carlsson, Antoine Quint, Sam Weinig, and myself.

            * CMakeLists.txt:
            * DerivedSources.make:
            * DerivedSources.pri:
            * GNUmakefile.am:
            * WebCore.exp.in:
            * WebCore.vcxproj/WebCore.vcxproj:
            * WebCore.vcxproj/WebCore.vcxproj.filters:
            * WebCore.xcodeproj/project.pbxproj:
            * css/CSSDefaultStyleSheets.cpp:
            * css/unavailablePlugIns.css: Added.
            Add new Source/WebCore/css/unavailablePlugIns.css stylesheet.

            * dom/EventListener.h:
            New event listener type to support the creation of an event listener
            for the label and icon for missing / blocked plug-in UI.

            * html/HTMLPlugInElement.cpp:
            (WebCore::HTMLPlugInElement::defaultEventHandler):
            Remove explicit event handling since we're now using a DOM event handler
            on the label and icon in the shadow root.

            * html/HTMLPlugInImageElement.cpp:
            (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
            Don't populate the shadow root with plugin snapshotting elements
            if we're not planning on showing a snapshot, because this means that
            the shadow root was created for the unavailable plugin indicator instead.

            * page/ChromeClient.h:
            (WebCore::ChromeClient::shouldUnavailablePluginMessageIncludeButton):
            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::RenderEmbeddedObject::RenderEmbeddedObject):
            (WebCore::shouldUnavailablePluginMessageIncludeButton):
            Rename from shouldUnavailablePluginMessageBeButton to
            shouldUnavailablePluginMessageIncludeButton for accuracy.

            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReasonDescription):
            Set custom text to be displayed in the unavailability indicator.

            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReason):
            (WebCore::RenderEmbeddedObject::handleUnavailablePluginButtonClickEvent):
            (WebCore::RenderEmbeddedObject::willBeDestroyed):
            (WebCore::RenderEmbeddedObject::isReplacementObscured):
            (WebCore::RenderEmbeddedObjectEventListener::handleEvent):
            (WebCore::RenderEmbeddedObjectEventListener::operator==):
            Remove the old code used to render the missing / blocked plug-in UI in C++ in favor
            of populating a shadow root in setPluginUnavailabilityReason(). We add a DOM event
            listener in the shadow root to eventually call into unavailablePluginButtonClicked()
            on the ChromeClient.

            (WebCore::RenderEmbeddedObject::paint):
            (WebCore::RenderEmbeddedObject::layout):
            Paint and lay out UA shadow root children.

            (WebCore::RenderEmbeddedObject::canHaveChildren):
            canHaveChildren can use the existence of a UA shadow root to decide
            whether a RenderEmbeddedObject can have children.

            * rendering/RenderEmbeddedObject.h:
            (WebCore::RenderEmbeddedObjectEventListener::create):
            (WebCore::RenderEmbeddedObjectEventListener::cast):
            (WebCore::RenderEmbeddedObjectEventListener::RenderEmbeddedObjectEventListener):
            Create the new event listener class necessary to handle events in the shadow root.

            (WebCore::RenderEmbeddedObject::pluginUnavailabilityReasonDescription): Added.

            * rendering/RenderWidget.h:
            Promote willBeDestroyed() to be public so we may override it in the RenderEmbeddedObject subclass.

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152689

    2013-07-15  Andreas Kling  <akling@apple.com>

            Pack WebCore::Font slightly better.
            <http://webkit.org/b/118681>
            <rdar://problem/14446014>

            Reviewed by Sam Weinig.

            Knock 8 bytes off of Font by packing the members better. Reduces memory consumption by 429 kB when
            viewing the full HTML5 spec at <http://whatwg.org/c>

            * platform/graphics/Font.h:
            (WebCore::Font::typesettingFeatures):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152653

    2013-07-15  Antoine Quint  <graouts@apple.com>

            Text with "text-overflow:ellipsis" and an SVG font do not render correctly
            https://bugs.webkit.org/show_bug.cgi?id=118669

            Reviewed by David Kilzer.

            Partial runs may be routed through the complex path in several Font functions. While incomplete,
            we can check for a non-NULL run.renderingContext() and exempt runs that have it from being forced
            down the complex path. A more thorough fix is already tracked by http://webkit.org/b/100050.

            Adding a new testcase which is a copy of svg/text/text-overflow-ellipsis-svgfont.html with kerning
            and ligatures turned on explicitly since DRT runs with those off by default and this option is required
            to be on for the issue to reproduce.

            Fix courtesy of Dan Bernstein.

            Test: svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures.html

            * platform/graphics/Font.cpp:
            (WebCore::Font::drawText):
            (WebCore::Font::drawEmphasisMarks):
            (WebCore::Font::selectionRectForText):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Rollout r152686.  Previously merged.

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152382

    2013-07-03  Gordon Sheridan  <gordon_sheridan@apple.com>

            Implement mechanism to detect (partially) hidden blocked plugins.
            https://bugs.webkit.org/show_bug.cgi?id=117998

            Reviewed by Dean Jackson.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::RenderEmbeddedObject::replacementTextRect):
            Added private method for calculating the size of the replacement text for blocked plugins.

            (WebCore::RenderEmbeddedObject::isReplacementObscured):
            Added public method to determine if the EMBED element used for a blocked plugin is inaccessible to the user.
            * rendering/RenderEmbeddedObject.h:
            Declare the two new methods mentioned above.

            * WebCore.exp.in:
            Export RenderEmbeddedObject::isReplacementObscured().

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152623

    2013-07-14  Jon Lee  <jonlee@apple.com>

            Origins with invalid ports are not marked as unique (118652)
            https://bugs.webkit.org/show_bug.cgi?id=118652
            <rdar://problem/14437753>

            Reviewed by Sam Weinig.

            * page/SecurityOrigin.cpp:
            (WebCore::SecurityOrigin::create): Return a unique origin if the port is out of range.

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152613

    2013-07-13  Commit Queue  <commit-queue@webkit.org>

            Unreviewed, rolling out r151978.
            http://trac.webkit.org/changeset/151978
            https://bugs.webkit.org/show_bug.cgi?id=118651

            Caused regressions at least 3 websites (Requested by rniwa on
            #webkit).

            * bindings/js/JSDOMBinding.cpp:
            * bindings/js/JSDOMBinding.h:
            * bindings/scripts/CodeGeneratorJS.pm:
            (GetNativeTypeFromSignature):
            (JSValueToNative):
            * bindings/scripts/IDLAttributes.txt:
            * bindings/scripts/test/JS/JSTestObj.cpp:
            (WebCore::setJSTestObjReflectedStringAttr):
            (WebCore::setJSTestObjReflectedURLAttr):
            (WebCore::setJSTestObjReflectedCustomURLAttr):
            * dom/Document.idl:
            * dom/Element.idl:
            * dom/Node.idl:

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152580

    2013-07-10  Roger Fong  <roger_fong@apple.com>

            Plugins that don't support snapshotting should not all autostart.
            https://bugs.webkit.org/show_bug.cgi?id=118572
            <rdar://problem/14324391>.

            Reviewed by Dean Jackson.

            Test: plugins/snapshotting/quicktime-plugin-snapshotted.html

            * html/HTMLPlugInImageElement.cpp:
            (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot): Pass in information about whether or not a snapshot exists
            to the shadow dom.
            * plugins/PluginViewBase.h:
            (WebCore::PluginViewBase::shouldNotAddLayer): This method determines whether or not we should add the plugin's layer to the tree.
            It should not be added if the plugin is in it's snapshotted state but does not actually support snapshotting.
            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): We should only add the layer to the tree when the plugin
            is actually playing. Otherwise we run into an issue where the contents of the layer initially appear on the screen briefly 
            on page load before we display the substitute for a plugin that doesn't support snapshotting.

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152568

    2013-07-11  Andreas Kling  <akling@apple.com>

            Revert r149313: Don't check for @media rules affected by viewport changes in every layout.
            <rdar://problem/14277905>

            Rubber-stamped by Antti Koivisto.

            This changed caused more harm than good. setFrameRect() is not the only path in FrameView
            that can cause media queries to need invalidation.

            * page/FrameView.cpp:
            (WebCore::FrameView::setFrameRect):
            (WebCore::FrameView::layout):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152554

    2013-07-10  Sam Weinig  <sam@webkit.org>

            Range.getClientRects() not working correctly for partially contained vertically styled text nodes
            <rdar://problem/14305675>
            https://bugs.webkit.org/show_bug.cgi?id=118447

            Reviewed by David Hyatt.

            Original patch by Mac Murrett, tweaked by me.

            Test: fast/dom/Range/getClientRects-vertical.html

            * rendering/RenderText.cpp:
            (WebCore::localQuadForTextBox):
            Use the physical accessors rather than the logical ones to get the correct metrics.

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152547

    2013-07-10  Eric Carlson  <eric.carlson@apple.com>

            [Mac] every enabled text track should be listed in the track menu
            https://bugs.webkit.org/show_bug.cgi?id=118477

            Reviewed by Jer Noble.

            Test: media/video-controls-captions-trackmenu-includes-enabled-track.html

            * html/shadow/MediaControlElements.cpp:
            (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay): Don't select the
                "Off" menu item if a track is enabled.

            * page/CaptionUserPreferencesMediaAF.cpp:
            (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Always include a track
                that is showing in the menu. Add more diagnostic logging.

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152532

    2013-07-10  James Craig  <james@cookiecrook.com>

            AX: AccessibilityNodeObject::supportsRequiredAttribute() should switch on CellRole
            https://bugs.webkit.org/show_bug.cgi?id=117817

            Reviewed by Chris Fleizach.

            CellRole supports the required attribute now for accessibility, according to ARIA spec. 
            Updated existing test coverage.

            * accessibility/AccessibilityNodeObject.cpp:
            (WebCore::AccessibilityNodeObject::supportsRequiredAttribute):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152522

    2013-07-09  James Craig  <james@cookiecrook.com>

            @readonly and @aria-readonly="false" are not exposed correctly to accessibility
            https://bugs.webkit.org/show_bug.cgi?id=118475

            Reviewed by Chris Fleizach.

            Account for implicit and explicit @readonly/@aria-readonly mismatches. Updated existing test coverage.

            * accessibility/AccessibilityRenderObject.cpp:
            (WebCore::AccessibilityRenderObject::canSetValueAttribute):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152520

    2013-07-09  Jer Noble  <jer.noble@apple.com>

            Reviewed by Simon Fraser.

            Remember the scroll position and restore after exiting full-screen mode.
            https://bugs.webkit.org/show_bug.cgi?id=61956

            No new tests, adds a client callback used by WebKit and WebKit2 win.

            * platform/graphics/win/FullScreenController.cpp:
            (FullScreenController::enterFullScreen):
            (FullScreenController::exitFullScreen):
            * platform/graphics/win/FullScreenControllerClient.h:

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152459

    2013-07-08  Ruth Fong  <ruth_fong@apple.com>

            Fix TextTrackCue::cueIndex() to handle the null case of TextTrack::cues(() properly
            https://bugs.webkit.org/show_bug.cgi?id=117815
            <rdar://problem/14211041>

            Reviewed by Eric Carlson.

            Merge https://src.chromium.org/viewvc/blink?revision=153206&view=revision

            No new tests, only behavior change is preventing a crash in the release build.
            cueIndex() is only used for sorting cues, so returning an invalidCueIndex in the case
            where track()->cues() is null makes sense and won't modify behavior.

            * html/track/TextTrackCue.cpp:
            (WebCore::TextTrackCue::cueIndex):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152388

    2013-07-03  Chris Fleizach  <cfleizach@apple.com>

            AX: Items the img aria role aren't inserting an object replacement character
            https://bugs.webkit.org/show_bug.cgi?id=118259

            Reviewed by Tim Horton.

            VoiceOver relies on object replacement characters being emitted when asking for selected text.
            This has worked if a real <img> is used, but if role="img" is used on a <div>, for example,
            no emission is performed, which leads to missed elements in text.

            Test: platform/mac/accessibility/aria-image-emits-object-replacement.html

            * editing/TextIterator.cpp:
            (WebCore::isRendererReplacedElement):
            (WebCore::TextIterator::advance):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152345

    2013-07-03  Radu Stavila  <stavila@adobe.com>

            [CSS Regions] Improve implementation of elements in region being flowed to another flow thread
            https://bugs.webkit.org/show_bug.cgi?id=118300

            Based on patch by Zoltán Árvai <zarvai@inf.u-szeged.hu>

            Reviewed by Csaba Osztrogonác.

            Fixed CSS_REGIONS guard.

            * dom/Element.h:
            * dom/NodeRenderingContext.cpp:
            (WebCore::NodeRenderingContext::elementInsideRegionNeedsRenderer):
            (WebCore::NodeRenderingContext::moveToFlowThreadIfNeeded):

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152330

    2013-07-02  Ruth Fong  <ruth_fong@apple.com>

            Change event should not be dispatched by clicking a scrollbar of select listbox
            https://bugs.webkit.org/show_bug.cgi?id=118019
            <rdar://problem/14297760>

            Reviewed by Dean Jackson.

            Test: fast/forms/select/listbox-click-on-scrollbar.html

            Merge the following:
            http://src.chromium.org/viewvc/blink?view=revision&revision=151689
            https://chromium.googlesource.com/chromium/blink/+/492549b0fcaa58a85aa0797446b62985a263704f

            Previously, a select element with the multiple attribute would dispatch
            an onChanged event when the scrollbar is clicked. This patch corrects this
            issue by only calling listBoxOnChange(), which fires the onChanged event, 
            when an actual option is clicked.

            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::childrenChanged): Updated to clear the list
            of selected items when when an <option> element is added to/deleted from its <select> element.
            (Without this addition, if a option was selected, and then JavaScript was used to modify 
            the <select> element, and then the scrollbar was clicked, an onChanged event would fire 
            because it remembers the previously selected option.)

            (WebCore::HTMLSelectElement::listBoxOnChange):

            (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Updated to
            only call listBoxOnChange() if at least one option is selected. 

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r152320

    2013-07-02  Radu Stavila  <stavila@adobe.com>

            [CSS Regions] Improve implementation of elements in region being flowed to another flow thread
            https://bugs.webkit.org/show_bug.cgi?id=118300

            Reviewed by David Hyatt.

            Methods that must be const have been turned back into const. Code has been better organized. 
            Performance is better. Tests have been added to.

            * dom/Element.cpp:
            (WebCore::Element::detach):
            (WebCore::Element::setIsInsideRegion):
            (WebCore::Element::isInsideRegion):
            (WebCore::Element::shouldMoveToFlowThread):
            * dom/Element.h:
            * dom/ElementRareData.h:
            (WebCore::ElementRareData::isInsideRegion):
            (WebCore::ElementRareData::setIsInsideRegion):
            (WebCore::ElementRareData::ElementRareData):
            * dom/Node.cpp:
            (WebCore::Node::isRegisteredWithNamedFlow):
            * dom/Node.h:
            * dom/NodeRenderingContext.cpp:
            (WebCore::NodeRenderingContext::parentRenderer):
            (WebCore::NodeRenderingContext::shouldCreateRenderer):
            (WebCore::NodeRenderingContext::elementInsideRegionNeedsRenderer):
            (WebCore::NodeRenderingContext::moveToFlowThreadIfNeeded):
            (WebCore::NodeRenderingContext::createRendererForElementIfNeeded):
            * dom/NodeRenderingContext.h:
            * dom/PseudoElement.h:
            * dom/Text.cpp:
            (WebCore::Text::textRendererIsNeeded):
            * dom/Text.h:
            * rendering/FlowThreadController.cpp:
            (WebCore::FlowThreadController::unregisterNamedFlowContentNode):
            (WebCore::FlowThreadController::isContentNodeRegisteredWithAnyNamedFlow):
            * rendering/FlowThreadController.h:
            * rendering/RenderObject.h:
            * rendering/RenderRegion.h:
            * svg/SVGElement.cpp:
            (WebCore::SVGElement::shouldMoveToFlowThread):
            * svg/SVGElement.h:

2013-07-15  Lucas Forschler  <lforschler@apple.com>

        Merge r151845

    2013-06-21  Ruth Fong  <ruth_fong@apple.com>

            Fix TextTrackCue::cueIndex() to handle the null case of TextTrack::cues(() properly
            https://bugs.webkit.org/show_bug.cgi?id=117815
            <rdar://problem/14211041> 

            Reviewed by Ryosuke Niwa.

            This patch adds assert statements to try to catch when 
            track()->cues() returns a null pointer.

            * html/track/TextTrackCue.cpp:
            (WebCore::TextTrackCue::cueIndex):

2013-07-12  Lucas Forschler  <lforschler@apple.com>

        Merge r152571

    2013-07-11  Timothy Hatcher  <timothy@apple.com>

            Revert r152267 and soft link WebInspectorUI.framework again.

            https://bugs.webkit.org/show_bug.cgi?id=118544

            Reviewed by David Kilzer.

            * platform/mac/SoftLinking.h: Rename SOFT_LINK_STAGED_FRAMEWORK_OPTIONAL
            to SOFT_LINK_STAGED_FRAMEWORK and ASSERT since we don't want to silently
            fail anymore when using this macro.

2013-07-10  Lucas Forschler  <lforschler@apple.com>

        Rollout r152556.  <rdar://problem/14305675>

2013-07-10  Lucas Forschler  <lforschler@apple.com>

        Merge r152554

    2013-07-10  Sam Weinig  <sam@webkit.org>

            Range.getClientRects() not working correctly for partially contained vertically styled text nodes
            <rdar://problem/14305675>
            https://bugs.webkit.org/show_bug.cgi?id=118447

            Reviewed by David Hyatt.

            Original patch by Mac Murrett, tweaked by me.

            Test: fast/dom/Range/getClientRects-vertical.html

            * rendering/RenderText.cpp:
            (WebCore::localQuadForTextBox):
            Use the physical accessors rather than the logical ones to get the correct metrics.

2013-07-10  Lucas Forschler  <lforschler@apple.com>

        Merge r152548

    2013-07-10  Tim Horton  <timothy_horton@apple.com>

            Deferring layer flushes can cause painting without layout being done
            https://bugs.webkit.org/show_bug.cgi?id=118493

            Reviewed by Simon Fraser.

            r147797 added a mechanism for the TileController to inform RenderLayerCompositor
            that it had performed an action (setNeedsDisplay, etc.) that would cause CoreAnimation
            to call back into us to paint in this runloop, and that it shouldn't throttle the next
            layer flush.

            However, if tiles were created and left unparented (because the TileController was
            out-of-window), when they are later parented, we failed to inform RenderLayerCompositor
            that they were about to call back for painting, and so it would happily throttle the
            next layer flush, and layout would be out of date, and garbage and corruption could result.

            To resolve this, rework the logic surrounding parenting existing-but-unparented tiles
            to ensure that they get added to the TileController's dirtyRect.

            No new tests; the bug only reproduces under specific timing circumstances, and
            manifests itself as an assertion failure or garbage on the screen, so it's quite
            hard to make a workable test.

            * platform/graphics/ca/mac/TileController.mm:
            (WebCore::TileController::revalidateTiles):
            - Factor out the code to parent unparented tiles so that it is shared between the
                created-new-tile and reparenting-existing-tile cases.
            - Keep track of whether we updated the frame of a pre-existing tile.
            - If the tile is dirty and needed to be parented (because either it's new
                or hadn't been parented before), add it to the dirty rect list.
            - If the tile changed size, add it to the dirty rect list.

            (WebCore::TileController::ensureTilesForRect):
            Ditto everything from revalidateTiles.

            (WebCore::TileController::createTileLayer):
            - Explicitly mark fresh tiles as needing display, so that we can depend on
                [WebTileLayer needsDisplay] in revalidateTiles to tell us that it's dirty.

2013-07-10  Lucas Forschler  <lforschler@apple.com>

        Merge r152541

    2013-07-09  Roger Fong  <roger_fong@apple.com>

            HTMLPluginElement's state should be Playing before firing mouse click event.
            https://bugs.webkit.org/show_bug.cgi?id=118398.
            <rdar://problem/14262126>

            Reviewed by Dean Jackson.

            Test: plugins/snapshotting/plugin-receives-click-event.html

            * html/HTMLPlugInImageElement.cpp:
            (WebCore::HTMLPlugInImageElement::simulatedMouseClickTimerFired):
            The defaultEventHandler returns early if the state is not Playing.
            This is because we only want the plugin to deal with user interaction normally if the
            plugin is actually enabled (not being snapshotted).
            When we click on the snapshotted plugin to start it, we mimic what would happen to the plugin
            normally by dispatching another click event on top of where we just clicked.
            However, we were sending the click event before setting the state to Playing which meant that our
            simulated click was not being handled. 
            We should be setting this state before sending the click, not after.

2013-07-10  Lucas Forschler  <lforschler@apple.com>

        Merge r152426

    2013-07-05  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Identify OS-level at build-time.
            https://bugs.webkit.org/show_bug.cgi?id=118428

            Reviewed by Anders Carlsson.

            * DerivedSources.make: Activate legible output features if present.
            * WebCorePrefix.h: Activate MSVC 2010 workarounds for CGFloat if
            building with VS2010.
            * config.h: Activate legible output features if present.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152514

    2013-07-09  Jeff Miller  <jeffm@apple.com>

            AuthenticationMac.mm does not handle NSURLAuthenticationMethodNegotiate in WebCore::mac()
            https://bugs.webkit.org/show_bug.cgi?id=118518

            Reviewed by Alexey Proskuryakov.

            * platform/network/mac/AuthenticationMac.mm:
            (WebCore::mac):
            Map ProtectionSpaceAuthenticationSchemeNegotiate to NSURLAuthenticationMethodNegotiate.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152513

    2013-07-09  Jeff Miller  <jeffm@apple.com>

            AuthenticationMac.mm does not handle NSURLAuthenticationMethodNegotiate
            https://bugs.webkit.org/show_bug.cgi?id=118517

            Reviewed by Brady Eidson.

            * platform/network/mac/AuthenticationMac.mm:
            (WebCore::core):
            Map "NSURLAuthenticationMethodNegotiate" to ProtectionSpaceAuthenticationSchemeNegotiate.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152494

    2013-07-09  Mark Lam  <mark.lam@apple.com>

            Fix 30% JSBench regression (caused by adding column numbers to stack traces).
            https://bugs.webkit.org/show_bug.cgi?id=118481.

            Reviewed by Mark Hahnenberg and Geoffrey Garen.

            Test: fast/js/line-column-numbers.html

            Updated the bindings to use StackFrame::computeLineAndColumn(). The old
            StackFrame::line() and StackFrame::column() has been removed. The new
            algorithm always computes the 2 values together anyway. Hence it is more
            efficient to return them as a pair instead of doing the same computation
            twice for each half of the result.

            * bindings/js/ScriptCallStackFactory.cpp:
            (WebCore::createScriptCallStack):
            (WebCore::createScriptCallStackFromException):
            * bindings/js/ScriptSourceCode.h:
            (WebCore::ScriptSourceCode::ScriptSourceCode):

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152453

    2013-07-08  Andreas Kling  <akling@apple.com>

            REGRESSION(r125294): A style rule with more than 8192 selectors can cause style corruption.
            <http://webkit.org/b/118369>
            <rdar://problem/14291428>

            Reviewed by Antti Koivisto.

            Add a semi-hard cap of 8192 selectors per CSS rule. Rules with longer selector lists will be split into
            multiple rules (with 8192 selectors per rule.) The style properties are shared behind the scenes
            so it's all pretty efficient.

            This does generate a different CSSOM for gigantic selector lists, I've added a test to document this.
            Note that setting CSSStyleRule.selectorText with over 8192 selectors will now fail, the splitting into
            multiple rules only happens when parsing full style sheets.

            Test: fast/css/rule-selector-overflow.html

            * css/CSSSelectorList.cpp:
            (WebCore::CSSSelectorList::selectorCount):

                Add a helper to count the number of selectors in a list (not the number of raw selector components.)

            * css/RuleSet.h:
            * css/CSSStyleRule.cpp:
            (WebCore::CSSStyleRule::setSelectorText):

                Add RuleData::maximumSelectorCount constant and cap CSSStyleRule.selectorText to that many selectors.

            * css/CSSSelectorList.h:
            (WebCore::CSSSelectorList::adoptSelectorArray):
            * css/StyleRule.cpp:
            (WebCore::StyleRule::create):
            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorCount):
            * css/StyleRule.h:
            (WebCore::StyleRule::parserAdoptSelectorArray):
            * css/StyleSheetContents.cpp:
            (WebCore::StyleSheetContents::parserAppendRule):

                The meat of this change. Split rules with >8K selectors into multiple rules with 8K selectors in each.

            * css/StyleRule.h:
            (WebCore::toStyleRule):

                Added a toStyleRule() helper for good measure.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152434

    2013-07-05  Tim Horton  <timothy_horton@apple.com>

            Tons of crashes on bots after r152425
            https://bugs.webkit.org/show_bug.cgi?id=118440
            <rdar://problem/14366772>

            Reviewed by Sam Weinig.

            Null-check the frame's page and early return. It's OK to do this
            because it only happens when we're being torn down.

            * page/FrameView.cpp:
            (WebCore::FrameView::minimumScrollPosition):
            (WebCore::FrameView::maximumScrollPosition):

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152433

    2013-07-05  Tim Horton  <timothy_horton@apple.com>

            Fix r152265: FrameView's pagination mode is only one of two, and the logic was totally wrong
            https://bugs.webkit.org/show_bug.cgi?id=118439
            <rdar://problem/14366120>

            Reviewed by Anders Carlsson.

            * page/FrameView.cpp:
            (WebCore::FrameView::maximumScrollPosition):
            - Test both Page and FrameView's pagination modes.
            - *Don't* clamp negatives to zero if we are paginated with scroll offset set,
                like the original changelog claimed, but the code did the opposite.
            - Don't clamp in *all* pagination modes; with 'direction: RTL' it's still possible
                to have a negative maximum position in LTR/TB pagination modes.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152430

    2013-07-05  Sam Weinig  <sam@webkit.org>

            WKPageFindStringMatches with kWKFindOptionsBackwards still doesn't work
            <rdar://problem/13881024>
            https://bugs.webkit.org/show_bug.cgi?id=118436

            Reviewed by Tim Horton.

            * page/Page.cpp:
            (WebCore::Page::findStringMatchingRanges):
            - When searching backwards, use END_TO_START rather than START_TO_END.
            - If there is no selection and we are searching backwards, we now select the last item,
              not the first.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152425

    2013-07-05  Tim Horton  <timothy_horton@apple.com>

            [wk2] Add API to lock the scroll position at the top or bottom of the page
            https://bugs.webkit.org/show_bug.cgi?id=118429
            <rdar://problem/14120323>

            Reviewed by Anders Carlsson.

            Test (API): WebKit2.ScrollPinningBehaviors

            * WebCore.exp.in:
            Expose FrameView::setScrollPinningBehavior.

            * page/FrameView.cpp:
            (WebCore::FrameView::FrameView):
            Our pinning behavior should be DoNotPin by default.

            * page/FrameView.cpp:
            (WebCore::FrameView::minimumScrollPosition):
            (WebCore::FrameView::maximumScrollPosition):
            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
            (WebCore::ScrollingTreeScrollingNodeMac::minimumScrollPosition):
            (WebCore::ScrollingTreeScrollingNodeMac::maximumScrollPosition):
            Fix the minimum scroll position's vertical location to the maximum if
            we're pinned to the bottom, and vice-versa if we're pinned to the top.

            (WebCore::FrameView::setScrollPinningBehavior): Added.
            If scroll pinning behavior has changed, inform ScrollingCoordinator
            and update scrollbars (which will also re-pin the scroll position).

            * page/FrameView.h:
            Override minimumScrollPosition, add setScrollPinningBehavior,
            and storage for m_scrollPinningBehavior.

            * page/scrolling/ScrollingCoordinator.h:
            (WebCore::ScrollingCoordinator::setScrollPinningBehavior): Added.

            * page/scrolling/ScrollingTree.cpp:
            (WebCore::ScrollingTree::ScrollingTree):
            Our pinning behavior should be DoNotPin by default.

            (WebCore::ScrollingTree::setScrollPinningBehavior):
            (WebCore::ScrollingTree::scrollPinningBehavior):
            Getter/setter for m_scrollPinningBehavior, scrolling-thread-safe.

            * page/scrolling/ScrollingTree.h:
            * page/scrolling/mac/ScrollingCoordinatorMac.h:
            * page/scrolling/mac/ScrollingCoordinatorMac.mm:
            (WebCore::ScrollingCoordinatorMac::setScrollPinningBehavior):
            Inform ScrollingTree of the scroll pinning behavior change.

            * platform/ScrollTypes.h:
            Add ScrollPinningBehavior enum.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152424

    2013-07-05  Zalan Bujtas  <zalan@apple.com>

            iframe constrained by max-width in full screen
            https://bugs.webkit.org/show_bug.cgi?id=118250

            Reviewed by Antti Koivisto.

            Ensure that contents inside iframe can go full screen properly.

            Set max-width and max-height values to the default 'none', so that iframes are not
            constrained when entering full screen.

            Test: fullscreen/full-screen-iframe-with-max-width-height.html

            * css/fullscreen.css:
            (iframe:-webkit-full-screen):

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152422

    2013-07-05  Eric Carlson  <eric.carlson@apple.com>

            [Mac] .webkitClosedCaptionsVisible doesn't work with "Automatic" caption mode
            https://bugs.webkit.org/show_bug.cgi?id=118319

            Reviewed by Jer Noble.

            Track when captions are enabled with the old 'webkitClosedCaptionsVisible' attribute and
            consider that when determining which track should be enabled.

            Test: media/track/track-legacyapi-with-automatic-mode.html

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_webkitLegacyClosedCaptionOverride.
            (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): Set m_webkitLegacyClosedCaptionOverride.
            (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): Return m_webkitLegacyClosedCaptionOverride.
            * html/HTMLMediaElement.h:

            * page/CaptionUserPreferencesMediaAF.cpp:
            (WebCore::CaptionUserPreferencesMediaAF::textTrackSelectionScore): Don't apply "automatic"
                logic when captions were enabled with .webkitClosedCaptionsVisible.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152383

    2013-07-03  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Updates to support changes in CoreGraphics libraries.
            https://bugs.webkit.org/show_bug.cgi?id=118373

            Reviewed by Anders Carlsson.

            * WebCorePrefix.h: Include definitions for isnan/round/roundf for versions of
            Visual Studio that do not provide them natively.

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152382

    2013-07-03  Gordon Sheridan  <gordon_sheridan@apple.com>

            Implement mechanism to detect (partially) hidden blocked plugins.
            https://bugs.webkit.org/show_bug.cgi?id=117998

            Reviewed by Dean Jackson.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::RenderEmbeddedObject::replacementTextRect):
            Added private method for calculating the size of the replacement text for blocked plugins.

            (WebCore::RenderEmbeddedObject::isReplacementObscured):
            Added public method to determine if the EMBED element used for a blocked plugin is inaccessible to the user.
            * rendering/RenderEmbeddedObject.h:
            Declare the two new methods mentioned above.

            * WebCore.exp.in:
            Export RenderEmbeddedObject::isReplacementObscured().

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152348

    2013-07-03  Zalan Bujtas  <zalan@apple.com>

            H&R Block 2010 Help window can not be reopened.
            https://bugs.webkit.org/show_bug.cgi?id=118342

            Reviewed by Antti Koivisto.

            http://trac.webkit.org/changeset/118916 changed the window.focus() behaviour so that
            only the opener can (re)focus() a particular window.
            H&R Block app relies on the relaxed window.focus() rules.

            * WebCore.exp.in:
            * platform/RuntimeApplicationChecks.cpp:
            (WebCore::applicationIsHRBlock):
            * platform/RuntimeApplicationChecks.h:

2013-07-09  Lucas Forschler  <lforschler@apple.com>

        Merge r152324

    2013-07-02  Jer Noble  <jer.noble@apple.com>

            media/unsupported-rtsp.html is failing
            https://bugs.webkit.org/show_bug.cgi?id=118327

            Reviewed by Eric Carlson.

            Fixes the media/unsupported-rtsp.html test.

            Set the contentType field of contentInformationRequest in order to trigger AVFoundation to 
            notice that loading failed and generate an error.

            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
            (WebCore::WebCoreAVFResourceLoader::notifyFinished):

2013-07-08  Lucas Forschler  <lforschler@apple.com>

        Merge r152315

    2013-07-02  Anders Carlsson  <andersca@apple.com>

            Always flip the coordinate system before drawing NSViews from Widget::paint
            https://bugs.webkit.org/show_bug.cgi?id=118318
            <rdar://problem/13895483>

            Reviewed by Beth Dakin.

            Undo the change that would not flip on 10.9; turns out the bug was in AppKit. Also remove the
            _hasCanDrawSubviewsIntoLayerOrAncestor workaround since drawing works correctly now.

            Also, pass flipped:NO when creating the NSGraphicsContext to indicate that the graphics context
            is unflipped as far as AppKit knows (since we flipped it earlier).

            * platform/mac/WidgetMac.mm:
            (WebCore::Widget::paint):

2013-07-08  Lucas Forschler  <lforschler@apple.com>

        Merge r152303

    2013-07-02  Tim Horton  <timothy_horton@apple.com>

            constrainScrollPositionForOverhang needs to handle scrollOrigin correctly
            https://bugs.webkit.org/show_bug.cgi?id=118176
            <rdar://problem/14301271>

            Reviewed by Anders Carlsson.

            Test: compositing/geometry/fixed-position-flipped-writing-mode.html

            WebCore makes use of constrainScrollPositionForOverhang not only for
            constraining fixed- and sticky-positioned elements to the viewport, but
            also for clamping the tile cache's visible rect.

            Therefore, constrainScrollPositionForOverhang needs to correctly take
            the scrollOrigin into account. The easiest way I saw to do this was to
            reimplement the function in terms of a pair of rect intersections
            between a virtual scrollable "viewport" and the document (with a bit
            of complication from headers and footers).

            The first intersection is performed, then if the viewport doesn't fit,
            it is pushed down and to the right, from the origin. Next, we intersect
            again, this time pushing the rect up by the amount it overflowed the document
            rect from the bottom right. This performs effectively the same constraint
            as previously, but handles the scrollOrigin correctly and is also somewhat
            easier to read and understand (with pictures).

            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
            (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
            Subtract the scrollOrigin out of the offset passed to scrollOffsetForFixedPosition,
            it's expecting an offset without the origin included.

            * platform/ScrollableArea.cpp:
            (WebCore::ScrollableArea::constrainScrollPositionForOverhang):
            Reimplement the function as described above.

2013-07-08  Lucas Forschler  <lforschler@apple.com>

        Rollout r151510. <rdar://problem/14380353>

2013-07-08  Lucas Forschler  <lforschler@apple.com>

        Merge r152306

    2013-07-02  Geoffrey Garen  <ggaren@apple.com>

            plainText() is O(N^2)
            https://bugs.webkit.org/show_bug.cgi?id=118282
            <rdar://problem/14284360>

            Reviewed by Alexey Proskuryakov.

            * editing/TextIterator.cpp:
            (WebCore::plainText): Linear growth for a vector data type is O(N^2).
            Don't do that. Luckily, StringBuilder does the right thing automatically,
            so we can just delete code.

2013-07-08  Lucas Forschler  <lforschler@apple.com>

        Merge r151737

    2013-06-19  Robert Hogan  <robert@webkit.org>

            Incorrect computation of shrink-to-fit width for block with white-space:nowrap and floating children
            https://bugs.webkit.org/show_bug.cgi?id=114879

            Reviewed by David Hyatt.
            Per http://www.w3.org/TR/CSS21/visudet.html#Computing_widths_and_margins when width is auto then floating non-replaced,
            absolute non-replaced, and inline-block non-replaced elements should use shrink-to-fit width. This trumps any no-wrap property 
            on the element so if we are shrinking to fit ensure our minimum width respects all possible line breaks.

            Test: fast/block/shrink-to-fit-width-container-with-floating-children.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::computeIntrinsicLogicalWidths):

2013-07-02  Lucas Forschler  <lforschler@apple.com>

        Merge r152328

    2013-07-02  Jessie Berlin  <jberlin@apple.com>

            The callback for WKPageGetPlugInInformation needs info about whether or not there are any
            non-playing instances of the plug-in on the page
            https://bugs.webkit.org/show_bug.cgi?id=118330

            Reviewed by Anders Carlsson.

            * WebCore.exp.in:
            Expose a symbol so it can be used in WebKit2.

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152265

    2013-07-01  Tim Horton  <timothy_horton@apple.com>

            Maximum scroll position can be negative in some cases
            https://bugs.webkit.org/show_bug.cgi?id=118175
            <rdar://problem/14301217>

            Reviewed by Anders Carlsson.

            Test (API): WebKit2.ResizeReversePaginatedWebView

            * page/FrameView.cpp:
            (WebCore::FrameView::maximumScrollPosition):
            * page/FrameView.h:
            Override maximumScrollPosition() in FrameView and don't clamp to zero if
            a reverse pagination mode is enabled, as it is possible (and common) to
            have a negative maximum scroll position with reverse pagination.

            * platform/ScrollView.cpp:
            (WebCore::ScrollView::updateScrollbars):
            Drive-by adoption of toIntSize().

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152204

    2013-06-28  Eric Carlson  <eric.carlson@apple.com>

            [Mac] adopt new AVFoundation caption API
            https://bugs.webkit.org/show_bug.cgi?id=118207

            Reviewed by Dean Jackson.

            No new tests, I was not able to come up with a reliable layout test.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::flushCues): New, call currentTrack->resetCueValues().
            (-[WebCoreAVFMovieObserver outputSequenceWasFlushed:]): New delegate method.

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152185

    2013-06-28  Ryosuke Niwa  <rniwa@webkit.org>

            -webkit-line-break: after-white-space sometimes truncates DOM on copy & paste
            https://bugs.webkit.org/show_bug.cgi?id=118164

            Reviewed by Sam Weinig.

            We can't assume that all subsequent ancestors contain exactly one child since they could have been
            added in the first if statement matching: currentNode->parentNode() != rootNode && isRemovableBlock(currentNode)

            Exit early when we encounter such an ancestor since removing its ancestor (that contains multiple children
            some of which aren't in nodesToRemove) can clobber more nodes than we're allowed to remove.

            Test: editing/pasteboard/simplfiying-markup-should-not-strip-content.html

            * editing/SimplifyMarkupCommand.cpp:
            (WebCore::SimplifyMarkupCommand::doApply):
            (WebCore::SimplifyMarkupCommand::pruneSubsequentAncestorsToRemove):

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152234

    2013-06-27  Jer Noble  <jer.noble@apple.com>

            Audio in apps which embed WebViews is corrupted.
            https://bugs.webkit.org/show_bug.cgi?id=118163

            Reviewed by Maciej Stachowiak.

            Add a preference, which defaults to off, which controls whether the
            AudioSessionManager will switch to a large audio buffer setting for
            power-savings during <video> playback.

            * WebCore.exp.in:
            * page/Settings.cpp:
            (WebCore::Settings::setLowPowerVideoAudioBufferSizeEnabled): Added.  Simple setter.
            * page/Settings.h:
            (WebCore::Settings::lowPowerVideoAudioBufferSizeEnabled): Added.  Simple getter.
            * platform/audio/mac/AudioSessionManagerMac.cpp:
            (AudioSessionManager::updateSessionState): Only set the large audio buffer
                size if lowPowerVideoAudioBufferSize is enabled.

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152231

    2013-07-01  Roger Fong  <roger_fong@apple.com>

            Unreviewed. Make WebCore.make copy over QTMovieWin DLL's and PDB's.
            <rdar://problem/14321403>

            * WebCore.vcxproj/WebCore.make:

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152207

    2013-06-29  Carlos Garcia Campos  <cgarcia@igalia.com>

            REGRESSION(151586): multipart/x-mixed-replace images are broken
            https://bugs.webkit.org/show_bug.cgi?id=118169

            Reviewed by Alexey Proskuryakov.

            When loading multipart content the resource data will change as
            the next part is loaded, so we need to make a copy of the data
            before sending it to the resource.

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::didReceiveResponse):

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152202

    2013-06-28  Gavin Barraclough  <barraclough@apple.com>

            PageThrottler::shouldThrottleTimers is wrong.
            https://bugs.webkit.org/show_bug.cgi?id=118210

            Reviewed by Anders Carlson.

            m_throttleState == PageNotThrottledState
                -> page NOT throttled, so should NOT throttle timers
            m_throttleState != PageNotThrottledState
                -> page NOT NOT throttled, so should throttle timers

            This needs cleaning up, but for now, 1 character fix.

            * page/PageThrottler.h:
            (WebCore::PageThrottler::shouldThrottleTimers):
                == -> !=

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152198

    2013-06-28  Ryosuke Niwa  <rniwa@webkit.org>

            An element with -webkit-user-select: all should be selected on single click
            https://bugs.webkit.org/show_bug.cgi?id=117864

            Reviewed by Darin Adler.

            Set m_mouseDownMayStartSelect true even when the node cannot start selection
            if the node was inside an element with -webkit-user-select: all.

            Test: editing/selection/user-select-all-with-single-click.html

            * page/EventHandler.cpp:
            (WebCore::canMouseDownStartSelect):

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152196

    2013-06-28  Alexey Proskuryakov  <ap@apple.com>

            [Mac] Crash when loading is stopped from -didReceiveResponse
            https://bugs.webkit.org/show_bug.cgi?id=118209
            <rdar://problem/14259249>

            Reviewed by Brady Eidson.

            Test: TestWebKitAPI/Tests/mac/StopLoadingFromDidReceiveResponse.mm.

            * loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::didReceiveResponse):
            Added yet another check for reachedTerminalState().

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152194

    2013-06-28  Beth Dakin  <bdakin@apple.com>

            Cached pages don't update their backing scale factor when it changes
            https://bugs.webkit.org/show_bug.cgi?id=118206
            -and-
            <rdar://problem/14261627>

            Reviewed by Tim Horton.

            It is not sufficient to mark pages in the PageCache as needing a full style 
            recalc. We also need to ensure that the RenderLayerCompositors for the CachesPages 
            get updated.

            Keep track of whether device scale has been updated with 
            m_needsDeviceScaleChanged. If that has been marked true, then restore() will call 
            Frame::deviceOrPageScaleFactorChanged().
            * history/CachedPage.cpp:
            (WebCore::CachedPage::CachedPage):
            (WebCore::CachedPage::restore):
            * history/CachedPage.h:
            (WebCore::CachedPage::markForDeviceScaleChanged):

            Propagate markForDeviceScaleChanged() to all of the CachedPages.
            * history/PageCache.cpp:
            (WebCore::PageCache::markPagesForDeviceScaleChanged):
            * history/PageCache.h:

            Call PageCache::markPagesForDeviceScaleChanged()
            * page/Page.cpp:
            (WebCore::Page::setDeviceScaleFactor):

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152117

    2013-06-27  Ruth Fong  <ruth_fong@apple.com>

            Polish context menus for media elements
            https://bugs.webkit.org/show_bug.cgi?id=118078
            <rdar://problem/14278960>

            Reviewed by Eric Carlson.

            No new tests: media/context-menu-action.html,
            which has been disabled by bug 116651, is used to test context menus.

            * English.lproj/Localizable.strings: Changed "Fullscreen" to "Full Screen"
            and added strings "Show Controls" and "Hide Controls".

            * page/ContextMenuController.cpp: Updated to include a new context menu item 
            that toggles betweeen "Show Controls" and "Hide Controls".

            * platform/ContextMenuItem.h:

            * platform/LocalizedStrings.cpp:
            * platform/LocalizedStrings.h:
            * platform/efl/LocalizedStringsEfl.cpp:
            * platform/gtk/LocalizedStringsGtk.cpp:
            * platform/qt/LocalizedStringsQt.cpp:
            Added equivalents of localized strings "Show Controls" and "Hide Controls".

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r152065

    2013-06-26  Roger Fong  <roger_fong@apple.com>

            Add an accessibility delegate interface to AppleWin port.
            https://bugs.webkit.org/show_bug.cgi?id=118094.

            Reviewed by Brent Fulgham.

            * accessibility/win/AXObjectCacheWin.cpp: We call the page client's AXStartFrameLoad and AXFinishFrameLoad methods here, which will in turn call the AccessibilityDelegate's callbacks.
            (WebCore::AXObjectCache::frameLoadingEventPlatformNotification):
            * loader/EmptyClients.h:
            (WebCore::EmptyChromeClient::AXStartFrameLoad):
            (WebCore::EmptyChromeClient::AXFinishFrameLoad):
            * page/ChromeClient.h:

2013-07-01  Lucas Forschler  <lforschler@apple.com>

        Merge r151978

    2013-06-25  Ryosuke Niwa  <rniwa@webkit.org>

            JSString should remember AtomicString
            https://bugs.webkit.org/show_bug.cgi?id=117386

            Reviewed by Geoffrey Garen.

            Added "Atomic" attribute as a WebKit extension to WebIDL, and deployed it in Element.idl and Node.idl so that
            the binding code can use newly added JSValue::toAtomic to update JSString's m_value.

            * bindings/js/JSDOMBinding.cpp:
            (WebCore::valueToAtomicStringWithNullCheck): Added.
            (WebCore::valueToAtomicStringWithUndefinedOrNullCheck): Added.

            * bindings/js/JSDOMBinding.h:

            * bindings/scripts/CodeGeneratorJS.pm:
            (GetNativeTypeFromSignature): Return const AtomicString& when either Atomic attribute is specified or the type is
            Reflect. Note that setAttribute and getAttribute both use AtomicString for all arguments.
            (JSValueToNative): Use AtomicString equivalents when possible when converting DOMString to a WebCore object.

            * bindings/scripts/IDLAttributes.txt: Added "Atomic" attribute.

            * bindings/scripts/test/JS/JSTestObj.cpp: Baselined test cases.
            (WebCore::setJSTestObjReflectedStringAttr):
            (WebCore::setJSTestObjReflectedURLAttr):
            (WebCore::setJSTestObjReflectedCustomURLAttr):

            * dom/Document.idl:
            * dom/Element.idl:
            * dom/Node.idl:

2013-06-27  Lucas Forschler  <lforschler@apple.com>

        Merge r152038

    2013-06-26  Jer Noble  <jer.noble@apple.com>

            Potential use-after-free after neutering AudioBuffer's underlying ArrayBuffer.
            https://bugs.webkit.org/show_bug.cgi?id=118040

            Reviewed by Filip Pizlo.

            Test: webaudio/audiobuffer-neuter.html

            When creating an AudioBuffer's backing ArrayBufferView objects, mark them as 'unneuterable',
            meaning the underlying data will be copied in a neuter scenario rather than transferred. This
            means the underlying assumtions of the webaudio code can continue to assume that the memory
            areas owned by the ArrayBufferView will be present until the AudioBuffer is itself destroyed.

            In order to not expose the 'unneuterable' behavior to JavaScript, return a fresh Float32Array
            wrapper around the ArrayBuffer object, rather than our own.

            * Modules/webaudio/AudioBuffer.cpp:
            (WebCore::AudioBuffer::AudioBuffer): Mark the newly created channels as not neuterable.
            (WebCore::AudioBuffer::getChannelData): Return a new Float32Array object rather than a pointer to our own.
            * Modules/webaudio/AudioBuffer.h:

2013-06-27  Lucas Forschler  <lforschler@apple.com>

        Merge r152035

    2013-06-26  Brent Fulgham  <bfulgham@apple.com>

            [Windows] Enable CaptionUserPreferencesMediaAF on Windows.
            https://bugs.webkit.org/show_bug.cgi?id=118076

            Reviewed by Eric Carlson.

            * WebCore.vcxproj/WebCore.vcxproj: Enable building the CaptionUserPreferencesMediaAF source file.
            * page/CaptionUserPreferencesMediaAF.cpp: Add soft-link commands for CoreText symbols needed in
              the implementation for Windows.
            * platform/LocalizedStrings.cpp: Enable Text Track-related strings on Windows.
            * platform/LocalizedStrings.h: Ditto.

2013-06-27  Lucas Forschler  <lforschler@apple.com>

        Merge r152004

    2013-06-26  Brent Fulgham  <bfulgham@apple.com>

            Prepare CaptionUserPreferencesMac for use on Windows port.
            https://bugs.webkit.org/show_bug.cgi?id=118069

            Reviewed by Eric Carlson.

            * WebCore.vcxproj/WebCore.vcxproj: Add new files.
            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
            * WebCore.xcodeproj/project.pbxproj: Update for new file name.
            * page/CaptionUserPreferencesMac.h: Removed.
            * page/CaptionUserPreferencesMac.mm: Removed.
            * page/CaptionUserPreferencesMediaAF.cpp: Copied from page/CaptionUserPreferencesMac.mm.
            * page/CaptionUserPreferencesMediaAF.h: Copied from page/CaptionUserPreferencesMac.h.
            * page/PageGroup.cpp:
            (WebCore::PageGroup::captionPreferences): Updated to new class name.

2013-06-27  Lucas Forschler  <lforschler@apple.com>

        Merge r151868

    2013-06-21  Brent Fulgham  <bfulgham@apple.com>

            AX: Title for ListItemRole should consist of concatenated child text elements.
            https://bugs.webkit.org/show_bug.cgi?id=117892

            Reviewed by Chris Fleizach.

            accessibility/listitem-title.html

            * accessibility/AccessibilityNodeObject.cpp:
            (WebCore::AccessibilityNodeObject::visibleText): Add ListItemRole to set of
            elements that concatenate their children for display purposes.
            (WebCore::AccessibilityNodeObject::title): Ditto.

2013-06-27  Lucas Forschler  <lforschler@apple.com>

        Merge r151841

    2013-06-20  Brent Fulgham  <bfulgham@apple.com>

            [Windows] AX: Radio buttons with "tab" role should describe themselves as tabs
            https://bugs.webkit.org/show_bug.cgi?id=117837

            Reviewed by Chris Fleizach.

            accessibility/aria-tab-role-on-buttons.html

            * accessibility/AccessibilityNodeObject.cpp:
            (WebCore::AccessibilityNodeObject::canSetSelectedAttribute): Indicate that certain accessibility
            types (such as Tabs) can be selected.
            * accessibility/AccessibilityNodeObject.h: Signature for canSelectAttribute override.

2013-06-27  Lucas Forschler  <lforschler@apple.com>

        Merge r151778

    2013-06-19  Brent Fulgham  <bfulgham@apple.com>

            AX: List Items should support a default action
            https://bugs.webkit.org/show_bug.cgi?id=117812

            Reviewed by Chris Fleizach.

            * accessibility/AccessibilityObject.cpp:
            (WebCore::AccessibilityObject::actionVerb): Provide a "select" verb
            for use in ListItemRole objects.
            * platform/LocalizedStrings.cpp:
            (WebCore::AXListItemActionVerb): Added.
            * platform/LocalizedStrings.h:
            * platform/blackberry/LocalizedStringsBlackBerry.cpp:
            (WebCore::AXListItemActionVerb):
            * platform/efl/LocalizedStringsEfl.cpp:
            (WebCore::AXListItemActionVerb):
            * platform/gtk/LocalizedStringsGtk.cpp:
            (WebCore::AXListItemActionVerb):

2013-06-27  Lucas Forschler  <lforschler@apple.com>

        Merge r151745

    2013-06-19  Brent Fulgham  <bfulgham@apple.com>

            [Windows] AX: Extend notification handling
            https://bugs.webkit.org/show_bug.cgi?id=117761.

            Reviewed by Anders Carlsson.

            accessibility/press-works-on-control-types.html

            * accessibility/win/AXObjectCacheWin.cpp:
            (WebCore::AXObjectCache::postPlatformNotification): Add handlers for more event notifications.
            * accessibility/win/AccessibilityObjectWrapperWin.cpp:
            (WebCore::AccessibilityObjectWrapper::accessibilityAttributeValue): Protect against null
            pointer dereference found during testing.
            * dom/Document.cpp:
            (WebCore::Document::implicitClose): Execute notification handler for Windows as well as Mac.
            * page/FrameView.cpp:
            (WebCore::FrameView::layout): Ditto.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r152020

    2013-06-26  Ryosuke Niwa  <rniwa@webkit.org>

            Speed up SVG sprites by only painting the source rect in SVGImage::draw
            https://bugs.webkit.org/show_bug.cgi?id=118070

            Reviewed by Tim Horton.

            Merge https://chromium.googlesource.com/chromium/blink/+/d359ab67fdd76a877d666dca91c311505dd27bbf.

            * svg/graphics/SVGImage.cpp:
            (WebCore::SVGImage::draw):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151998

    2013-06-26  Ryosuke Niwa  <rniwa@webkit.org>

            Set Attr.ownerDocument in Element#setAttributeNode()
            https://bugs.webkit.org/show_bug.cgi?id=118031

            Reviewed by Andreas Kling.

            Merge https://chromium.googlesource.com/chromium/blink/+/fa739fe5369f55bbdcb3fa123cb64df36b8ae414.

            Adopt Attr node as needed.

            Test: fast/dom/Attr/set-attribute-node-from-iframe.html

            * dom/Element.cpp:
            (WebCore::Element::setAttributeNode):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151997

    2013-06-25  David Hyatt  <hyatt@apple.com>

            Flex boxes (both old and new) don't handle max-height images correctly.
            https://bugs.webkit.org/show_bug.cgi?id=118000

            Reviewed by Beth Dakin.

            Tests: css3/flexbox/image-percent-max-height.html
                   fast/flexbox/image-percent-max-height.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::dirtyForLayoutFromPercentageHeightDescendants):
            (WebCore::RenderBlock::layoutBlockChildren):
            Pull the percentage height descendant code that dirties those descendants
            out of layoutBlockChildren and into a protected helper function,
            dirtyForLayoutFromPercentageHeightDescendants, that can be called from the 
            flex box code.

            Also patch dirtyForLayoutFromPercentageHeightDescendants so that it will dirty
            preferred logical widths when a child has an aspect ratio, since we know that
            percentage height changes will potentially affect the preferred widths of the image and
            its ancestor blocks.

            * rendering/RenderBlock.h:
            Declaration of the new dirtyForLayoutFromPercentageHeightDescendants function.

            * rendering/RenderDeprecatedFlexibleBox.cpp:
            (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
            Make the old flex box code call dirtyForLayoutFromPercentageHeightDescendants so
            that everything is dirtied properly.

            (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
            (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
            Remove the isReplaced()/percentage height/width dirtying now that the old flexible
            box is using the same dirtying mechanism as RenderBlock.

            * rendering/RenderFlexibleBox.cpp:
            (WebCore::RenderFlexibleBox::layoutBlock):
            Patch the new flexible box code to use the dirtying mechanism that RenderBlock
            uses for percentage heights/widths on replaced descendants.

            * rendering/RenderObject.h:
            (WebCore::RenderObject::hasAspectRatio):
            Pulled the static helper function from RenderReplaced into a full-blown method
            on RenderObject, so that dirtyForLayoutFromPercentageHeightDescendants can call
            it to check if an object has an aspect ratio.

            * rendering/RenderReplaced.cpp:
            (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):
            (WebCore::RenderReplaced::computeIntrinsicRatioInformation):
            Patch the call sites of the static helper function to use hasAspectRatio instead
            and get rid of the static in the cpp file.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151994

    2013-06-26  Brady Eidson  <beidson@apple.com>

            [Mac] Document URL is not updated by HSTS
            <rdar://problem/14241270> and https://bugs.webkit.org/show_bug.cgi?id=118003

            Patch started by Alexey Proskuryakov, finished by Brady Eidson.

            Reviewed by Brady Eidson and then Alexey Proskuryakov.

            Synthesize a response and properly handle willSendRequest when the URL changes in a way that's typical for HSTS.

            * platform/network/mac/WebCoreURLResponse:
            * platform/network/mac/WebCoreURLResponse:
            (WebCore::synthesizeRedirectResponseIfNecessary): Synthesize a redirect response and when the URL changes in a way that's
              typical for HSTS connections.

            * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
            (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Call synthesizeRedirectResponseIfNecessary.

            * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
            (-[WebCoreResourceHandleAsOperationQueueDelegate connection:willSendRequest:redirectResponse:]): Ditto.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151986

    2013-06-26  Ryosuke Niwa  <rniwa@webkit.org>

            Use-after-free in RadioInputType::handleKeydownEvent
            https://bugs.webkit.org/show_bug.cgi?id=118035

            Reviewed by Kent Tamura.

            Use RefPtr for inputElement since setFocusedNode could blow it away.

            * html/RadioInputType.cpp:
            (WebCore::RadioInputType::handleKeydownEvent):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151971

    2013-06-25  Dean Jackson  <dino@apple.com>

            Don't snapshot plug-ins that come from the same host as the page
            https://bugs.webkit.org/show_bug.cgi?id=117969
            <rdar://problem/12885400>

            Reviewed by Tim Horton.

            If a page is serving plug-in content directly, then that content
            is typically very important to the page. For example, embedding
            a video or audio player. In this case, don't snapshot the plug-ins.

            * html/HTMLPlugInImageElement.cpp:
            (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Add a test
            that compares the plug-in's URL against the main page's URL and don't snapshot
            if they are the same.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151934

    2013-06-24  Simon Fraser  <simon.fraser@apple.com>

            Fix various crashes on sites with fixed backgrounds
            https://bugs.webkit.org/show_bug.cgi?id=117959

            Reviewed by Andy Estes.

            FrameView::removeSlowRepaintObject() would assume that addSlowRepaintObject()
            had been called before it, but this isn't always the case. For example, if
            a page has a fixed background on the body, this falls into the accelerated
            path in WK2 tiled mode, so addSlowRepaintObject() is never called. However,
            we still call removeSlowRepaintObject() if the body is removed.

            So null-check m_slowRepaintObjects to avoid crashing.

            Test: platform/mac-wk2/tiled-drawing/fixed-background/fixed-background-removal.html

            * page/FrameView.cpp:
            (WebCore::FrameView::removeSlowRepaintObject):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151916

    2013-06-24  Eric Carlson  <eric.carlson@apple.com>

            Potential crash when in-band track is removed
            https://bugs.webkit.org/show_bug.cgi?id=117938
            <rdar://problem/14246763>

            Reviewed by Jer Noble.

            This is timing dependent and I was unable to come up with a reliable test.

            * html/track/InbandTextTrack.cpp:
            (WebCore::InbandTextTrack::willRemoveTextTrackPrivate): Early return if the media element
                has been cleared.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151894

    2013-06-24  Zalan Bujtas  <zalan@apple.com>

            Hittest finds the truncated text instead of the floating input, when the input is clicked.
            https://bugs.webkit.org/show_bug.cgi?id=115675

            Reviewed by David Hyatt.

            Ignore truncated text on inline textbox and everything beyond the ellipsis box on
            the root inlinebox while hittesting. (provided that nodeAtPoint finds no hit for any of
            the root inline's children.)

            Test: fast/css/text-overflow-ellipsis-and-floating-input-hittest.html

            * rendering/InlineFlowBox.cpp:
            (WebCore::InlineFlowBox::nodeAtPoint):
            * rendering/InlineTextBox.cpp:
            (WebCore::InlineTextBox::nodeAtPoint):
            (WebCore::InlineTextBox::paint):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151879

    2013-06-22  Simon Fraser  <simon.fraser@apple.com>

            Followup from r151877 .
            Fix crash in fast/frames/iframe-access-screen-of-deleted.html by null-checking the widget.

            * platform/mac/PlatformScreenMac.mm:
            (WebCore::screenForWidget):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151877

    2013-06-22  Simon Fraser  <simon.fraser@apple.com>

            screen.availWidth always returns width of primary display
            https://bugs.webkit.org/show_bug.cgi?id=117863

            Reviewed by Geoffrey Garen.

            In WebKit2, Widgets have no platformWidget, so trying to get to the
            NSScreen via the platform widget's window never succeeded, and we always
            fell back on getting info for the main display.

            However, we were already pushing the WKView's displayID down to the
            WebProcess for the requestAnimationFrame infrastructure, so use that.

            Add a virtual function on Widget windowDisplayID(), that is overridden
            in FrameView to return the PlatformDisplayID which Page has.

            Fix PlatformScreenMac to fall back to Widget::windowDisplayID() when it fails
            to get an NSWindow from the Widget.

            Add a utility category on NSScreen to get an NSScreen's displayID, and to
            find an NSScreen given a displayID.

            * WebCore.exp.in:
            * WebCore.xcodeproj/project.pbxproj:
            * page/FrameView.cpp:
            (WebCore::FrameView::windowDisplayID):
            * page/FrameView.h:
            * platform/Widget.cpp:
            (WebCore::Widget::windowDisplayID):
            * platform/Widget.h:
            * platform/mac/PlatformScreenMac.h: Added.
            * platform/mac/PlatformScreenMac.mm:
            (+[NSScreen screenForDislayID:]):
            (-[NSScreen displayID]):
            (WebCore::screenRect):
            (WebCore::screenAvailableRect):
            * platform/mac/WidgetMac.mm:
            (WebCore::Widget::windowDisplayID):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151875

    2013-06-21  Geoffrey Garen  <ggaren@apple.com>

            Crashes due to NULL dereference beneath WebCore::StyleResolver::loadPendingSVGDocuments and related functions
            https://bugs.webkit.org/show_bug.cgi?id=117903

            Reviewed by Darin Adler.

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::loadPendingSVGDocuments): Add a NULL check for
            RenderStyle here...
            (WebCore::StyleResolver::loadPendingResources): ...and here.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151873

    2013-06-21  Simon Fraser  <simon.fraser@apple.com>

            Occasional crash swiping between pages
            https://bugs.webkit.org/show_bug.cgi?id=117902

            Reviewed by Beth Dakin.

            m_scrollingStateTree->rootStateNode() can be null when quickly swiping between pages,
            so check this in ScrollingCoordinatorMac::commitTreeState().

            * page/scrolling/mac/ScrollingCoordinatorMac.mm:
            (WebCore::ScrollingCoordinatorMac::commitTreeState):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151852

    2013-06-21  James Craig  <james@cookiecrook.com>

            AX: audio/video playback control timers (elapsed and remaining) should be exposed as ApplicationTimerRole
            https://bugs.webkit.org/show_bug.cgi?id=117883

            Reviewed by Chris Fleizach.

            Some of the media controls were returning the wrong role. Updated existing test coverage.

            * accessibility/AccessibilityMediaControls.h:
            (WebCore::AccessibilityMediaTimeDisplay::roleValue):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151836

    2013-06-21  Zalan Bujtas  <zalan@apple.com>

            Rollout r150602: Restoring text-overflow vs. floating rendering behaviour.
            https://bugs.webkit.org/show_bug.cgi?id=117871

            Unreviewed. Rolling out r150602.
            Undesirable rendering behaviour.

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlock::checkLinesForTextOverflow):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151832

    2013-06-21  Christophe Dumez  <ch.dumez@sisa.samsung.com>

            REGRESSION (r150663): Using webkitAudioContext in Inspector makes it undefined everywhere
            https://bugs.webkit.org/show_bug.cgi?id=117825

            Reviewed by Kentaro Hara.

            Partially revert r150663 so that we use Settings to enable WebAudio instead of
            RuntimeEnabledFeatures.

            Introduce a new [EnabledBySetting] IDL extended attribute which behaves similarly to
            the existing [EnabledAtRuntime] but relies on Settings instead of RuntimeEnabledFeatures
            to determine if the feature should be enabled. Make use of this new IDL attribute for
            webkitAudioContext interface.

            No new tests, no behavior change.

            * Modules/webaudio/AudioContext.idl:
            * WebCore.exp.in:
            * WebCore.order:
            * bindings/generic/RuntimeEnabledFeatures.cpp:
            * bindings/generic/RuntimeEnabledFeatures.h:
            * bindings/scripts/CodeGeneratorJS.pm:
            (GenerateImplementation):
            * bindings/scripts/IDLAttributes.txt:
            * bindings/scripts/preprocess-idls.pl:
            (GenerateConstructorAttribute):
            * bindings/scripts/test/JS/JSTestObj.cpp:
            (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
            (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
            * bindings/scripts/test/JS/JSTestObj.h:
            * bindings/scripts/test/ObjC/DOMTestObj.h:
            * bindings/scripts/test/ObjC/DOMTestObj.mm:
            (-[DOMTestObj TestSubObjEnabledBySetting]):
            (-[DOMTestObj setTestSubObjEnabledBySetting:]):
            * bindings/scripts/test/TestObj.idl:
            * page/Settings.in:

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151822

    2013-06-20  Ryosuke Niwa  <rniwa@webkit.org>

            REGRESSION(r145788): mouse drag on canvas shouldn't start selection
            https://bugs.webkit.org/show_bug.cgi?id=117860

            Reviewed by Benjamin Poulain.

            Like HTMLImageElement, HTMLCanvasElement shouldn't start selection.

            Also uninline some virtual function overrides.

            Test: fast/events/mosuedrag-on-canvas-should-not-start-selection.html

            * html/HTMLCanvasElement.cpp:
            (WebCore::HTMLCanvasElement::areAuthorShadowsAllowed):
            (WebCore::HTMLCanvasElement::canContainRangeEndPoint):
            (WebCore::HTMLCanvasElement::canStartSelection):
            * html/HTMLCanvasElement.h:

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151821

    2013-06-20  Ryosuke Niwa  <rniwa@webkit.org>

            REGRESSION(r149652): accessing items in .children via id doesn't work when element is not rooted in DOM tree
            https://bugs.webkit.org/show_bug.cgi?id=117836

            Reviewed by Benjamin Poulain.

            When the root node of a HTML collection is not in the document or in a shadow tree,
            we shouldn't use its tree scope's id and name maps to find name getters.

            Always use the slow path in such cases.

            Test: fast/dom/htmlallcollection-detached-node-children.html

            * html/HTMLCollection.cpp:
            (WebCore::HTMLCollection::namedItem):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151812

    2013-06-20  Alexey Proskuryakov  <ap@apple.com>

            https://bugs.webkit.org/show_bug.cgi?id=116495
            Fix null-pointer deref in DocumentLoader::responseReceived()

            Patch by Nate Chapin, reviewed by Mike West and myself.

            Test: http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event.html

            * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::responseReceived): Added
            a null check.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151807

    2013-06-20  Enrica Casucci  <enrica@apple.com>

            Initial advance on the first glyph of the run is not correctly set for rtl text.
            https://bugs.webkit.org/show_bug.cgi?id=117839
            <rdar://problem/13860717>

            Reviewed by Sam Weinig.

            We need to set the initial advance to the glyphBuffer, using the
            initial advance of the complex run that will be drawn first.
            In order to choose the run correctly we must consider the text direction.

            Test: fast/text/complex-first-glyph-with-initial-advance.html

            * platform/graphics/mac/ComplexTextController.cpp:
            (WebCore::ComplexTextController::advance):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151804

    2013-06-20  Simon Fraser  <simon.fraser@apple.com>

            FrameView needs to initialize paintsEntireContents on creation
            https://bugs.webkit.org/show_bug.cgi?id=117844

            Reviewed by Anders Carlsson.

            In WebKit1, if the WebView is layer-backed, WebHTMLView gets a layer.
            In this mode, FrameView::paintsEntireContents() is true. However,
            we would only call setPaintsEntireContents(true) on the FrameView
            when the view's layer-backed status changes. FrameView also needs
            to fetch this state when it is initialized, because we may be creating
            a new FrameView for an already layer-backed WebHTMLView.

            * page/ChromeClient.h:
            (WebCore::ChromeClient::shouldPaintEntireContents):
            * page/FrameView.cpp:
            (WebCore::FrameView::init):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151803

    2013-06-20  Simon Fraser  <simon.fraser@apple.com>

            Sticky elements are missing or misplaced sometimes when reloading a page that scrolls to a named anchor
            https://bugs.webkit.org/show_bug.cgi?id=117819

            Reviewed by Anders Carlsson.

            At the end of FrameView::performPostLayoutTasks() we call scrollToAnchor() which attempts
            to restore the scroll position to a named anchor, even when the document has been
            changed by layout. This ends up in a call to ScrollView::scrollTo(), which in turn
            calls repaintFixedElementsAfterScrolling(). However, repaintFixedElementsAfterScrolling()
            would bail if m_nestedLayoutCount != 0, so we never updated layer positions which
            depend on scroll position (but which would not be updated by layout, since their
            renderers are not marked for layout when scrolling happens).

            We've solved this problem once before in updateFixedElementsAfterScrolling() which
            checks for m_nestedLayoutCount <= 1, so that we do work on the outermost nested layout.
            Apply that same fix to repaintFixedElementsAfterScrolling().

            Very timing-dependent, so hard to make a test.

            * page/FrameView.cpp:
            (WebCore::FrameView::repaintFixedElementsAfterScrolling):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151796

    2013-06-20  Eric Carlson  <eric.carlson@apple.com>

            ASSERT removing then adding a <track> element
            https://bugs.webkit.org/show_bug.cgi?id=117814

            Reviewed by Jer Noble.

            Test: media/track/add-and-remove-track.html

            * html/HTMLTrackElement.cpp:
            (WebCore::HTMLTrackElement::insertedInto): Always call ensureTrack before adding the track
                to the parent <video> element.
            (WebCore::HTMLTrackElement::ensureTrack): Call m_track->setTrackElement() in case the
                parent was cleared after m_track was created.

            * html/track/LoadableTextTrack.cpp:
            (WebCore::LoadableTextTrack::setTrackElement): New, set m_trackElement.
            * html/track/LoadableTextTrack.h:

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151793

    2013-06-20  Alexey Proskuryakov  <ap@apple.com>

            [Mac] Downloaded file name encoding is incorrect when download link opens in a new window
            https://bugs.webkit.org/show_bug.cgi?id=117818
            <rdar://problem/14212635>

            Reviewed by Brady Eidson.

            No tests added. The machinery we have for logging downloaded file name is very
            far from being able to work in a secondary window.

            * loader/FrameLoader.cpp: (WebCore::FrameLoader::addExtraFieldsToRequest):
            Made a targeted fix - don't update encoding fallback array if we already have one,
            there is no chance for it to be more correct. In this case, it's incorrect because
            it comes from a new blank window, instead of original referer.
            We have a lot of code in addExtraFieldsToRequest() to struggle with this, and we have
            a FIXME to try not calling it from policy delegate.

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151776

    2013-06-20  James Craig  <james@cookiecrook.com>

            AX: aria-required is not exposed on all expected roles
            https://bugs.webkit.org/show_bug.cgi?id=115123

            Reviewed by Chris Fleizach.

            aria-required is now exposed on more roles. Updated existing test file.

            * accessibility/AccessibilityNodeObject.cpp:
            (WebCore::AccessibilityNodeObject::supportsRequiredAttribute):
            * accessibility/AccessibilityNodeObject.h:
            * accessibility/AccessibilityObject.h:
            (WebCore::AccessibilityObject::supportsRequiredAttribute):
            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (-[WebAccessibilityObjectWrapper additionalAccessibilityAttributeNames]):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151785

    2013-06-19  Jer Noble  <jer.noble@apple.com>

            Roll-on in-band captions are displayed bottom-to-top rather than top-to-bottom.
            https://bugs.webkit.org/show_bug.cgi?id=117811

            Reviewed by Eric Carlson.

            When comparing Generic cues, we should check that their type is Generic, not WebVTT.

            * html/track/TextTrackCueGeneric.cpp:
            (WebCore::TextTrackCueGeneric::isOrderedBefore):

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151774

    2013-06-20  Seokju Kwon  <seokju.kwon@gmail.com>

            Web Inspector: Use console.timeStamp instead of console.markTimeline
            https://bugs.webkit.org/show_bug.cgi?id=117810

            Reviewed by Joseph Pecoraro.

            Webkit supports both console.timeStamp and console.markTimeline.
            And they do the exact same thing.
            This patch gets rid of console.markTimeline for Chrome/Firebug compatibility.

            No new functionality, no new tests.

            * WebCore.order:
            * page/Console.cpp:
            * page/Console.h:
            * page/Console.idl:

2013-06-26  Lucas Forschler  <lforschler@apple.com>

        Merge r151719

    2013-06-18  Ryosuke Niwa  <rniwa@webkit.org>

            Input type range slider is not updated when min or max are changed
            https://bugs.webkit.org/show_bug.cgi?id=117778

            Reviewed by Kent Tamura.

            Merge https://chromium.googlesource.com/chromium/blink/+/089c7a0ba2d85b9b59632c2603fbc6472b310be1.

            Test: fast/forms/range/range-change-min-max.html

            * html/RangeInputType.cpp:
            (WebCore::RangeInputType::minOrMaxAttributeChanged):

2013-06-25  Lucas Forschler  <lforschler@apple.com>

        Merge r151747

    2013-06-19  Oliver Hunt  <oliver@apple.com>

            Incorrect use of jsCast in a finalizer
            https://bugs.webkit.org/show_bug.cgi?id=117807

            Reviewed by Geoffrey Garen.

            We can't use jsCast in a finalizer as it checks an object's structure,
            and the structure may already have been swept by that point.  Use a
            static_cast instead.

            * bridge/runtime_array.cpp:
            (JSC::RuntimeArray::destroy):

2013-06-25  Lucas Forschler  <lforschler@apple.com>

        Merge r151929

    2013-06-24  Ruth Fong  <ruth_fong@apple.com>

            Expose the mediaHasAudio() function in WK2
            https://bugs.webkit.org/show_bug.cgi?id=117946
            <rdar://problem/14250527>

            Reviewed by Beth Dakin.

            * WebCore.exp.in: Updated to include symbol for
            HTMLMediaElement::mediaHasAudio() function.

2013-06-21  Lucas Forschler  <lforschler@apple.com>

        Merge r151787

    2013-06-20  Roger Fong  <roger_fong@apple.com>

            Make Windows makefile copy build output to a different folder.
            <rdar://problem/14219184>.

            * WebCore.vcxproj/WebCore.make:

2013-06-20  Lucas Forschler  <lforschler@apple.com>

        Merge r151799

2013-06-20  Lucas Forschler  <lforschler@apple.com>

        Merge r151762

    2013-06-19  Alexey Proskuryakov  <ap@apple.com>

            [Mac] Common crashes when playing media
            https://bugs.webkit.org/show_bug.cgi?id=117813
            <rdar://problem/13837412>

            Reviewed by Eric Carlson.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (-[WebCoreAVFLoaderDelegate resourceLoader:didCancelLoadingRequest:]):
            This method may be called from a secondary thread, but it does things that are
            not thread safe.

2013-06-18  Roger Fong  <roger_fong@apple.com>

        Disable some feature flags.
        <rdar://problem/14171207>.

        Rubberstamped by Jon Lee.

        * Configurations/FeatureDefines.xcconfig:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):

2013-06-18  Darin Adler  <darin@apple.com>

        Improve style of null checks in FrameView::setFrameRect
        https://bugs.webkit.org/show_bug.cgi?id=117681

        Reviewed by Sam Weinig.

        * page/FrameView.cpp:
        (WebCore::FrameView::setFrameRect): Used nested if statements and local variables
        to tighten this code up a little.

2013-06-18  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Move IDL extended attributes to their correct location
        https://bugs.webkit.org/show_bug.cgi?id=117732

        Reviewed by Kentaro Hara.

        Move IDL extended attributes to their correct location according to the
        latest Web IDL specification. We used to be inconsistent in the positioning
        of the extended attributes. This simplifies a lot the code of the IDL parser
        and makes our IDL files more standard.

        Based on Blink r148345 by Kentaro Hara <haraken@chromium.org>.

        No new tests, no behavior change.

        * Modules/encryptedmedia/MediaKeyMessageEvent.idl:
        * Modules/notifications/Notification.idl:
        * Modules/speech/SpeechSynthesisVoice.idl:
        * bindings/scripts/IDLParser.pm:
        (parseDefinitions):
        (parseInterfaceMembers):
        (parseInterfaceMember):
        (parseDictionaryMembers):
        (parseAttributeOrOperationOrIterator):
        (parseAttribute):
        * css/CSSFontFaceLoadEvent.idl:
        * dom/Document.idl:
        * dom/Element.idl:
        * dom/Node.idl:
        * html/HTMLBodyElement.idl:
        * html/HTMLEmbedElement.idl:
        * html/HTMLFrameSetElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLSelectElement.idl:
        * html/HTMLSourceElement.idl:
        * page/DOMWindow.idl:
        * svg/SVGElementInstance.idl:
        * svg/SVGScriptElement.idl:
        * testing/TypeConversions.idl:

2013-06-18  Jessie Berlin  <jberlin@apple.com>

        Let the script to update the Localizable.strings file do the reordering it wants to do.

        Rubber-stamped by Anders Carlsson.

        * English.lproj/Localizable.strings:

2013-06-18  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Unreviewed gardening -- show missing AccessibilityNodeObject source
        files in Visual Studio.

        * WebCore.vcxproj/WebCore.vcxproj: Add missing files.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.

2013-06-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r151513.
        http://trac.webkit.org/changeset/151513
        https://bugs.webkit.org/show_bug.cgi?id=117763

        It causes assertions in debug (Requested by benjaminp on
        #webkit).

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::startAnimation):
        (WebCore::RenderLayerBacking::startTransition):

2013-06-18  Roger Fong  <roger_fong@apple.com>

        Replace tools32 folder with tools and update WebKit Windows solution accordingly.
        <rdar://problem/14118143>.

        Rubberstamped by Brent Fulgham.

        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj:
        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoDebug.props:
        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoRelease.props:
        * WebCore.vcxproj/QTMovieWin/QTMovieWinDebug.props:
        * WebCore.vcxproj/QTMovieWin/QTMovieWinPostBuild.cmd:
        * WebCore.vcxproj/QTMovieWin/QTMovieWinProduction.props:
        * WebCore.vcxproj/QTMovieWin/QTMovieWinRelease.props:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCoreDebug.props:
        * WebCore.vcxproj/WebCoreDebugWinCairo.props:
        * WebCore.vcxproj/WebCoreGenerated.vcxproj:
        * WebCore.vcxproj/WebCoreGeneratedDebug.props:
        * WebCore.vcxproj/WebCoreGeneratedDebugWinCairo.props:
        * WebCore.vcxproj/WebCoreGeneratedProduction.props:
        * WebCore.vcxproj/WebCoreGeneratedRelease.props:
        * WebCore.vcxproj/WebCoreGeneratedReleaseWinCairo.props:
        * WebCore.vcxproj/WebCoreProduction.props:
        * WebCore.vcxproj/WebCoreRelease.props:
        * WebCore.vcxproj/WebCoreReleaseWinCairo.props:
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
        * WebCore.vcxproj/build-generated-files.sh:

2013-06-18  Zoltan Horvath  <zoltan@webkit.org>

        [CSS Shapes] Remove lineOverflowsFromShapeInside boolean from RenderBlock::layoutRunsAndFloatsInRange function
        https://bugs.webkit.org/show_bug.cgi?id=117757

        Reviewed by David Hyatt.

        We don't need keep lineOverflowsFromShapeInside boolean in RenderBlock::layoutRunsAndFloatsInRange and in its
        helpers because it's easy to decide whether we are in an shape content overflow state or not, so I got rid of
        lineOverflowsFromShapeInside's occurences and updated the affected functions.

        Covered by existing overflow tests in fast/exclusions/shape-inside and fast/regions/shape-inside.

        * rendering/RenderBlock.h: Update helper's definition.
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::pushShapeContentOverflowBelowTheContentBox): Add condition when overflow is already positioned.
        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLine): Remove lineOverflowsFromShapeInside.
        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread):  Remove lineOverflowsFromShapeInside.
        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):  Remove lineOverflowsFromShapeInside.

2013-06-18  Zalan Bujtas  <zalan@apple.com>

        widthMediaFeatureEval ends up with null FrameView during iframe unload.
        https://bugs.webkit.org/show_bug.cgi?id=117754

        Reviewed by Geoffrey Garen.

        Ensure that MediaQueryEvaluator checks against NULL FrameView.

        While frames are being unloaded, the Frame object does not necessarily have valid
        FrameView anymore. Layout on the main frame can end up querying media values on such child
        frames, while detaching.

        Test: fast/frames/crash-when-child-iframe-forces-layout-during-unload-and-sibling-frame-has-mediaquery.html

        * css/MediaQueryEvaluator.cpp:
        (WebCore::orientationMediaFeatureEval):
        (WebCore::aspect_ratioMediaFeatureEval):
        (WebCore::evalResolution):
        (WebCore::heightMediaFeatureEval):
        (WebCore::widthMediaFeatureEval):
        (WebCore::MediaQueryEvaluator::eval):

2013-06-18  Ruth Fong  <ruth_fong@apple.com>

        Expose a getMediaType method in WebKit
        https://bugs.webkit.org/show_bug.cgi?id=117667

        Reviewed by Brady Eidson.

        * WebCore.exp.in: Updated to add a symbol for 
        HitTestResult::mediaIsVideo method
        and alphabetize the list of exposed methods.

2013-06-18  Ryosuke Niwa  <rniwa@webkit.org>

        Remove unused bool argument from ReplacementFragment's constructor
        https://bugs.webkit.org/show_bug.cgi?id=117752

        Reviewed by Antti Koivisto.

        Merge https://chromium.googlesource.com/chromium/blink/+/265586d9f154a9dff657511d09926429b8e1b53d.

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplacementFragment::ReplacementFragment):
        (WebCore::ReplaceSelectionCommand::doApply):

2013-06-18  Eric Carlson  <eric.carlson@apple.com>

        Not all subtitle tracks are SDH
        https://bugs.webkit.org/show_bug.cgi?id=117738

        Reviewed by Dean Jackson.

        No new tests, existing tests updated.

        * html/track/InbandTextTrack.cpp:
        (WebCore::InbandTextTrack::isSDH): New.

        * html/track/InbandTextTrack.h: Add isSDH override.
        * html/track/TextTrack.h:

        * page/CaptionUserPreferencesMac.mm:
        (WebCore::trackDisplayName): Only add "SDH" label if a track claims to be SDH.

        * platform/graphics/InbandTextTrackPrivate.h:
        (WebCore::InbandTextTrackPrivate::isSDH): New.

        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.h:
        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm:
        (WebCore::InbandTextTrackPrivateAVFObjC::isSDH): Return true if track has both "transcribes
            spoken dialog for accessibility" and "describes music and sound for accessibility" 
            characteristics.

2013-06-18  Ryosuke Niwa  <rniwa@webkit.org>

        Simplify FormKeyGenerator::willDeleteForm
        https://bugs.webkit.org/show_bug.cgi?id=117751

        Reviewed by Antti Koivisto.

        Merge https://chromium.googlesource.com/chromium/blink/+/c6399efb9da863eb1d1fc98b17ef925998b985ac

        * html/FormController.cpp:
        (WebCore::FormKeyGenerator::willDeleteForm):

2013-06-18  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r147602): Search text field doesn't render selection when it has some :focus rules
        https://bugs.webkit.org/show_bug.cgi?id=117747

        Reviewed by Kent Tamura.

        Merge https://chromium.googlesource.com/chromium/blink/+/7ff656c8239ce3b125246abcc8b149a603fcff28

        r147612 added setNeedsLayout(true, MarkOnlyThis) for
        TextControlInnerTextElement renderer. It's ok for input[type=text]
        because RenderTextControlSingleLine also has needsLayout flag, and it
        has only the inner text renderer as a child.

        As for input[type=search], it doesn't work. Renderer structure for
        input[type=search] is:

        RenderTextControlSingleLine
        └Renderer for TextControlInnerContainer
          └Renderer for TextControlInnerElement
            └Renderer for TextControlInnerTextElement

        After r147612, there is a case that only RenderTextControlSingleLine
        and TextControlInnerTextElement renderer have needsLayout flag, and
        others don't.  It won't trigger layout for
        TextControlInnerTextElement renderer.

        We should set needsLayout flags of TextControlInnerContainer renderer
        and TextControlInnerElement renderer by MarkContainingBlockChain.

        Manual Tests: search-select-all-with-focus-style.html
        (I tried but couldn't make a test that works in DRT)

        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::styleDidChange):

2013-06-18  Dean Jackson  <dino@apple.com>

        Attempted build fix for non-Mac.

        * platform/graphics/SimpleFontData.cpp:
        (WebCore::SimpleFontData::nonSyntheticItalicFontData):

2013-06-18  Dean Jackson  <dino@apple.com>

        Synthesized vertical italics on rotated glyphs are transformed incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=117726

        Reviewed by Enrica Casucci.

        If a font does not have italic glyphs, and is in a vertical flow, then
        the synthesis of italics was skewing in the wrong direction. While here,
        ensure that no CJK text will get italics in vertical layout.

        This is a topic under discussion in the CSS Working Group. The resolution
        at the June 2013 face-to-face was that:
        - italics in Japanese (and Chinese) text are rare in vertical layout
        - most people wanted Latin text to italicize in the direction of the line flow

        The final behaviour was left undefined, but we consider the change here
        to be sufficient for now. In all cases, the best solution is to avoid
        synthesized italics by specifying a font that includes such forms.

        Tests: fast/text/international/synthesized-italic-vertical-latin.html
               fast/text/international/synthesized-italic-vertical.html

        * platform/graphics/FontGlyphs.cpp:
        (WebCore::glyphDataAndPageForCJKCharacterWithoutSyntheticItalic): New function
            that makes a new glyph data pair that is marked as NOT using a synthesized italic.
        (WebCore::FontGlyphs::glyphDataAndPageForCharacter): If this is a CJK character and
            has a synthesized oblique, then run it through the function above to make a new glyph data pair.
        * platform/graphics/SimpleFontData.cpp:
        (WebCore::SimpleFontData::nonSyntheticItalicFontData): Creates/returns a new SimpleFontData that will
            not synthesize italics.
        * platform/graphics/SimpleFontData.h: New method nonSyntheticItalicFontData.
        * platform/graphics/mac/FontMac.mm:
        (WebCore::Font::drawGlyphs): This is the actual bug fix. If you are in a vertical flow, the
            skew direction should be downwards, not leftwards.

2013-06-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r151549.
        http://trac.webkit.org/changeset/151549
        https://bugs.webkit.org/show_bug.cgi?id=117741

        broke selection in the web inspector source after scrolling
        (Requested by smfr on #webkit).

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeRectForRepaint):
        * rendering/RenderLayerModelObject.cpp:
        * rendering/RenderLayerModelObject.h:

2013-06-18  Santosh Mahto  <santosh.ma@samsung.com>

        <video> element delays document load event for ~ 3 seconds
        https://bugs.webkit.org/show_bug.cgi?id=90272

        Reviewed by Eric Carlson.

        Test: media/media-preload-no-delay-loadevent.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::prepareForLoad):
        No need to delay document load event here  when preload="none"

2013-06-18  Diego Pino Garcia  <dpino@igalia.com>

        [GTK] Remove comment about possibility of handling ObjCPolymorphic (it's used by ObjC bindings only)
        https://bugs.webkit.org/show_bug.cgi?id=117546

        Reviewed by Xan Lopez.

        According to the WebKit IDL spec the modifier ObjCPolymorphic only
        applies to the Objective-C bindings generator

        * bindings/scripts/CodeGeneratorGObject.pm:
        (IsPolymorphic): Remove comment. Search parameter 'type' in array, instead of
        concatening a series of 'or' conditionals.

2013-06-18  Víctor Manuel Jáquez Leal  <vjaquez@igalia.com>

        Fix after r151673
        https://bugs.webkit.org/show_bug.cgi?id=116042

        Reviewed by Philippe Normand.

        Removed a spurious semicolon in the video sink caps definition.

        No new tests, no behavior change.

        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:

2013-06-18  Praveen R Jadhav  <praveen.j@samsung.com>

        [WebSpeech] Speech Recognition requires convertValue support in JSDictionary
        https://bugs.webkit.org/show_bug.cgi?id=117731

        Reviewed by Christophe Dumez.

        Build fails after enabling ENABLE_SCRIPTED_SPEECH feature. This patch
        resolves the issue.

        No new tests. No change in behaviour.

        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:

2013-06-18  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] only notify download client when download error
        https://bugs.webkit.org/show_bug.cgi?id=117687

        Reviewed by Rob Buis.

        When met network error in downloading, we notify the error to download
        client through download stream, we shouldn't notify page client the error.
        RIM JIRA 419985

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::shouldNotifyClientFailed):

2013-06-18  Mario Sanchez Prada  <mario.prada@samsung.com>

        Shader compiler not properly configured for GLES on cairo based ports
        https://bugs.webkit.org/show_bug.cgi?id=117705

        Reviewed by Martin Robinson.

        Configure the shader compiler with SH_ESSL_OUTPUT for GLESv2
        compliant platforms, and with SH_GLSL_OUTPUT otherwise.

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):

2013-06-18  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        touching any idl rebuilds all derived sources
        https://bugs.webkit.org/show_bug.cgi?id=117708

        Reviewed by Kentaro Hara.

        Fix preprocess-idls.pl script to update the following files only
        if they have changed:
        DerivedSources/WebCore/supplemental_dependency.tmp
        DerivedSources/WebCore/DOMWindowConstructors.idl
        DerivedSources/WebCore/WorkerContextConstructors.idl

        This avoids triggering uselessly bindings generation for all IDL
        files whenever an IDL file is touched.

        No new tests, no behavior change.

        * bindings/scripts/preprocess-idls.pl:
        (WriteFileIfChanged):
        (GeneratePartialInterface):

2013-06-18  Víctor Manuel Jáquez Leal  <vjaquez@igalia.com>

        [GStreamer] [texmap] upload a video buffer into the video texture
        https://bugs.webkit.org/show_bug.cgi?id=116042

        Reviewed by Philippe Normand.

        This patch prepares more quickly the texture when the video frame is
        already in the GPU memory.

        It is done using a new buffer's metadata available in GStreamer 1.2,
        and its purpose is to upload buffers into a OpenGL texture.

        If the decoder provides buffers with this metadata, the buffer will be
        uploaded into the texture used for the video display and it will be
        rendered, avoiding a expensive mem copies. This is particularly useful
        for Full HD videos, where all the processing and display will be done
        in the GPU.

        No new tests, covered by existing tests.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (webkitVideoSinkProposeAllocation):

2013-06-17  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Set the http response status text
        https://bugs.webkit.org/show_bug.cgi?id=117307

        Reviewed by Brent Fulgham.

        No new tests, covered by existing ones.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::headerCallback):

2013-06-14  Brent Fulgham  <bfulgham@apple.com>

        AX: Correct accessibility role when -webkit-box:display is used.
        https://bugs.webkit.org/show_bug.cgi?id=117706

        Reviewed by Chris Fleizach.

        accessibility/box-styled-lists.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): If HTML token is
        of the list element type, treat it as a ListItemRole accessibility role, regardless
        of what specific renderer is being used.

2013-06-17  Roger Fong  <roger_fong@apple.com>

        Add some UNUSED_PARAMs to RenderBlock.cpp so that it builds properly if CSS_EXCLUSIONS is disabled.
        https://bugs.webkit.org/show_bug.cgi?id=117722.

        Rubberstamped by Jon Lee.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):

2013-06-17  Beth Dakin  <bdakin@apple.com>

        PageBanners appear over HTML5 video when media element is in full screen mode
        https://bugs.webkit.org/show_bug.cgi?id=117721
        -and corresponding-
        <rdar://problem/13686998>

        Reviewed by Sam Weinig.

        Update the scrolling tree when a header/footer has been removed.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateLayerForHeader):
        (WebCore::RenderLayerCompositor::updateLayerForFooter):

2013-06-17  Roger Fong  <roger_fong@apple.com>

        Modify Windows makefiles to copy some bin output into Program Files.
        https://bugs.webkit.org/show_bug.cgi?id=117714.
        <rdar://problem/14179054>

        Reviewed by Brent Fulgham.

        * WebCore.vcxproj/WebCore.make:

2013-06-17  Max Vujovic  <mvujovic@adobe.com>

        Crash in loadPendingShaders
        https://bugs.webkit.org/show_bug.cgi?id=117665

        Reviewed by Dean Jackson.

        Speculative fix because the crash reports do not contain a test case.

        Rearrange the conditions to check m_state.hasPendingShaders() first. Additionally, check if
        m_state.style() is non-null.

        No new tests. We don't know how to reproduce this crash yet.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::loadPendingShaders):

2013-06-17  Ruth Fong  <ruth_fong@apple.com>

        REGRESSION: Important controls are missing from <video> element UI, when compared to QuickTime
        https://bugs.webkit.org/show_bug.cgi?id=20599

        Add a "Download Video"/"Download Audio" context menu item to download media
        elements.

        Reviewed by Beth Dakin.

        No new tests. media/context-menu-action.html,
        which has been disabled by bug 116651, is used to test context menus.

        * English.lproj/Localizable.strings: Updated to
        include localizable strings for "Download Video" and "Download Audio".

        * page/ContextMenuController.cpp: Updated to 
        include and handle a "Download Video/Audio" context menu item.

        * platform/ContextMenuItem.h:

        * platform/LocalizedStrings.cpp: 
        * platform/LocalizedStrings.h:
        * platform/efl/LocalizedStringsEfl.cpp:
        * platform/gtk/LocalizedStringsGtk.cpp:
        * platform/qt/LocalizedStringsQt.cpp: 
        Updated to include localizable strings for "Download Video" and "Download Audio".

2013-06-17  Zoltan Horvath  <zoltan@webkit.org>

        [CSS Shapes] Consider bottom borders when calculating the position of the overflow
        https://bugs.webkit.org/show_bug.cgi?id=117663

        Reviewed by Alexandru Chiculita.

        When you have a shape and the content overflows from the shape we need to push the overflow below the content box,
        not below the border box. We didn't consider the bottom borders of the content box, now I fixed it too and the overflow
        just starts after the content box. I added a new helper function called pushShapeContentOverflowBelowTheContentBox. Now
        both the shape in flow thread and the shape overflow use the same function. I added a new test and modified the existing
        tests to cover all the affected cases.

        Test: fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-block-content.html
        Existing overflow tests also modified to test the behavior:
              fast/exclusions/shape-inside/shape-inside-empty-expected.html
              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-block-content-expected.html
              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-block-content.html
              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-expected.html
              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions.html
              fast/regions/shape-inside/shape-inside-on-regions-block-content-overflow-multiple-shapes-expected.html
              fast/regions/shape-inside/shape-inside-on-regions-block-content-overflow-multiple-shapes.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::pushShapeContentOverflowBelowTheContentBox):
        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLine):
        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread):

2013-06-17  Igor Oliveira  <igor.o@sisa.samsung.com>

        [CSS Regions] ::before and ::after pseudo-elements are not displayed for regions
        https://bugs.webkit.org/show_bug.cgi?id=80163

        When the implementation of the before/after was moved to the DOM, before/after generated
        content stoppped to work with css regions. The problem happens when:
        1. RenderRegion can not have children and when the PseudoElement::attach tries to create a renderer for the
        generated content, it fails.
        2. RenderRegion::canHaveGeneratedChildren should not be false because regions can have generated content.

        Reviewed by David Hyatt.

        Tests: fast/regions/region-dynamic-after-before.html
               fast/regions/region-generated-content-before-after.html

        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::shouldCreateRenderer):
        * rendering/RenderRegion.h:

2013-06-17  Michael Brüning  <michael.bruning@digia.com>

        [Mac] Remove unmaintained GStreamer specific video code.
        https://bugs.webkit.org/show_bug.cgi?id=117694

        Reviewed by Philippe Normand.

        No new tests, no behaviour change.

        * platform/mac/WebVideoFullscreenController.mm:
        (-[WebVideoFullscreenController setupVideoOverlay:]):
        (-[WebVideoFullscreenController windowDidLoad]):
        (-[WebVideoFullscreenController setMediaElement:]):
        (-[WebVideoFullscreenController windowDidExitFullscreen]):

2013-06-17  Michael Brüning  <michael.bruning@digia.com>

        [Qt] Remove Qt specific QTKIT flagged code.
        https://bugs.webkit.org/show_bug.cgi?id=117635

        Reviewed by Simon Hausmann.

        Due to disabling QTKIT for Qt in r151546, the
        code the flags that are not taken into account
        anymore and the code that has been rendered
        unreachable by this are removed.

        No new tests, no behavioural change.

        * Target.pri:
        * WebCore.exp.in:
        * page/Settings.cpp:
        * page/Settings.h:
        * platform/KURL.h:
        * platform/SharedBuffer.h:
        * platform/cf/KURLCFNet.cpp:
        (WebCore::KURL::fileSystemPath):
        * platform/cf/SharedBufferCF.cpp:
        * platform/graphics/FloatSize.h:
        * platform/graphics/IntRect.h:
        * platform/graphics/IntSize.h:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::installedMediaEngines):
        * platform/graphics/cg/FloatSizeCG.cpp:
        * platform/graphics/cg/IntRectCG.cpp:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::createQTMovieLayer):
        (WebCore::MediaPlayerPrivateQTKit::preferredRenderingMode):
        (WebCore::MediaPlayerPrivateQTKit::paint):
        (-[WebCoreMovieObserver layerHostChanged:]):
        * platform/mac/SharedBufferMac.mm:
        (+[WebCoreSharedBufferData initialize]):
        (WebCore::SharedBuffer::createWithContentsOfFile):

2013-06-17  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        REGRESSSION(r151632) : Build error on ASSERT(WTF_USE_GRAMMAR_CHECKING)
        https://bugs.webkit.org/show_bug.cgi?id=117692

        Reviewed by Jocelyn Turcotte.

        Ifdef the feature-depending code and fix the assertions to check runtime conditions.

        * editing/Editor.cpp:
        (WebCore::Editor::advanceToNextMisspelling):
        (WebCore::Editor::markMisspellingsOrBadGrammar):
        (WebCore::Editor::markBadGrammar):
        * editing/TextCheckingHelper.cpp:
        (WebCore::findBadGrammars):
        (WebCore::TextCheckingHelper::findFirstGrammarDetail):
        (WebCore::TextCheckingHelper::findFirstBadGrammar):
        (WebCore::TextCheckingHelper::isUngrammatical):
        (WebCore::TextCheckingHelper::markAllBadGrammar):
        (WebCore::checkTextOfParagraph):
        * editing/TextCheckingHelper.h:

2013-06-17  Grzegorz Czajkowski  <g.czajkowski@samsung.com>

        Unreviewed, rolling out r151632.
        http://trac.webkit.org/changeset/151632
        https://bugs.webkit.org/show_bug.cgi?id=117585

        Debug build error ASSERT(WTF_USE_GRAMMAR_CHECKING) for non MAC
        platforms

        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        (WebCore::ContextMenuController::createAndAppendSpellingAndGrammarSubMenu):
        (WebCore::ContextMenuController::populate):
        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
        * platform/LocalizedStrings.cpp:
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
        * platform/LocalizedStrings.h:
        * platform/efl/LocalizedStringsEfl.cpp:
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
        * platform/gtk/LocalizedStringsGtk.cpp:
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
        * platform/qt/LocalizedStringsQt.cpp:
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):

2013-06-17  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix make distcheck.

        * GNUmakefile.list.am: Remove non existent files from compilation
        and add a missing header file.

2013-06-14  Grzegorz Czajkowski  <g.czajkowski@samsung.com>

        Context menu grammar checking items are available when GRAMMAR_CHECKING macro is off
        https://bugs.webkit.org/show_bug.cgi?id=117585

        Reviewed by Anders Carlsson.

        Do not add "Check Grammar With Spelling" and "Ignore Grammar" to the context menu
        when GRAMMAR_CHECKING is off.
        Replace "Spelling and Grammar" with "Spelling" as the sub menu title and "Show/Hide Spelling
        and Grammar" with "Show/Hide Spelling" when GRAMMAR_CHECKING is off.

        Additionally, guard grammar checking in context menu code to not necessarily
        compile it.

        No new layout tests because every port has a different way of showing
        spelling/grammar context menu items.

        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        (WebCore::ContextMenuController::createAndAppendSpellingAndGrammarSubMenu):
        (WebCore::ContextMenuController::populate):
        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
        * platform/LocalizedStrings.cpp:
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):
        * platform/LocalizedStrings.h:
        * platform/efl/LocalizedStringsEfl.cpp:
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):
        * platform/gtk/LocalizedStringsGtk.cpp:
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):
        * platform/qt/LocalizedStringsQt.cpp:
        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
        (WebCore::contextMenuItemTagSpellingMenu):
        (WebCore::contextMenuItemTagShowSpellingPanel):

2013-06-16  Simon Fraser  <simon.fraser@apple.com>

        Fix test assertion after r151624

        An assertion was hit in RenderObject::willBeDestroyed()
        for fast/css/getComputedStyle/getComputedStyle-background-shorthand.html
        because the code asserted that the RenderObject had been removed from
        the FrameView's slowRepaintObject set before remove() was called,
        so move the assertion to after that call.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willBeDestroyed):

2013-06-16  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Remove a redundant virtual call to hostWindow() in FrameView::invalidateRect()
        https://bugs.webkit.org/show_bug.cgi?id=117685

        Reviewed by Andreas Kling.

        From Blink r152490 by <vivek.vg@samsung.com>

        * page/FrameView.cpp:
        (WebCore::FrameView::invalidateRect): Avoid hostWindow() twice call.

2013-06-16  Kent Tamura  <tkent@chromium.org>

        Fix two assertion failures in Range::insertNode
        https://bugs.webkit.org/show_bug.cgi?id=116511

        Reviewed by Ryosuke Niwa.

        > ASSERTION FAILED: childBefore == (offset ? container->childNode(offset - 1) : 0)
        > third_party/WebKit/Source/WebCore/dom/RangeBoundaryPoint.h(115) : void WebCore::RangeBoundaryPoint::set(PassRefPtr<WebCore::Node>, int, WebCore::Node *)

        > ASSERTION FAILED: child->parentNode()
        > ../../third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h(133) : void WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node *)
        >  1   0x87594b2 WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node*)
        >  2   0x87534a9 WebCore::Range::insertNode(WTF::PassRefPtr<WebCore::Node>, int&)

        Range::insertNode calls Node::insertBefore, in which an event handler
        can update the DOM structure so that RangeBoundaryPoint don't like. We
        postpone event dispatching by EventQueueScope.

        Also, remove old comments about Acid3. The behavior is standardized.
        (Step 9 of http://dom.spec.whatwg.org/#dom-range-insertnode)

        This patch imports http://src.chromium.org/viewvc/blink?view=revision&revision=150470 .

        Test: fast/dom/Range/range-insertNode-assertion.html

        * dom/Range.cpp:
        (WebCore::Range::insertNode):
         - Add EventQueueScope
         - Remove obsolete comments

2013-06-16  Simon Fraser  <simon.fraser@apple.com>

        Fixed backgrounds in composited layers not repainted on scrolling
        https://bugs.webkit.org/show_bug.cgi?id=117684

        Reviewed by Tim Horton.
        
        FrameView is aware that "slow-repaint objects" (i.e. renderers with 
        background-attachment:fixed) require a slow-scrolling path. However,
        it was ignorant of the fact that such objects could be painting into
        compositing layers; it simply dirtied the main tiles, and nothing else.
        
        Fix by having FrameView track the slow-repaints objects explicitly, as we
        do for position:fixed, and repaint each of them on scrolling.

        Test: compositing/repaint/fixed-background-scroll.html

        * page/FrameView.cpp:
        (WebCore::FrameView::FrameView): No need to initialize m_slowRepaintObjectCount,
        which is now an OwnPtr<RenderObjectSet>.
        (WebCore::FrameView::useSlowRepaints): Use hasSlowRepaintObjects() now.
        (WebCore::FrameView::addSlowRepaintObject): Now adds the object to a set,
        allocating the set if necessary.
        (WebCore::FrameView::removeSlowRepaintObject): Remove the object from the set,
        and deallocate the set if empty.
        (WebCore::FrameView::scrollContentsSlowPath): Call repaintSlowRepaintObjects();
        this is the change that fixes the bug for always-composited implementations (e.g.
        tile cache). This is a conservative change; we still invalidate the tile cache
        as well. This could be optimized later.
        (WebCore::FrameView::repaintSlowRepaintObjects): Repaint each object in the set.
        Their appropriate compositing ancestor will be repainted.
        (WebCore::FrameView::scrollPositionChangedViaPlatformWidget): Call
        repaintSlowRepaintObjects() so that fixed backgrounds in composited layers are
        correctly repainted; this fixes the bug for WebKit1.
        * page/FrameView.h: Replace m_slowRepaintObjectCount with a HashSet of
        RenderObjects.
        (WebCore::FrameView::hasSlowRepaintObject): Takes a RenderObject* now.
        (WebCore::FrameView::hasSlowRepaintObjects): Ditto.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::styleWillChange): Pass the RenderObject.
        (WebCore::RenderObject::willBeDestroyed): Assert that this RenderObject
        has been removed from FrameView's set of slow-repaint objects already, if
        the document is not being destroyed.
        (WebCore::RenderObject::willBeRemovedFromTree): Pass the RenderObject.

2013-06-15  Simon Fraser  <simon.fraser@apple.com>

        Painting of fixed background images is wrong in composited layers
        https://bugs.webkit.org/show_bug.cgi?id=65793

        Reviewed by Sam Weinig.
        
        The code that computed background image geometry for background-attachment:fixed
        images was unaware of compositing, so often painting the image at the wrong location.
        
        Fix by having RenderBoxModelObject::calculateBackgroundImageGeometry() do the correct
        math for fixed backgrounds in composited layer by offsetting the viewport rect by
        the paint container's absolute position.

        Tests: compositing/backgrounds/fixed-background-on-descendant.html
               compositing/backgrounds/fixed-backgrounds.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::getBackgroundPaintedExtent): Now returns a bool indicating
        whether it is returning a reliable extent rect. It can return false in the case where
        a background is fixed, since computing the correct extent would require finding
        the appropriate composited ancestor to pass to calculateBackgroundImageGeometry().
        This is OK since this function is used for "background opaque" optimizations.
        (WebCore::RenderBox::computeBackgroundIsKnownToBeObscured): If getBackgroundPaintedExtent()
        returns false, return false.
        (WebCore::RenderBox::maskClipRect): We removed mask-attachment, so we never need to
        compute the composited ancestor here and can pass null.
        (WebCore::RenderBox::repaintLayerRectsForImage): Unwrap a comment.
        If the changed image is related to a fixed background, geometry.hasNonLocalGeometry()
        will be true. In that cause, just repaint the entire renderer rather than groveling
        around for a composited ancestor.
        * rendering/RenderBox.h: Changed name and signature of backgroundPaintedExtent.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended): calculateBackgroundImageGeometry()
        now needs to know the painting container.
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Now takes a painting
        container, that is required to correctly compute the viewport-relative offset for fixed
        backgrounds. geometry.setHasNonLocalGeometry() is set for fixed backgrounds to indicate
        to callers that, if they didn't pass a paint container, the destRect is not accurate.
        The main bug fix is also here: we move the viewportRect by the absolute location of
        paint container, which is equivalent to the composited layer offset.
        (WebCore::RenderBoxModelObject::getGeometryForBackgroundImage): calculateBackgroundImageGeometry()
        takes a paint container.
        * rendering/RenderBoxModelObject.h:
        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::BackgroundImageGeometry):
        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setHasNonLocalGeometry):
        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::hasNonLocalGeometry):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::computeBackgroundIsKnownToBeObscured): If getBackgroundPaintedExtent()
        can't cheaply give an accurate answer, return false.
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundImage): Pass the paint container,
        which is our own renderer.

2013-06-15  Simon Fraser  <simon.fraser@apple.com>

        webkit-backface-visibility on a parent element stops background-position from updating
        https://bugs.webkit.org/show_bug.cgi?id=116319

        Reviewed by Darin Adler.

        The optimization added in r102952 was incorrect in the case where a style change
        resulted in a positioned-movement-only layout but also required a repaint; it assumed
        that a composited layer did not need to be repainted for a a positioned-movement-only layout.
        
        Fix by making RenderObject::setNeedsLayoutForPositionedMovement() check whether the
        style change requires a repaint, and calling setLayerNeedsFullRepaint() in that situation.

        Test: compositing/repaint/positioned-movement.html

        * rendering/RenderLayer.h: RepaintStatus values do not need to be bit flags.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::setStyle): Pass the old style to setNeedsPositionedMovementLayout().
        (WebCore::RenderObject::styleDidChange): Ditto.
        * rendering/RenderObject.h:
        (WebCore::RenderObject::setNeedsPositionedMovementLayout): Now takes a const RenderStyle*.
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff): Remove a comment now that this bug is fixed.
        (WebCore::RenderStyle::diffRequiresRepaint): Public wrapper for changeRequiresRepaint().
        That function never uses contextSensitiveProperties so we can safely ignore them.
        * rendering/style/RenderStyle.h: Expose a way to call changeRequiresRepaint().

2013-06-15  Darin Adler  <darin@apple.com>

        Try to fix iOS after last Pasteboard change.

        * platform/ios/PasteboardIOS.mm:
        (WebCore::Pasteboard::writeSelection): Put the new code inline here because the
        stringSelectionForPasteboard function is currently Mac-only.

2013-06-15  Darin Adler  <darin@apple.com>

        Move Pasteboard::getStringSelection to Editor, fixing a layering violation
        https://bugs.webkit.org/show_bug.cgi?id=117673

        Reviewed by Ryosuke Niwa.

        * editing/Editor.h: Added stringSelectionForPasteboardWithImageAltText.

        * editing/mac/EditorMac.mm:
        (WebCore::Editor::stringSelectionForPasteboard): Moved code here from the Pasteboard
        class, since all the Pasteboard class did really was turn around and call back here.
        (WebCore::Editor::stringSelectionForPasteboardWithImageAltText): Added. Variant of
        the function above that includes image alt text. Separate named functions are often
        the best pattern for something like this unless there are many different combinations.

        * platform/Pasteboard.h: Remove the Mac-only Pasteboard::getStringSelectioon.

        * platform/ios/PasteboardIOS.mm:
        (WebCore::Pasteboard::writeSelection):
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::writeSelectionForTypes):
        Call the two new functions instead of the old Pasteboard::getStringSelection.

2013-06-15  Darin Adler  <darin@apple.com>

        Support using clang instead of gcc for bindings preprocessing
        https://bugs.webkit.org/show_bug.cgi?id=117674

        Reviewed by Sam Weinig.

        I couldn't build on my computer because I don't have gcc installed.
        This is my cut at fixing it.

        * bindings/scripts/CodeGeneratorObjC.pm:
        (ReadPublicInterfaces): Use clang if present.
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor): Ditto.

2013-06-14  Robert Hogan  <robert@webkit.org>

        REGRESSION (r148367): Facebook and Twitter icons at macworld.com are stacked vertically, obscuring Twitter one
        https://bugs.webkit.org/show_bug.cgi?id=117284

        Reviewed by David Hyatt.

        Test: fast/text/whitespace/inline-whitespace-wrapping-7.html

        We were looking for line breaks in trailing collapsed whitespace even when inside a nowrap inline.
        It's wrong to do this as we don't know yet if we will want or need to break - that decision has to
        be deferred until we enter a part of the line that is autowrap.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):

2013-06-14  Lukasz Gajowy  <l.gajowy@samsung.com>

        background-color is not preserved when inserting a new paragraph
        https://bugs.webkit.org/show_bug.cgi?id=117138

        Reviewed by Ryosuke Niwa.

        The style isn't copied because background-color isn't defined as inheritable property.

        Test: editing/inserting/insert-paragraph-not-preserving-background-color.html

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion):
        Passing EditingPropertiesInEffect instead of implicit parameter OnlyEditingInheritableProperties.

2013-06-14  Adam Barth  <abarth@webkit.org>

        Threaded HTML parser can ASSERT in some situations
        https://bugs.webkit.org/show_bug.cgi?id=117662

        Reviewed by Ryosuke Niwa.

        This patch merges https://chromium.googlesource.com/chromium/blink/+/3c0a112b42d72c7623f78463166dd7f04d680b4c

        --->8---
        The parser is supposed to stop processing data when there's a pending
        location change, but before this CL we would actually process the first
        token from every chunk when there was a pending location change.

        If the first token in a chunk was a "script" start tag, that would put
        the tree builder into TextMode, which can only process character
        tokens. If the next chunk starts with another start tag token, the tree
        builder would be sad and hit an ASSERT.

        This CL reorders a couple lines in HTMLDocumentParser so that we check
        for pending location changes before processing any tokens. This change
        stops us from processing the first token from each chunk while there is
        a pending location change.

        This issue can reproduce on any platform, but it reproduced often on
        Android because mobile markup often elides spaces between consecutive
        script tags. If there are space characters between the script tags,
        then those space characters will be the first ones processes in the
        chunk, which doesn't trigger the ASSERT.
        ---8<---

        Since we landed this patch in Blink, we've been able to reproduce this
        issue on desktops as well. I spoke with rniwa in #webkit and he said
        that WebKit doesn't have any current plans to enable the threaded
        parser but that it was probably worth merging this patch anyway.

        Test: http/tests/navigation/pending-location-change-assert.html

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::processParsedChunkFromBackgroundParser):

2013-06-14  Patrick Gansterer  <paroga@webkit.org>

        Introduce USE(WINGDI) for the Windows port
        https://bugs.webkit.org/show_bug.cgi?id=116138

        Reviewed by Ryosuke Niwa.

        Using USE(WINGDI) instead of OS(WINCE) will allow us to
        compile the GDI based Windows port on WinNT too.

        * config.h:
        * platform/graphics/BitmapImage.h:
        * platform/graphics/FontPlatformData.h:
        * platform/graphics/GlyphBuffer.h:
        (WebCore):
        (GlyphBuffer):
        * platform/graphics/Gradient.h:
        (Gradient):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore):
        * platform/graphics/GraphicsContext.h:
        (WebCore):
        (GraphicsContext):
        * platform/graphics/ImageBufferData.h:
        * platform/graphics/NativeImagePtr.h:
        (WebCore):
        * platform/graphics/Path.h:
        * platform/graphics/Pattern.h:
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginView::paintWindowedPluginIntoContext):
        (WebCore::PluginView::paint):
        (WebCore::PluginView::snapshot):

2013-06-13  Jer Noble  <jer.noble@apple.com>

        Report the memory cost of HTMLMediaElements to GC.
        https://bugs.webkit.org/show_bug.cgi?id=117608

        Reviewed by Darin Adler.

        Report the extra memory cost of a HTMLMediaElement to the VM, in order to
        encourage GC to occur after a media element is removed from the DOM.

        Because we cannot know for sure the memory cost of our underlying media
        framework objects, use the worst case scenario for the media memory cost:
        the buffered percentage of movie * the total data length of the movie.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_reportedExtraMemoryCost.
        (WebCore::HTMLMediaElement::removedFrom): Report the extra memory cost.
        * html/HTMLMediaElement.h:
        * html/TimeRanges.cpp:
        (TimeRanges::totalDuration): Added convenience function.
        * html/TimeRanges.h:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::extraMemoryCost): Pass to MediaPlayerPrivate.
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::extraMemoryCost): Default to 0.
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::extraMemoryCost): Return the percentage
            loaded * total data length.
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:

2013-06-13  Jer Noble  <jer.noble@apple.com>

        Add support for AVFoundation-backed HTMLMediaElements in the WebVideoFullScreenController.
        https://bugs.webkit.org/show_bug.cgi?id=117597

        Reviewed by Eric Carlson.

        Check for media elements with AVFoundation media types and create a AVPlayerLayer
        rather than a QTMovieLayer.

        * platform/mac/WebVideoFullscreenController.h:
        * platform/mac/WebVideoFullscreenController.mm:
        (-[WebVideoFullscreenController setupVideoOverlay:]): Take a CALayer rather than a
            QTMovieLayer. Move the code which connects the layer with it's media source into
            setMediaElement.
        (-[WebVideoFullscreenController windowDidLoad]): Give the window's contentView a generic
            CALayer instaead of a QTMovieLayer.
        (-[WebVideoFullscreenController setMediaElement:]): Test whether the incoming media 
            element is backed by a QTMovie or an AVPlayer, and create the appropriate layer.
        (-[WebVideoFullscreenController windowDidExitFullscreen]): Remove the observer of
            AVPlayer's rate property.
        (-[WebVideoFullscreenController observeValueForKeyPath:ofObject:change:context:]):
            If the keyPath is "rate", call rateChanged.

2013-06-14  Enrica Casucci  <enrica@apple.com>

        WKPageFindStringMatches ignores the kWKFindOptionsBackwards option.
        https://bugs.webkit.org/show_bug.cgi?id=117647
        <rdar://problem/13881024>

        Reviewed by Darin Adler.
        
        The API returns the matched ranges in the DOM order regardless of the
        find direction, but the index of the first match after the user selection
        should take the find direction into account.

        Extended existing test in TestWebKitAPI.

        * page/Page.cpp:
        (WebCore::Page::findStringMatchingRanges): Added handling of the Backwards case.
        * page/Page.h: Fixed incorrect name of the enum.

2013-06-14  Jer Noble  <jer.noble@apple.com>

        REGRESSION (r150651): Web Audio doesn't work at all (silence or squawks) on Mountain Lion
        https://bugs.webkit.org/show_bug.cgi?id=117652

        Reviewed by Eric Carlson.

        r150651 disabled setting the buffer size to a large value, but in so doing, also
        disabled setting the buffer size to a small value for Web Audio. Narrow the Mountain
        Lion protection to just the <video> element case.
        
        * platform/audio/mac/AudioSessionManagerMac.cpp:
        (AudioSessionManager::updateSessionState):

2013-06-14  Ryosuke Niwa  <rniwa@webkit.org>

        Function names on Object.prototype should be common identifiers
        https://bugs.webkit.org/show_bug.cgi?id=117614

        Reviewed by Darin Adler.

        Use the added common identifiers.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::finishCreation):
        (WebCore::JSDOMWindowBase::updateDocument):

2013-06-14  Arpita Bahuguna  <a.bah@samsung.com>

        Editing: wrong text position when you click enter on the text behind the image
        https://bugs.webkit.org/show_bug.cgi?id=115023

        Reviewed by Ryosuke Niwa.

        When trying to break a line after an image followed by some text, contrary
        to the expected behavior the text doesn't move to a new line, instead, the
        caret position just shifts to the end of line.

        As per the existing implementation for inserting a paragraph separator,
        the insertion position obtained corresponds to the point after the image
        element.
        Since the insertion position doesn't resolve to being offset in the
        following text node (0 offset), no splitting of text occurs and the block
        to be inserted is placed after the containing (start) block (thereby
        causing the caret position to shift).

        If the computed insertionPosition points to an element that shall be
        ignored for editing purposes (i.e. cannot have a VisiblePosition inside
        it), and the position lies either at the start or at the end of such
        an element, we should move our Position either upstream or
        downstream (respectively) so as to obtain a valid position which can
        be used further for splitting of the text.
        
        Test: editing/inserting/insert-paragraph-after-non-editable-node-before-text.html

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        Moving the insertionPosition either upstream or downstream, if the point
        lies either at the start or at the end of the anchor node.
        The ensuing position, if a text node, can then be used for splitting of
        the text correctly.

2013-06-14  Alberto Garcia  <agarcia@igalia.com>

        [BlackBerry] Remove implementation of ContextMenu classes
        https://bugs.webkit.org/show_bug.cgi?id=114860

        Reviewed by Rob Buis.

        This code is not being used so we can safely remove it.

        * PlatformBlackBerry.cmake:
        * platform/blackberry/ContextMenuBlackBerry.cpp: Removed.
        * platform/blackberry/ContextMenuItemBlackBerry.cpp: Removed.
        * platform/blackberry/LocalizedStringsBlackBerry.cpp:

2013-06-14  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Provide simple <meter> drawing logic for testing.
        https://bugs.webkit.org/show_bug.cgi?id=117645.

        Reviewed by Anders Carlsson.

        accessbility/meter-element.html

        * rendering/RenderThemeSafari.cpp: Simple test implementation
        (WebCore::RenderThemeSafari::adjustMeterStyle): Added.
        (WebCore::RenderThemeSafari::supportsMeter): Added.
        (WebCore::RenderThemeSafari::meterSizeForBounds): Added.
        (WebCore::RenderThemeSafari::paintMeter): Added.
        * rendering/RenderThemeSafari.h:
        * rendering/RenderThemeWin.cpp:
        (WebCore::RenderThemeWin::progressBarTheme): Added.
        (WebCore::RenderThemeWin::getClassicThemeData): Support meters.
        (WebCore::RenderThemeWin::getThemeData): Support meter theme.
        (WebCore::RenderThemeWin::adjustMeterStyle): Added.
        (WebCore::RenderThemeWin::supportsMeter): Added.
        (WebCore::RenderThemeWin::meterSizeForBounds): Added.
        (WebCore::RenderThemeWin::paintMeter): Added.
        * rendering/RenderThemeWin.h:

2013-06-14  Eric Carlson  <eric.carlson@apple.com>

        Potential use-after-free with an event fired at a HTMLMediaElement which is currently being deleted
        https://bugs.webkit.org/show_bug.cgi?id=117466

        Reviewed by Oliver Hunt.
        
        Merge https://chromium.googlesource.com/chromium/blink/+/f4200a0093b3d9376f703961615359ec7fb712b4
        
        If an event is created using as target an HTMLMediaElement which is
        currently being deleted it becomes a heap-use-after free situation.

        The GenericEventQueue instance is already owned by the HTMLMediaElement,
        and there already is an underlying mechanism to set the target of the
        event to NULL, if their target is owner of the queue.

        In order to avoid creating this reference in the first place, we enqueue
        the event with a NULL target to defer the refcount increment until the
        timer for dispatching the event happens (which won't happen at all if
        garbage collection is already destroying the objects).

        Test: media/track/media-element-enqueue-event-crash.html

        * dom/GenericEventQueue.cpp:
        (WebCore::GenericEventQueue::enqueueEvent): Don't ASSERT if the event has no target.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement): Close the event queue so it won't try to
            dispatch any pending events.
        (WebCore::HTMLMediaElement::scheduleEvent): Don't set the event target, it will happen just
            prior to event dispatch.
        (WebCore::HTMLMediaElement::stop): Close the event queue.

2013-06-14  Dean Jackson  <dino@apple.com>

        Clicking on snapshotting plug-ins does not restart them
        https://bugs.webkit.org/show_bug.cgi?id=117620
        <rdar://problem/13821729>

        Follow-up review comments from Darin Adler, with some
        discussion on IRC.

        Sprinkle OVERRIDE on virtual functions where needed. Also
        make sure that the Event is a MouseEvent before casting to it.

        * html/HTMLPlugInElement.h: Move defaultEventHandler back to protected and add OVERRIDE.
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::defaultEventHandler): Check for MouseEvent and
        use toMouseEvent().
        * html/HTMLPlugInImageElement.h: Sprinkle some OVERRIDEs, and move defaultEventHandler
        to private.

2013-06-14  Timothy Hatcher  <timothy@apple.com>

        Remove front-end from the WebCore Xcode project.
        https://bugs.webkit.org/show_bug.cgi?id=117640

        Reviewed by Darin Adler.

        * WebCore.xcodeproj/project.pbxproj:

2013-06-14  Jaehun Lim  <ljaehun.lim@samsung.com>

        CSSParser::parseImageSet() doesn't need a parameter.
        https://bugs.webkit.org/show_bug.cgi?id=117617

        Reviewed by Darin Adler.

        parseImageSet() can get m_valueList directly.
        And minor fixes.

        No new tests, no behavior change.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseContent):
        (WebCore::CSSParser::parseFillImage):
        (WebCore::CSSParser::parseBorderImage):
        (WebCore::CSSParser::parseImageSet):
        * css/CSSParser.h:

2013-06-14  Tiancheng Jiang  <tijiang@rim.com>

        [BlackBerry] Dropdown button UX updates.
        https://bugs.webkit.org/show_bug.cgi?id=117642.

        Reviewed by Rob Buis.

        JIRA 388652
        Internally Reviewed by Jeff Rogers.

        Change arrow assert.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::paintMenuList):

2013-06-14  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] LayerTiler fails to tile really big layers
        https://bugs.webkit.org/show_bug.cgi?id=117211

        Reviewed by Carlos Garcia Campos.

        PR 273550

        The cause for this bug was that LayerTiler computed which tiles are
        visible by exhaustively mapping every tile to normalized device
        coordinates and checking if it intersected the viewport. If there was a
        lot of tiles, it would get stuck in this loop, iterating over all
        tiles, for a very long time. Also, the visibility information was
        transferred to the WebKit thread using mutexes, which added unnecessary
        mutex contention to the mix.

        Fixed by doing the reverse calculation, unprojecting the visible part
        of the layer to layer coordinate space to find which tiles are visible.
        Instead of doing a traditional unprojection of point to line and see
        where the line intersects the layer, this patch uses the w-coordinates
        of triangle vertices to perform "perspective correct texturing" of the
        intersection points in device space, which is equivalent to
        unprojection since perspective correct texturing computes a 2D
        coordinate in (normalized) layer coordinate space which is easily
        scaled up to the layer bounds and get the visible region expressed in
        layer coordinate space.

        The visible area is approximated by a rectangle, and a set of tiles
        needing render are added to the mix, and  we have a swappable data
        structure so visbility can be transferred to WebKit thread without
        mutexes, but instead using atomic swap.

        No new tests, covered by existing tests.

        * platform/graphics/blackberry/CanvasLayerWebKitThread.cpp:
        (CanvasLayerCompositingThreadClient):
        (WebCore::CanvasLayerCompositingThreadClient::drawTextures):
        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.h:
        (EGLImageLayerCompositingThreadClient):
        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::drawSurface):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (LayerCompositingThread):
        * platform/graphics/blackberry/LayerCompositingThreadClient.h:
        (WebCore):
        (LayerCompositingThreadClient):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::compositeLayersRecursive):
        * platform/graphics/blackberry/LayerTile.cpp:
        (WebCore::LayerTile::LayerTile):
        (WebCore::LayerTile::setContents):
        (WebCore::LayerTile::updateContents):
        (WebCore::LayerTile::discardContents):
        * platform/graphics/blackberry/LayerTile.h:
        (LayerTile):
        (WebCore::LayerTile::contentsScale):
        (WebCore::LayerTile::setContentsDirty):
        * platform/graphics/blackberry/LayerTiler.cpp:
        (LayerVisibility):
        (WebCore::LayerVisibility::LayerVisibility):
        (WebCore::LayerVisibility::visibleRect):
        (WebCore::LayerVisibility::setVisibleRect):
        (WebCore::LayerVisibility::needsRender):
        (WebCore::LayerVisibility::tileNeedsRender):
        (WebCore::LayerVisibility::willRenderTile):
        (WebCore::LayerVisibility::swapTilesNeedingRender):
        (WebCore::LayerVisibility::merge):
        (WebCore):
        (WebCore::LayerTiler::LayerTiler):
        (WebCore::LayerTiler::~LayerTiler):
        (WebCore::LayerTiler::updateTextureContentsIfNeeded):
        (WebCore::LayerTiler::swapFrontVisibility):
        (WebCore::LayerTiler::setFrontVisibility):
        (WebCore::LayerTiler::layerVisibilityChanged):
        (WebCore::LayerTiler::uploadTexturesIfNeeded):
        (WebCore::LayerTiler::processTextureJob):
        (WebCore::LayerTiler::addTileJob):
        (WebCore::LayerTiler::performTileJob):
        (WebCore::LayerTiler::drawTile):
        (WebCore::inflateViewport):
        (WebCore::LayerTiler::drawTextures):
        (WebCore::LayerTiler::pruneTextures):
        (WebCore::LayerTiler::rectForTile):
        * platform/graphics/blackberry/LayerTiler.h:
        (WebCore):
        (LayerTiler):
        (WebCore::LayerTiler::TextureJob::TextureJob):
        (WebCore::LayerTiler::takeFrontVisibility):
        * platform/graphics/blackberry/LayerUtilities.h:
        (WebCore):
        (WebCore::det):
        (WebCore::dot):
        (LayerClipEdge):
        (WebCore::LayerClipEdge::LayerClipEdge):
        (WebCore::LayerClipEdge::isPointInside):
        (WebCore::LayerClipEdge::computeIntersection):
        (WebCore::intersectPolygonWithRect):
        (WebCore::computeBarycentricCoordinates):
        (WebCore::manhattanDistanceToViewport):
        (UnprojectionVertex):
        (WebCore::compareManhattanDistanceToViewport):
        (WebCore::unproject):

2013-06-14  Antoine Quint  <graouts@apple.com>

        [Mac] clicking caption track glyph should dismiss menu
        https://bugs.webkit.org/show_bug.cgi?id=117621

        We now correctly capture all click events while the captions track menu
        is showing, and ensure that no other control in the media player can be
        activated as the track list gets dismissed by clicking anywhere but on
        itself.

        Reviewed by Eric Carlson.

        * html/shadow/MediaControlsApple.cpp:
        (WebCore::MediaControlsApple::showClosedCaptionTrackList):
        Make the controls panel non-interactive and track click events in the
        capture phase also on the controls container itself such that we can
        identify correctly whether a click in the <video> shadow tree is on
        the track list or another element (the target could only be resolved
        to a shadow tree node if the event is handled within the shadow tree).

        (WebCore::MediaControlsApple::hideClosedCaptionTrackList):
        Make the controls panel interactive again and remove the new click
        event handler on the controls container.

        (WebCore::MediaControlsApple::handleClickEvent):
        Capture any click event that targets a node anywhere outside of the track
        list container and its subtree and hide the track list in this condition.

        (WebCore::MediaControlsAppleEventListener::handleEvent):
        Call handleClickEvent() on the media controls when a click event is handled.

        * html/shadow/MediaControlsApple.h:
        New public handleClickEvent() API such that it can be called from
        MediaControlsAppleEventListener::handleEvent().

2013-06-14  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Accelerated compositing layers that intersect the image plane are incorrectly transformed
        https://bugs.webkit.org/show_bug.cgi?id=117067

        Reviewed by Carlos Garcia Campos.

        PR 273550

        The BlackBerry port used to mathematically project each corner of each
        layer bounds rectangle, which gives the wrong results when the layer
        intersects the image plane.

        For display lists, we still got the correct appearance of the layer
        contents, since the display list results in geometry that's transformed
        in the vertex shader, on the GPU.

        However, the transformed bounds are used for drawing the debug border,
        performing visibility calculations on the CPU and drawing of WebGL,
        masks/reflections and filters. Using the mathematical projection of
        points that lie behind the image plane gives the wrong results.

        The most important consequence of this bug was that the wrong area of
        the layer would be considered visible, so a tiled layer would not
        populate the right tiles (or any tiles at all).

        Fixed by implementing something along the lines of the recipe in
        section 6.2 of http://www.w3.org/TR/css3-transforms.

        No new tests, manually testable by enabling debug border on
        https://developer.mozilla.org/en-US/demos/detail/the-box/launch.

        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::LayerCompositingThread):
        (WebCore::LayerCompositingThread::setDrawTransform):
        (WebCore):
        (WebCore::LayerCompositingThread::textureCoordinates):
        (WebCore::LayerCompositingThread::drawTextures):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (LayerCompositingThread):
        (WebCore::LayerCompositingThread::transformedBounds):
        (WebCore::LayerCompositingThread::ws):
        (WebCore::LayerCompositingThread::centerW):
        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
        (WebCore::LayerFilterRenderer::applyActions):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::compareLayerW):
        (WebCore::LayerRenderer::compositeLayers):
        (WebCore::LayerRenderer::drawDebugBorder):
        (WebCore):
        (WebCore::LayerRenderer::updateLayersRecursive):
        (WebCore::LayerRenderer::compositeLayersRecursive):
        * platform/graphics/blackberry/LayerRenderer.h:
        (WebCore):
        (LayerRenderer):
        * platform/graphics/blackberry/LayerRendererSurface.cpp:
        (WebCore::LayerRendererSurface::boundingBox):
        (WebCore::LayerRendererSurface::transformedBounds):
        * platform/graphics/blackberry/LayerRendererSurface.h:
        (WebCore::LayerRendererSurface::setDrawTransform):
        (WebCore::LayerRendererSurface::setReplicaDrawTransform):
        (LayerRendererSurface):
        * platform/graphics/blackberry/LayerUtilities.h: Added.
        (WebCore):
        (LayerClipPlane):
        (WebCore::LayerClipPlane::LayerClipPlane):
        (WebCore::LayerClipPlane::isPointInside):
        (WebCore::LayerClipPlane::computeIntersection):
        (WebCore::intersect):
        (WebCore::boundingBox):
        (WebCore::multVecMatrix):
        (WebCore::toVector):

2013-06-14  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        [Qt] Map rewind and fast forward keys to match GoogleTV
        https://bugs.webkit.org/show_bug.cgi?id=117634

        Reviewed by Jocelyn Turcotte.

        Set the same keycode for media keys rewind and fast-forward as
        GoogleTV does.

        * platform/qt/PlatformKeyboardEventQt.cpp:
        (WebCore::windowsKeyCodeForKeyEvent):

2013-06-13  Carlos Garcia Campos  <cgarcia@igalia.com>

        Avoid unnecessary data copies when loading subresources with DoNotBufferData option
        https://bugs.webkit.org/show_bug.cgi?id=115804

        Reviewed by Darin Adler.

        When DoNotBufferData option is used to load a resource its data
        is always copied before sending it to the CachedResource. Most
        of the cached resources ignore the incremental data and wait
        until all data has been received to save the ResourceBuffer,
        that will be NULL anyway when DoNotBufferData is used.
        CachedRawResource notifies its clients about the incremental
        data, but it doesn't save the data when DoNotBufferData option
        is present. In those cases we are unnecessary copying the data.

        CachedResource::data has been split into
        CachedResource::addDataBuffer() used for incremental data chunks
        when buffering data, CachedResource::addData() used for
        incremental data chunks when not buffering and
        CachedResource::finishLoading() used to finish the loading. This
        way we get rid of the allDataReceived boolean parameter and cached
        resources not interested in incremenetal data chunks only have to
        implement finishLoading() without having to check if all data have
        been received or not.

        SubresourceLoader::sendDataToResource was always called after
        checking if loading multipart content, and then it was checked
        again to decided whether to copy the data or not. It has been
        removed in favor of calling directly the resource methods,
        finishLoading for multipart content, addDataBuffer for data chunks
        when buffering and addData for data chunks when not buffering.

        No new functionality, covered by existing tests.

        * html/ImageDocument.cpp:
        (WebCore::ImageDocumentParser::appendBytes): Update to API changes.
        (WebCore::ImageDocumentParser::finish): Ditto.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::didReceiveResponse): Call
        finishLoading() for multipart content.
        (WebCore::SubresourceLoader::didReceiveDataOrBuffer): Add data to
        the resource using addDataBuffer or addData depending on whether
        we are buffering or not.
        (WebCore::SubresourceLoader::didFinishLoading): Call
        finishLoading() for the cached resource instead of data.
        * loader/SubresourceLoader.h:
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::finishLoading):
        * loader/cache/CachedCSSStyleSheet.h:
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::finishLoading):
        * loader/cache/CachedFont.h:
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::isValidDecodedImageSize): Helper function
        to check if the image size is valid.
        (WebCore::CachedImage::addIncrementalDataBuffer): Helper function
        to add incremental data buffer.
        (WebCore::CachedImage::addDataBuffer): Call
        addIncrementalDataBuffer().
        (WebCore::CachedImage::addData): Create a ResourceBuffer and call
        addIncrementalDataBuffer().
        (WebCore::CachedImage::finishLoading):
        * loader/cache/CachedImage.h:
        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::calculateIncrementalDataChunk):
        Returns a pointer to the data corresponding to the current chunk
        and its length.
        (WebCore::CachedRawResource::addDataBuffer): Assert to make sure
        this is only called when BufferData option is present. Use
        calculateIncrementalDataChunk().
        (WebCore::CachedRawResource::addData): Assert to make sure this is
        only called when DoNotBufferData option is present.
        (WebCore::CachedRawResource::finishLoading):
        (WebCore::CachedRawResource::notifyClientsDataWasReceived): Helper
        private function to notify the clients about data received.
        * loader/cache/CachedRawResource.h:
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::addDataBuffer):
        (WebCore::CachedResource::addData):
        (WebCore::CachedResource::finishLoading):
        * loader/cache/CachedResource.h:
        * loader/cache/CachedSVGDocument.cpp:
        (WebCore::CachedSVGDocument::finishLoading):
        * loader/cache/CachedSVGDocument.h:
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::finishLoading):
        * loader/cache/CachedScript.h:
        * loader/cache/CachedShader.cpp:
        (WebCore::CachedShader::finishLoading):
        * loader/cache/CachedShader.h:
        * loader/cache/CachedTextTrack.cpp:
        (WebCore::CachedTextTrack::addDataBuffer):
        (WebCore::CachedTextTrack::finishLoading):
        * loader/cache/CachedTextTrack.h:
        * loader/cache/CachedXSLStyleSheet.cpp:
        (WebCore::CachedXSLStyleSheet::finishLoading):
        * loader/cache/CachedXSLStyleSheet.h:

2013-06-14  Michał Pakuła vel Rutka  <m.pakula@samsung.com>

        [EFL] Fix build when DRAG_SUPPORT is set OFF
        https://bugs.webkit.org/show_bug.cgi?id=117628

        Reviewed by Gyuyoung Kim.

        Add guard around Clipboard::declareAndWriteDragImage.

        * platform/efl/ClipboardEfl.cpp:

2013-06-13  Simon Fraser  <simon.fraser@apple.com>

        Sometimes we stick in slow scrolling mode even after leaving a page
        https://bugs.webkit.org/show_bug.cgi?id=117622

        Reviewed by Sam Weinig.
        
        ScrollingCoordinator, and thus the scrolling state tree, is owned by Page,
        and so persists when navigating between cached pages. We do give the ScrollingStateTree
        a new ScrollingStateScrollingNode on navigation, however the ScrollingStateScrollingNode
        would not have dirty flags set for, say, WheelEventHandlerCount if the document had
        no wheel handlers. And because that dirty flag wasn't set, ScrollingTree::commitNewTreeState()
        would fail to update m_hasWheelEventHandlers, so we'd remain in slow scrolling.
        
        Fix by having ScrollingStateTree remember if it's been given a new root ScrollingStateScrollingNode,
        and making ScrollingTree::commitNewTreeState() to the right thing in that case.
        
        Also fix a couple of issues with the tiled scrolling indicator. First, on cached page
        navigation, the indicator color would show the state for the old page, because
        ScrollingCoordinatorMac::commitTreeState() checked scrollingTree()->hasWheelEventHandlers()
        before the scrolling thread has committed the new scrolling tree.
        
        Second, the color change would animate, so stop that.

        Not testable, since tests can only dump the scrolling state tree.

        * page/scrolling/ScrollingStateTree.cpp:
        (WebCore::ScrollingStateTree::ScrollingStateTree):
        (WebCore::ScrollingStateTree::attachNode):
        (WebCore::ScrollingStateTree::commit):
        * page/scrolling/ScrollingStateTree.h:
        (WebCore::ScrollingStateTree::hasNewRootStateNode):
        * page/scrolling/ScrollingTree.cpp:
        (WebCore::ScrollingTree::commitNewTreeState):
        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
        (WebCore::ScrollingCoordinatorMac::commitTreeState):
        * platform/graphics/ca/mac/TileController.mm:
        (-[WebTiledScrollingIndicatorLayer init]): Turn off borderColor implicit animations.

2013-06-13  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Merge http response header values
        https://bugs.webkit.org/show_bug.cgi?id=117342

        Reviewed by Brent Fulgham.

        According to the HTTP RFC some HTTP header values should be
        merged if multiple entries for the same header exists.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::isAppendableHeader):
        (WebCore::headerCallback):

2013-06-13  Simon Fraser  <simon.fraser@apple.com>

        Should not call firePaintRelatedMilestones() for "update control tints" paint pass
        https://bugs.webkit.org/show_bug.cgi?id=117624

        Reviewed by Sam Weinig.

        When window activation changes, we do a fake paint pass that is just used to
        invalidate controls that change their appearance in background windows. This fake
        paint should not be recorded in the inspector, and it should not cause paint-related
        milestones to fire.

        * page/FrameView.cpp:
        (WebCore::FrameView::paintContents):

2013-06-13  Dean Jackson  <dino@apple.com>

        Clicking on snapshotting plug-ins does not restart them
        https://bugs.webkit.org/show_bug.cgi?id=117620
        <rdar://problem/13821729>

        Reviewed by Simon Fraser.

        HTMLPlugInElement has an event handler which would return
        immediately if the element was not snapshotted, restarting
        or playing. There is a case it missed, which was snapshotting
        (WaitingForSnapshot to be precise). If we get a click in this
        state then it should immediately restart.

        * html/HTMLPlugInElement.h: Move defaultEventHandler to public (we call it from the child class).
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::defaultEventHandler): If there is a click on a snapshotting
        plug-in, then call restart.
        * html/HTMLPlugInImageElement.h: Virtual defaultEventHandler declaration.

2013-06-13  Zoltan Horvath  <zoltan@webkit.org>

        Use borderAndPadding[Before,After]() instead of border[Before,After]() + padding[Before,After]()
        https://bugs.webkit.org/show_bug.cgi?id=117611

        Reviewed by Dirk Schulze.

        I added a new function called borderAndPaddingAfter(), since we already had borderAndPaddingBefore(). I changed
        every separate additions to the old/new function. This change makes the code shorter and more straightforward.

        Behavior hasn't changed, no new tests were needed.

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlock):
        (WebCore::RenderBlock::marginBeforeEstimateForChild):
        (WebCore::RenderBlock::layoutBlockChildren):
        (WebCore::RenderBlock::paintColumnRules):
        (WebCore::RenderBlock::columnRectAt):
        (WebCore::RenderBlock::relayoutForPagination):
        (WebCore::RenderBlock::adjustRectForColumns):
        (WebCore::RenderBlock::flipForWritingModeIncludingColumns):
        (WebCore::RenderBlock::adjustStartEdgeForWritingModeIncludingColumns):
        (WebCore::RenderBlock::adjustForColumns):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread):
        (WebCore::RenderBlock::layoutInlineChildren):
        * rendering/RenderBoxModelObject.h:
        (WebCore::RenderBoxModelObject::borderAndPaddingStart):
        (WebCore::RenderBoxModelObject::borderAndPaddingBefore):
        (WebCore::RenderBoxModelObject::borderAndPaddingAfter):
        (WebCore::RenderBoxModelObject::borderAndPaddingLogicalHeight):
        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::layoutSpecialExcludedChild):
        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::heightAdjustedForSetOffset):
        (WebCore::RenderMultiColumnSet::prepareForLayout):
        (WebCore::RenderMultiColumnSet::columnRectAt):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::computeIntrinsicPadding):
        (WebCore::RenderTableCell::cellBaselinePosition):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcRowLogicalHeight):
        (WebCore::RenderTableSection::layoutRows):
        (WebCore::RenderTableSection::firstLineBoxBaseline):
        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::lineSnapAdjustment):
        (WebCore::RootInlineBox::selectionTop):
        (WebCore::RootInlineBox::ascentAndDescentForBox):

2013-06-13  Andreas Kling  <akling@apple.com>

        Move Node::shouldUseInputMethod() to Element.
        <http://webkit.org/b/117603>

        Reviewed by Antti Koivisto.

        This method is only ever called on Elements, so move it off of Node.

        * dom/Element.cpp:
        (WebCore::Element::shouldUseInputMethod):
        * dom/Element.h:
        * dom/Node.cpp:
        * dom/Node.h:
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.h:

2013-06-13  Max Vujovic  <mvujovic@adobe.com>

        [CSS Regions] Selection dragged from a region paints its background
        https://bugs.webkit.org/show_bug.cgi?id=117607

        Reviewed by Alexandru Chiculita.

        When a RenderFlowThread is in the selection paint phase, tell its layer to paint with the
        selection only behavior. This way, only foregrounds and not backgrounds will be painted in
        the dragged selection.

        Manual test: ManualTests/regions/drag-selection-painting.html

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::paintFlowThreadPortionInRegion):

2013-06-13  Zoltan Horvath  <zoltan@webkit.org>

        [CSS Shapes][CSS Regions] Respect bottom positioned shapes and content adjustment inside shapes
        https://bugs.webkit.org/show_bug.cgi?id=117599

        Reviewed by David Hyatt.

        In r150478 I added support for multiple positioned shape-insides on regions, this patch covers the cases when a shape
        is positioned to the bottom of the region or the region contains a shape which forces the content to be adjusted inside
        the shape (e.g. we have a triangle shape and the first line needs to be started at the first position where it fits).
        I introduced a new helper function to update the current shape and the current line segments in the flow thread cases. With
        this new helper function all the logic which calculates the segments for shape-inside on regions is located in one function.

        Tests: fast/regions/shape-inside/shape-inside-on-regions-block-content-overflow-bottom-positioned-multiple-shapes.html
               fast/regions/shape-inside/shape-inside-on-regions-block-content-polygon-with-adjustment.html
               fast/regions/shape-inside/shape-inside-on-regions-inline-content-overflow-bottom-positioned-multiple-shapes.html
               fast/regions/shape-inside/shape-inside-on-regions-inline-content-polygon-with-adjustment.html

        * rendering/RenderBlock.h: Add new helper's declaration
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::LineLayoutState::LineLayoutState): Add a member to carry adjustment for flow thread cases.
        (WebCore::LineLayoutState::adjustedLogicalLineTop): Add new member.
        (WebCore::LineLayoutState::setAdjustedLogicalLineTop): Add new setter for the new member.
        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLine): Move flow thread case to its helper function.
        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread): Added new helper for flow thread cases.
        (WebCore::RenderBlock::adjustLogicalLineTopAndLogicalHeightIfNeeded): Save adjustment for flow thread cases.

2013-06-13  Mihai Tica  <mitica@adobe.com>

        [CSS Background Blending] Enable CSS Background blending for layers with SVGs.

        The change implies adding the blending parameter for SVGImage
        https://bugs.webkit.org/show_bug.cgi?id=117588

        Reviewed by Dirk Schulze.

        Tests: css3/compositing/background-blend-mode-image-svg.html
               css3/compositing/background-blend-mode-svg-color.html

        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::draw):

2013-06-13  Mihai Tica  <mitica@adobe.com>

        Updating the -webkit-background-blend-mode property dynamically does not trigger a redraw of the element.

        Adding krit's fix: actual blending values should be compared, not the sets.
        https://bugs.webkit.org/show_bug.cgi?id=117223

        Reviewed by Dirk Schulze.

        Test: css3/compositing/background-blend-mode-image-color-dynamic.html

        * rendering/style/FillLayer.cpp:
        (WebCore::FillLayer::operator==):

2013-06-13  Beth Dakin  <bdakin@apple.com>

        Headers and footers should be pinned to the left edge of the window when scrolling 
        horizontally, even when zoomed
        https://bugs.webkit.org/show_bug.cgi?id=117562
        -and corresponding-
        <rdar://problem/14006745>

        Reviewed by Sam Weinig.

        We really want to use the width value from scrollOffsetForFixedPosition() for the 
        banner with a scaled factor of 1. So if there is a different scale factor, re-
        compute this value specifically for the banners. 
        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):

2013-06-13  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Support byte and octet types in bindings generators
        https://bugs.webkit.org/show_bug.cgi?id=117547

        Reviewed by Kentaro Hara.

        Add support for byte and octet IDL types to the bindings
        generator:
        http://dev.w3.org/2006/webapi/WebIDL/#idl-byte
        http://dev.w3.org/2006/webapi/WebIDL/#idl-octet

        No new tests, covered by existing layout tests and by new
        bindings tests.

        No new tests, covered by bindings tests and:
        fast/js/webidl-type-mapping.html

        * WebCore.exp.in: Export new symbols for mac port.
        * bindings/js/JSDOMBinding.cpp:
        * bindings/js/JSDOMBinding.h: Add toInt8() / toUInt8()
        methods to convert from JSValue to int8_t / uint8_t as
        specified by Web IDL.

        * bindings/js/JSDataViewCustom.cpp: Remove custom code for
        getInt8, getUInt8, setInt8, setUInt8 now that byte and octet
        types are supported by the bindings generator.

        * bindings/scripts/CodeGeneratorCPP.pm:
        * bindings/scripts/CodeGeneratorGObject.pm:
        * bindings/scripts/CodeGeneratorJS.pm:
        * bindings/scripts/CodeGeneratorObjC.pm:
        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
        * bindings/scripts/test/CPP/WebDOMTestObj.h:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl: Add tests for byte and octet types.
        * html/canvas/DataView.idl: Remove [Custom] extended attribute for
        getInt8, getUInt8, setInt8, setUInt8 and use newly supported byte / octet
        types.

2013-06-13  Timothy Hatcher  <timothy@apple.com>

        Revert r150339 since it causes a hang while paused in the Web Inspector in other apps.

        https://bugs.webkit.org/show_bug.cgi?id=117596

        Reviewed by Joseph Pecoraro.

        * platform/mac/EventLoopMac.mm:
        (WebCore::EventLoop::cycle):

2013-06-13  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Unreviewed gardening.  Remove dangling 'strings' folder from solution.

        * WebCore.vcxproj/WebCore.vcxproj.filters: Get rid of 'strings' that was orphaned by
        recent file reorganization.

2013-06-13  Praveen R Jadhav  <praveen.j@samsung.com>

        Avoid unwanted thread hops in ScriptProcessorNode when 'onaudioprocess' listener is not set.
        https://bugs.webkit.org/show_bug.cgi?id=117578.

        Reviewed by Darin Adler.

        ScriptProcessorNode process operation continues to dispatch AudioProcessingEvent
        even though 'onaudioprocess' listener is not set. This results in unwanted thread hops.
        Code is optimized to dispatch AudioProcessingEvent only if the listener is set.

        No new tests, already covered by existing tests.

        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::ScriptProcessorNode):
        (WebCore::ScriptProcessorNode::process):
        (WebCore::ScriptProcessorNode::setOnaudioprocess):
        * Modules/webaudio/ScriptProcessorNode.h:
        (WebCore::ScriptProcessorNode::onaudioprocess):

2013-06-13  Max Vujovic  <mvujovic@adobe.com>

        [CSS Regions] -webkit-background-clip: text; does not clip the background in regions
        https://bugs.webkit.org/show_bug.cgi?id=117566

        Reviewed by Alexandru Chiculita.

        This patch enables -webkit-background-clip: text; on regions.

        Test: fast/regions/webkit-background-clip-text.html

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::paintFlowThreadPortionInRegion):
            Force black text if we're in the text clip paint phase. This makes sure the text's alpha
            channel does not affect the final opacity of the background clipping result. Rather,
            the text's alpha channel affects the amount of blending between the text color
            and the background.
        * rendering/RenderRegion.cpp:
        (WebCore::shouldPaintRegionContentsInPhase):
            Factor out a function to check if we should paint the region contents in a particular
            phase. Add "PaintPhaseTextClip" so that we draw the contents in the text clipping phase.
        (WebCore::RenderRegion::paintObject):
            Call shouldPaintRegionContentsInPhase instead of doing the phase checks directly in this
            function. Move, update, and clarify the surrounding comments.

2013-06-13  Anton Obzhirov  <a.obzhirov@samsung.com>

        [CSS Regions] Regions auto-height and absolute positioning bug
        https://bugs.webkit.org/show_bug.cgi?id=111092

        Reviewed by David Hyatt.

        During last layout that should update the auto-height regions new auto-height region height
        is calculated correctly based on the text content, but it requires extra step 
        to reposition the render block after new logical height is set (correct logical height becomes
        available only during last layout). 

        Tests: fast/regions/autoheight-abspos-bottom-align.html

        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::updateLogicalHeight):

2013-06-13  Brent Fulgham  <bfulgham@webkit.org>

        [WinCairo] Unreviewed build correction.

        * WebCore.vcxproj/WebCoreCairo.props: Use proper WebKit_Libraries
        environment variable, rather than older WebKitLibraries.

2013-06-13  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Avoid duplicate isInt32() / isUInt32() checks in JSDOMBindings
        https://bugs.webkit.org/show_bug.cgi?id=117593

        Reviewed by Geoffrey Garen.

        Avoid duplicate isInt32() / isUInt32() checks in JSDOMBindings by
        calling asInt32() / asUInt32() instead of toInt32() / toUInt32()
        when we already know the value is a int32 / uint32.

        No new tests, no behavior change.

        * bindings/js/JSDOMBinding.cpp:

2013-06-13  Yuki Sekiguchi  <yuki.sekiguchi@access-company.com>

        Setting overflow:hidden on position:absolute does not repaint hidden content
        https://bugs.webkit.org/show_bug.cgi?id=116994

        Reviewed by Simon Fraser.

        Since a container which has overflow clip of RenderBox which has self painting layer doesn't have a rect of the RenderBox as visual overflow,
        the container should not clip request repainting rect of the RenderBox.

        Test: fast/repaint/change-overflow-and-display-of-relative.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeRectForRepaint):
        * rendering/RenderLayerModelObject.cpp:
        (WebCore::RenderLayerModelObject::shouldUseClipForRepaint): If this has self painting layer, we should not clip for repaint.
        * rendering/RenderLayerModelObject.h:

2013-06-13  Mihai Tica  <mitica@adobe.com>

        [CSS Background Blending] Gradients don't blend with any of the layers behind.
        First, allow the layers behind opaque gradients to be drawn, then add the blending filters
        when working with gradients.

        https://bugs.webkit.org/show_bug.cgi?id=117532

        Reviewed by Dirk Schulze.

        Tests: css3/compositing/background-blend-mode-gradient-color.html
               css3/compositing/background-blend-mode-gradient-gradient.html
               css3/compositing/background-blend-mode-gradient-image.html
               css3/compositing/background-blend-mode-multiple-background-layers.html

        * platform/graphics/GeneratorGeneratedImage.cpp:
        (WebCore::GeneratorGeneratedImage::draw):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::paintFillLayers):

2013-06-13  Michael Brüning  <michael.bruning@digia.com>

        [Qt][Mac] Disable QTKit video on OS X.
        https://bugs.webkit.org/show_bug.cgi?id=117591

        Reviewed by Tor Arne Vestbø.

        Deployment of the same Qt binaries to different
        Mac OS X version makes it impossible to link against
        the correct WebKitSystemInterface version at build time.

        No new tests, no behavioural change.

        * WebCore.pri:

2013-06-13  Morten Stenshorne  <mstensho@opera.com>

        Column balancing support in the region based multicol implementation
        https://bugs.webkit.org/show_bug.cgi?id=116033

        Start by setting the column height to the flow thread's height divided
        by the number of columns. Then stretch the column height until
        contents fits without creating overflowing columns, or until the
        maximum allowed column height is reached, whichever comes first. This
        may require several layout iterations (but normally only a
        couple). For each time we stretch, stretch by the least amount
        required to make a difference to which box goes where.

        Also make sure that the columns get tall enough to honor orphans
        and widows settings.

        This change takes some tiny steps in preparing for multiple column
        set support. There is also some minor cleanup and bugfixing; see
        details below.

        Reviewed by David Hyatt.

        Tests: fast/multicol/newmulticol/balance-images.html
               fast/multicol/newmulticol/balance-maxheight1.html
               fast/multicol/newmulticol/balance-maxheight2.html
               fast/multicol/newmulticol/balance1.html
               fast/multicol/newmulticol/balance2.html
               fast/multicol/newmulticol/balance3.html
               fast/multicol/newmulticol/balance4.html
               fast/multicol/newmulticol/balance5.html
               fast/multicol/newmulticol/balance6.html
               fast/multicol/newmulticol/balance7.html
               fast/multicol/newmulticol/balance8.html
               fast/multicol/newmulticol/balance9.html
               fast/multicol/newmulticol/cell-shrinkback.html
               fast/multicol/newmulticol/columns-shorthand-parsing.html
               fast/multicol/newmulticol/orphans-and-widows-balance.html
               fast/multicol/newmulticol/single-line.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::adjustForUnsplittableChild):
        (WebCore::RenderBlock::setPageBreak):
        (WebCore):
        (WebCore::RenderBlock::updateMinimumPageHeight):
        (WebCore::calculateMinimumPageHeight):
        (WebCore::RenderBlock::adjustLinePositionForPagination):
        (WebCore::RenderBlock::adjustBlockChildForPagination): If no lines
        cross the boundaries, we need to report where blocks cross
        instead, so that the column balancer knows how much to stretch
        columns if necessary.
        * rendering/RenderBlock.h:
        * rendering/RenderFlowThread.h:
        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::RenderMultiColumnBlock):
        (WebCore::RenderMultiColumnBlock::checkForPaginationLogicalHeightChange):
        (WebCore::RenderMultiColumnBlock::relayoutForPagination):
        (WebCore::RenderMultiColumnBlock::layoutSpecialExcludedChild):
        * rendering/RenderMultiColumnBlock.h:
        (WebCore::RenderMultiColumnBlock::columnHeightAvailable):
        (WebCore::RenderMultiColumnBlock::requiresBalancing):
        (RenderMultiColumnBlock):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::RenderMultiColumnFlowThread::autoGenerateRegionsToBlockOffset):
        (WebCore::RenderMultiColumnFlowThread::setPageBreak):
        (WebCore):
        (WebCore::RenderMultiColumnFlowThread::updateMinimumPageHeight):
        * rendering/RenderMultiColumnFlowThread.h:
        (RenderMultiColumnFlowThread):
        * rendering/RenderMultiColumnSet.cpp: Get rid of
        RenderMultiColumnSet::updateLogicalHeight() override. Make
        RenderMultiColumnSet behave more like normal blocks, by having
        computeLogicalHeight() calculate logical top in addition to
        height, just like any other block.
        (WebCore::RenderMultiColumnSet::RenderMultiColumnSet):
        (WebCore::RenderMultiColumnSet::heightAdjustedForSetOffset): This
        method will become more meaningful once we add support for
        multiple column sets.
        (WebCore):
        (WebCore::RenderMultiColumnSet::pageLogicalTopForOffset):
        (WebCore::RenderMultiColumnSet::setAndConstrainColumnHeight):
        (WebCore::RenderMultiColumnSet::calculateBalancedHeight):
        (WebCore::RenderMultiColumnSet::recordSpaceShortage):
        (WebCore::RenderMultiColumnSet::updateLogicalWidth):
        (WebCore::RenderMultiColumnSet::prepareForLayout):
        (WebCore::RenderMultiColumnSet::computeLogicalHeight):
        (WebCore::RenderMultiColumnSet::columnCount):
        (WebCore::RenderMultiColumnSet::columnIndexAtOffset):
        repaintFlowThreadContent() could end up in an infinite loop
        because columnIndexAtOffset() could return UINT_MAX
        (subtracting 1 from unsigned 0, which columnCount() could return),
        which an unsigned integer obviously can never become larger
        than. Also always call columnIndexAtOffset() if we want to get the
        column index for some offset, rather than doing it on our own
        sometimes. To make this work also during layout, we cannot just
        return the last column created so far if we're past it, since
        adding new columns is exactly what we want to do at this point.
        * rendering/RenderMultiColumnSet.h:
        (RenderMultiColumnSet):

2013-06-12  Anders Carlsson  <andersca@apple.com>

        Remove the notion of inactive plug-ins
        https://bugs.webkit.org/show_bug.cgi?id=117570
        <rdar://problem/13484213>

        Reviewed by Tim Horton.

        Remove RenderEmbeddedObject::PluginInactive and the replacement text.

        * English.lproj/Localizable.strings:
        * platform/LocalizedStrings.cpp:
        * platform/LocalizedStrings.h:
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::unavailablePluginReplacementText):
        * rendering/RenderEmbeddedObject.h:

2013-06-12  Dean Jackson  <dino@apple.com>

        [Mac] Change default Traditional Chinese serif font on 10.9
        https://bugs.webkit.org/show_bug.cgi?id=117568

        Reviewed by Alexey Proskuryakov.

        Change default font on newer versions of OS X.

        * page/mac/SettingsMac.mm:
        (WebCore::Settings::initializeDefaultFontFamilies): Use 'Songti TC'
        on 10.9 and above.

2013-06-12  Dean Jackson  <dino@apple.com>

        [Mac] Change default Simplified Chinese serif font on 10.9
        https://bugs.webkit.org/show_bug.cgi?id=117567

        Reviewed by Alexey Proskuryakov.

        Change default font on newer versions of OS X.

        * page/mac/SettingsMac.mm:
        (WebCore::Settings::initializeDefaultFontFamilies): Use 'Songti SC'
        instead of 'STSong' on newer systems.

2013-06-12  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Fix crashes due to failed ImageBuffer allocation
        https://bugs.webkit.org/show_bug.cgi?id=117541

        Reviewed by Andreas Kling.

        From Blink r152268 by <pdr@chromium.org>

        A crash can happen due to a failed ImageBuffer allocation in
        SVGImage::drawPatternForContainer(). Added a check for that failed allocation.

        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::drawPatternForContainer):

2013-06-12  Eduardo Lima Mitev  <elima@igalia.com>

        [atk] Replace deprecated call to atk_document_get_locale() in DumpRenderTree
        https://bugs.webkit.org/show_bug.cgi?id=115647

        Reviewed by Martin Robinson.

        Override the get_object_locale() method of WebkitAccessibleWrapperAtk's internal
        AtkObject, to include custom implementations for AtkDocument and AtkText objects,
        taking the logic as-is from AtkDocument::get_document_locale() and DumpRenderTree's
        AccessibilityUIElementAtk::language(), respectively.

        Apart from improving encapsulation, this avoids calling deprecated get_document_locale()
        method.

        No new functionality, no new tests.

        * accessibility/atk/WebKitAccessibleInterfaceDocument.cpp:
        (webkitAccessibleDocumentInterfaceInit): Chains implementation of
        AtkDocument::get_document_locale() to AtkObject::get_object_locale().
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetObjectLocale): Add implementation of locale resolution for
        objects of type AtkDocument and AtkText.
        (webkitAccessibleClassInit): Override AtkObject::get_object_locale() method.

2013-06-12  Zan Dobersek  <zdobersek@igalia.com>

        [GTK] Move more build targets for source code that's free of layer violations into libPlatform
        https://bugs.webkit.org/show_bug.cgi?id=115936

        Reviewed by Martin Robinson.

        No new tests - no new functionality.

        * GNUmakefile.list.am: Move more build targets under the platform_sources and platformgtk_sources listing.
        These build targets represent source files that are already free of platform layer violations and are as such
        ready to be pushed down from the WebCore layer into the Platform layer.

2013-06-12  Ruth Fong  <ruth_fong@apple.com>

        "Open Video in New Window" doesn't make sense in fullscreen
        https://bugs.webkit.org/show_bug.cgi?id=117556

        Reviewed by Beth Dakin.

        No new tests needed.

        * WebCore.exp.in: Added WebKit2 hook for mediaIsInFullscreen() method.

2013-06-12  Ryosuke Niwa  <rniwa@webkit.org>

        Accessibility code assumes an area element's parent is a map element
        https://bugs.webkit.org/show_bug.cgi?id=117496

        Reviewed by Chris Fleizach.

        We can't make such an assumption. Scripts can insert any element between area and map elements.

        Merge https://chromium.googlesource.com/chromium/blink/+/b6f486284f08c52904701c93e1ec0b7d6e76af9f.

        Test: accessibility/image-map-with-indirect-area-crash.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):

2013-06-12  Robert Hogan  <robert@webkit.org>

        Whitespace between inlines with nowrap and a shrink-to-fit parent gets a line-break when it shouldn't
        https://bugs.webkit.org/show_bug.cgi?id=117370

        Reviewed by David Hyatt.

        Test: fast/text/whitespace/inline-whitespace-wrapping-8.html

        A no-wrap inline shouldn't include trailing space when deciding whether it fits on a line. 
        Likewise when we finish iterating through the objects on a line we should clear our linebreak
        if the only thing that prevents us fitting on the line is our collapsed trailing whitespace.
         
        Removing the trailing space from this measurement means we need to watch out for potential
        breaks between no-wrap inlines, in particular if we leave a no-wrap inline ignoring spaces
        and enter an autowrap inline then we need to mark the beginning of the autowrap inline
        as a potential linebreak. The test fast/text/whitespace/inline-whitespace-wrapping-5.html 
        is an example of such a case.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::LineWidth::LineWidth):
        (WebCore::LineWidth::fitsOnLine):
        (WebCore::LineWidth::fitsOnLineExcludingTrailingWhitespace):
        (WebCore::LineWidth::fitsOnLineExcludingTrailingCollapsedWhitespace):
        (WebCore::LineWidth::setTrailingWhitespaceWidth):
        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):

2013-06-12  Bem Jones-Bey  <bjonesbe@adobe.com>

        [CSS Shapes] rectangle and inset-rectangle do not properly handle rx and ry
        https://bugs.webkit.org/show_bug.cgi?id=116745

        Reviewed by Dirk Schulze.

        If ry is not supplied, it now defaults to the rx value. Also, if rx
        and ry are not supplied, they default to 0px. This also has the effect
        that the computed style for any rectangle or inset-rectangle now
        contains all six parameters.

        If rx > width/2 then it is clamped to width/2, and if ry > height/2,
        then it is clamped to height/2. This happens at layout time because
        given mixed units and relative units, that is the only time this
        determination can be made.

        Tests: fast/exclusions/shape-inside/shape-inside-rounded-rectangle-large-radius.html
               fast/exclusions/shape-outside-floats/shape-outside-floats-rounded-rectangle-large-radius.html

        * css/BasicShapeFunctions.cpp:
        (WebCore::valueForBasicShape): Remove checks for undefined, since rx
            and ry cannot be undefined in BasicShapes anymore.
        (WebCore::basicShapeForValue): If radii are undefined in CSS, set
            default values in the BasicShape, per the spec.
        * rendering/ExclusionShape.cpp:
        (WebCore::ensureRadiiDoNotOverlap): Utility method to ensure radii
            don't overlap.
        (WebCore::ExclusionShape::createExclusionShape): Remove defaulting to
            zero, clamp radii per the spec.
        * rendering/style/BasicShapes.cpp:
        (WebCore::BasicShapeRectangle::path): Remove defaulting.
        (WebCore::BasicShapeRectangle::blend): Ditto.
        (WebCore::BasicShapeInsetRectangle::path): Ditto.
        (WebCore::BasicShapeInsetRectangle::blend): Ditto.
        * rendering/style/BasicShapes.h:
        (WebCore::BasicShapeRectangle::BasicShapeRectangle): Remove defaulting
            to undefined for radii.
        (WebCore::BasicShapeRectangle::setCornerRadiusX): Add assert to
            prevent undefined.
       (WebCore::BasicShapeRectangle::setCornerRadiusY): Add assert to
            prevent undefined.
        (WebCore::BasicShapeInsetRectangle::BasicShapeInsetRectangle): Ditto.
        (WebCore::BasicShapeInsetRectangle::setCornerRadiusX): Add assert to
            prevent undefined.
       (WebCore::BasicShapeInsetRectangle::setCornerRadiusY): Add assert to
            prevent undefined.

2013-06-11  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Support Title UI Element Accessibility Attribute
        https://bugs.webkit.org/show_bug.cgi?id=117530

        Reviewed by Anders Carlsson.

        Fixes: accessibility/list-item-role.html
               accessibility/hidden-legend.html

        * accessibility/win/AccessibilityObjectWrapperWin.cpp:
        (WebCore::AccessibilityObjectWrapper::accessibilityAttributeValue): Extend to support access
        for the Title UI Element object.
        * accessibility/win/AccessibilityObjectWrapperWin.h: Revise interface to use Variant output,
        which is more in keeping with the Mac's 'id' method signature.

2013-06-12  Ralph Thomas  <ralpht@gmail.com>

        [CSS Shaders] Animations and transitions should use validated custom programs
        https://bugs.webkit.org/show_bug.cgi?id=117550

        Run filters used for animations and transitions through RenderLayer::computeFilterOperations
        in order to validate custom filter operations.

        Reviewed by Alexandru Chiculita.

        No new tests as no platform can run custom filters with accelerated animations yet.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::startAnimation):
        (WebCore::RenderLayerBacking::startTransition):

2013-06-12  Ruth Fong  <ruth_fong@apple.com>

        Allow for toggling fullscreen on <video> elements
        https://bugs.webkit.org/show_bug.cgi?id=117220

        Reviewed by Dean Jackson.

        This patch adds the ability for fullscreen
        context menu item on <video> elements to switch between "Enter Fullscreen"
        and "Exit Fullscreen" and behave appropriately.

        No new tests. media/context-menu-action.html,
        which has been disabled by bug 116651, is used to test context menus.

        * English.lproj/Localizable.strings: Add "Exit Fullscreen" string.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::toggleFullscreenState): Added to appropriately enter/exit fullscreen.
        * html/HTMLMediaElement.h:
        * page/ContextMenuController.cpp:
        * platform/ContextMenuItem.h:
        * platform/LocalizedStrings.cpp:
        * platform/LocalizedStrings.h:
        Updated to rename variables more appropriately to reflect the toggle-ability of video fullscreen.
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::mediaIsInFullscreen): Added to check if an element
        was a media element in fullscreen.
        (WebCore::HitTestResult::toggleMediaFullscreenState): Added to hook into
        HTMLMediaElement::toggleFullscreenState.
        * rendering/HitTestResult.h:

2013-06-12  Sergio Villar Senin  <svillar@igalia.com>

        Skipping {}, () and [] blocks while error recovering in CSS
        https://bugs.webkit.org/show_bug.cgi?id=116071

        Reviewed by Darin Adler.

        From Blink r150201 and r150755 by <serya@chromium.org>

        Test: fast/css/parsing-expr-error-recovery.html

        The CSS parser should properly recover from invalid {}, () and []
        blocks skipping them instead of discarding the whole declaration
        as invalid. This merge is actually made of two different changes
        from Blink, the original one that fixes the bug and another one
        which refactors a bit the code making it more legible.

        * css/CSSGrammar.y.in:

2013-06-12  Alberto Garcia  <agarcia@igalia.com>

        [BlackBerry] Remove dead WebDOM code
        https://bugs.webkit.org/show_bug.cgi?id=113370

        Reviewed by Anders Carlsson.

        BlackBerry PR 347565
        Internally reviewed by Charles Wei.

        * PlatformBlackBerry.cmake:

2013-06-12  Daniel Bates  <dabates@apple.com>

        window.find() case-insensitive search doesn't match diacritical marks
        https://bugs.webkit.org/show_bug.cgi?id=117353
        <rdar://problem/8535227>

        Reviewed by Darin Adler.

        Currently, a case-insensitive window.find() search will return true for a word w
        (e.g. café) with diacritical characters when w appears on the page without
        diacritical marks (e.g. cafe). This leads to bad results, especially when
        searching for a non-English word (e.g. qué) where the presence of an accented
        character(s) may change the meaning of the word. Instead window.find() should
        return false when case-insensitively matching a word with diacritical marks to
        the same word without diacritical marks.

        Test: fast/text/find-diacritical-mark.html

        * editing/TextIterator.cpp:
        (WebCore::SearchBuffer::SearchBuffer):

2013-06-12  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Support latest Web IDL indexed property getters
        https://bugs.webkit.org/show_bug.cgi?id=117507

        Reviewed by Kentaro Hara.

        Support latest Web IDL indexed property getters:
        http://www.w3.org/TR/WebIDL/#dfn-support-indexed-properties

        Drop support for outdated [IndexedGetter] and [NumericIndexedGetter]
        IDL extended attributes. Since the new getter format specifies the
        return type, the bindings generator is now smart enough to know if
        the indexed getter is numeric or not on its own.

        Based on Blink r149564 by <kojih@chromium.org>.

        No new tests, no behavior change.

        * Modules/filesystem/EntryArray.idl:
        * Modules/filesystem/EntryArraySync.idl:
        * Modules/gamepad/GamepadList.idl:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/speech/SpeechGrammarList.idl:
        * Modules/speech/SpeechRecognitionResult.idl:
        * Modules/speech/SpeechRecognitionResultList.idl:
        * bindings/scripts/CodeGenerator.pm:
        (IsNumericType):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertySlotBody):
        (GenerateGetOwnPropertyDescriptorBody):
        (GetIndexedGetterFunction):
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestEventTarget.idl:
        * bindings/scripts/test/TestTypedArray.idl:
        * css/CSSRuleList.idl:
        * css/CSSStyleDeclaration.idl:
        * css/CSSValueList.idl:
        * css/MediaList.idl:
        * css/StyleSheetList.idl:
        * css/WebKitCSSFilterValue.idl:
        * css/WebKitCSSKeyframesRule.idl:
        * css/WebKitCSSTransformValue.idl:
        * dom/ClientRectList.idl:
        * dom/DOMNamedFlowCollection.idl:
        * dom/DOMStringList.idl:
        * dom/DataTransferItemList.idl:
        * dom/NamedNodeMap.idl:
        * dom/NodeList.idl:
        * dom/PropertyNodeList.idl:
        * dom/TouchList.idl:
        * fileapi/FileList.idl:
        * html/DOMSettableTokenList.idl:
        * html/DOMTokenList.idl:
        * html/HTMLAllCollection.idl:
        * html/HTMLCollection.idl:
        * html/HTMLFormControlsCollection.idl:
        * html/HTMLFormElement.idl:
        * html/HTMLPropertiesCollection.idl:
        * html/HTMLSelectElement.idl:
        * html/RadioNodeList.idl:
        * html/canvas/Float32Array.idl:
        * html/canvas/Float64Array.idl:
        * html/canvas/Int16Array.idl:
        * html/canvas/Int32Array.idl:
        * html/canvas/Int8Array.idl:
        * html/canvas/Uint16Array.idl:
        * html/canvas/Uint32Array.idl:
        * html/canvas/Uint8Array.idl:
        * html/canvas/Uint8ClampedArray.idl:
        * html/track/AudioTrackList.idl:
        * html/track/TextTrackCueList.idl:
        * html/track/TextTrackList.idl:
        * html/track/TextTrackRegionList.idl:
        * html/track/VideoTrackList.idl:
        * page/PerformanceEntryList.idl:
        * page/SpeechInputResultList.idl:
        * plugins/DOMMimeTypeArray.idl:
        * plugins/DOMPlugin.idl:
        * plugins/DOMPluginArray.idl:

2013-06-12  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Rename [CallWith] to [ConstructorCallWith] for IDL interfaces
        https://bugs.webkit.org/show_bug.cgi?id=117531

        Reviewed by Kentaro Hara.

        Rename [CallWith] to [ConstructorCallWith] for IDL interfaces as the
        meaning is slightly different when [CallWith] is used for IDL operations
        or attributes. This improves IDL readability a bit and makes it more
        directly understandable.

        Also removed [ConstructorCallWith] statements from interfaces with custom
        constructors or no constructor, as this does not have any effect.

        No new tests, no behavior change.

        * Modules/filesystem/FileWriter.idl:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/notifications/Notification.idl:
        * Modules/speech/SpeechRecognition.idl:
        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/webaudio/OfflineAudioContext.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestInterface.idl:
        * dom/MessageChannel.idl:
        * fileapi/FileReader.idl:
        * html/MediaController.idl:
        * html/track/TextTrackCue.idl:
        * page/EventSource.idl:
        * workers/SharedWorker.idl:
        * workers/Worker.idl:
        * xml/XMLHttpRequest.idl:

2013-06-12  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        [Qt] Set windows key-code for multimedia keys
        https://bugs.webkit.org/show_bug.cgi?id=117535

        Reviewed by Jocelyn Turcotte.

        Map Qt Key-events to their defined windows keycode values.

        * platform/qt/PlatformKeyboardEventQt.cpp:
        (WebCore::windowsKeyCodeForKeyEvent):

2013-06-12  Sergio Villar Senin  <svillar@igalia.com>

        [Soup] Use ResourceLoadPriority
        https://bugs.webkit.org/show_bug.cgi?id=112902

        Reviewed by Carlos Garcia Campos.

        Use the ResourceLoadPriority from the ResourceRequest to set the
        correnpondent priority to each SoupMessage.

        No new tests required as there is no change in functionality,
        we're just enabling a new feature in the underlying network stack.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::createSoupMessageForHandleAndRequest):
        * platform/network/soup/ResourceRequest.h:
        (WebCore):
        (WebCore::toSoupMessagePriority): Translates ResourceLoadPriority
        to SoupMessagePriority.

2013-06-12  Zan Dobersek  <zdobersek@igalia.com>

        Remove memoryInfoEnabled, quantizedMemoryInfoEnabled settings
        https://bugs.webkit.org/show_bug.cgi?id=117512

        Reviewed by Darin Adler.

        * page/Settings.in: Remove the memoryInfoEnabled and the quantizedMemoryInfoEnabled settings. These are not used
        anywhere anymore after r151199 which simplified and moved the MemoryInfo interface under window.internals.

2013-06-12  Diego Pino Garcia  <dpino@igalia.com>

        [GTK] Parameter 'pseudoElement' from function 'webkit_dom_dom_window_get_computed_style' should be allowed to be NULL
        https://bugs.webkit.org/show_bug.cgi?id=117332

        Reviewed by Xan Lopez.

        Add parameter 'pseudoElement' to the list of parameters that are allowed to
        be NULL.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GetGReturnMacro):

2013-06-12  Sergio Villar Senin  <svillar@igalia.com>

        Add CSS parsing recovery to functions
        https://bugs.webkit.org/show_bug.cgi?id=117500

        Reviewed by Andreas Kling.

        From Blink r150205 by <serya@chromium.org>

        Add parsing recovery capabilities to functions. Errors were
        correctly detected without this change but then the whole
        declaration was invalidated. By using expr_recovery to handle them
        we can recover from those errors and go on with the parsing.

        * css/CSSGrammar.y.in:

2013-06-11  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Unreviewed, rolling out r151378.
        http://trac.webkit.org/changeset/151378
        https://bugs.webkit.org/show_bug.cgi?id=117400

        Decreased IDL readability a bit.

        * Modules/encryptedmedia/MediaKeys.idl:
        * Modules/mediastream/RTCIceCandidate.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCSessionDescription.idl:
        * Modules/webaudio/OfflineAudioContext.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestInterface.idl:
        * bindings/scripts/test/TestNamedConstructor.idl:
        * css/WebKitCSSMatrix.idl:
        * html/HTMLOptionElement.idl:
        * page/EventSource.idl:
        * workers/SharedWorker.idl:
        * workers/Worker.idl:

2013-06-11  Ryosuke Niwa  <rniwa@webkit.org>

        Have to invalidate the mute button when changing the volume
        https://bugs.webkit.org/show_bug.cgi?id=117464

        Reviewed by Darin Adler.

        Merge https://chromium.googlesource.com/chromium/blink/+/c4c685c82908449526fd8c251cc551e729ebed08
        but without a test since the test doesn't work in WebKit.

        * html/shadow/MediaControls.cpp:
        (WebCore::MediaControls::changedVolume):

2013-06-11  Max Vujovic  <mvujovic@adobe.com>

        [CSS Regions] Regions don't create a stacking context for their contents
        https://bugs.webkit.org/show_bug.cgi?id=114268

        Reviewed by Alexandru Chiculita.

        Paint the region content (from RenderFlowThread) during the background phase instead of the
        foreground phase.

        Let's assume there is a region and a sibling element. The sibling partially overlaps the
        region and appears after the region in DOM order.

        Before this patch, we would paint in this order:
        1) Region background
        2) Sibling background
        3) Region content
        4) Sibling content

        As a result, the sibling background would incorrectly paint between the region
        background and the region content. Instead, the sibling background should paint over the
        region background and the region content.

        After this patch, we paint in this order:
        1) Region background
        2) Region content
        3) Sibling background
        4) Sibling content

        Test: fast/regions/region-sibling-paint-order.html

        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::paintObject):

2013-06-11  Jer Noble  <jer.noble@apple.com>

        REGRESSION: (r149232) videos on disney.com are initially scrambled on load
        https://bugs.webkit.org/show_bug.cgi?id=117517

        Reviewed by Eric Carlson.

        Set a background color on the AVPlayerLayer to avoid corruption when no
        frames are available to display.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer):

2013-06-11  Ryosuke Niwa  <rniwa@webkit.org>

        Use HTMLElementFactory to create equivalent elements in WebVTTElement
        https://bugs.webkit.org/show_bug.cgi?id=117423

        Reviewed by Eric Carlson.

        Merge https://chromium.googlesource.com/chromium/blink/+/3d60bec8e5dabfe877c482797d9ef430bfde31

        This change forces the calls through the factory so that we create appropriate sub-classes based upon the passed tag name,
        rather than just creating a concrete HTMLElement class with an inappropriate tag name.

        Test: media/track/getCueAsHTMLCrash.html

        * html/track/WebVTTElement.cpp:
        (WebCore::WebVTTElement::createEquivalentHTMLElement):

2013-06-11  Benjamin Poulain  <bpoulain@apple.com>

        Split SelectorDataList::executeSingleTagNameSelectorData() into the 4 kinds of traversal
        https://bugs.webkit.org/show_bug.cgi?id=117486

        Reviewed by Ryosuke Niwa.

        Since this is pretty common, split the name selector to have the constant conditions
        outside the traversal.

        * dom/SelectorQuery.cpp:
        (WebCore::SelectorDataList::executeSingleTagNameSelectorData):

2013-06-11  Eric Carlson  <eric.carlson@apple.com>

        [Mac] Update text track menu
        https://bugs.webkit.org/show_bug.cgi?id=117351

        Reviewed by Darin Adler.

        No new tests, existing tests updated.

        * English.lproj/Localizable.strings: Update the menu title.

        * page/CaptionUserPreferencesMac.mm: System language is no longer needed.

        * platform/LocalizedStrings.cpp: Ditto.
        * platform/LocalizedStrings.h:

2013-06-11  Benjamin Poulain  <bpoulain@apple.com>

        Fix the element type in the selector checkers
        https://bugs.webkit.org/show_bug.cgi?id=117450

        Reviewed by Anders Carlsson.

        * css/SelectorCheckerFastPath.cpp:
        (WebCore::HTMLNames::checkClassValue):
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorDataList::executeSingleClassNameSelectorData):

2013-06-11  Benjamin Poulain  <bpoulain@apple.com>

        Clean up the initializer mess in Document
        https://bugs.webkit.org/show_bug.cgi?id=117448

        Reviewed by Ryosuke Niwa.

        Basic cleaning from
        https://chromium.googlesource.com/chromium/blink/+/e54ba8d3b62b0245ecdf2f3ec11cd33b4035a4d7

        * dom/Document.cpp:
        (WebCore::Document::Document):
        * dom/Document.h:

2013-06-11  Jer Noble  <jer.noble@apple.com>

        Set the font size for in-band captions on the display box, not the :cue.
        https://bugs.webkit.org/show_bug.cgi?id=117515

        Reviewed by Eric Carlson.

        Make the in-band font size behavior match the out-of-band behavior.

        * html/track/TextTrackCueGeneric.cpp:
        (WebCore::TextTrackCueGeneric::setFontSize):

2013-06-11  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Implement 'attributeValue' accessor to support testing.
        https://bugs.webkit.org/show_bug.cgi?id=117513

        Reviewed by Anders Carlsson.

        * WebCore.vcxproj/WebCore.vcxproj: Add new implementation file.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * accessibility/win/AccessibilityObjectWrapperWin.cpp: Added.
        * accessibility/win/AccessibilityObjectWrapperWin.h: Add declaration

2013-05-27  Robert Hogan  <robert@webkit.org>

        Positioned Replaced Elements That Aren't RenderReplaced get Incorrect Width
        https://bugs.webkit.org/show_bug.cgi?id=93735

        Reviewed by Darin Adler.

        Replaced elements that aren't RenderReplaced aren't |isReplaced| and don't have an 
        intrinsic height or width. This causes them to go down the wrong height and width computation
        path in RenderBox when they are absolute positioned. 
        
        The notion of |isReplaced| is entwined with the notion of being |isInline| so it isn't really 
        possible to make them isReplaced without re-wiring a lot of code. So instead use an ad-hoc definition
        of isReplacedElement in RenderBox to bring all replaced elements into the height and width calculation.
        To make sure we get the right height and width in there, give non-RenderReplaced replaced renderers
        the helpers for returning their approximation of intrinsic height and width.

        Test: fast/replaced/width-and-height-of-positioned-replaced-elements.html

        * rendering/RenderBox.cpp:
        (WebCore::isReplacedElement):
        (WebCore::RenderBox::computePositionedLogicalWidth):
        (WebCore::RenderBox::computePositionedLogicalHeight):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::intrinsicSize):
        * rendering/RenderButton.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::RenderListBox):
        (WebCore::RenderListBox::computeLogicalHeight):
        * rendering/RenderListBox.h:
        * rendering/RenderMenuList.h:
        * rendering/RenderReplaced.h:
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::RenderTextControl):
        (WebCore::RenderTextControl::computeLogicalHeight):
        * rendering/RenderTextControl.h:

2013-06-11  Ryosuke Niwa  <rniwa@webkit.org>

        There are unused variables in ApplyStyleCommand::mergeEndWithNextIfIdentical and ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds
        https://bugs.webkit.org/show_bug.cgi?id=117475

        Reviewed by Andreas Kling.

        Removed.

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):

2013-06-11  Robert Hogan  <robert@webkit.org>

        Fix typo in r151445

        Unreviewed build fix.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2013-06-11  Ryosuke Niwa  <rniwa@webkit.org>

        Remove redundant calls to ceilToFloat in RenderBlock::computeInlinePreferredLogicalWidths
        https://bugs.webkit.org/show_bug.cgi?id=117490

        Reviewed by Andreas Kling.

        Merge https://chromium.googlesource.com/chromium/blink/+/be336b14325b2938ff6a4fb6191073a6e717a57c.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2013-06-03  Robert Hogan  <robert@webkit.org>

        Painting collapsed borders during scrolling
        https://bugs.webkit.org/show_bug.cgi?id=85658

        Reviewed by David Hyatt.

        Test: fast/repaint/table-cell-collapsed-border-scroll.html

        WHen painting collapsed borders we need to paint the borders of the row above
        the topmost dirtied row so that we compute the correct value for the dirtied row's collapsed border.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paintObject):

2013-06-11  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Custom HTTP method support
        https://bugs.webkit.org/show_bug.cgi?id=117302

        Reviewed by Kenneth Rohde Christiansen.

        No new tests, already covered by existing ones like:
        http/tests/xmlhttprequest/workers/methods.html
        http/tests/xmlhttprequest/workers/methods-async.html

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::initializeHandle):

2013-06-11  Seokju Kwon  <seokju.kwon@gmail.com>

        Web Inspector: Remove 'using namespace std'
        https://bugs.webkit.org/show_bug.cgi?id=117498

        Reviewed by Anders Carlsson.

        No new tests, no behavior change.

        * inspector/InspectorAgent.cpp: Remove unneeded 'using namespace std'.
        * inspector/InspectorFrontendClientLocal.cpp: Use explicit std:: qualifiers instead.
        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowHeight):
        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowWidth):
        * inspector/InspectorFrontendHost.cpp: Remove unneeded 'using namespace std'.
        * inspector/InspectorPageAgent.cpp: Remove unneeded 'using namespace std'.

2013-06-11  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Support latest Web IDL named property getters
        https://bugs.webkit.org/show_bug.cgi?id=117403

        Reviewed by Kentaro Hara.

        Add support for the latest Web IDL named property getters to the JSC
        bindings generator:
        http://www.w3.org/TR/WebIDL/#idl-named-properties

        Drop support for outdated [NamedGetter] IDL extended attribute.

        Support for other kinds of named properties will be added in later
        patches. This patch only brings named property getters.

        This patch is based on Blink r149247 by kojih@chromium.org.

        No new tests, no behavior change.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertySlotBody):
        (GenerateGetOwnPropertyDescriptorBody):
        (GetSpecialAccessorFunctionForType):
        (GetNamedGetterFunction):
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/IDLParser.pm:
        (applyTypedefs):
        (parseSpecialOperation):
        (parseSpecials):
        (applyMemberList):
        * bindings/scripts/test/TestEventTarget.idl:
        * css/StyleSheetList.idl:
        * dom/DOMNamedFlowCollection.idl:
        * dom/DOMStringMap.idl:
        * dom/NamedNodeMap.idl:
        * dom/NodeList.idl:
        * html/HTMLAllCollection.idl:
        * html/HTMLCollection.idl:
        * html/HTMLFormControlsCollection.idl:
        * html/HTMLPropertiesCollection.idl:
        * plugins/DOMMimeTypeArray.idl:
        * plugins/DOMPlugin.idl:
        * plugins/DOMPluginArray.idl:
        * storage/Storage.idl:

2013-06-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        [BlackBerry] Test editing/execCommand/indent-paragraphs.html times out
        https://bugs.webkit.org/show_bug.cgi?id=117235

        Reviewed by Rob Buis.

        PR 346414.

        After r150224 ResourceHandle::start() can fail returning false so
        that the ResourceHandle is destroyed and the error not
        handled. Handle the errors by scheduling a InvalidURLFailure and
        returning true when startJob fails to make sure the ResourceHandle
        is not destroyed and the error is handled and notified to the
        client.

        Fixes timeout in editing/execCommand/indent-paragraphs.html.

        * platform/network/blackberry/ResourceHandleBlackBerry.cpp:
        (WebCore::ResourceHandle::start):

2013-06-11  Ryosuke Niwa  <rniwa@webkit.org>

        Remove IntRect::pixelSnapped* and its enclosingRect since they are no longer used
        https://bugs.webkit.org/show_bug.cgi?id=117494

        Reviewed by Darin Adler.

        Merge: https://chromium.googlesource.com/chromium/blink/+/9433dc00e882e2808ac1db3c1fd89090896d7b58
               https://chromium.googlesource.com/chromium/blink/+/7beaa73aa099170cb2cad02c12c5e0a448b12c21

        * inspector/InspectorLayerTreeAgent.cpp:
        (WebCore::InspectorLayerTreeAgent::buildObjectForLayer):
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::update):
        * platform/graphics/IntRect.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::hitTestCulledInline):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::repaintUsingContainer):

2013-06-11  Sergio Villar Senin  <svillar@igalia.com>

        Autoclose braces and parentheses at the end of style sheet
        https://bugs.webkit.org/show_bug.cgi?id=117414

        Reviewed by Andreas Kling.

        From Blink r150202 by <serya@chromium.org>

        Use closing_parenthesis and closing_brace instead of the literals
        '}' and ')'. This allows the parser to treat expressions with
        unmatched closing braces/parenthesis as if all of them were
        actually closed.

        Tests: animations/keyframe-autoclose-brace.html
               css3/autoclose-braces-and-parentheses.html

        * css/CSSGrammar.y.in:

2013-06-10  Jae Hyun Park  <jae.park@company100.net>

        [CoordinatedGraphics] Typos in custom shader support
        https://bugs.webkit.org/show_bug.cgi?id=117413

        Reviewed by Noam Rosenthal.

        Wrong keyframe is passed when assigning filterValue.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
        (WebCore::CoordinatedGraphicsScene::setLayerAnimationsIfNeeded):

2013-06-10  Ryosuke Niwa  <rniwa@webkit.org>

        text-transform: capitalize shouldn't upconvert
        https://bugs.webkit.org/show_bug.cgi?id=117485

        Reviewed by Adam Barth.

        Avoid the upconversion. Merge https://chromium.googlesource.com/chromium/blink/+/c5a221d6da2443df0639c01c40aac6040908ec79.

        * rendering/RenderText.cpp:
        (WebCore::makeCapitalized):

2013-06-10  Ryosuke Niwa  <rniwa@webkit.org>

        DocType strings should be 8 bit wide
        https://bugs.webkit.org/show_bug.cgi?id=117487

        Reviewed by Michael Saboff.

        Merge https://chromium.googlesource.com/chromium/blink/+/8da02d0ce3965c4e6bf227db856bce930393429a.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertDoctype):

2013-06-10  Ryosuke Niwa  <rniwa@webkit.org>

        Make more functions const
        https://bugs.webkit.org/show_bug.cgi?id=117455

        Reviewed by Benjamin Poulain.

        Merge https://chromium.googlesource.com/chromium/blink/+/886866f5034d7f30f8aa607b909313f99db1f3b4.

        * editing/VisibleUnits.cpp:
        (WebCore::CachedLogicallyOrderedLeafBoxes::boxIndexInLeaves):
        * html/canvas/WebGLRenderingContext.cpp:
        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::evalDisabledErrorMessage):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::LineWidth::shouldIndentText):

2013-06-10  Jer Noble  <jer.noble@apple.com>

        REGRESSION(r151302): Many broken webaudio/ tests on Mac port.
        https://bugs.webkit.org/show_bug.cgi?id=117446

        Reviewed by Chris Rogers.

        The new "pageConsentRequiredForAudioStart()" restriction was blocking playback event
        even when page consent was given. Remvoe the restriction immediately in that case.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::startRendering):

2013-06-10  Andreas Kling  <akling@apple.com>

        REGRESSION(r150633): Find on page non-focused text highlight color is bright yellow.
        <rdar://problem/14098882>
        <http://webkit.org/b/117371>

        Reviewed by Anders Carlsson.

        There was a mistake in the parameter ordering which still compiled because of
        implicit bool/unsigned conversion.
        Changed the interface of Page::findMatchesForText() to use enums instead of bools.

        No test because the color of the highlighted matches is not available through APIs.

        * page/Page.h:
        * page/Page.cpp:
        (WebCore::Page::findMatchesForText):
        (WebCore::Page::markAllMatchesForText):
        (WebCore::Page::countFindMatches):

2013-06-10  Bear Travis  <betravis@adobe.com>

        [CSS Shapes][CSS Exclusions] Split CSS Exclusions and CSS Shapes code
        https://bugs.webkit.org/show_bug.cgi?id=117162

        Reviewed by Alexandru Chiculita.

        With the split between the CSS Exclusions and CSS Shapes specifications,
        some renaming is necessary. In general, this patch removes 'Exclusion' from
        any Shapes code, while organizing the rendering shapes code into a 'shapes'
        folder.

        Renames:
        ExclusionShape -> Shape
        Exclusion[Rectangle|Polygon] -> [Rectangle|Polygon]Shape
        Exclusion -> Shape

        Refactoring, no new tests.

        * CMakeLists.txt:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.pri:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSPrimitiveValue.h:
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::ApplyPropertyShape::setValue):
        (WebCore::ApplyPropertyShape::applyValue):
        (WebCore::ApplyPropertyShape::createHandler):
        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::blendFunc):
        (WebCore::PropertyWrapperShape::PropertyWrapperShape):
        (WebCore::CSSPropertyAnimation::ensurePropertyMap):
        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::LayoutState):
        * rendering/LayoutState.h:
        (WebCore::LayoutState::LayoutState):
        (WebCore::LayoutState::shapeInsideInfo):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::styleDidChange):
        (WebCore::RenderBlock::updateShapeInsideInfoAfterStyleChange):
        (WebCore::shapeInfoRequiresRelayout):
        (WebCore::RenderBlock::updateRegionsAndExclusionsBeforeChildLayout):
        (WebCore::RenderBlock::computeShapeSize):
        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
        (WebCore::RenderBlock::insertFloatingObject):
        (WebCore::RenderBlock::computeLogicalLocationForFloat):
        (WebCore::RenderBlock::positionNewFloats):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::ensureShapeInsideInfo):
        (WebCore::RenderBlock::shapeInsideInfo):
        (WebCore::RenderBlock::setShapeInsideInfo):
        (WebCore::RenderBlock::allowsShapeInsideInfoSharing):
        (WebCore::RenderBlock::xPositionForFloatIncludingMargin):
        (WebCore::RenderBlock::yPositionForFloatIncludingMargin):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutShapeInsideInfo):
        (WebCore::LineWidth::LineWidth):
        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
        (WebCore::constructBidiRunsForLine):
        (WebCore::adjustLogicalLineTop):
        (WebCore::RenderBlock::updateLineBoundariesForShapes):
        (WebCore::RenderBlock::adjustLogicalLineTopAndLogicalHeightIfNeeded):
        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::willBeDestroyed):
        (WebCore::RenderBox::styleDidChange):
        (WebCore::RenderBox::updateShapeOutsideInfoAfterStyleChange):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::shapeOutsideInfo):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintOffset):
        * rendering/RenderView.h:
        (WebCore::RenderView::pushLayoutState):
        * rendering/shapes/PolygonShape.cpp: Renamed from Source/WebCore/rendering/ExclusionPolygon.cpp.
        (WebCore::leftSide):
        (WebCore::isReflexVertex):
        (WebCore::computeXIntersection):
        (WebCore::inwardEdgeNormal):
        (WebCore::outwardEdgeNormal):
        (WebCore::appendArc):
        (WebCore::snapVerticesToLayoutUnitGrid):
        (WebCore::computeShapePaddingBounds):
        (WebCore::computeShapeMarginBounds):
        (WebCore::PolygonShape::shapePaddingBounds):
        (WebCore::PolygonShape::shapeMarginBounds):
        (WebCore::getVertexIntersectionVertices):
        (WebCore::appendIntervalX):
        (WebCore::compareEdgeIntersectionX):
        (WebCore::computeXIntersections):
        (WebCore::computeOverlappingEdgeXProjections):
        (WebCore::PolygonShape::getExcludedIntervals):
        (WebCore::PolygonShape::getIncludedIntervals):
        (WebCore::firstFitRectInPolygon):
        (WebCore::aboveOrToTheLeft):
        (WebCore::PolygonShape::firstIncludedIntervalLogicalTop):
        * rendering/shapes/PolygonShape.h: Renamed from Source/WebCore/rendering/ExclusionPolygon.h.
        (WebCore::OffsetPolygonEdge::OffsetPolygonEdge):
        (WebCore::OffsetPolygonEdge::edgeIndex):
        (WebCore::OffsetPolygonEdge::basis):
        (WebCore::PolygonShape::PolygonShape):
        * rendering/shapes/RectangleShape.cpp: Renamed from Source/WebCore/rendering/ExclusionRectangle.cpp.
        (WebCore::ellipseXIntercept):
        (WebCore::ellipseYIntercept):
        (WebCore::FloatRoundedRect::paddingBounds):
        (WebCore::FloatRoundedRect::marginBounds):
        (WebCore::FloatRoundedRect::cornerInterceptForWidth):
        (WebCore::RectangleShape::shapePaddingBounds):
        (WebCore::RectangleShape::shapeMarginBounds):
        (WebCore::RectangleShape::getExcludedIntervals):
        (WebCore::RectangleShape::getIncludedIntervals):
        (WebCore::RectangleShape::firstIncludedIntervalLogicalTop):
        * rendering/shapes/RectangleShape.h: Renamed from Source/WebCore/rendering/ExclusionRectangle.h.
        (WebCore::FloatRoundedRect::FloatRoundedRect):
        (WebCore::FloatRoundedRect::rx):
        (WebCore::FloatRoundedRect::ry):
        (WebCore::RectangleShape::RectangleShape):
        * rendering/shapes/Shape.cpp: Renamed from Source/WebCore/rendering/ExclusionShape.cpp.
        (WebCore::createRectangleShape):
        (WebCore::createShapeCircle):
        (WebCore::createShapeEllipse):
        (WebCore::createPolygonShape):
        (WebCore::physicalRectToLogical):
        (WebCore::physicalPointToLogical):
        (WebCore::physicalSizeToLogical):
        (WebCore::Shape::createShape):
        * rendering/shapes/Shape.h: Renamed from Source/WebCore/rendering/ExclusionShape.h.
        (WebCore::LineSegment::LineSegment):
        (WebCore::Shape::~Shape):
        (WebCore::Shape::shapeMargin):
        (WebCore::Shape::shapePadding):
        * rendering/shapes/ShapeInfo.cpp: Renamed from Source/WebCore/rendering/ExclusionShapeInfo.cpp.
        (WebCore::::computedShape):
        (WebCore::::computeSegmentsForLine):
        * rendering/shapes/ShapeInfo.h: Renamed from Source/WebCore/rendering/ExclusionShapeInfo.h.
        (WebCore::MappedInfo::ensureInfo):
        (WebCore::MappedInfo::removeInfo):
        (WebCore::MappedInfo::info):
        (WebCore::MappedInfo::infoMap):
        (WebCore::ShapeInfo::~ShapeInfo):
        (WebCore::ShapeInfo::setShapeSize):
        (WebCore::ShapeInfo::clearSegments):
        (WebCore::ShapeInfo::shapeLogicalTop):
        (WebCore::ShapeInfo::shapeLogicalBottom):
        (WebCore::ShapeInfo::shapeLogicalLeft):
        (WebCore::ShapeInfo::shapeLogicalRight):
        (WebCore::ShapeInfo::shapeLogicalWidth):
        (WebCore::ShapeInfo::shapeLogicalHeight):
        (WebCore::ShapeInfo::logicalLineTop):
        (WebCore::ShapeInfo::logicalLineBottom):
        (WebCore::ShapeInfo::shapeContainingBlockHeight):
        (WebCore::ShapeInfo::lineOverlapsShapeBounds):
        (WebCore::ShapeInfo::lineWithinShapeBounds):
        (WebCore::ShapeInfo::dirtyShapeSize):
        (WebCore::ShapeInfo::shapeSizeDirty):
        (WebCore::ShapeInfo::owner):
        (WebCore::ShapeInfo::ShapeInfo):
        (WebCore::ShapeInfo::logicalTopOffset):
        (WebCore::ShapeInfo::logicalLeftOffset):
        * rendering/shapes/ShapeInsideInfo.cpp: Renamed from Source/WebCore/rendering/ExclusionShapeInsideInfo.cpp.
        (WebCore::LineSegmentRange::LineSegmentRange):
        (WebCore::ShapeInsideInfo::isEnabledFor):
        (WebCore::ShapeInsideInfo::adjustLogicalLineTop):
        * rendering/shapes/ShapeInsideInfo.h: Renamed from Source/WebCore/rendering/ExclusionShapeInsideInfo.h.
        (WebCore::LineSegmentIterator::LineSegmentIterator):
        (WebCore::ShapeInsideInfo::createInfo):
        (WebCore::ShapeInsideInfo::hasSegments):
        (WebCore::ShapeInsideInfo::segments):
        (WebCore::ShapeInsideInfo::segmentRanges):
        (WebCore::ShapeInsideInfo::currentSegment):
        (WebCore::ShapeInsideInfo::setNeedsLayout):
        (WebCore::ShapeInsideInfo::needsLayout):
        (WebCore::ShapeInsideInfo::ShapeInsideInfo):
        * rendering/shapes/ShapeInterval.cpp: Renamed from Source/WebCore/rendering/ExclusionInterval.cpp.
        (WebCore::IntervalX1Comparator::operator()):
        (WebCore::ShapeInterval::intersect):
        (WebCore::sortShapeIntervals):
        (WebCore::mergeShapeIntervals):
        (WebCore::intersectShapeIntervals):
        (WebCore::subtractShapeIntervals):
        * rendering/shapes/ShapeInterval.h: Renamed from Source/WebCore/rendering/ExclusionInterval.h.
        (WebCore::ShapeInterval::ShapeInterval):
        * rendering/shapes/ShapeOutsideInfo.cpp: Renamed from Source/WebCore/rendering/ExclusionShapeOutsideInfo.cpp.
        (WebCore::ShapeOutsideInfo::isEnabledFor):
        (WebCore::ShapeOutsideInfo::computeSegmentsForLine):
        * rendering/shapes/ShapeOutsideInfo.h: Renamed from Source/WebCore/rendering/ExclusionShapeOutsideInfo.h.
        (WebCore::ShapeOutsideInfo::shapeLogicalOffset):
        (WebCore::ShapeOutsideInfo::leftSegmentShapeBoundingBoxDelta):
        (WebCore::ShapeOutsideInfo::rightSegmentShapeBoundingBoxDelta):
        (WebCore::ShapeOutsideInfo::createInfo):
        (WebCore::ShapeOutsideInfo::ShapeOutsideInfo):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::initialShapeInside):
        * rendering/style/RenderStyle.h:
        * rendering/style/ShapeValue.h: Renamed from Source/WebCore/rendering/style/ExclusionShapeValue.h.
        (WebCore::ShapeValue::createShapeValue):
        (WebCore::ShapeValue::createOutsideValue):
        (WebCore::ShapeValue::createImageValue):
        (WebCore::ShapeValue::type):
        (WebCore::ShapeValue::shape):
        (WebCore::ShapeValue::image):
        (WebCore::ShapeValue::setImage):
        (WebCore::ShapeValue::operator==):
        (WebCore::ShapeValue::ShapeValue):
        * rendering/style/StyleRareNonInheritedData.h:

2013-06-10  Iago Toral Quiroga  <itoral@igalia.com>

        Use Cairo implementation of the WidgetBackingStore instead of X11 when running on Wayland
        https://bugs.webkit.org/show_bug.cgi?id=116717

        Reviewed by Martin Robinson.

        Refactored WidgetBackingStore to be an abstract base class and make
        GtkWidgetBackingStoreX11 and WidgetBackingStoreCairo inherit from it.
        GtkWidgetBackingStoreX11 renamed to WidgetBackingStoreGtkX11.

        * GNUmakefile.list.am:
        * platform/cairo/WidgetBackingStore.h:
        (WebCore):
        (WidgetBackingStore):
        (WebCore::WidgetBackingStore::WidgetBackingStore):
        (WebCore::WidgetBackingStore::~WidgetBackingStore):
        * platform/cairo/WidgetBackingStoreCairo.cpp:
        (WebCore::WidgetBackingStoreCairo::create):
        (WebCore):
        (WebCore::WidgetBackingStoreCairo::WidgetBackingStoreCairo):
        (WebCore::WidgetBackingStoreCairo::~WidgetBackingStoreCairo):
        (WebCore::WidgetBackingStoreCairo::cairoSurface):
        (WebCore::WidgetBackingStoreCairo::scroll):
        * platform/cairo/WidgetBackingStoreCairo.h: Added.
        (WebCore):
        (WidgetBackingStoreCairo):
        * platform/gtk/GtkWidgetBackingStoreX11.cpp:
        (WebCore::WidgetBackingStoreGtkX11::create):
        (WebCore):
        (WebCore::WidgetBackingStoreGtkX11::WidgetBackingStoreGtkX11):
        (WebCore::WidgetBackingStoreGtkX11::~WidgetBackingStoreGtkX11):
        (WebCore::WidgetBackingStoreGtkX11::cairoSurface):
        (WebCore::WidgetBackingStoreGtkX11::scroll):
        * platform/gtk/GtkWidgetBackingStoreX11.h: Added.
        (WebCore):
        (WidgetBackingStoreGtkX11):

2013-06-10  Otto Derek Cheung  <otcheung@rim.com>

        [BlackBerry] Store ParsedCookies as RefPtrs instead of PassRefPtrs in CookieDatabaseBackingStore
        https://bugs.webkit.org/show_bug.cgi?id=117411

        JIRA388672
        BRWSR-11465
        Reviewed by Rob Buis.

        When we queue up ParsedCookie objects for modification, we should be storing them as a refptr instead
        of a PassRefPtr.

        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h:

2013-06-10  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in RenderGeometryMap::mapToContainer
        https://bugs.webkit.org/show_bug.cgi?id=117395

        Reviewed by Alexandru Chiculita.

        Test: fast/regions/assert-flow-thread-compositing.html

        We should not allow RenderNamedFlowThread layers to be composited, rather their collected children should checked
        for compositing through their associated RenderRegions.

        The assert in RenderGeometryMap::mapToContainer was hit because after https://bugs.webkit.org/show_bug.cgi?id=117270
        the render named flow threads are hooked in RenderView layer tree - with the caveat that they are not directly involved
        in hit testing/paint which is done through their associated regions.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Bail out if we hit a render named flow thread layer.
        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto.

2013-06-10  Sergio Villar Senin  <svillar@igalia.com>

        Refactor CALCFUNCTION rules in the CSS grammar
        https://bugs.webkit.org/show_bug.cgi?id=117401

        Reviewed by Andreas Kling.

        From Blink r149862 by <serya@chromium.org>.

        Reduce the number of CALCFUNCTION rules by refactoring the closing
        parenthesis handling code.

        No new tests required as this is a refactoring, no new functionality
        added.

        * css/CSSGrammar.y.in:

2013-06-10  Radu Stavila  <stavila@adobe.com>

        [CSS Regions] Rename region-overflow to region-fragment
        https://bugs.webkit.org/show_bug.cgi?id=117397

        Renamed -webkit-region-overflow to -webkit-region-fragment and 
        webkitRegionOverflow to webkitRegionFragment according to the new working draft
        at http://www.w3.org/TR/2013/WD-css3-regions-20130528/#the-region-fragment-property

        Reviewed by Alexander Pavlov.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator RegionFragment):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::applyProperty):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::hasNextPage):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayout):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:

2013-06-10  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Replace [ConstructorRaisesException] with [RaisesException]
        https://bugs.webkit.org/show_bug.cgi?id=117400

        Reviewed by Kentaro Hara.

        Replace [ConstructorRaisesException] with [RaisesException] IDL extended
        attribute and drop [ConstructorRaisesException]. It makes little sense
        to have 2 extended attributes with the same meaning.

        [RaisesException] can now be used on IDL operations to indicate that the
        method may throw exceptions or on interfaces to indicate that the
        constructor may throw exceptions.

        From Blink r148027 by Kentaro Hara <haraken@chromium.org>.

        No new tests, no behavior change.

        * Modules/encryptedmedia/MediaKeys.idl:
        * Modules/mediastream/RTCIceCandidate.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCSessionDescription.idl:
        * Modules/webaudio/OfflineAudioContext.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestInterface.idl:
        * bindings/scripts/test/TestNamedConstructor.idl:
        * css/WebKitCSSMatrix.idl:
        * html/HTMLOptionElement.idl:
        * page/EventSource.idl:
        * workers/SharedWorker.idl:
        * workers/Worker.idl:

2013-06-10  Mátyás Mustoha  <mmatyas@inf.u-szeged.hu>

        Web Inspector: refactor statusBarItems getter in front-end.
        https://bugs.webkit.org/show_bug.cgi?id=110114

        Reviewed by Noam Rosenthal.

        Refactored "statusBarItems" methods from getters into functions and
        moved default implementation from Panel.js to View.js.

        Patch created by Andrey Lushnikov.

        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.SearchView.prototype.statusBarItems):
        * inspector/front-end/ApplicationCacheItemsView.js:
        (WebInspector.ApplicationCacheItemsView.prototype.statusBarItems):
        * inspector/front-end/AuditsPanel.js:
        (WebInspector.AuditsPanel.prototype.statusBarItems):
        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileView.prototype.statusBarItems):
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileView.prototype.statusBarItems):
        * inspector/front-end/CanvasProfileView.js:
        (WebInspector.CanvasProfileView.prototype.statusBarItems):
        (WebInspector.CanvasProfileType.prototype.statusBarItems):
        * inspector/front-end/ConsolePanel.js:
        (WebInspector.ConsolePanel.prototype.statusBarItems):
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.statusBarItems):
        * inspector/front-end/CookieItemsView.js:
        (WebInspector.CookieItemsView.prototype.statusBarItems):
        * inspector/front-end/DOMStorageItemsView.js:
        (WebInspector.DOMStorageItemsView.prototype.statusBarItems):
        * inspector/front-end/DatabaseTableView.js:
        (WebInspector.DatabaseTableView.prototype.statusBarItems):
        * inspector/front-end/Drawer.js:
        * inspector/front-end/ElementsPanel.js:
        (WebInspector.ElementsPanel.prototype.statusBarItems):
        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionPanel.prototype.statusBarItems):
        * inspector/front-end/FileSystemView.js:
        (WebInspector.FileSystemView.prototype.statusBarItems):
        * inspector/front-end/HeapSnapshotView.js:
        * inspector/front-end/IndexedDBViews.js:
        (WebInspector.IDBDataView.prototype.statusBarItems):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype.statusBarItems):
        (WebInspector.NetworkPanel.prototype.statusBarItems):
        * inspector/front-end/Panel.js:
        (WebInspector.Panel.prototype.wasShown):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.statusBarItems):
        (WebInspector.ProfilesPanel.prototype.statusBarItems):
        (WebInspector.ProfilesPanel.prototype._updateProfileTypeSpecificUI):
        (WebInspector.ProfilesPanel.prototype._showProfile):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.statusBarItems):
        (WebInspector.ResourcesPanel.prototype._innerShowView):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.statusBarItems):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype.statusBarItems):
        * inspector/front-end/View.js:
        (WebInspector.View.prototype.statusBarItems):

2013-06-10  Benjamin Poulain  <benjamin@webkit.org>

        Add special tree walking for the single tag or class CSS query selectors
        https://bugs.webkit.org/show_bug.cgi?id=117388

        Reviewed by Ryosuke Niwa.

        Queries for a single tag name or a single class name are the most common
        input of querySelector.

        This patch adds a simplified tree walking in those cases, only checking that particular
        case instead of a full selector.

        With the change, the balanced query selector benchmarks become 11% faster.

        * css/SelectorCheckerFastPath.cpp:
        (WebCore::HTMLNames::checkClassValue):
        * dom/SelectorQuery.cpp:
        (WebCore::isSingleTagNameSelector):
        (WebCore::SelectorDataList::executeSingleTagNameSelectorData):
        (WebCore::isSingleClassNameSelector):
        (WebCore::SelectorDataList::executeSingleClassNameSelectorData):
        (WebCore::SelectorDataList::execute):
        * dom/SelectorQuery.h:

2013-06-09  Roger Fong  <roger_fong@apple.com>

        Layout info should never be cleared before delayed scroll information updates.
        https://bugs.webkit.org/show_bug.cgi?id=116689.

        Reviewed by Darin Adler.

        Test: fast/flexbox/clear-overflow-before-scroll-update.html

        Make sure that clearLayoutOverflow only gets called after layer()->updateScrollInfoAfterLayout().
        Also move clearLayoutOverflow to RenderBlock so we can keep all the delayed scroll update logic in RenderBlock.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::finishDelayUpdateScrollInfo): Call clearLayoutOverflow here.
        (WebCore::RenderBlock::layout): Only call clearLayoutOverflow here if scrolling isn't being delayed.
        (WebCore::RenderBlock::clearLayoutOverflow): Remove clearLayoutOverflow, move into RenderBlock to keep delayed scrolling logic in the same file.
        * rendering/RenderBlock.h:
        * rendering/RenderBox.cpp:
        * rendering/RenderBox.h:
        * rendering/RenderDeprecatedFlexibleBox.cpp: Should call updateScrollInfoAfterLayout, not layer()->updateScrollInfoAfterLayout(), so that it takes delayed scrolling logic into account.
        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
        * rendering/RenderGrid.cpp: Ditto
        (WebCore::RenderGrid::layoutBlock):

2013-06-09  Benjamin Poulain  <bpoulain@apple.com>

        Split the 3 paths of SelectorDataList::execute() into 3 separate functions
        https://bugs.webkit.org/show_bug.cgi?id=117378

        Reviewed by Ryosuke Niwa.

        Split those to have several small execute() fucntions instead of a giant one.

        * dom/SelectorQuery.cpp:
        (WebCore::selectorForIdLookup):
        (WebCore::isTreeScopeRoot):
        (WebCore::SelectorDataList::executeFastPathForIdSelector):
        (WebCore::SelectorDataList::executeSingleSelectorData):
        (WebCore::SelectorDataList::executeSingleMultiSelectorData):
        (WebCore::SelectorDataList::execute):
        * dom/SelectorQuery.h:

2013-06-09  Benjamin Poulain  <bpoulain@apple.com>

        Scrolling with platformWidget and delegateScrolling is incorrectly clamped
        https://bugs.webkit.org/show_bug.cgi?id=117369
        <rdar://problem/13985064>

        Reviewed by Darin Adler.

        The patch http://trac.webkit.org/changeset/142526 clamps the input position
        in the ScrollView scroll range. This was done for the path to the ScrollingCoordinator.

        The problem with that change is ScrollView::setScrollPosition() can delegate the scrolling
        to either a platformWidget, or through delegateScrolling. After r142526, the position is clamped,
        and we do not let those external scrolling mechanims handle the out-of-bound scrolling.

        This patch fixes the issue by moving the threaded scrolling call to ScrollView,
        after the delegate handling code.

        * page/FrameView.cpp:
        (WebCore::FrameView::setScrollPosition):
        (WebCore::FrameView::requestScrollPositionUpdate):

2013-06-08  Igor Oliveira  <igor.o@sisa.samsung.com>

        before/after generated content is not working with HTMLSummaryElement and HTMLDetailsElement.
        https://bugs.webkit.org/show_bug.cgi?id=117374

        Allow before/after pseudo generated content be added in HTMLDetailsElement and HTMLSumamaryElement.

        Reviewed by Ryosuke Niwa.

        Test: fast/css-generated-content/details-summary-before-after.html

        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
        * html/HTMLSummaryElement.cpp:
        (WebCore::HTMLSummaryElement::childShouldCreateRenderer):

2013-06-08  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Allow headers with empty value
        https://bugs.webkit.org/show_bug.cgi?id=117344

        Reviewed by Brent Fulgham.

        No new tests, already covered by:
        http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
        http/tests/xmlhttprequest/post-blob-content-type-sync.html

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::initializeHandle):

2013-06-08  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Handling of blob elements is incorrect
        https://bugs.webkit.org/show_bug.cgi?id=117301

        Reviewed by Kenneth Rohde Christiansen.

        No new tests, covered by existing ones:
        http/tests/fileapi/xhr-send-form-data-filename-escaping.html
        http/tests/fileapi/xhr-send-form-data-mimetype-normalization.html

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::getFormElementsCount): Resolve Blob elements.

2013-06-07  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Regions] Layers inside the RenderFlowThread should be collected by the layer of RenderView
        https://bugs.webkit.org/show_bug.cgi?id=117270

        Reviewed by David Hyatt.

        RenderNamedFlowThreads are attached to the RenderView, but they are painted 
        and hit-tested through their regions. The easiest way to prevent the RenderView 
        from seeing the RenderNamedFlowThreads as its own children was to avoid collecting
        the layers of the RenderNamedFlowThreads as children layers of the RenderView.

        However, most of the code is analyzing the layers tree starting from the root,
        so having the RenderNamedFlowThread participate in the layer tree is needed
        in order to enable compositing for layers inside the flow thread.

        This patch makes the RenderNamedFlowThread visible to the RenderView, but
        ignores it when iterates the children of the RenderView in paint and hit-test methods.

        No new tests, no visible changes.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintList):
        (WebCore::RenderLayer::hitTestList):
        (WebCore::RenderLayer::calculateLayerBounds):
        (WebCore::RenderLayer::collectLayers):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeLayers):

2013-06-07  Bear Travis  <betravis@adobe.com>

        [CSS Exclusions][CSS Shapes] Incorrect compile flag in LayoutState.h
        https://bugs.webkit.org/show_bug.cgi?id=117318

        Reviewed by Alexandru Chiculita.

        m_exclusionShapeInsideInfo should be guarded by the CSS_SHAPES flag,
        not the CSS_EXCLUSIONS flag.

        No tests required.

        * rendering/LayoutState.h:

2013-06-07  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Get rid of outdated raises() from Web IDL
        https://bugs.webkit.org/show_bug.cgi?id=117350

        Reviewed by Darin Adler.

        Stop using "raises()" in the IDL as this is no longer part of the Web IDL
        specification. Web IDL no longer specifies exceptions for operations. Instead
        it is now explained in prose.

        WebKit still needs to know if the method can throw an exception (but does not
        need the exception name) so this patch adds a WebKit specific IDL extended
        attribute: [RaisesException]. The naming is consistent with Blink.

        This results in more standard and concise IDL. This also simplifies a lot
        the code of the IDL parser.

        No new tests, no behavior change.

        * Modules/battery/BatteryManager.idl:
        * Modules/encryptedmedia/MediaKeySession.idl:
        * Modules/encryptedmedia/MediaKeys.idl:
        * Modules/filesystem/DirectoryEntrySync.idl:
        * Modules/filesystem/DirectoryReaderSync.idl:
        * Modules/filesystem/EntrySync.idl:
        * Modules/filesystem/FileEntrySync.idl:
        * Modules/filesystem/FileWriter.idl:
        * Modules/filesystem/FileWriterSync.idl:
        * Modules/filesystem/WorkerContextFileSystem.idl:
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBFactory.idl:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBKeyRange.idl:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/MediaStreamTrack.idl:
        * Modules/mediastream/NavigatorMediaStream.idl:
        * Modules/mediastream/RTCDTMFSender.idl:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/navigatorcontentutils/NavigatorContentUtils.idl:
        * Modules/networkinfo/NetworkInfoConnection.idl:
        * Modules/notifications/Notification.idl:
        * Modules/notifications/NotificationCenter.idl:
        * Modules/speech/SpeechRecognition.idl:
        * Modules/vibration/NavigatorVibration.idl:
        * Modules/webaudio/AudioBuffer.idl:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/AudioNode.idl:
        * Modules/webdatabase/DOMWindowWebDatabase.idl:
        * Modules/webdatabase/DatabaseSync.idl:
        * Modules/webdatabase/WorkerContextWebDatabase.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorCPP.pm:
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateFunction):
        (GenerateFunctions):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateParametersCheck):
        (GenerateImplementationFunctionCall):
        (GenerateConstructorDefinition):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/IDLParser.pm:
        (parseOperationRest):
        * bindings/scripts/test/TestEventTarget.idl:
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/TestSupplemental.idl:
        * bindings/scripts/test/TestTypedefs.idl:
        * css/CSSHostRule.idl:
        * css/CSSMediaRule.idl:
        * css/CSSPrimitiveValue.idl:
        * css/CSSStyleDeclaration.idl:
        * css/CSSStyleSheet.idl:
        * css/CSSSupportsRule.idl:
        * css/FontLoader.idl:
        * css/MediaList.idl:
        * css/WebKitCSSMatrix.idl:
        * dom/CharacterData.idl:
        * dom/DOMImplementation.idl:
        * dom/DataTransferItemList.idl:
        * dom/Document.idl:
        * dom/DocumentFragment.idl:
        * dom/DocumentType.idl:
        * dom/Element.idl:
        * dom/EventTarget.idl:
        * dom/MessagePort.idl:
        * dom/MutationObserver.idl:
        * dom/NamedNodeMap.idl:
        * dom/Node.idl:
        * dom/NodeIterator.idl:
        * dom/Range.idl:
        * dom/ShadowRoot.idl:
        * dom/Text.idl:
        * dom/WebKitNamedFlow.idl:
        * fileapi/FileReader.idl:
        * fileapi/FileReaderSync.idl:
        * html/DOMTokenList.idl:
        * html/HTMLCanvasElement.idl:
        * html/HTMLDialogElement.idl:
        * html/HTMLElement.idl:
        * html/HTMLEmbedElement.idl:
        * html/HTMLFrameElement.idl:
        * html/HTMLIFrameElement.idl:
        * html/HTMLInputElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLObjectElement.idl:
        * html/HTMLOptionsCollection.idl:
        * html/HTMLSelectElement.idl:
        * html/HTMLTableElement.idl:
        * html/HTMLTableRowElement.idl:
        * html/HTMLTableSectionElement.idl:
        * html/HTMLTextAreaElement.idl:
        * html/HTMLVideoElement.idl:
        * html/MediaController.idl:
        * html/TimeRanges.idl:
        * html/canvas/CanvasGradient.idl:
        * html/canvas/CanvasRenderingContext2D.idl:
        * html/canvas/DOMPath.idl:
        * html/canvas/DataView.idl:
        * html/canvas/OESVertexArrayObject.idl:
        * html/canvas/WebGLDebugShaders.idl:
        * html/canvas/WebGLRenderingContext.idl:
        * html/track/AudioTrackList.idl:
        * html/track/TextTrack.idl:
        * html/track/TextTrackCue.idl:
        * html/track/TextTrackList.idl:
        * html/track/VideoTrackList.idl:
        * loader/appcache/DOMApplicationCache.idl:
        * page/Crypto.idl:
        * page/DOMSelection.idl:
        * page/DOMWindow.idl:
        * page/EventSource.idl:
        * page/History.idl:
        * page/Performance.idl:
        * storage/Storage.idl:
        * svg/SVGAngle.idl:
        * svg/SVGAnimationElement.idl:
        * svg/SVGColor.idl:
        * svg/SVGDocument.idl:
        * svg/SVGLength.idl:
        * svg/SVGLengthList.idl:
        * svg/SVGLocatable.idl:
        * svg/SVGMatrix.idl:
        * svg/SVGNumberList.idl:
        * svg/SVGPaint.idl:
        * svg/SVGPathSegList.idl:
        * svg/SVGPointList.idl:
        * svg/SVGStringList.idl:
        * svg/SVGTextContentElement.idl:
        * svg/SVGTransformList.idl:
        * testing/InternalSettings.idl:
        * testing/Internals.idl:
        * workers/AbstractWorker.idl:
        * workers/DedicatedWorkerContext.idl:
        * workers/Worker.idl:
        * workers/WorkerContext.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestUpload.idl:
        * xml/XMLSerializer.idl:
        * xml/XPathEvaluator.idl:
        * xml/XPathExpression.idl:
        * xml/XPathResult.idl:

2013-06-07  Brady Eidson  <beidson@apple.com>

        REGRESSION (r151088): Crash navigating away from non-loaded main resources with non-loaded scripts.
        <rdar://problem/14052886> and https://bugs.webkit.org/show_bug.cgi?id=117278

        Reviewed by Anders Carlsson.

        Test: http/tests/navigation/slow-loading-page-with-slow-script.php

        * html/parser/HTMLScriptRunner.cpp:
        (WebCore::HTMLScriptRunner::isPendingScriptReady): The script runner might be told about a script
          after it has already been detached (the main resource load has finished/failed/cancelled).
          Don't dereference a null document in that case.

2013-06-07  Andy Estes  <aestes@apple.com>

        Compile WebCoreTestShimLibrary.cpp on iOS, but exclude the Carbon bits
        https://bugs.webkit.org/show_bug.cgi?id=117360

        Reviewed by Mark Rowe.

        In r150114 we tried to make the WebCoreTestShim target build on iOS by
        excluding its only source file from the build. While this allowed the
        target to build, it prevented the target's product (WebCoreTestShim.dylib)
        from being created. This causes xcodebuild to fail if you ask it to
        install the target.

        Fix this by building the target's product on iOS. Just use the
        preprocessor to exclude the bits that won't build on iOS.

        * Configurations/WebCoreTestShim.xcconfig:
        * testing/WebCoreTestShimLibrary.cpp:

2013-06-07  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION: Lines jump up and down while typing Chinese or Japanese
        https://bugs.webkit.org/show_bug.cgi?id=115931

        Reviewed by Darin Adler.

        The bug was caused by Font::width caching the width of text even when the font fallbacks existed when fallbackFonts
        argument was null; because of this, a later call to Font::width was returning the width without filling up
        fallbackFonts even if it was not null this time.

        Fixed the bug by adding a local fallback fonts hash set, and checking the emptiness of this variable in Font::width.
        Also added pass fallbackFonts around in various places to make use of the cached font fallbacks.

        No new tests. Unfortunately I haven't been able to make a reliable reduction for this bug.

        * platform/graphics/Font.cpp:
        (WebCore::Font::width):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::measureHyphenWidth):
        (WebCore::setLogicalWidthForTextRun):
        (WebCore::textWidth):
        (WebCore::tryHyphenating):
        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
        * rendering/RenderText.cpp:
        (WebCore::maxWordFragmentWidth):
        (WebCore::RenderText::computePreferredLogicalWidths):

2013-06-07  Zan Dobersek  <zdobersek@igalia.com>

        [regression] build failure WebKitFontFamilyNames.h missing
        https://bugs.webkit.org/show_bug.cgi?id=117178

        Reviewed by Sam Weinig.

        * GNUmakefile.am: Make libPlatform and other sources depend on the generated platform sources. This should prevent
        build failures in source code that's depending on the generated platform sources.

2013-06-07  Chris Fleizach  <cfleizach@apple.com>

        MathML line fraction needs to parse number values
        https://bugs.webkit.org/show_bug.cgi?id=117305

        Reviewed by Darin Adler.

        The line fraction thickness was not handling arbitrary thickness numbers.
        The accessibility code was not handling default values for line thickness, so
        it made sense to have AX rely on the RenderFraction object to retrive the thickness.

        Modified existing tests to cover new behavior.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::mathLineThickness):
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::updateFromElement):
        * rendering/mathml/RenderMathMLFraction.h:
        (WebCore::RenderMathMLFraction::lineThickness):
        (WebCore::toRenderMathMLFraction):

2013-06-07  Claudio Saavedra  <csaavedra@igalia.com>

        [rendering] Use foreground color to render the overtype caret
        https://bugs.webkit.org/show_bug.cgi?id=117347

        Reviewed by Darin Adler.

        Currently, the overtype caret is rendered using the colors of
        a normal selection, which is confusing. This patch enables RenderObject
        to differentiate between a normal and a overtype caret selection,
        in order to use a different color for the latter.

        Also, let RenderView update the selection if this is unchanged
        when going from a overtype caret to one character selection and
        viceversa.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::selectionBackgroundColor):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setSelection):
        * rendering/RenderView.h:

2013-06-07  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Get rid of outdated getter / setter raises from Web IDL
        https://bugs.webkit.org/show_bug.cgi?id=117346

        Reviewed by Darin Adler.

        Stop using "getter / setter raises" in the IDL as this is no longer part of
        the Web IDL specification. Web IDL no longer specifies exceptions for
        attribute getters or setters. Instead, it is now explained in prose.

        WebKit still needs to know if the getter / setter can throw an exception
        (but does not need the exception name) so this patch adds 2 WebKit specific
        IDL extended attributes: [GetterRaisesException] / [SetterRaisesException].
        The naming is consistent with Blink.

        This results in more standard and concise IDL. This also simplifies a lot
        the code of the IDL parser.

        Note that this patch does not remove "raises()" from the IDL methods yet.
        This should be replaced by [RaisesException] IDL extended attribute in a
        later patch.

        No new tests, no behavior change.

        * Modules/indexeddb/IDBRequest.idl:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCSessionDescription.idl:
        * Modules/mediastream/RTCStatsResponse.idl:
        * Modules/webaudio/AnalyserNode.idl:
        * Modules/webaudio/AudioBufferSourceNode.idl:
        * Modules/webaudio/AudioNode.idl:
        * Modules/webdatabase/SQLResultSet.idl:
        * bindings/scripts/CodeGeneratorCPP.pm:
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateProperty):
        (GenerateFunctions):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/IDLParser.pm:
        (parseAttributeRest):
        (parseAttributeRestOld):
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/TestTypedefs.idl:
        * css/CSSCharsetRule.idl:
        * css/CSSRule.idl:
        * css/CSSStyleDeclaration.idl:
        * css/CSSValue.idl:
        * css/MediaList.idl:
        * dom/Attr.idl:
        * dom/CharacterData.idl:
        * dom/Document.idl:
        * dom/Node.idl:
        * dom/ProcessingInstruction.idl:
        * dom/Range.idl:
        * dom/ShadowRoot.idl:
        * dom/TreeWalker.idl:
        * html/HTMLElement.idl:
        * html/HTMLInputElement.idl:
        * html/HTMLMarqueeElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLMeterElement.idl:
        * html/HTMLOptionElement.idl:
        * html/HTMLOptionsCollection.idl:
        * html/HTMLProgressElement.idl:
        * html/HTMLSelectElement.idl:
        * html/HTMLTableElement.idl:
        * html/HTMLTextAreaElement.idl:
        * html/MediaController.idl:
        * html/track/TextTrackCue.idl:
        * html/track/TextTrackRegion.idl:
        * page/DOMWindow.idl:
        * storage/Storage.idl:
        * svg/SVGAltGlyphElement.idl:
        * svg/SVGAngle.idl:
        * svg/SVGAnimatedBoolean.idl:
        * svg/SVGAnimatedEnumeration.idl:
        * svg/SVGAnimatedInteger.idl:
        * svg/SVGAnimatedNumber.idl:
        * svg/SVGAnimatedString.idl:
        * svg/SVGElement.idl:
        * svg/SVGGlyphRefElement.idl:
        * svg/SVGLangSpace.idl:
        * svg/SVGLength.idl:
        * svg/SVGPreserveAspectRatio.idl:
        * svg/SVGSVGElement.idl:
        * svg/SVGScriptElement.idl:
        * svg/SVGStyleElement.idl:
        * svg/SVGViewSpec.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XPathResult.idl:

2013-06-07  Kangil Han  <kangil.han@samsung.com>

        Remove unused header includes in Document
        https://bugs.webkit.org/show_bug.cgi?id=117339

        Reviewed by Andreas Kling.

        Minor code cleanup.

        * dom/Document.cpp:
        * dom/Document.h:

2013-06-07  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        Unnecessary use of Layout types in GraphicsLayer::paintGraphicsLayerContents
        https://bugs.webkit.org/show_bug.cgi?id=117340

        Reviewed by Darin Adler.

        There is no reason to use Layout types when copying from Int types to Int types.

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::paintGraphicsLayerContents):

2013-06-07  Grzegorz Czajkowski  <g.czajkowski@samsung.com>

        [EFL][GTK] TextCheckerEnchant uses deprecated enchant_dict_add_to_personal
        https://bugs.webkit.org/show_bug.cgi?id=117335

        Reviewed by Christophe Dumez.

        enchant_dict_add_to_personal has been deprecated at r22321 in Enchant repository.

        No behavior change, no new tests needed.

        * platform/text/enchant/TextCheckerEnchant.cpp:
        (WebCore::TextCheckerEnchant::learnWord):
        Use enchant_dict_add instead of enchant_dict_add_to_personal.

2013-06-07  Zalan Bujtas  <zalan@apple.com>

        Frame flattening: crash when child iframe is removed during beforeload.
        https://bugs.webkit.org/show_bug.cgi?id=116220

        Reviewed by Antti Koivisto.

        FrameView can get destroyed in updateWidget(). Normally, it is protected by layout()
        but with frame flattening on, it can also be called asynchronously through the
        post layout timer.

        Test: fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html

        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2013-06-06  Carlos Garcia Campos  <cgarcia@igalia.com>

        Make CachedResource virtual methods overridden in derived classes private
        https://bugs.webkit.org/show_bug.cgi?id=117289

        Reviewed by Darin Adler.

        And mark them as OVERRIDE too. Also mark all CachedResource
        derived classes as FINAL.

        * inspector/InspectorPageAgent.cpp:
        (WebCore::cachedResourcesForFrame):
        * loader/cache/CachedCSSStyleSheet.h:
        * loader/cache/CachedFont.h:
        * loader/cache/CachedImage.h:
        * loader/cache/CachedRawResource.h:
        * loader/cache/CachedSVGDocument.h:
        * loader/cache/CachedScript.h:
        * loader/cache/CachedShader.h:
        * loader/cache/CachedTextTrack.h:
        * loader/cache/CachedXSLStyleSheet.h:

2013-06-07  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] getBoundingClientRect wrong for inline content nodes
        https://bugs.webkit.org/show_bug.cgi?id=117290

        Reviewed by Alexandru Chiculita.

        getBoundingClientRect returned incorrect values for inline content that
        was directly flowed inside regions because its mapLocalToContainer was not
        properly patched as its RenderBox counterpart. This patch adds mapLocalToContainer
        method in RenderFlowThread so that is properly called for all the elements inside the
        flow thread.

        Also, modified offsetFromContainer so that if the container is the flow thread,
        offsetDependsOnPoint is set to true which further sets RenderGeometryMapStep::m_isNonUniform
        to true for each step added in pushMappingToContainer methods.

        Test: fast/regions/flowed-inline-content-bounding-client-rect.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer):
        (WebCore::RenderBox::pushMappingToContainer):
        (WebCore::RenderBox::offsetFromContainer):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::mapLocalToContainer):
        * rendering/RenderFlowThread.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetFromContainer):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::offsetFromContainer):

2013-06-06  Kangil Han  <kangil.han@samsung.com>

        Minor code cleanup to remove unused header includes
        https://bugs.webkit.org/show_bug.cgi?id=117283

        Reviewed by Andreas Kling.

        * loader/cache/CachedResourceClient.h:
        * rendering/RenderBlock.cpp:
        * rendering/RenderBox.cpp:
        * rendering/RenderBoxModelObject.cpp:
        * rendering/RenderObject.cpp:

2013-06-06  Jer Noble  <jer.noble@apple.com>

        Restrict WebAudio from playing when disallowed by page.
        https://bugs.webkit.org/show_bug.cgi?id=117310

        Reviewed by Eric Carlson.

        Add a new behavior restriction which would mute WebAudio
        when media playback is disallowed by the page.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::constructCommon): Set the RequirePageConsentForAudioStartRestriction
            restriction for the Mac port
        (WebCore::AudioContext::document): Cast the execution context to a document.
        (WebCore::AudioContext::lazyInitialize): Call startRendering() instead of
            m_destinationNode->startRendering() directly.
        (WebCore::AudioContext::startRendering): If media loading is disabled, add
            a mediaCanStart listener.
        (WebCore::AudioContext::mediaCanStart): Remove the RequirePageConsentForAudioStartRestriction.
        * Modules/webaudio/AudioContext.h:
        (WebCore::AudioContext::pageConsentRequiredForAudioStart): Added; simple wrapper.
        * Modules/webaudio/AudioDestinationNode.cpp:
        (WebCore::AudioDestinationNode::render): Mute output if pageConsentRequiredForAudioStart().

2013-06-03  Jer Noble  <jer.noble@apple.com>

        Upstream iOS WebAudio behavior restrictions.
        https://bugs.webkit.org/show_bug.cgi?id=117151

        Reviewed by Eric Carlson.

    2012-06-25  Jeffrey Pfau  <jpfau@apple.com>

            <rdar://problem/11041007> WebAudio should restrict playback to user interaction on iOS

            Added a bevahior restrictions field in AudioContext that behaviors similarly to
            the one in HTMLMediaElement. Restrictions are lifted when JavaScript calls noteOn,
            noteGrainOn or startRendering from a user gesture event.

            Reviewed by Dean Jackson.

            No new tests, testing framework doesn't support web audio.

            * Modules/webaudio/AudioBufferSourceNode.cpp:
            (WebCore::AudioBufferSourceNode::startGrain):
            * Modules/webaudio/AudioContext.cpp:
            (WebCore::AudioContext::AudioContext):
            (WebCore::AudioContext::constructCommon):
            (WebCore::AudioContext::lazyInitialize):
            (WebCore::AudioContext::startRendering):
            * Modules/webaudio/AudioContext.h:
            (WebCore::AudioContext::userGestureRequiredForAudioStart):
            (WebCore::AudioContext::addBehaviorRestriction):
            (WebCore::AudioContext::removeBehaviorRestriction):
            * Modules/webaudio/AudioDestinationNode.cpp:
            (WebCore::AudioDestinationNode::render):
            * Modules/webaudio/AudioScheduledSourceNode.cpp:
            (WebCore::AudioScheduledSourceNode::start):

2013-06-06  Ruth Fong  <ruth_fong@apple.com>

        Expose HTMLCanvasElement supportsContext
        https://bugs.webkit.org/show_bug.cgi?id=70117

        Reviewed by Darin Adler.

        Adds the supportsContext function for <canvas> elements as speced here:
        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-canvas-supportscontext

        Test: fast/canvas/webgl/canvas-supports-context.html

        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::get3DContextAttributes): Added.
        Refactored function from JSHTMLCanvasElement::getContext that parses attributes.
        (WebCore::JSHTMLCanvasElement::getContext): Updated to use refactored function.
        (WebCore::JSHTMLCanvasElement::supportsContext): Added.
        Exposes JS function supportsContext.
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::getContext): Updated to use refactored functions.
        (WebCore::HTMLCanvasElement::supportsContext): Added.
        Implements supportsContext function based on contextId parameter (i.e. '2d').
        * html/HTMLCanvasElement.h: Added refactored functions from HTMLCanvasElement::getContext.
        * html/HTMLCanvasElement.idl:

2013-06-06  Zoltan Horvath  <zoltan@webkit.org>

        [CSS Shapes] Rename updateLineBoundariesForExclusions to updateShapeAndSegmentsForCurrentLine
        https://bugs.webkit.org/show_bug.cgi?id=117308

        Reviewed by Alexandru Chiculita.

        We have a standalone specification for CSS Shapes now: http://dev.w3.org/csswg/css-shapes/
        this change renames updateLineBoundariesForExclusions to updateShapeAndSegmentsForCurrentLine.

        No behavior change, no new tests needed.

        * rendering/RenderBlock.h:
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::updateLineBoundariesForShapes):
        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):

2013-06-06  Diego Pino Garcia  <dpino@igalia.com>

        [GTK] Parameter 'refChild' from function 'webkit_dom_node_insert_before' should be allowed to be NULL
        https://bugs.webkit.org/show_bug.cgi?id=117303

        Reviewed by Xan Lopez.

        Add parameter 'refChild' to the list of parameters that are allowed to
        be NULL.

        * bindings/scripts/CodeGeneratorGObject.pm:

2013-06-06  Bem Jones-Bey  <bjonesbe@adobe.com>

        Fix formatting in BasicShapes.cpp
        https://bugs.webkit.org/show_bug.cgi?id=117309

        Reviewed by Alexandru Chiculita.

        I reformatted the code in BasicShapes.cpp (bug 116734) to fix the
        style issues, and I got some of the formatting wrong, which makes the
        code much harder to read. This patch fixes that formatting.

        No new tests, formatting clean up.

        * rendering/style/BasicShapes.cpp:
        (WebCore::BasicShapeRectangle::path): Fix formatting.
        (WebCore::BasicShapeInsetRectangle::path): Fix formatting.

2013-06-06  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Clean up AddIncludesForType in JSC bindings generators
        https://bugs.webkit.org/show_bug.cgi?id=117297

        Reviewed by Kentaro Hara.

        Clean up AddIncludesForType in JSC bindings generators:
        - Add JSC specific SkipIncludeHeader() subroutine and move
        exceptions there.
        - Remove special case for SerializedScriptValue by improving
        the condition for callbacks: "JS" prefix is now only added to
        headers in callbacks if they are wrapper types. Non-wrapper
        types such as SerializedScriptValue do not have a JS*.h
        header.

        No new tests, code clean up.

        * bindings/scripts/CodeGenerator.pm:
        (SkipIncludeHeader):
        - Reuse IsPrimitiveType() to avoid code duplication.
        - Remove special case for String as this is not a valid IDL type
        and it is not currently used.
        * bindings/scripts/CodeGeneratorJS.pm:
        (SkipIncludeHeader):
        (AddIncludesForType):

2013-06-06  Radu Stavila  <stavila@adobe.com>

        :hover style not applied on hover if its display property is different from original style's
        https://bugs.webkit.org/show_bug.cgi?id=7555

        Properly apply the :hover pseudo-class when reattaching is required (e.g. when changing the display type)

        A new AttachContext class was created to be passed along as an optional parameter to the attach/detach/reattach methods.
        This new parameter is used to:
            - prevent the element from being removed from the list of hovered/active elements upon detach when a reattach is in progress
            - prevent the style from being incorrectly computed (due to the previous point)
            - prevent the style from being computed twice (the attach() method used to recompute it)

        Special care was required to the case when display:none is specified in the :hover class. Enabling the :hover style
        was leaving the element without a renderer, which was causing it to remain stuck in the :hover state (subsequent mouseMove
        events were not able to reset the element to its normal style due to the fact that it had no renderer).

        The DragController::startDrag method was updated to properly handle the case when dragImage is NULL 
        (for instance by setting display:none inside the -webkit-drag pseudo-class).

        Reviewed by Antti Koivisto.

        Tests: fast/regions/hover-display-block-inline.html
               fast/regions/hover-display-block-none.html

        * page/DragController.cpp:
        (WebCore::DragController::startDrag):
        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::attach):
        (WebCore::ContainerNode::detach):
        * dom/ContainerNode.h:
        * dom/Document.cpp:
        (WebCore::Document::attach):
        (WebCore::Document::detach):
        (WebCore::Document::updateHoverActiveState):
        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::setHovered):
        (WebCore::Element::createRendererIfNeeded):
        (WebCore::Element::attach):
        (WebCore::Element::detach):
        (WebCore::Element::recalcStyle):
        * dom/Element.h:
        * dom/Node.cpp:
        (WebCore::Node::AttachDetachContext::AttachDetachContext):
        (WebCore::Node::AttachDetachContext::~AttachDetachContext):
        (WebCore::Node::attach):
        (WebCore::Node::detach):
        * dom/Node.h:
        (WebCore::Node::reattach):
        (WebCore::Node::reattachIfAttached):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::attach):
        * dom/PseudoElement.h:
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::attach):
        * dom/ShadowRoot.h:
        * dom/Text.cpp:
        (WebCore::Text::attach):
        * dom/Text.h:
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::attach):
        * html/HTMLCanvasElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::attach):
        * html/HTMLFormControlElement.h:
        * html/HTMLFrameElement.cpp:
        (WebCore::HTMLFrameElement::attach):
        * html/HTMLFrameElement.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::attach):
        * html/HTMLFrameElementBase.h:
        * html/HTMLFrameSetElement.cpp:
        (WebCore::HTMLFrameSetElement::attach):
        * html/HTMLFrameSetElement.h:
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::attach):
        * html/HTMLImageElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::attach):
        (WebCore::HTMLInputElement::detach):
        * html/HTMLInputElement.h:
        * html/HTMLLIElement.cpp:
        (WebCore::HTMLLIElement::attach):
        * html/HTMLLIElement.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::attach):
        * html/HTMLMediaElement.h:
        * html/HTMLOptGroupElement.cpp:
        (WebCore::HTMLOptGroupElement::attach):
        (WebCore::HTMLOptGroupElement::detach):
        * html/HTMLOptGroupElement.h:
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::attach):
        (WebCore::HTMLOptionElement::detach):
        * html/HTMLOptionElement.h:
        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::detach):
        * html/HTMLPlugInElement.h:
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::attach):
        (WebCore::HTMLPlugInImageElement::detach):
        * html/HTMLPlugInImageElement.h:
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::attach):
        * html/HTMLProgressElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::attach):
        * html/HTMLTextAreaElement.h:
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::attach):
        * html/HTMLVideoElement.h:
        * html/PluginDocument.cpp:
        (WebCore::PluginDocument::detach):
        * html/PluginDocument.h:
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::attach):
        (WebCore::InsertionPoint::detach):
        * html/shadow/InsertionPoint.h:
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::detach):
        * html/shadow/SliderThumbElement.h:
        * html/shadow/SpinButtonElement.cpp:
        (WebCore::SpinButtonElement::detach):
        * html/shadow/SpinButtonElement.h:
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldCancelButtonElement::detach):
        (WebCore::InputFieldSpeechButtonElement::attach):
        (WebCore::InputFieldSpeechButtonElement::detach):
        * html/shadow/TextControlInnerElements.h:
        * loader/PlaceholderDocument.cpp:
        (WebCore::PlaceholderDocument::attach):
        * loader/PlaceholderDocument.h:
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::attach):
        * svg/SVGImageElement.h:

2013-06-06  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        ENABLE(PAN_SCROLLING) AutoscrollController::updateAutoscrollRenderer calls hitTestResultAtPoint with `true` for HitTestRequestType
        https://bugs.webkit.org/show_bug.cgi?id=116896

        Reviewed by Andreas Kling.

        Update hitTestResultAtPoint call to new API.

        * page/AutoscrollController.cpp:
        (WebCore::AutoscrollController::updateAutoscrollRenderer):

2013-06-06  Carlos Garcia Campos  <cgarcia@igalia.com>

        ResourceLoader::resourceData() should not return a PassRefPtr
        https://bugs.webkit.org/show_bug.cgi?id=117288

        Reviewed by Darin Adler.

        Change ResourceLoader::resourceData() to return a raw pointer
        instead of a PassRefPtr since we don't want to transfer the
        ownership of the resource data. Also pass a raw pointer to
        CachedResource::data() so that the cached resource can decide
        whether to take a reference of the data or not, for example,
        CachedRawResource only takes a reference when buffering policy is
        BufferData.

        * html/ImageDocument.cpp:
        (WebCore::ImageDocumentParser::appendBytes):
        (WebCore::ImageDocumentParser::finish):
        * loader/ResourceLoader.cpp:
        * loader/ResourceLoader.h:
        (WebCore::ResourceLoader::resourceData):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::sendDataToResource):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::data):
        * loader/cache/CachedCSSStyleSheet.h:
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::data):
        * loader/cache/CachedFont.h:
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::data):
        * loader/cache/CachedImage.h:
        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::data):
        * loader/cache/CachedRawResource.h:
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::data):
        * loader/cache/CachedResource.h:
        * loader/cache/CachedSVGDocument.cpp:
        (WebCore::CachedSVGDocument::data):
        * loader/cache/CachedSVGDocument.h:
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::data):
        * loader/cache/CachedScript.h:
        * loader/cache/CachedShader.cpp:
        (WebCore::CachedShader::data):
        * loader/cache/CachedShader.h:
        * loader/cache/CachedTextTrack.cpp:
        (WebCore::CachedTextTrack::data):
        * loader/cache/CachedTextTrack.h:
        * loader/cache/CachedXSLStyleSheet.cpp:
        (WebCore::CachedXSLStyleSheet::data):
        * loader/cache/CachedXSLStyleSheet.h:

2013-06-06  Chris Fleizach  <cfleizach@apple.com>

        AX: iOS ignores ARIA progressbar elements
        https://bugs.webkit.org/show_bug.cgi?id=116727

        Reviewed by David Kilzer.

        Make this an accessible element on iOS.

        Test: platform/iphone-simulator/accessibility/progressbar.html

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):
        (-[WebAccessibilityObjectWrapper _accessibilityMinValue]):
        (-[WebAccessibilityObjectWrapper _accessibilityMaxValue]):

2013-06-06  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Remove unused HashValueForClassAndName() from JSC bindings generator
        https://bugs.webkit.org/show_bug.cgi?id=117292

        Reviewed by Kentaro Hara.

        Remove HashValueForClassAndName() subroutine from JSC bindings generator
        as it is dead code.

        No new tests, code clean up.

        * bindings/scripts/CodeGeneratorJS.pm:

2013-06-06  Gwang Yoon Hwang  <ryumiel@company100.net>

        Cannot set a new timer inside of timer callback in RunLoopTimerGtk & RunLoopTimerEFL
        https://bugs.webkit.org/show_bug.cgi?id=117224

        Reviewed by Christophe Dumez.

        RunLoopTimer should clear its isActive flag before invoking timer
        callback.

        * platform/efl/RunLoopEfl.cpp:
        (WebCore::RunLoop::TimerBase::timerFired):
        * platform/gtk/RunLoopGtk.cpp:
        (WebCore::RunLoop::TimerBase::timerFiredCallback):

2013-06-06  Diego Pino Garcia  <dpino@igalia.com>

        [GTK] Parameters 'inResult' and 'resolver' from function 'webkit_dom_document_evaluate' should be allowed to be NULL
        https://bugs.webkit.org/show_bug.cgi?id=117129

        Reviewed by Xan Lopez.

        At this moment there was a temporary fix that allowed parameter
        'inResult' to be NULL (see: webk.it/42115). However, there was no fix
        for parameter 'resolver'.
        
        This patch refactors the code of the previous fix, moving the code for
        determine whether a parameter can be NULL or not to GetGReturnMacro.
        The solution is quite general and will alow to add other parameters in
        the future if needed. 

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GetGReturnMacro): Pass functionName, as in some cases the code
        generated depends on the paramName and the functionName
        (ParamCanBeNull): Checks if a parameter is allowed to be NULL 
        (GenerateFunction):

2013-06-06  Zalan Bujtas  <zalan@apple.com>

        SVG objects are misplaced when SVG root has CSS transform.
        https://bugs.webkit.org/show_bug.cgi?id=117252

        Reviewed by Simon Fraser.

        Update layer transforms for SVG if needed.

        SVG root, similarly to RenderBlock needs to call RenderLayer
        to get transforms updated after layout, in order to
        position the transformed objects properly.

        Test: fast/transforms/transform-svg.html

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::layout):

2013-06-06  Jae Hyun Park  <jae.park@company100.net>

        Coordinated Graphics : Refactor CoordinatedSurface to manage the lifecycle of GraphicsContext
        https://bugs.webkit.org/show_bug.cgi?id=108899

        Reviewed by Noam Rosenthal.

        This is a preparation patch for Threaded Coordinated Graphics.

        This patch changes CoordinatedSurface to be responsible for the
        lifecycle of GraphicsContext used in Coordinated Graphics System.
        CoordinatedImageBacking and UpdateAtlas do not ask for the ownership
        of GraphicsContext anymore. Instead, those classes use client pattern to
        ask the CoordiantedSurface to paint to the GraphicsContext.

        This refactoring is needed to implement CoordinatedSurface for Threaded
        Coordinated Graphics.

        No new tests, covered by existing tests.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::paintToSurface):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
        (WebCore::ImageBackingSurfaceClient::ImageBackingSurfaceClient):
        (WebCore::CoordinatedImageBacking::update):
        * platform/graphics/texmap/coordinated/CoordinatedSurface.h:
        (WebCore::CoordinatedSurface::Client::~Client):
        * platform/graphics/texmap/coordinated/CoordinatedTile.cpp:
        (WebCore::CoordinatedTile::updateBackBuffer):
        (WebCore::CoordinatedTile::paintToSurfaceContext):
        * platform/graphics/texmap/coordinated/CoordinatedTile.h:
        * platform/graphics/texmap/coordinated/UpdateAtlas.cpp:
        (WebCore::UpdateAtlasSurfaceClient::UpdateAtlasSurfaceClient):
        (WebCore::UpdateAtlas::paintOnAvailableBuffer):
        * platform/graphics/texmap/coordinated/UpdateAtlas.h:

2013-06-05  Ryosuke Niwa  <rniwa@webkit.org>

        Revert the second half of r151257. WebGLRenderingContext::create can return null.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::getContext):

2013-06-05  Ryosuke Niwa  <rniwa@webkit.org>

        Remove unnecessary null check in HTMLCanvasElement.cpp.

        Rubber-stamped by Benjamin Poulain.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::getContext):

2013-06-05  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Add implementation for HTTP PUT method.
        https://bugs.webkit.org/show_bug.cgi?id=117256

        Reviewed by Brent Fulgham.

        No new tests, covered by existing tests.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::getFormSize):
        (WebCore::setupFormData):
        (WebCore::ResourceHandleManager::setupPUT):
        (WebCore::ResourceHandleManager::setupPOST):

2013-06-05  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Normalize mime type information
        https://bugs.webkit.org/show_bug.cgi?id=117194

        Reviewed by Brent Fulgham.

        * platform/MIMETypeRegistry.cpp: Enable MIME type normalization for curl.

2013-06-05  Xueqing Huang  <huangxueqing@baidu.com>

        Move OleGetClipboard to Pasteboard::createForCopyAndPaste.
        https://bugs.webkit.org/show_bug.cgi?id=117064

        Reviewed by Darin Adler.

        No behavior change, no new tests.

        * platform/win/EditorWin.cpp:
        (WebCore::Editor::newGeneralClipboard): Editor should not create IDataObject explicitly then set it to Pasteboard.
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::createForCopyAndPaste): Construct a Pasteboard and create IDataObject by "OleGetClipboard".

2013-06-05  Benjamin Poulain  <bpoulain@apple.com>

        WebSQL forces 16-bit strings
        https://bugs.webkit.org/show_bug.cgi?id=116935

        Reviewed by Darin Adler.

        Merge chromium 49c9632ac135f6f06e623a7a81d9da1f6bb7196f.
        https://chromium.googlesource.com/chromium/blink/+/49c9632ac135f6f06e623a7a81d9da1f6bb7196f

        * platform/sql/SQLiteStatement.cpp:
        (WebCore::SQLiteStatement::getColumnValue):

2013-06-05  Bear Travis  <betravis@adobe.com>

        [CSS Exclusions][CSS Shapes] Split CSS Exclusions & Shapes compile & runtime flags
        https://bugs.webkit.org/show_bug.cgi?id=117172

        Reviewed by Alexandru Chiculita.

        This patch adds a new compile and runtime flag for the CSS Shapes feature, which
        has split off from the previous CSS Exclusions and Shapes specification. The
        specifications are available here:
        http://dev.w3.org/csswg/css-exclusions/
        http://dev.w3.org/csswg/css-shapes/

        The changes introduce a new CSS_SHAPES compile flag, and a new cssShapesEnabled
        runtime flag. In general, the code changes are simple renames.

        Refactoring, no new tests.

        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setCSSShapesEnabled):
        (WebCore::RuntimeEnabledFeatures::cssShapesEnabled):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::isSimpleLengthPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::applyProperty):
        (WebCore::StyleResolver::loadPendingImages):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::CSSPropertyAnimation::ensurePropertyMap):
        * rendering/BidiRun.h:
        (WebCore::BidiRun::BidiRun):
        * rendering/ExclusionShapeInfo.cpp:
        * rendering/ExclusionShapeInfo.h:
        * rendering/ExclusionShapeInsideInfo.cpp:
        * rendering/ExclusionShapeInsideInfo.h:
        * rendering/ExclusionShapeOutsideInfo.cpp:
        * rendering/ExclusionShapeOutsideInfo.h:
        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::LayoutState):
        * rendering/LayoutState.h:
        (WebCore::LayoutState::LayoutState):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::styleDidChange):
        (WebCore::exclusionInfoRequiresRelayout):
        (WebCore::RenderBlock::updateRegionsAndExclusionsBeforeChildLayout):
        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
        (WebCore::RenderBlock::insertFloatingObject):
        (WebCore::RenderBlock::computeLogicalLocationForFloat):
        (WebCore::RenderBlock::positionNewFloats):
        (WebCore::::collectIfNeeded):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::xPositionForFloatIncludingMargin):
        (WebCore::RenderBlock::yPositionForFloatIncludingMargin):
        (WebCore::RenderBlock::FloatIntervalSearchAdapter::FloatIntervalSearchAdapter):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::LineWidth::LineWidth):
        (WebCore::LineWidth::updateAvailableWidth):
        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
        (WebCore::RenderBlock::constructLine):
        (WebCore::computeExpansionForJustifiedText):
        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
        (WebCore::RenderBlock::computeInlineDirectionPositionsForSegment):
        (WebCore::constructBidiRunsForLine):
        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::willBeDestroyed):
        (WebCore::RenderBox::styleDidChange):
        * rendering/RenderBox.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintOffset):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::hasPaintOffset):
        * rendering/RenderView.h:
        (WebCore::RenderView::pushLayoutState):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayout):
        * rendering/style/RenderStyle.h:
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setCSSShapesEnabled):

2013-06-05  Oliver Hunt  <oliver@apple.com>

        Don't throttle timers if a page is doing something that might be interesting
        https://bugs.webkit.org/show_bug.cgi?id=117273

        Reviewed by Gavin Barraclough.

        Make the decision about whether or not to throttle timers be
        determined by the PageThrottler

        * page/Page.cpp:
        (WebCore::Page::throttleTimers):
        (WebCore::Page::unthrottleTimers):
        (WebCore::Page::setVisibilityState):
        (WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):
        * page/Page.h:
        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::throttlePage):
        (WebCore::PageThrottler::unthrottlePage):

2013-06-05  Mark Salisbury  <mark.salisbury@hp.com>

        [WinCE,WinCairo] RenderThemeWin.cpp needs to include FrameSelection.h.
        https://bugs.webkit.org/show_bug.cgi?id=116583

        Reviewed by Brent Fulgham.

        * rendering/RenderThemeWin.cpp:

2013-06-05  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Restrict allowed protocols
        https://bugs.webkit.org/show_bug.cgi?id=117257

        Reviewed by Brent Fulgham.

        curl supports various protocols (like: HTTP,...,POP3,IMAP...) and by
        default all of the are enabled for a single curl handle. Furthermore
        all of the protocols are allowed during Location header follow.
        This could pose a security risk for example: a malicious server responds
        with a crafted Location header pointing to an imap/../(etc) url and the
        curl backend will follow it and will give the result for the WebCore.

        This patch will restrict the allowed protocols to: HTTP(S), FTP(S), FILE

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::initializeHandle):

2013-06-05  Bear Travis  <betravis@adobe.com>

        [css exclusions] Clean up ExclusionShapeInsideInfo dynamic removal code
        https://bugs.webkit.org/show_bug.cgi?id=116236

        Reviewed by David Hyatt.

        Instead of keeping the ExclusionShapeInsideInfo around after it has
        become stale, we can immediately remove it and just mark descendants
        for relayout. This patch removes most of the code added by
        https://bugs.webkit.org/show_bug.cgi?id=111029
        in favor of this simpler approach.

        This patch does not introduce new functionality.

        * rendering/ExclusionShapeInsideInfo.h:
        (WebCore::ExclusionShapeInsideInfo::ExclusionShapeInsideInfo):
        (ExclusionShapeInsideInfo): Remove needsRemoval code.
        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::LayoutState): Ditto.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::updateExclusionShapeInsideInfoAfterStyleChange): Remove
        needsRemoval code and mark descendants for layout.
        (WebCore):
        (WebCore::RenderBlock::markShapeInsideDescendantsForLayout): Method to mark
        descendants of a shape inside with inline content for layout.
        (WebCore::exclusionInfoRequiresRelayout): Remove needsRemoval code.
        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout): Ditto.
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::exclusionShapeInsideInfo): Ditto.
        (RenderBlock):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutExclusionShapeInsideInfo): Ditto.

2013-06-05  Arunprasad Rajkumar  <arurajku@cisco.com>

        Avoid multiple copies of inline script & style strings
        https://bugs.webkit.org/show_bug.cgi?id=117202

        Reviewed by Darin Adler.

        Merge from https://chromiumcodereview.appspot.com/16005007.

        No new tests needed.

        The HTML parser breaks up large text nodes into small chunks to avoid some
        O(n^2) editing algorithms. This fix skips that workaround for <script> and
        <style> elements, which aren't likely to need editing. As a result, <script>
        ends up with a single text node, containing a contiguous String, which is the
        source code of that inline script block.

        Prior this fix, we could end up with two copies of large inline scripts: one
        monolithic string retained by JSC and a number of shards retained by the DOM.
        After this fix, both the DOM and JSC use the same monolithic string, removing a
        copy.

        * dom/Text.cpp:
        (WebCore::Text::createWithLengthLimit):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::shouldUseLengthLimit):
        (WebCore::HTMLConstructionSite::insertTextNode):

2013-06-05  Kondapally Kalyan  <kalyan.kondapally@intel.com>

        [EFL] Build fix with EGL and GLES2 backend.
        https://bugs.webkit.org/show_bug.cgi?id=117246

        Reviewed by Kenneth Rohde Christiansen.

        r150958 added support for EGLTransportSurfaceClient.
        This patch adds the missing changes.

        * platform/graphics/surfaces/efl/GLTransportSurface.cpp:
        (WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):
        (WebCore::GLTransportSurfaceClient::GLTransportSurfaceClient):
        * platform/graphics/surfaces/efl/GLTransportSurface.h:
        * platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
        (WebCore::GraphicsSurfacePrivate::initializeClient):
        * platform/graphics/surfaces/egl/EGLXSurface.cpp:
        (WebCore::EGLXTransportSurfaceClient::EGLXTransportSurfaceClient):
        * platform/graphics/surfaces/egl/EGLXSurface.h:
        * platform/graphics/surfaces/glx/GLXSurface.cpp:
        (WebCore::GLXTransportSurfaceClient::GLXTransportSurfaceClient):
        * platform/graphics/surfaces/glx/GLXSurface.h:
        * platform/graphics/surfaces/glx/X11Helper.cpp:
        (WebCore::X11Helper::createOffScreenWindow):
        (WebCore::X11Helper::createPixmap):
        * platform/graphics/surfaces/glx/X11Helper.h:

2013-06-05  Jae Hyun Park  <jae.park@company100.net>

        [GTK] Support using GLContext from multiple threads
        https://bugs.webkit.org/show_bug.cgi?id=117238

        Reviewed by Martin Robinson.

        Current implementation assumes that GLContext is only used in the main thread.
        However, to support using GLContext from multiple threads, we need to change it
        to thread local. Therefore, ASSERT(isMainThread()) is removed and GLContext is
        changed to thread local.

        * platform/graphics/cairo/GLContext.cpp:
        (WebCore::ThreadGlobalGLContext::setContext):
        (WebCore::ThreadGlobalGLContext::context):
        (WebCore::currentContext):
        (WebCore::GLContext::sharingContext):
        (WebCore::GLContext::~GLContext):
        (WebCore::GLContext::makeContextCurrent):
        (WebCore::GLContext::getCurrent):

2013-06-05  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Unreviewed build fix when CHANNEL_MESSAGING is disabled.

        Add #if ENABLE(CHANNEL_MESSAGING) to JSMessageChannelCustom.cpp.

        * bindings/js/JSMessageChannelCustom.cpp:

2013-06-05  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Remove remaining custom getters for WorkerContext constructor attributes
        https://bugs.webkit.org/show_bug.cgi?id=117247

        Reviewed by Kentaro Hara.

        Remove custom getter code for remaining constructor attribute on WorkerContext
        interface. The custom code wasn't needed as it was doing nothing more than the
        generated one. These constructor attributes are now automatically generated.

        No new tests, no behavior change.

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Modules/websockets/WebSocket.idl:
        * Modules/websockets/WorkerContextWebSocket.idl: Removed.
        * WebCore.order:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSWorkerContextCustom.cpp:
        * dom/MessageChannel.idl:
        * page/EventSource.idl:
        * workers/WorkerContext.idl:
        * xml/XMLHttpRequest.idl:

2013-06-05  Ryuan Choi  <ryuan.choi@samsung.com>

        Remove ChromeClient::deviceOrPageScaleFactorChanged
        https://bugs.webkit.org/show_bug.cgi?id=117245

        Reviewed by Andreas Kling.

        It was introduced for chromium at r147357.
        But now, there are no ports to use this.

        No new tests - no behavior change.

        * page/ChromeClient.h:
        * page/Frame.cpp:
        (WebCore::Frame::deviceOrPageScaleFactorChanged):

2013-06-05  Gwang Yoon Hwang  <ryumiel@company100.net>

        [Coordinated Graphics] Prevent a recursive painting in CoordinatedGraphicsLayer
        https://bugs.webkit.org/show_bug.cgi?id=117222

        Reviewed by Noam Rosenthal.

        CoordinatedGraphicsLayer::flushCompositingState() will cross frame
        boundaries if the GraphicsLayers are connected. In this case,
        updateContentBuffers will invoke a painting of a sub-frame that causes
        flushCompositingState recursively.

        To prevent this behavior this patch extracts updateContentBuffers from
        flushCompositingState, and places it in
        updateContentBuffersIncludeSublayers, which is another tree traveler for
        painting.

        No new tests, covered by existing tests.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):
        (WebCore::CoordinatedGraphicsLayer::syncPendingStateChangesIncludingSubLayers):
        (WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:

2013-06-05  Andreas Kling  <akling@apple.com>

        Fix some inefficiencies in AnimationController's composite animation map.
        <http://webkit.org/b/117248>

        Reviewed by Antti Koivisto.

        Clean up some small things that were showing up in a window resizing profile (0.4%)

        * page/animation/AnimationControllerPrivate.h:
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::ensureCompositeAnimation):

            Renamed this ensure* to conform to the WebKit Design Patterns, 2013 edition.
            Always do a single hash lookup instead of two.

        (WebCore::AnimationControllerPrivate::clear):

            Use RefPtr<T> for local variables, never PassRefPtr<T>. See WKDP, 2013 ed.

        (WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer):
        (WebCore::AnimationControllerPrivate::isRunningAnimationOnRenderer):
        (WebCore::AnimationControllerPrivate::isRunningAcceleratedAnimationOnRenderer):
        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):

            Peek into m_compositeAnimations through "const CompositeAnimation*" instead
            of using RefPtrs. There's no need to hold a reference on the animation while
            querying some const method on it.

        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
        (WebCore::AnimationController::updateAnimations):

            Poke into m_compositeAnimations through "CompositeAnimation*" instead of using
            RefPtrs. There's no need to hold a reference here either, we can modify the
            animations through a raw pointer.

2013-06-05  Roland Takacs  <rtakacs@inf.u-szeged.hu>

        Web Inspector: Clear button doesn't clean Memory graph in Overview pane.
        https://bugs.webkit.org/show_bug.cgi?id=112429

        Reviewed by Noam Rosenthal.

        There is an early return from TimelineMemoryOverview.update() when
        record array is empty. Thats why if you click onto the clear button,
        the canvas won't be updated.
        Moved this "return condition" after the canvas size definition
        because we need to know the canvas size for refreshing.
        Overridden TimelineOverviewBase's reset function to clear
        HeapSizeLabels' content.

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineMemoryOverview.prototype.reset):
        (WebInspector.TimelineMemoryOverview.prototype.update):

2013-06-05  Gwang Yoon Hwang  <ryumiel@company100.net>

        [Coordinated Graphics] Rename client classes for CoordinatedImageBacking and UpdateAtlas.
        https://bugs.webkit.org/show_bug.cgi?id=111948

        Reviewed by Noam Rosenthal.

        This patch renames CoordinatedImageBacking::Coordinator to
        CoordinatedImageBacking::Client, and UpdateAtlasClient to
        UpdateAtlas::Client for naming consistency and clarification.

        No new tests, covered by existing tests.

        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
        (WebCore::CoordinatedImageBacking::create):
        (WebCore::CoordinatedImageBacking::CoordinatedImageBacking):
        (WebCore::CoordinatedImageBacking::removeHost):
        (WebCore::CoordinatedImageBacking::update):
        (WebCore::CoordinatedImageBacking::clearContentsTimerFired):
        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.h:
        * platform/graphics/texmap/coordinated/UpdateAtlas.cpp:
        (WebCore::UpdateAtlas::UpdateAtlas):
        * platform/graphics/texmap/coordinated/UpdateAtlas.h:

2013-06-05  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        [Qt] Handle Return key without key text
        https://bugs.webkit.org/show_bug.cgi?id=117239

        Reviewed by Andreas Kling.

        Test added to tst_qwebpage.cpp.

        * platform/qt/PlatformKeyboardEventQt.cpp:
        (WebCore::keyTextForKeyEvent):

2013-06-05  Gwang Yoon Hwang  <ryumiel@company100.net>

        Coordinated Graphics: Unify messages related object's lifecycles into CoordinatedGraphicsState.
        https://bugs.webkit.org/show_bug.cgi?id=111919

        Reviewed by Noam Rosenthal.

        CoordinatedLayerTreeHostProxy has several methods, which simply passes
        these calls to CoordinatedGraphicsScene.

        This patch removes methods in CoordinatedLayerTreeHostProxy just for
        message chaining. Instead of that, messages for creation/deletion of objects
        (Layers, CustomFilters, UpdateAtlas, and ImageBacking) are unified into
        CommitCoordinatedGraphicsState.

        And this patch also removes codes for WebCoordinatedSurface in
        CoordinatedLayerTreeHost, except for a factory method.
        CoordinatedGraphicsArgumentCoders [en|de]codes CoordinatedSurface itself
        using WebCoordinatedSurface.

        No new tests, covered by existing tests.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
        (WebCore::CoordinatedGraphicsScene::syncCustomFilterPrograms):
        (WebCore::CoordinatedGraphicsScene::syncUpdateAtlases):
        (WebCore::CoordinatedGraphicsScene::syncImageBackings):
        (WebCore::CoordinatedGraphicsScene::commitSceneState):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.h:
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsState.h:
        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
        (WebCore::CoordinatedImageBacking::update):
        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.h:
        * platform/graphics/texmap/coordinated/UpdateAtlas.cpp:
        (WebCore::UpdateAtlas::UpdateAtlas):
        * platform/graphics/texmap/coordinated/UpdateAtlas.h:

2013-06-05  Andreas Kling  <akling@apple.com>

        Remove unnecessary null checks in SelectorChecker::checkOne().
        <http://webkit.org/b/117243>

        Reviewed by Antti Koivisto.

        This function was riddled with unnecessary null checks of 'element', despite ASSERT(element)
        being the first thing it does.

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):

2013-06-05  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Merge [NoInterfaceObject] and [OmitConstructor] extended attributes
        https://bugs.webkit.org/show_bug.cgi?id=115853

        Reviewed by Geoffrey Garen.

        Remove [OmitConstructor] extended attribute as it is overlapping with
        the standard [NoInterfaceObject] Web IDL extended attribute.

        Having [NoInterfaceObject] extended attribute on an interface now
        implies that its constructor is omitted (i.e. not generated).

        No new tests, no behavior change.

        * Modules/geolocation/Coordinates.idl:
        * Modules/geolocation/Geolocation.idl:
        * Modules/geolocation/Geoposition.idl:
        * Modules/notifications/Notification.idl:
        * Modules/notifications/NotificationCenter.idl:
        * Modules/quota/StorageInfo.idl:
        * Modules/quota/StorageQuota.idl:
        * Modules/webdatabase/Database.idl:
        * Modules/webdatabase/DatabaseSync.idl:
        * Modules/webdatabase/SQLError.idl:
        * Modules/webdatabase/SQLResultSet.idl:
        * Modules/webdatabase/SQLResultSetRowList.idl:
        * Modules/webdatabase/SQLTransaction.idl:
        * Modules/webdatabase/SQLTransactionSync.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateAttributesHashTable):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * css/CSSUnknownRule.idl:
        * css/MediaQueryListListener.idl:
        * dom/EventListener.idl:
        * dom/EventTarget.idl:
        * html/MicroDataItemValue.idl:
        * html/ValidityState.idl:
        * html/canvas/EXTDrawBuffers.idl:
        * html/canvas/EXTTextureFilterAnisotropic.idl:
        * html/canvas/OESElementIndexUint.idl:
        * html/canvas/OESStandardDerivatives.idl:
        * html/canvas/OESTextureFloat.idl:
        * html/canvas/OESTextureHalfFloat.idl:
        * html/canvas/OESVertexArrayObject.idl:
        * html/canvas/WebGLCompressedTextureATC.idl:
        * html/canvas/WebGLCompressedTexturePVRTC.idl:
        * html/canvas/WebGLCompressedTextureS3TC.idl:
        * html/canvas/WebGLContextAttributes.idl:
        * html/canvas/WebGLDebugRendererInfo.idl:
        * html/canvas/WebGLDebugShaders.idl:
        * html/canvas/WebGLDepthTexture.idl:
        * html/canvas/WebGLLoseContext.idl:
        * inspector/JavaScriptCallFrame.idl:
        * inspector/ScriptProfile.idl:
        * inspector/ScriptProfileNode.idl:
        * loader/appcache/DOMApplicationCache.idl:
        * page/AbstractView.idl:
        * page/Console.idl:
        * page/Crypto.idl:
        * page/PerformanceEntryList.idl:
        * page/WorkerNavigator.idl:
        * page/make_settings.pl:
        (generateInternalSettingsIdlFile):
        * svg/ElementTimeControl.idl:
        * svg/SVGAnimationElement.idl:
        * svg/SVGExternalResourcesRequired.idl:
        * svg/SVGFitToViewBox.idl:
        * svg/SVGLangSpace.idl:
        * svg/SVGLocatable.idl:
        * svg/SVGTests.idl:
        * svg/SVGTransformable.idl:
        * svg/SVGURIReference.idl:
        * testing/InternalSettings.idl:
        * testing/Internals.idl:
        * testing/MallocStatistics.idl:
        * testing/MemoryInfo.idl:
        * testing/TypeConversions.idl:
        * workers/DedicatedWorkerContext.idl:
        * workers/SharedWorkerContext.idl:
        * workers/WorkerContext.idl:
        * xml/XPathNSResolver.idl:

2013-06-05  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        [Qt] Font::shouldUseSmoothing() has fake dependency on Qt 5.1
        https://bugs.webkit.org/show_bug.cgi?id=117195

        Reviewed by Jocelyn Turcotte.

        Remove the fake dependency on Qt 5.1 so we may rebase the layout tests
        before switching to Qt 5.1

        * platform/graphics/qt/FontPlatformDataQt.cpp:
        (WebCore::FontPlatformData::FontPlatformData):

2013-06-05  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Respect renderer creation constraints when element is part of named flow
        https://bugs.webkit.org/show_bug.cgi?id=116790

        Reviewed by David Hyatt.

        Before adding a child to a named flow, we have to make sure that the rules for
        creation are properly checked.

        Test: fast/regions/br-content-node-crash.xhtml

        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::isChildAllowed):
        Call isChildAllowed on the original parent renderer, before reparenting to
        named flow.
        * rendering/RenderNamedFlowThread.h:

2013-06-05  Philippe Normand  <pnormand@igalia.com>

        Unreviewed, GStreamer 0.10 build fix after r151175.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
        (WebCore::MediaPlayerPrivateGStreamerBase::paint):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2013-06-05  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSS Regions] REGRESSION Incorrect layer clipping inside flow thread
        https://bugs.webkit.org/show_bug.cgi?id=117074

        Reviewed by David Hyatt.

        Function RenderBox::mapLocalToContainer was adapted for elements inside flow threads to convert
        elements coordinates to RenderView coordinates, passing through the region in which the elements
        were flowed (https://bugs.webkit.org/show_bug.cgi?id=66641).

        The fix for https://bugs.webkit.org/show_bug.cgi?id=76486 modified RenderLayer::calculateClipRects and replaced
        convertToLayerCoords with localToContainerPoint, which further calls mapLocalToContainer.

        However, for elements inside the flow thread, which acts as a root layer for its collected children, we do not want
        to get the offset in RenderView coordinates but rather in flow thread coordinates (and still take transforms into
        account). This patch modifies RenderBox::mapLocalToContainer so that it stops at flow thread boundary when the passed
        repaintContainer is the flow thread. The flow thread is the container for repaint for elements inside it, as seen from
        RenderObject::containerForRepaint.

        No new tests, converted overflow-size-change-with-stacking-context and overflow-size-change-with-stacking-context-rtl
        into ref tests so that the we do not rely on pixel tests in the future.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer):

2013-06-05  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Remove [NoInterfaceObject] from TreeWalker
        https://bugs.webkit.org/show_bug.cgi?id=117225

        Reviewed by Kentaro Hara.

        Remove [NoInterfaceObject] IDL extended attribute from TreeWalker interface
        to match Firefox's behavior and the specification:
        http://www.w3.org/TR/DOM-Level-2-Traversal-Range/traversal.html#Traversal-TreeWalker

        No new tests, already covered by existing tests.

        * dom/TreeWalker.idl:

2013-06-05  Zan Dobersek  <zdobersek@igalia.com>

        Move MemoryInfo under window.internals
        https://bugs.webkit.org/show_bug.cgi?id=117197

        Reviewed by Ryosuke Niwa.

        The MemoryInfo interface is not a subject of any specification and should not be exposed
        to the Web. It's still used by the performance tests so it is moved under the testing
        internals, accessible through window.internals.memoryInfo.

        The jsHeapSizeLimit attribute is removed from the MemoryInfo interface as that value was
        only usable when using the V8 bindings which are not supported anymore. A small fast/harness
        test is also provided to check that the MemoryInfo object is accessible through window.internals.

        Test: fast/harness/memoryinfo-object.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Target.pri:
        * UseJSC.cmake:
        * WebCore.exp.in:
        * WebCore.order:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/gobject/GNUmakefile.am: Remove the GObject bindings targets for MemoryInfo.
        * bindings/js/JSBindingsAllInOne.cpp: Remove the JSMemoryInfo.h and MemoryInfo.h inclusion.
        * bindings/js/JSMemoryInfoCustom.cpp: Removed.
        * bindings/js/ScriptGCEvent.cpp: Remove the ENABLE(INSPECTOR) guards.
        (WebCore::ScriptGCEvent::getHeapSize): Remove the jsHeapSizeLimit assignment.
        * bindings/js/ScriptGCEvent.h: Remove the ENABLE(INSPECTOR) guards.
        (WebCore::HeapInfo::HeapInfo): Remove the jsHeapSizeLimit member.
        * page/Console.cpp: Remove the Console::memory method.
        * page/Console.h: Ditto.
        * page/Console.idl: Remove the window.console.memory attribute.
        * page/MemoryInfo.cpp: Removed.
        * page/Performance.cpp: Remove the Performance::memory method.
        * page/Performance.h: Ditto.
        * page/Performance.idl: Remove the window.performance.memory attribute.
        * testing/Internals.cpp:
        (WebCore::Internals::memoryInfo): Return a MemoryInfo object upon invoking.
        * testing/Internals.h: Declare the Internals::memoryInfo method.
        * testing/Internals.idl: Expose the window.internals.memoryInfo operation.
        * testing/MemoryInfo.h: Renamed from Source/WebCore/page/MemoryInfo.h.
        (WebCore::MemoryInfo::create): Return a new RefPtr-wrapped MemoryInfo object.
        (WebCore::MemoryInfo::usedJSHeapSize): Return the value of the equally-named HeapInfo member.
        (WebCore::MemoryInfo::totalJSHeapSize): Ditto.
        (WebCore::MemoryInfo::MemoryInfo): Acquire the current heap info upon construction.
        * testing/MemoryInfo.idl: Renamed from Source/WebCore/page/MemoryInfo.idl.
        The jsHeapSizeLimit attribute is removed.

2013-06-04  Peter Gal  <galpeter@inf.u-szeged.hu>

        [curl] Headers should be parsed as utf8 if possible
        https://bugs.webkit.org/show_bug.cgi?id=117196

        Reviewed by Brent Fulgham.

        Testcase already present: http/tests/download/literal-utf-8.html

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::headerCallback): Parse the header as an utf8 string if possible.

2013-06-04  Oliver Hunt  <oliver@apple.com>

        Prevent throttling while resources are being loaded
        https://bugs.webkit.org/show_bug.cgi?id=117218

        Reviewed by Gavin Barraclough.

        Make use of the page activity assertion infrastructure to delay
        throttling while we are waiting on resource loads.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::completed):
        (WebCore::FrameLoader::started):
        * loader/FrameLoader.h:
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::init):
        (WebCore::SubresourceLoader::checkForHTTPStatusCodeError):
        (WebCore::SubresourceLoader::didFinishLoading):
        (WebCore::SubresourceLoader::didFail):
        (WebCore::SubresourceLoader::willCancel):
        * loader/SubresourceLoader.h:

2013-06-04  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Remove [NoInterfaceObject] from XPathExpression and NodeIterator
        https://bugs.webkit.org/show_bug.cgi?id=117204

        Reviewed by Alexey Proskuryakov.

        Remove [NoInterfaceObject] from XPathExpression and NodeIterator to match
        their respective specifications:
        - http://www.w3.org/TR/DOM-Level-3-XPath/xpath.html#XPathExpression
        - http://www.w3.org/TR/DOM-Level-2-Traversal-Range/traversal.html#Traversal-NodeIterator

        No new tests, already covered by:
        fast/js/global-constructors-attributes.html

        * dom/NodeIterator.idl:
        * xml/XPathExpression.idl:

2013-06-04  Chris Fleizach  <cfleizach@apple.com>

        AX: MathML multiscripts not exposed in Accessibility
        https://bugs.webkit.org/show_bug.cgi?id=115069

        Unreviewed, build fix.

        Remove an accessibility iOS method that was erroneously added.

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

2013-06-04  Greg Hughes  <ghughes@apple.com>

        Add "VisibleOnly" key to search predicate
        https://bugs.webkit.org/show_bug.cgi?id=115491

        Reviewed by Chris Fleizach.

        Added support for accessibility clients to use the search predicate to find only visible elements

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::isAccessibilityObjectSearchMatch):
        (WebCore::AccessibilityObject::isOnscreen):
        (WebCore):
        * accessibility/AccessibilityObject.h:
        (AccessibilitySearchCriteria):
        (WebCore::AccessibilitySearchCriteria::AccessibilitySearchCriteria):
        (AccessibilityObject):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

2013-06-04  Roger Fong  <roger_fong@apple.com>

        Unreviewed. Rollout of r151146. Broke some tests.

        * page/FrameView.cpp:
        (WebCore::FrameView::forceLayoutForPagination):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
        (WebCore::RenderBlock::layout):
        * rendering/RenderBlock.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::clearLayoutOverflow):
        * rendering/RenderBox.h:
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutBlock):

2013-06-04  Noam Rosenthal  <noam@webkit.org>

        Refactor the code that decides whether to enable WebGL from settings to helper functions
        https://bugs.webkit.org/show_bug.cgi?id=117181

        This removes some #ifdef crud out of the getContext() function.

        Reviewed by Benjamin Poulain.

        * html/HTMLCanvasElement.cpp:
        (WebCore::requiresAcceleratedCompositingForWebGL):
        (WebCore::shouldEnableWebGL):
        (WebCore::HTMLCanvasElement::getContext):

2013-06-04  Thiago Santos  <thiago.sousa.santos@collabora.com>

        Prevent race when pad caps is set on gstreamer player
        https://bugs.webkit.org/show_bug.cgi?id=115355

        Reviewed by Philippe Normand.

        Prevent race when pad caps is set on gstreamer player and
        Also protect internal paint buffer with a mutex.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
        (WebCore::MediaPlayerPrivateGStreamerBase::paint):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        (MediaPlayerPrivateGStreamerBase):

2013-06-04  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>

        [Qt] Fix a crash in QtPixmapRuntime.
        https://bugs.webkit.org/show_bug.cgi?id=117193
        https://bugreports.qt-project.org/browse/QTBUG-30736

        Reviewed by Allan Sandfeld Jensen.

        The crash could only be reproduced in release builds on Windows.
        JSClassCreate calculates the size of JSClassDefinition.staticValues
        and staticFunctions by iterating until an entry with a null name is found.

        * bridge/qt/qt_pixmapruntime.cpp:
        (JSC::Bindings::QtPixmapRuntime::getClassRef):

2013-06-04  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Automatically generate WorkerContext constructor attributes
        https://bugs.webkit.org/show_bug.cgi?id=117183

        Reviewed by Kentaro Hara.

        Add [GlobalContext=WindowOnly|WorkerOnly|WindowAndWorker] IDL extended attribute
        to indicate to the bindings generator on which global context the constructor
        attribute should be generated for interfaces without [NoInterfaceObject]:
        - WindowOnly: only on the global Window object (default if ommitted)
        - WorkerOnly: only on the worker context
        - WindowAndWorker: On both the global Window object and the worker context

        This covers all the current use cases.

        The JSC bindings generator now automatically generates the Constructor attributes
        on the WorkerContext for non-callback interfaces which do not have the
        [NoInterfaceObject] extended attribute but have [GlobalContext=WorkerOnly|WindowAndWorker]
        extended attribute.

        No new tests, already covered by:
        fast/js/global-constructors-attributes.html
        fast/js/global-constructors-attributes-worker.html

        * CMakeLists.txt:
        * DerivedSources.make: Pass new --workerContextConstructorsFile argument to preprocess-idls.pl.
        * DerivedSources.pri: Ditto.
        * GNUmakefile.am: Ditto.
        * PlatformBlackBerry.cmake: Ditto.
        * UseJSC.cmake: Ditto.
        * bindings/scripts/IDLAttributes.txt: Add [GlobalContext=WindowOnly|WorkerOnly|WindowAndWorker]
        IDL extended attribute.
        * bindings/scripts/preprocess-idls.pl: Add support for [GlobalContext] extended attribute and
        generate a partial interface for WorkerContext global constructors that are automatically
        generated.
        * dom/MessageEvent.idl: Add [GlobalContext=WindowAndWorker].
        * fileapi/Blob.idl: Add [GlobalContext=WindowAndWorker].
        * fileapi/FileReader.idl: Add [GlobalContext=WindowAndWorker].
        * fileapi/FileReaderSync.idl: Add [GlobalContext=WorkerOnly] and remove [NoInterfaceObject]
        as the interface should only be visible in worker environment as per the spec.
        * html/DOMURL.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/ArrayBuffer.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/DataView.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Float32Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Float64Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Int16Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Int32Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Int8Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Uint16Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Uint32Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Uint8Array.idl: Add [GlobalContext=WindowAndWorker].
        * html/canvas/Uint8ClampedArray.idl: Add [GlobalContext=WindowAndWorker].
        * workers/WorkerContext.idl: Remove several Constructor attributes which are now automatically
        generated.
        * workers/WorkerLocation.idl: Add [GlobalContext=WorkerOnly] and remove [NoInterfaceObject]
        as the interface should only be visible in worker environment as per the spec.

2013-06-04  Kangil Han  <kangil.han@samsung.com>

        Use ASSERT_DISABLED option for assertion purpose code in InlineBox
        https://bugs.webkit.org/show_bug.cgi?id=117146

        Reviewed by Alexey Proskuryakov.

        We can distinguish assertion code with debug purpose by using ASSERT_DISABLED option.

        * rendering/InlineBox.cpp:
        (WebCore::InlineBox::~InlineBox):
        (WebCore::InlineBox::destroy):
        (WebCore::InlineBox::operator delete):
        * rendering/InlineBox.h:
        (WebCore::InlineBox::InlineBox):

2013-06-04  Kent Tamura  <tkent@chromium.org>

        Fix an assertion failure in Range::textNodeSplit by Text::splitText
        https://bugs.webkit.org/show_bug.cgi?id=116509

        Reviewed by Ryosuke Niwa.

        Range::textNodeSplit is called in Text::splitText, and it assumes the
        next sibling node is still a Text node. A DOM mutation event handler can
        break this assumption.

        We had better postpone DOM mutation events dispatched in Node::insertBefore
        until exiting splitText to avoid inconsistent Range state.

        This imports http://src.chromium.org/viewvc/blink?view=revision&revision=150493 .

        Test: fast/dom/Range/split-text-in-range.html

        * dom/Text.cpp:
        (WebCore::Text::splitText): Add EventQueueScope.

2013-06-03  Kangil Han  <kangil.han@samsung.com>

        Remove unused arithmetic operation in RenderListItem
        https://bugs.webkit.org/show_bug.cgi?id=117175

        Reviewed by Brent Fulgham.

        Variable 'markerLogicalLeft' is reassigned a value before the old one has been used.

        * rendering/RenderListItem.cpp:
        (WebCore::RenderListItem::positionListMarker):

2013-06-03  Roger Fong  <roger_fong@apple.com>

        Unreviewed. Some AppleWin VS2010 house cleaning.

        * WebCore.vcxproj/build-generated-files.sh:

2013-06-03  Roger Fong  <roger_fong@apple.com>

        clearLayoutOverflow should never be called before calling layer()->updateScrollInfoAfterLayout().
        https://bugs.webkit.org/show_bug.cgi?id=116689.

        Reviewed by Ojan Vafai.

        Make sure that clearLayoutOverflow only gets called after layer()->updateScrollInfoAfterLayout().
        Also move clearLayoutOverflow to RenderBlock so we can keep all the delayed scroll update logic together.

        Test: fast/flexbox/clear-overflow-before-scroll-update.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layout): Remove call to clearLayoutOverflow.
        (WebCore::RenderBlock::finishDelayUpdateScrollInfo): Add call to clearLayoutOverflow.
        (WebCore::RenderBlock::updateScrollInfoAfterLayout): Ditto.
        (WebCore::RenderBlock::clearLayoutOverflow): ASSERT(!gDelayUpdateScrollInfo) and move from RenderBox to RenderBlock to keep delayed scroll update logic together.
        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderBox.cpp:
        * rendering/RenderBox.h:
        (WebCore::RenderBox::layoutOverflowRect): Remove from layoutOverflowRect.
        (RenderBox): 
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock): This should call updateScrollInfoAfterLayout() intead of directly calling layer()->updateScrollInfoAfterLayout().
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutBlock): Ditto.

2013-05-31  Anders Carlsson  <andersca@apple.com>

        Take the normal NSView code path when drawing into an inclusive layer
        https://bugs.webkit.org/show_bug.cgi?id=117094
        <rdar://problem/13812355>

        Reviewed by Sam Weinig.

        For now, take the normal code path when drawing into an inclusive layer.

        * platform/mac/WidgetMac.mm:
        (WebCore::Widget::paint):

2013-05-31  Tiancheng Jiang  <tijiang@rim.com>

        [BlackBerry] Update Button UX.
        https://bugs.webkit.org/show_bug.cgi?id=116992

        Reviewed by Rob Buis.

        BlackBerry PR 342298.
        Internally Review by Jeff Rogers.

        * css/themeBlackBerry.css:

2013-05-31  David Kilzer  <ddkilzer@apple.com>

        DerivedSources.make: any rules that use $(FEATURE_DEFINES) should be rebuilt when FeatureDefines.xcconfig changes
        <http://webkit.org/b/117081>

        Reviewed by Mark Rowe.

        * DerivedSources.make: Add $(PLATFORM_FEATURE_DEFINES)
        dependency for all rules that use $(FEATURE_DEFINES) to generate
        files.
        (PLATFORM_FEATURE_DEFINES): Set this variable to
        Configurations/FeatureDefines.xcconfig if not already set on
        Mac OS X.

2013-05-31  Tiancheng Jiang  <tijiang@rim.com>

        Text Field UX updates.
        https://bugs.webkit.org/show_bug.cgi?id=116996

        Reviewed by Rob Buis.

        BlackBerry PR 342333.
        Internally Reviewed by Jeff Rogers.

        Update disabled text field font color.

        * css/themeBlackBerry.css:

2013-05-31  Dean Jackson  <dino@apple.com>

        Update CheckedInt.h to latest version from Mozilla
        https://bugs.webkit.org/show_bug.cgi?id=117009

        Reviewed by Darin Adler.

        Mozilla have updated their version of CheckedInt and suggested
        we sync. Here are the improvements:

        - CheckedInt now consistently rejects unsupported types. Before, you
        could sometimes construct a CheckedInt from an unsupported type (like,
        float) or multiply a CheckedInt by a float, and have it not caught! See
        https://bugzilla.mozilla.org/show_bug.cgi?id=869194
         - Fixed a possibility of undefined behavior in unary operator-. See bug
        https://bugzilla.mozilla.org/show_bug.cgi?id=849666
         - CheckedInt now supports the "long long" and "unsigned long long"
        types. We don't like "long long" (and neither does the Google C++ style
        guide!) but we had to do that because libogg exposes typedefs to those
        types. See Bug https://bugzilla.mozilla.org/show_bug.cgi?id=869685
         - CheckedInt also now supports "signed char" in addition to "char" ---
        they are not the same type! See Bug https://bugzilla.mozilla.org/show_bug.cgi?id=847521
         - Fixed and simplified usage of CheckedInt outside of Mozilla. You'll
        like this one! See Bug https://bugzilla.mozilla.org/show_bug.cgi?id=849667
         - Fixed compilation with the Intel C++ compiler. See bug https://bugzilla.mozilla.org/show_bug.cgi?id=784309

        * html/canvas/CheckedInt.h: Updated.

2013-05-31  Andre Moreira Magalhaes   <andre.magalhaes@collabora.co.uk>

        Make sure gstreamer source element is thread-safe
        https://bugs.webkit.org/show_bug.cgi?id=115352

        Reviewed by Philippe Normand.

        GStreamer source element may be created by any gstreamer element on any thread by calling
        gst_element_make_from_uri with the URIs handled by the source element.
        This patch makes sure the gstreamer source element is thread-safe to avoid issues with it
        being created outside the main thread.

        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (_WebKitWebSrcPrivate):
        (webkit_web_src_init):
        (webKitWebSrcFinalize):
        (webKitWebSrcSetProperty):
        (webKitWebSrcGetProperty):
        (webKitWebSrcStop):
        (webKitWebSrcStart):
        (webKitWebSrcChangeState):
        (webKitWebSrcQueryWithParent):
        (webKitWebSrcGetUri):
        (webKitWebSrcSetUri):
        (webKitWebSrcNeedDataMainCb):
        (webKitWebSrcEnoughDataMainCb):
        (webKitWebSrcSeekMainCb):
        (webKitWebSrcSeekDataCb):
        (webKitWebSrcSetMediaPlayer):
        (StreamingClient::StreamingClient):
        (StreamingClient::~StreamingClient):
        (StreamingClient::didReceiveResponse):
        (StreamingClient::didReceiveData):
        (StreamingClient::didFinishLoading):
        (StreamingClient::wasBlocked):
        (StreamingClient::cannotShowURL):

2013-05-31  Sergio Villar Senin  <svillar@igalia.com>

        Build fix when CSSParser debugging is enabled
        https://bugs.webkit.org/show_bug.cgi?id=117075

        Reviewed by Andreas Kling.

        Build fails when enabling parser debugging by setting YYDEBUG to
        1 because of a missing include.

        * css/CSSGrammar.y.includes:

2013-05-31  Alberto Garcia  <agarcia@igalia.com>

        [Soup] [Gstreamer] ASSERT in StreamingClient::getOrCreateReadBuffer
        https://bugs.webkit.org/show_bug.cgi?id=116686

        Reviewed by Carlos Garcia Campos.

        We were using g_input_stream_read_async() to handle redirections
        because of Gnome bug #691489.

        This produces an unexpected read attempt which triggers an assert
        in StreamingClient::getOrCreateReadBuffer().

        Now that the Gnome bug is fixed we can replace read_async() with
        skip_async().

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::ResourceHandle::ensureReadBuffer):
        (WebCore::redirectSkipCallback):
        (WebCore::sendRequestCallback):

2013-05-30  Eugene Klyuchnikov  <eustas@chromium.org>

        selectionStart/selectionEnd return "obsolete" values when requested during "input" event
        https://bugs.webkit.org/show_bug.cgi?id=110742

        Reviewed by Ryosuke Niwa.

        This patch defers firing "webkitEditableContentChanged" until new
        selection is applied to control. This makes selection during "input"
        more consistent and reliable.

        Background: "input" event is fired by "webkitEditableContentChanged"
        dispatcher. But "input" is scoped event, so under some conditions its
        dispatching may be deferred. When "input" dispatching is deferred,
        dispatcher observes updated selectionStart and selectionEnd.
        Otherwise values repersent state before applying editing command.

        So, to make selectionStart/End to be more predictable and useful, we
        need either always dispatch "input" before selection is updated, or
        always dispatch "input" after selection is updated.

        As it was mentioned, dispatching could be deferred by scoping. So
        dispatching before updating selection couldn't be guaranteed.
        Moreover, it will be hard to calculate updated selection in user
        code. On the other side - old selection could be easily tracked.

        So, it looks logically that we should guarantee dispatching "input"
        after updating selection. There are no execution paths in
        "webkitEditableContentChanged" dispatched that depends on current
        selection. So it is safe to fire this event after selection is updated.

        Test: editing/selection/caret-after-keypress.html

        * editing/Editor.cpp:
        Dispatch "input" event after new selection in applied.

2013-05-30  Ruth Fong  <ruth_fong@apple.com>

        WebKit's Enter Full Screen for <video> elements isn't working
        https://bugs.webkit.org/show_bug.cgi?id=117001

        Reviewed by Jer Noble.

        Fix workflow to allow a video to enter into full screen
        mode from a kWKContextMenuItemTagEnterVideoFullscreen 
        context menu item by denoting the enterFullscreenForVideo
        call as a user gesture, so Document::requestFullScreenForElement
        will execute correctly.

        No new tests. Covered by media/context-menu-actions.html,
        which is disabled due to bug #116651.

        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::enterFullscreenForVideo):

2013-05-30  Rafael Brandao  <rafael.lobo@openbossa.org>

        Fix double hash lookup in RenderTableSection::paintObject loop
        https://bugs.webkit.org/show_bug.cgi?id=117055

        Reviewed by Antonio Gomes.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paintObject):

2013-05-31  Stephanie Lewis  <slewis@apple.com>

        Update low memory handler to use new memory pressure notifications on new OS versions.
        <rdar://problem/14027095>

        Reviewed by Mark Rowe.

        No change in functionality.

        * WebCore.exp.in:
        * platform/mac/MemoryPressureHandlerMac.mm:
        (WebCore::MemoryPressureHandler::install): Call new API
        * platform/mac/WebCoreSystemInterface.h: 
        * platform/mac/WebCoreSystemInterface.mm:

2013-05-30  Rafael Brandao  <rafael.lobo@openbossa.org>

        Fix double hash lookup in WebSocket::connect loop
        https://bugs.webkit.org/show_bug.cgi?id=117052

        Reviewed by Anders Carlsson.

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):

2013-05-30  Benjamin Poulain  <bpoulain@apple.com>

        Remove some 16bits conversion.
        https://bugs.webkit.org/show_bug.cgi?id=116935

        Reviewed by Darin Adler.

        Merge chromium ce35a544d09e6cb907457535340eb0e9984e57b8.
        https://chromium.googlesource.com/chromium/blink/+/ce35a544d09e6cb907457535340eb0e9984e57b8

        * html/parser/InputStreamPreprocessor.h:
        * platform/FileSystem.cpp:
        (WebCore::encodeForFileName):

2013-05-30  Anders Carlsson  <andersca@apple.com>

        REGRESSION (r119759): Adobe Flash Player "smaller" installer relies on the incorrect firing of a load event and needs an app-specific hack for compatibility
        https://bugs.webkit.org/show_bug.cgi?id=117042
        <rdar://problem/13916291>

        Reviewed by Mark Rowe.

        Ignore HTTP errors for scripts requested from within the installer. Instead of just checking for the
        Adobe Flash installer, we use the "com.solidstatenetworks.awkhost" bundle identifier to determine
        whether to apply the workaround. This could in theory fix other installers that use the same mechanism.

        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::shouldIgnoreHTTPStatusCodeErrors):
        * loader/cache/CachedScript.h:
        * platform/RuntimeApplicationChecks.cpp:
        (WebCore::applicationIsSolidStateNetworksDownloader):
        * platform/RuntimeApplicationChecks.h:

2013-05-30  Sergio Villar Senin  <svillar@igalia.com>

        Allow no space between "background-position:" dimensions
        https://bugs.webkit.org/show_bug.cgi?id=116870

        Reviewed by Darin Adler.

        From Blink r149314 by <ericwilligers@chromium.org>

        Specs allow no spaces between the dimensions of a
        "background-position:" like "1px+1px", we should support
        that.

        Whitespaces are no longer early consumed, dramatically dropping
        the shift/reduce conflicts to half. The productions unary_term,
        calc_func_term, calc_func_expr and calc_func_paren_expr no longer
        consume whitespaces.

        * css/CSSGrammar.y.in:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::realLex):

2013-05-30  Jer Noble  <jer.noble@apple.com>

        HTMLMediaElement will not unthrottle page when playback stops for nreasons other than user-initiated pause.
        https://bugs.webkit.org/show_bug.cgi?id=117016

        Reviewed by Oliver Hunt.

        Add a new class PageActivityAssertionToken to allow HTMLMediaElement to decouple
        knowledge of and control over the lifetime of PageThrottler. The new class will
        have weak references to and from the PageThrottler so that holders of the token
        will not need to care if the Page or PageThrottler has been destroyed. 

        HTMLMediaElement will create one of these PageActivityAssertionTokens when playback
        begins and destroy it when playback stops for any reason, or when the element is
        destroyed.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        (WebCore::HTMLMediaElement::playInternal):
        (WebCore::HTMLMediaElement::pauseInternal):
        (WebCore::HTMLMediaElement::playbackProgressTimerFired):
        (WebCore::HTMLMediaElement::updatePlayState):
        * html/HTMLMediaElement.h:
        * page/Page.cpp:
        (WebCore::createActivityToken): Added simple factory method.
        * page/Page.h:
        * page/PageActivityAssertionToken.cpp: 
        (WebCore::PageActivityAssertionToken::PageActivityAssertionToken): Call addActivityToken();
        (WebCore::PageActivityAssertionToken::~PageActivityAssertionToken): Call removeActivityToken();
        (WebCore::PageActivityAssertionToken::invalidate): Clear m_throttler.
        * page/PageActivityAssertionToken.h:
        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::~PageThrottler): Invalidate all outstanding tokens.
        (WebCore::PageThrottler::addActivityToken): Bump the activity count.
        (WebCore::PageThrottler::removeActivityToken): Lower the activity count.
        * page/PageThrottler.h:

        Add the new files to the various build systems:
        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:

2013-05-29  Jeffrey Pfau  <jpfau@apple.com>

        [Mac] Enable cache partitioning and the public suffix list on 10.8
        <rdar://problem/13679019>

        Rubber-stamped by David Kilzer.

        * Configurations/FeatureDefines.xcconfig:

2013-05-30  Andreas Kling  <akling@apple.com>

        Fix double hash lookup in DocumentEventQueue::cancelEvent().
        <http://webkit.org/b/117031>

        Reviewed by Anders Carlsson.

        * dom/DocumentEventQueue.cpp:
        (WebCore::DocumentEventQueue::cancelEvent):

2013-05-30  Andreas Kling  <akling@apple.com>

        Fix double hash lookup in DocumentLoader::removeSubresourceLoader().
        <http://webkit.org/b/117030>

        Reviewed by Anders Carlsson.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::removeSubresourceLoader):

2013-05-30  Andreas Kling  <akling@apple.com>

        Fix double hash lookup in RenderView::repaintSelection() loop.
        <http://webkit.org/b/117029>

        Reviewed by Anders Carlsson.

        * rendering/RenderView.cpp:
        (WebCore::RenderView::repaintSelection):

2013-05-30  Peter Gal  <galpeter@inf.u-szeged.hu>

        CURL: Incorrect stripping of query from file URL
        https://bugs.webkit.org/show_bug.cgi?id=104307

        Reviewed by Darin Adler.

        Clear the query part of the file URL if there is any.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::initializeHandle):

2013-05-30  Antti Koivisto  <antti@apple.com>

        Separate generic font family settings to a class
        https://bugs.webkit.org/show_bug.cgi?id=117027

        Reviewed by Andreas Kling.

        The new class is under platform/ and can be accessed by the font code directly without platform violations.

        * WebCore.xcodeproj/project.pbxproj:
        * page/Settings.cpp:
        (WebCore::invalidateAfterGenericFamilyChange):
        (WebCore::Settings::Settings):
        (WebCore::Settings::~Settings):
        (WebCore::Settings::create):
        (WebCore::Settings::standardFontFamily):
        (WebCore::Settings::setStandardFontFamily):
        (WebCore::Settings::fixedFontFamily):
        (WebCore::Settings::setFixedFontFamily):
        (WebCore::Settings::serifFontFamily):
        (WebCore::Settings::setSerifFontFamily):
        (WebCore::Settings::sansSerifFontFamily):
        (WebCore::Settings::setSansSerifFontFamily):
        (WebCore::Settings::cursiveFontFamily):
        (WebCore::Settings::setCursiveFontFamily):
        (WebCore::Settings::fantasyFontFamily):
        (WebCore::Settings::setFantasyFontFamily):
        (WebCore::Settings::pictographFontFamily):
        (WebCore::Settings::setPictographFontFamily):
        * page/Settings.h:
        * platform/graphics/FontGenericFamilies.cpp: Added.
        (WebCore::setGenericFontFamilyForScript):
        (WebCore::genericFontFamilyForScript):
        (WebCore::FontGenericFamilies::FontGenericFamilies):
        (WebCore::FontGenericFamilies::standardFontFamily):
        (WebCore::FontGenericFamilies::fixedFontFamily):
        (WebCore::FontGenericFamilies::serifFontFamily):
        (WebCore::FontGenericFamilies::sansSerifFontFamily):
        (WebCore::FontGenericFamilies::cursiveFontFamily):
        (WebCore::FontGenericFamilies::fantasyFontFamily):
        (WebCore::FontGenericFamilies::pictographFontFamily):
        (WebCore::FontGenericFamilies::setStandardFontFamily):
        (WebCore::FontGenericFamilies::setFixedFontFamily):
        (WebCore::FontGenericFamilies::setSerifFontFamily):
        (WebCore::FontGenericFamilies::setSansSerifFontFamily):
        (WebCore::FontGenericFamilies::setCursiveFontFamily):
        (WebCore::FontGenericFamilies::setFantasyFontFamily):
        (WebCore::FontGenericFamilies::setPictographFontFamily):
        * platform/graphics/FontGenericFamilies.h: Added.
        (WebCore::UScriptCodeHashTraits::emptyValue):
        (WebCore::UScriptCodeHashTraits::constructDeletedValue):
        (WebCore::UScriptCodeHashTraits::isDeletedValue):
        (WebCore::FontGenericFamilies::create):

2013-05-30  Andreas Kling  <akling@apple.com>

        Avoid using CSSOM style declarations in HTML editing.
        <http://webkit.org/b/117019>

        Reviewed by Antti Koivisto.

        Convert the editing code to use ComputedStyleExtractor instead of instantiating CSSOM wrappers.

        * css/CSSComputedStyleDeclaration.h:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
        (WebCore::ComputedStyleExtractor::useFixedFontDefaultSize):
        (WebCore::ComputedStyleExtractor::propertyMatches):
        (WebCore::ComputedStyleExtractor::copyProperties):
        (WebCore::ComputedStyleExtractor::copyPropertiesInSet):

            Moved here from CSSComputedStyleDeclaration. These methods are used by HTML editing.

        (WebCore::CSSComputedStyleDeclaration::copyProperties):

            Reimplemented to call ComputedStyleExtractor.

        * css/CSSStyleDeclaration.h:
        * css/PropertySetCSSStyleDeclaration.h:
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::copyProperties):

            Removed CSSStyleDeclaration::cssPropertyMatches(), the remaining code lives in
            ComputedStyleExtractor::propertyMatches() and is only used by HTML editing.

        * css/StylePropertySet.h:
        * css/StylePropertySet.cpp:
        (WebCore::MutableStylePropertySet::removeEquivalentProperties):

            Added an overload that takes a ComputedStyleExtractor.
            This code should move into EditingStyle.cpp, material for a follow-up patch.

        * editing/ApplyStyleCommand.cpp:
        (WebCore::toIdentifier):

            Add a file-local helper for yanking the identifier value (if any) out of a CSSPrimitiveValue.

        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
        (WebCore::highestEmbeddingAncestor):
        * editing/EditingStyle.h:
        * editing/EditingStyle.cpp:
        (WebCore::editingStyleFromComputedStyle):
        (WebCore::extractPropertyValue):
        (WebCore::identifierForStyleProperty):
        (WebCore::textColorFromStyle):
        (WebCore::backgroundColorFromStyle):
        (WebCore::EditingStyle::init):
        (WebCore::EditingStyle::removeStyleAddedByNode):
        (WebCore::EditingStyle::removeStyleConflictingWithStyleOfNode):
        (WebCore::EditingStyle::triStateOfStyle):
        (WebCore::EditingStyle::styleIsPresentInComputedStyleOfNode):
        (WebCore::EditingStyle::removeStyleFromRulesAndContext):
        (WebCore::StyleChange::StyleChange):
        (WebCore::fontWeightIsBold):
        (WebCore::extractPropertiesNotIn):
        (WebCore::getPropertiesNotIn):

            Use ComputedStyleExtractor instead of CSSComputedStyleDeclaration in all of this code.
            Templatized a bunch of the code so we don't have to repeat ourselves for both StylePropertySet
            and ComputedStyleExtractor inputs.

2013-05-30  Roland Takacs  <rtakacs@inf.u-szeged.hu>

        Remove "hidden"=true from Inspector.json
        https://bugs.webkit.org/show_bug.cgi?id=114116

        Reviewed by Timothy Hatcher.

        Remove "hidden"=true because it's a Chromium concept.
        Patch created by Timothy Hatcher.

        * inspector/Inspector.json:

2013-05-30  Kondapally Kalyan  <kalyan.kondapally@intel.com>

        [EFL][EGL] Implement TransportSurface client.
        https://bugs.webkit.org/show_bug.cgi?id=114122

        Reviewed by Kenneth Rohde Christiansen.

        Covered by existing WebGL tests.

        This patch implements the client support for Transport
        Surface with EGL backend using GLES2.

        * platform/graphics/surfaces/efl/GLTransportSurface.cpp:
        (WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):
        (WebCore::GLTransportSurfaceClient::GLTransportSurfaceClient):
        * platform/graphics/surfaces/efl/GLTransportSurface.h:
        (GLTransportSurfaceClient):
        * platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
        (WebCore::GraphicsSurfacePrivate::initializeClient):
        * platform/graphics/surfaces/egl/EGLConfigSelector.cpp:
        (WebCore):
        (WebCore::EGLConfigSelector::surfaceClientConfig):
        (WebCore::EGLConfigSelector::findMatchingConfigWithVisualId):
        * platform/graphics/surfaces/egl/EGLConfigSelector.h:
        (WebCore):
        (EGLConfigSelector):

        Support for retrieving valid EGLConfig on client side.

        * platform/graphics/surfaces/egl/EGLHelper.cpp:
        (WebCore):
        (WebCore::resolveDisplay):
        (WebCore::EGLHelper::resolveEGLBindings):
        (WebCore::EGLHelper::createEGLImage):
        (WebCore::EGLHelper::destroyEGLImage):
        (WebCore::EGLHelper::imageTargetTexture2DOES):
        * platform/graphics/surfaces/egl/EGLHelper.h:

        Helper functions to create and destroy EGLImage.

        * platform/graphics/surfaces/egl/EGLXSurface.cpp:
        (WebCore::EGLXTransportSurfaceClient::EGLXTransportSurfaceClient):
        (WebCore):
        (WebCore::EGLXTransportSurfaceClient::~EGLXTransportSurfaceClient):
        (WebCore::EGLXTransportSurfaceClient::destroy):
        (WebCore::EGLXTransportSurfaceClient::prepareTexture):
        (WebCore::EGLTextureFromPixmap::EGLTextureFromPixmap):
        (WebCore::EGLTextureFromPixmap::~EGLTextureFromPixmap):
        (WebCore::EGLTextureFromPixmap::destroy):
        (WebCore::EGLTextureFromPixmap::isValid):
        (WebCore::EGLTextureFromPixmap::bindTexImage):
        (WebCore::EGLTextureFromPixmap::reBindTexImage):
        * platform/graphics/surfaces/egl/EGLXSurface.h:
        (EGLXTransportSurfaceClient):

        TransportSurfaceClient implementation.

        (WebCore):
        * platform/graphics/surfaces/glx/GLXSurface.cpp:
        (WebCore::GLXTransportSurfaceClient::GLXTransportSurfaceClient):
        * platform/graphics/surfaces/glx/GLXSurface.h:
        (GLXTransportSurfaceClient):
        * platform/graphics/surfaces/glx/X11Helper.cpp:
        (WebCore::X11Helper::createOffScreenWindow):
        (WebCore):
        (WebCore::X11Helper::createPixmap):
        * platform/graphics/surfaces/glx/X11Helper.h:
        (X11Helper):

2013-05-30  Mike West  <mkwst@chromium.org>

        Rename 'KURL::elidedString' and inspector's 'String.prototype.trimMiddle' for clarity.
        https://bugs.webkit.org/show_bug.cgi?id=111700

        Reviewed by Darin Adler.

        Darin suggested that 'KURL::elidedString' is inaccurately named[1], this
        patch is an attempt to do better. It additionally brings the Inspector's
        'String.prototype.trimMiddle' method into line, as the two methods do
        more or less the same thing.

        After a bit of discussion with Maciej and Daniel Bates on IRC, I've
        settled on 'KURL::stringCenterEllipsizedToLength(unsigned)' and
        'String.prototype.centerEllipsizedToLength(number)' respectively.

        No new tests are added, as this patch shouldn't have any visible effect
        on the web. It's strictly an internal refactoring.

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        (WebCore::WebSocket::send):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::send):
        (WebCore::WebSocketChannel::fail):
        * bindings/ScriptControllerBase.cpp:
        (WebCore::ScriptController::canExecuteScripts):
        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv):
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::executeScript):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::canPlayType):
        (WebCore::HTMLMediaElement::isSafeToLoadURL):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::submitForm):
        (WebCore::FrameLoader::loadFrameRequest):
        (WebCore::FrameLoader::commitProvisionalLoad):
        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions):
        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
        (WebCore::createWindow):
        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::willSendRequest):
        (WebCore::MainResourceLoader::responseReceived):
        * loader/MixedContentChecker.cpp:
        (WebCore::MixedContentChecker::logWarning):
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::didReceiveResponse):
        (WebCore::ApplicationCacheGroup::didFail):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::canRequest):
        (WebCore::CachedResourceLoader::requestResource):
        (WebCore::CachedResourceLoader::loadResource):
        (WebCore::CachedResourceLoader::printAccessDeniedMessage):
        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
        (WebCore::CSPDirectiveList::allowScriptNonce):
        (WebCore::CSPDirectiveList::allowPluginType):
        * platform/KURL.cpp:
        (WebCore::KURL::stringCenterEllipsizedToLength):
        * platform/KURL.h:
            Rename 'KURL::elidedString' to 'KURL::stringCenterEllipsizedToLength',
            and adjust callsites accordingly.
        * inspector/front-end/CallStackSidebarPane.js:
        (WebInspector.CallStackSidebarPane.Placard.prototype._update):
        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype._buildAttributeDOM):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGenericObjectNode.prototype.shortenWindowURL):
        * inspector/front-end/Linkifier.js:
        (WebInspector.Linkifier.DefaultFormatter.prototype.formatLiveAnchor):
        * inspector/front-end/ResourceUtils.js:
        (WebInspector.linkifyURLAsNode):
        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer.prototype._titleForFile):
        * inspector/front-end/utilities.js:
            Rename 'String.prototype.trimMiddle' to 'String.prototype.centerEllipsizedToLength'
            and adjust callsites accordingly.

2013-05-30  Antti Koivisto  <antti@apple.com>

        Rename FontFallbackList.cpp/h to FontGlyphs.cpp/h
        https://bugs.webkit.org/show_bug.cgi?id=117022

        Reviewed by Andreas Kling.

        Rename to match the class name.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/Font.h:
        * platform/graphics/FontCache.cpp:
        * platform/graphics/FontFallbackList.cpp: Removed.
        * platform/graphics/FontFallbackList.h: Removed.
        * platform/graphics/FontFastPath.cpp:
        * platform/graphics/FontGlyphs.cpp: Copied from Source/WebCore/platform/graphics/FontFallbackList.cpp.
        * platform/graphics/FontGlyphs.h: Copied from Source/WebCore/platform/graphics/FontFallbackList.h.
        * platform/graphics/mac/FontComplexTextMac.cpp:

2013-05-30  Ryosuke Niwa  <rniwa@webkit.org>

        Get rid of Position::computedStyle
        https://bugs.webkit.org/show_bug.cgi?id=117024

        Reviewed by Andreas Kling.

        Removed the function.

        * dom/Position.cpp:
        * dom/Position.h:
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::positionToComputeInlineStyleChange): We need a position
        inside the dummy element since we'll get the containing element's style instead
        if we had the position before the dummy element.
        * editing/EditingStyle.cpp:
        (WebCore::StyleChange::StyleChange):

2013-05-30  Seokju Kwon  <seokju.kwon@gmail.com>

        Remove obsolete forward declaration from InspectorFrontendHost.h
        https://bugs.webkit.org/show_bug.cgi?id=117017

        Reviewed by Joseph Pecoraro.

        Remove obsolete forward declaration and fix style issue as well.

        No change in behavior, no new tests.

        * inspector/InspectorFrontendHost.h:
        (WebCore):
        (InspectorFrontendHost):

2013-05-29  Tim Horton  <timothy_horton@apple.com>

        Expose incrementalRenderingSuppressionTimeout via WK2
        https://bugs.webkit.org/show_bug.cgi?id=117015
        <rdar://problem/13992853>

        Reviewed by Darin Adler.

        * dom/Document.cpp:
        (WebCore::Document::setVisualUpdatesAllowed):
        Inform the FrameLoader that we're ready to transition the page, if
        nothing else already has. This will be forwarded to the FrameLoaderClient,
        and WebKit2's implementation will go ahead and un-freeze the layer tree,
        so that the incremental rendering suppression watchdog timer actually works.

        (WebCore::Document::setVisualUpdatesAllowedByClient):
        Make incremental rendering suppression extension tokens play nice with the
        watchdog timer; allow setVisualUpdatesAllowedByClient=true to re-enable updates
        if either the page is in the "completed" state or the watchdog has already fired.

        * loader/FrameLoader.cpp:
        * loader/FrameLoader.h:
        (WebCore::FrameLoader::forcePageTransitionIfNeeded): Added.
        Forward to the client.

        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::forcePageTransitionIfNeeded): Added.

2013-05-29  Praveen R Jadhav  <praveen.j@samsung.com>

        ProgressEvent should not be cancelable
        https://bugs.webkit.org/show_bug.cgi?id=114444

        Reviewed by Darin Adler.

        Parameter "cancelable" in ProgressEvent is set to false, by default, as mentioned in the specification. The spec link is given below.

        Spec: http://www.w3.org/TR/2011/CR-progress-events-20110922/#suggested-names-for-events-using-the-progressevent-interface

        No new tests. file-reader-event-listener.html and infoOnProgressEvent-expected.txt are updated.

        * dom/ProgressEvent.cpp:
        (WebCore::ProgressEvent::ProgressEvent):
        (WebCore):

2013-05-29  Simon Fraser  <simon.fraser@apple.com>

        Fix paint-related milestones to not fire when the layer tree is frozen
        https://bugs.webkit.org/show_bug.cgi?id=117012

        Reviewed by Tim Horton.

        In the previous code, it was possible to paint some layer and schedule
        the m_paintRelatedMilestonesTimer, but then the layer tree was put into
        a frozen state because the page redirected. However, the paint-related
        milestones timer would still fire. This caused woes with header/footer
        banners.
        
        Fix by not firing paint-related milestones if the layer tree is frozen,
        which we know via a new ChromeClient callback. When unfrozen, we'll
        paint again, and fire the timer later.

        * page/ChromeClient.h:
        (WebCore::ChromeClient::layerTreeStateIsFrozen):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::paintRelatedMilestonesTimerFired):

2013-05-29  Ryosuke Niwa  <rniwa@webkit.org>

        Store form control list with RefPtr
        https://bugs.webkit.org/show_bug.cgi?id=116910

        Reviewed by Kent Tamura.

        Merge https://chromium.googlesource.com/chromium/blink/+/582132773280455ead1d42b0073be37efdeaf989.

        Unfortunately, the Blink change doesn't provide much insight as to what kind of crashes are fixed
        by this code change but it cleans up the way form elements with state are registered to the form
        controller so it seems benefitial to merge it anyway.

        * dom/Document.cpp:
        (WebCore::Document::dispose):
        * html/FormController.cpp:
        (WebCore::FormController::createSavedFormStateMap):
        (WebCore::FormController::registerFormElementWithState):
        (WebCore::FormController::unregisterFormElementWithState):
        (WebCore):
        * html/FormController.h:
        (FormController):
        * html/HTMLFormControlElementWithState.cpp:
        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
        (WebCore::HTMLFormControlElementWithState::insertedInto):
        (WebCore):
        (WebCore::HTMLFormControlElementWithState::removedFrom):
        * html/HTMLFormControlElementWithState.h:
        (HTMLFormControlElementWithState):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::insertedInto):

2013-05-29  Andreas Kling  <akling@apple.com>

        Take ComputedStyleExtractor for a spin.
        <http://webkit.org/b/116968>

        Reviewed by Antti Koivisto.

        Convert some editing and SVG code to use ComputedStyleExtractor instead of creating full
        blown CSSComputedStyleDeclaration objects.

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
        (WebCore::highestEmbeddingAncestor):
        (WebCore::ApplyStyleCommand::computedFontSize):
        * editing/EditingStyle.cpp:
        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):
        (WebCore::EditingStyle::textDirectionForSelection):
        (WebCore::getIdentifierValue):
        (WebCore::backgroundColorInEffect):
        * editing/EditingStyle.h:
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::computeCSSPropertyValue):

2013-05-29  Benjamin Poulain  <bpoulain@apple.com>

        Add a special case for SelectorDataList::execute when there is only one selector
        https://bugs.webkit.org/show_bug.cgi?id=116891

        Reviewed by Andreas Kling.

        In the vast majority of cases, querySelector is called with a single selector.

        This patch takes that input into account to improve the performance of
        SelectorDataList::execute(). For the case of a single selector, we avoid three
        branches executed for every node of the traversal.

        This improves QuerySelector's time by 2.3%.

        * dom/SelectorQuery.cpp:
        (WebCore::SelectorDataList::execute):

2013-05-29  Dean Jackson  <dino@apple.com>

        -webkit-text-underline-position should not be inherited
        https://bugs.webkit.org/show_bug.cgi?id=116363

        Reverting http://trac.webkit.org/changeset/150366
        It was an incorrect fix referring to an old specification.

        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
        (WebCore::StyleRareInheritedData::operator==):
        * rendering/style/StyleRareInheritedData.h:
        (StyleRareInheritedData):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2013-05-29  Ryuan Choi  <ryuan.choi@samsung.com>

        [CMAKE] cmake errors when CMAKE_BUILD_TYPE is not specified.
        https://bugs.webkit.org/show_bug.cgi?id=116899

        Reviewed by Laszlo Gombos.

        * CMakeLists.txt: Fixed if statement to escape when find command fails.

2013-05-28  Oliver Hunt  <oliver@apple.com>

        Add more accurate activity state tracking
        https://bugs.webkit.org/show_bug.cgi?id=116893

        Reviewed by Gavin Barraclough.

        Add a hysteresis to Page activity throttling.  We do this
        through a PageThrottler class that now handles entering and
        exiting throttling state, and adds a hysteresis to we can
        limit the amount of on/off bouncing on the throttle.

        Media elements now make use of this to disable timer throttling
        while they are playing, and plugins use it to momentarily bounce
        from throttled to unthrottled state.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.exp.in:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        (WebCore::HTMLMediaElement::pageThrottlerIfPossible):
        (WebCore):
        (WebCore::HTMLMediaElement::playInternal):
        (WebCore::HTMLMediaElement::pauseInternal):
        * html/HTMLMediaElement.h:
        (WebCore):
        * html/MediaController.cpp:
        (MediaController::unpause):
        * page/ChromeClient.h:
        (WebCore::ChromeClient::incrementActivePageCount):
        (WebCore::ChromeClient::decrementActivePageCount):
        (ChromeClient):
        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::~Page):
        (WebCore::Page::setThrottled):
        * page/Page.h:
        (WebCore):
        (Page):
        (WebCore::Page::pageThrottler):
        * page/PageThrottleState.h: Added.
        * page/PageThrottler.cpp: Added.
        (WebCore):
        (WebCore::PageThrottler::PageThrottler):
        (WebCore::PageThrottler::~PageThrottler):
        (WebCore::PageThrottler::clearPage):
        (WebCore::PageThrottler::throttlePage):
        (WebCore::PageThrottler::unthrottlePage):
        (WebCore::PageThrottler::setThrottled):
        (WebCore::PageThrottler::preventThrottling):
        (WebCore::PageThrottler::allowThrottling):
        (WebCore::PageThrottler::stopThrottleHysteresisTimer):
        (WebCore::PageThrottler::reportInterestingEvent):
        (WebCore::PageThrottler::startThrottleHysteresisTimer):
        (WebCore::PageThrottler::throttleHysteresisTimerFired):
        * page/PageThrottler.h: Added.
        (WebCore):
        (PageThrottler):
        (WebCore::PageThrottler::create):
        (WebCore::PageThrottler::shouldThrottleAnimations):
        (WebCore::PageThrottler::shouldThrottleTimers):

2013-05-29  Kent Tamura  <tkent@chromium.org>

        Remove leftover files for ENABLE_PAGE_POPUP and ENABLE_CALENDAR_PICKER
        https://bugs.webkit.org/show_bug.cgi?id=116999

        Reviewed by Anders Carlsson.

        * Resources/pagepopups/colorSuggestionPicker.css: Removed.
        * Resources/pagepopups/colorSuggestionPicker.js: Removed.
        * Resources/pagepopups/pickerCommon.css: Removed.
        * Resources/pagepopups/pickerCommon.js: Removed.
        * Resources/pagepopups/suggestionPicker.css: Removed.
        * Resources/pagepopups/suggestionPicker.js: Removed.

2013-05-29  Jer Noble  <jer.noble@apple.com>

        Unreviewed build fix; remove unintentional semicolon.

        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::finish):

2013-05-29  Anders Carlsson  <andersca@apple.com>

        Merge PODArea::Chunk into PODFreeListArena::FreeListChunk
        https://bugs.webkit.org/show_bug.cgi?id=117000

        Reviewed by Oliver Hunt.

        * platform/PODArena.h:
        (WebCore::PODArena::roundUp):
        * platform/PODFreeListArena.h:
        (PODFreeListArena):
        (WebCore::PODFreeListArena::FreeListChunk::FreeListChunk):
        (FreeListChunk):
        (WebCore::PODFreeListArena::FreeListChunk::~FreeListChunk):
        (WebCore::PODFreeListArena::FreeListChunk::allocate):

2013-05-29  Anders Carlsson  <andersca@apple.com>

        Move some PODArena members to PODFreeListArena
        https://bugs.webkit.org/show_bug.cgi?id=116993

        Reviewed by Sam Weinig.

        This is more work towards merging the two classes.

        * platform/PODArena.h:
        (PODArena):
        * platform/PODFreeListArena.h:
        (PODFreeListArena):
        (WebCore::PODFreeListArena::PODFreeListArena):

2013-05-29  Jer Noble  <jer.noble@apple.com>

        [Mac] Scrubbing long movie files results in timeline snapping back to 0 during scrub.
        https://bugs.webkit.org/show_bug.cgi?id=116986

        Reviewed by Eric Carlson.

        Keep a count of the number of in-flight seek requests, and only issue a timeupdate
        (which triggers a "seeked" event) when the final seek completes.

        Test: media/video-seek-multiple.html

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::seek):
        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        (MediaPlayerPrivateAVFoundation):

2013-05-29  Anders Carlsson  <andersca@apple.com>

        Remove unused code from PODArena
        https://bugs.webkit.org/show_bug.cgi?id=116990

        Reviewed by Sam Weinig.

        PODArena is only used as a base class of PODFreeListArena so remove unused member functions and make all
        members protected to make it impossible to use it without subclassing.

        PODArena is a risky class to use since it doesn't return memory to the system unless the arena object is destroyed.
        This was the reason why PODFreeListArea was added. An upcoming patch will merge PODArena with PODFreeListArena and
        this is a small step towards that goal.

        * platform/PODArena.h:

2013-05-29  Darin Adler  <darin@apple.com>

        Remove custom binding for Clipboard setDragImage function
        https://bugs.webkit.org/show_bug.cgi?id=116422

        Reviewed by Sam Weinig.

        * bindings/js/JSClipboardCustom.cpp: Removed setDragImage binding.

        * dom/Clipboard.cpp:
        (WebCore::Clipboard::canSetDragImage): Added a condition that this is a drag
        and drop clipboard. That used to be checked in the setDragImage binding.
        (WebCore::Clipboard::setDragImage): Added a version that takes an Element
        and calls through to the existing functions (in the legacy code path), or handles
        both the Element and HTMLImageElement not-in-document cases (in the new code path).

        * dom/Clipboard.h: Updated for changes above.

        * dom/Clipboard.idl: Removed [Custom] from setDragImage.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleDrag): Call the new setDragImage instead of the
        old setDragImageElement.

2013-05-29  Praveen R Jadhav  <praveen.j@samsung.com>

        Cleanup AudioSourceNode.idl from WebKit build.
        https://bugs.webkit.org/show_bug.cgi?id=116905.

        Reviewed by Darin Adler.

        AudioSourceNode.idl is not part of WebAudio Specifications anymore.
        AudioNode is inherited directly in all the audio source nodes.

        No new tests. Current test cases will cover all the scenarios.

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Modules/webaudio/AudioBufferSourceNode.h:
        * Modules/webaudio/AudioBufferSourceNode.idl:
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::AudioScheduledSourceNode):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/AudioSourceNode.h: Removed.
        * Modules/webaudio/AudioSourceNode.idl: Removed.
        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
        (WebCore::MediaElementAudioSourceNode::MediaElementAudioSourceNode):
        * Modules/webaudio/MediaElementAudioSourceNode.h:
        (MediaElementAudioSourceNode):
        * Modules/webaudio/MediaElementAudioSourceNode.idl:
        * Modules/webaudio/MediaStreamAudioDestinationNode.idl:
        * Modules/webaudio/MediaStreamAudioSourceNode.cpp:
        (WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
        * Modules/webaudio/MediaStreamAudioSourceNode.h:
        (MediaStreamAudioSourceNode):
        * Modules/webaudio/MediaStreamAudioSourceNode.idl:
        * Modules/webaudio/OscillatorNode.h:
        * Modules/webaudio/OscillatorNode.idl:
        * Target.pri:
        * WebCore.xcodeproj/project.pbxproj:

2013-05-29  Adam Barth  <abarth@webkit.org>

        Optimize RenderText::offsetNext for 8 bit strings
        https://bugs.webkit.org/show_bug.cgi?id=116877

        Reviewed by Darin Adler.

        Previously, this function was always upconverting strings to 16 bits in
        order to create a cursorMovementIterator. This patch adds a fast path
        for ASCII and Latin-1 strings, which don't need this complicated cursor
        movement logic.

        I ran into this code because nextOffset showed up as a memory pig on a
        memory profile of Mobile Gmail.

        Test: editing/selection/move-by-character-brute-force.html

        * rendering/RenderText.cpp:
        (WebCore::RenderText::previousOffset):
        (WebCore::RenderText::nextOffset):

2013-05-29  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Correct copy command (form versus forms)

        * WebCore.vcproj/copyForwardingHeaders.cmd:
        * WebCore.vcxproj/copyForwardingHeaders.cmd:

2013-05-29  Bem Jones-Bey  <bjonesbe@adobe.com>

        [CSS Shapes] Fix style issues in BasicShapes
        https://bugs.webkit.org/show_bug.cgi?id=116734

        Reviewed by Alexandru Chiculita.

        Fix indentation in BasicShapes.cpp, and change enums to respect the
        style rules CamelCase instead of HAVING_UNDERSCORES.

        No new tests, only style changes.

        * css/BasicShapeFunctions.cpp:
        (WebCore::valueForBasicShape):
        (WebCore::basicShapeForValue):
        * css/CSSBasicShapes.cpp:
        (WebCore::buildRectangleString):
        (WebCore::CSSBasicShapeRectangle::equals):
        (WebCore::CSSBasicShapeCircle::equals):
        (WebCore::CSSBasicShapeEllipse::equals):
        (WebCore::CSSBasicShapePolygon::equals):
        (WebCore::CSSBasicShapeInsetRectangle::equals):
        * css/CSSBasicShapes.h:
        (WebCore::CSSBasicShapeRectangle::type):
        (WebCore::CSSBasicShapeInsetRectangle::type):
        (WebCore::CSSBasicShapeCircle::type):
        (WebCore::CSSBasicShapeEllipse::type):
        (WebCore::CSSBasicShapePolygon::type):
        * rendering/ExclusionShape.cpp:
        (WebCore::ExclusionShape::createExclusionShape):
        * rendering/ExclusionShapeInsideInfo.cpp:
        (WebCore::ExclusionShapeInsideInfo::isEnabledFor):
        * rendering/ExclusionShapeOutsideInfo.cpp:
        (WebCore::ExclusionShapeOutsideInfo::isEnabledFor):
        * rendering/style/BasicShapes.cpp:
        (WebCore::BasicShape::canBlend):
        (WebCore::BasicShapeRectangle::path):
        (WebCore::BasicShapeCircle::path):
        (WebCore::BasicShapeEllipse::path):
        (WebCore::BasicShapeInsetRectangle::path):
        * rendering/style/BasicShapes.h:
        (WebCore::BasicShapeRectangle::type):
        (WebCore::BasicShapeCircle::type):
        (WebCore::BasicShapeEllipse::type):
        (WebCore::BasicShapePolygon::type):
        (WebCore::BasicShapeInsetRectangle::type):

2013-05-29  Otto Derek Cheung  <otcheung@rim.com>

        [BlackBerry] Handle Host-Only cookies
        https://bugs.webkit.org/show_bug.cgi?id=116969

        PR 338809
        Reviewed by Rob Buis.
        Internally Reviewed by Joe Mason.

        Adding support for host-only cookies (cookies with no
        specified domains). These cookies should only be returned
        when the host matches the cookie domain exactly.

        Tested using Opera and Browser cookie test suite. Tested
        that host cookies are being stored in it's own map using
        Web Inspector.

        * platform/blackberry/CookieManager.cpp:
        (WebCore::CookieManager::getRawCookies):
        (WebCore::CookieManager::checkAndTreatCookie):
        (WebCore::CookieManager::findOrCreateCookieMap):
        * platform/blackberry/CookieParser.cpp:
        (WebCore::CookieParser::CookieParser):
        (WebCore::CookieParser::parseOneCookie):
        * platform/blackberry/ParsedCookie.h:
        (WebCore::ParsedCookie::isHostOnly):
        (ParsedCookie):

2013-05-29  Ryosuke Niwa  <rniwa@webkit.org>

        Remove the size of DataVector in HTMLToken
        https://bugs.webkit.org/show_bug.cgi?id=116931

        Reviewed by Sam Weinig.

        Merge https://chromium.googlesource.com/chromium/blink/+/7977721e62c471bfa17b84d82cd5d8243a4eb9a9.

        Shink HTMLToken by 1.5 kB

        HTMLToken has an inline vector for buffering characters during tokenization. We
        originally picked the inline capacity of this buffer somewhat arbitrarily. This
        CL tunes the number based on a somewhat non-scientific browse of a number of
        popular web sites.

        I (abarth) instrumented content_shell to log the length of each complete DataVector. I
        then browsed around a variety of web sites to collect data. The 99% percentile
        of DataVector lengths was just shy of 250 characters. I rounded that up to 256
        because powers of two are pretty. That means we'll malloc an external buffer
        less than 1% of the time, which seems fine.

        * html/parser/HTMLToken.h:
        (HTMLToken):

2013-05-29  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Build correction after r150837

        New 'forms' sub-folder of html needs to be included in
        copy operations.

        * WebCore.vcproj/copyForwardingHeaders.cmd: copy html/forms.
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters: Use correct
        'obj32' folder for build output.
        * WebCore.vcxproj/copyForwardingHeaders.cmd: copy html/forms.

2013-05-29  Tiancheng Jiang  <tijiang@rim.com>

        [BlackBerry] Radio Button UX updates.
        https://bugs.webkit.org/show_bug.cgi?id=116881

        Reviewed by Rob Buis.

        BlackBerry PR 342322.
        Internally Reviewed by Jeff Rogers.
        Change images.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::paintRadio):

2013-05-29  Tiancheng Jiang  <tijiang@rim.com>

        [BlackBerry] Datetime string is not centred in form controls.
        https://bugs.webkit.org/show_bug.cgi?id=100760

        Reviewed by Rob Buis.

        BlackBerry PR 343512
        Internally Reviewed by Jeff Rogers.

        Adjust margin for inner text node of datetime form controls.

        * css/themeBlackBerry.css:
        (input::-webkit-date-and-time-value):

2013-05-29  Brent Fulgham  <bfulgham@apple.com>

        [Windows] Build correction after r150876

        A clean build will now fail because the BaseMultipleFieldsDateAndTimeInputType sources have
        been removed, but are still referenced in the project file.

        * WebCore.vcxproj/WebCore.vcxproj: Remove reference to BaseMultipleFieldsDateAndTimeInputType
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto

2013-05-28  Jer Noble  <jer.noble@apple.com>

        Support the 'onended' EventListener property for AudioBufferSourceNode and OscillatorNode.
        https://bugs.webkit.org/show_bug.cgi?id=116798

        Reviewed by Eric Carlson.

        Tests: webaudio/audiobuffersource-ended.html
               webaudio/oscillator-ended.html

        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::AudioScheduledSourceNode):
        (WebCore::AudioScheduledSourceNode::setOnended): Set m_hasEndedListener.
        (WebCore::AudioScheduledSourceNode::finish): Call notifyEndedDispatch on the main thread.
        (WebCore::AudioScheduledSourceNode::notifyEndedDispatch): Call notifyEnded().
        (WebCore::AudioScheduledSourceNode::notifyEnded): Call the onended event listener.
        * Modules/webaudio/AudioScheduledSourceNode.h:
        (WebCore::AudioScheduledSourceNode::onended): Added boilerplate.
        * Modules/webaudio/AudioBufferSourceNode.idl: Added the onerror attribute.
        * Modules/webaudio/OscillatorNode.idl: Ditto.

2013-05-29  Bem Jones-Bey  <bjonesbe@adobe.com>

        [CSS Shapes] Support parsing inset-rectangle shapes
        https://bugs.webkit.org/show_bug.cgi?id=116638

        Reviewed by Dean Jackson.

        Add parsing for inset-rectangle. It's very similar to parsing for
        rectangle.

        No new tests, updated existing tests to cover this.

        * css/BasicShapeFunctions.cpp:
        (WebCore::valueForBasicShape): Add support for inset rectangles.
        (WebCore::basicShapeForValue): Add support for inset rectangles.
        * css/CSSBasicShapes.cpp:
        (WebCore::buildInsetRectangleString): Create an inset-rectangle css
            string.
        (WebCore::CSSBasicShapeInsetRectangle::cssText): Convert inset
            rectangle shape to a CSS string.
        (WebCore::CSSBasicShapeInsetRectangle::equals): Compare two inset
            rectangles.
        (WebCore::CSSBasicShapeInsetRectangle::serializeResolvingVariables):
            Create an inset rectangle string, with CSS variables resolved.
        (WebCore::CSSBasicShapeInsetRectangle::hasVariableReference):
            Determine if this inset rectangle has any CSS Variable references.
        * css/CSSBasicShapes.h:
        (CSSBasicShapeInsetRectangle): Add inset rectangle class. This is a
            direct representation of the CSS property. All the methods below
            are just simple getters and setters, along with a construtor and a
            factory method.
        (WebCore::CSSBasicShapeInsetRectangle::create): 
        (WebCore::CSSBasicShapeInsetRectangle::top): 
        (WebCore::CSSBasicShapeInsetRectangle::right):
        (WebCore::CSSBasicShapeInsetRectangle::bottom):
        (WebCore::CSSBasicShapeInsetRectangle::left):
        (WebCore::CSSBasicShapeInsetRectangle::radiusX):
        (WebCore::CSSBasicShapeInsetRectangle::radiusY):
        (WebCore::CSSBasicShapeInsetRectangle::setTop):
        (WebCore::CSSBasicShapeInsetRectangle::setRight):
        (WebCore::CSSBasicShapeInsetRectangle::setBottom):
        (WebCore::CSSBasicShapeInsetRectangle::setLeft):
        (WebCore::CSSBasicShapeInsetRectangle::setRadiusX):
        (WebCore::CSSBasicShapeInsetRectangle::setRadiusY):
        (WebCore::CSSBasicShapeInsetRectangle::type):
        (WebCore::CSSBasicShapeInsetRectangle::CSSBasicShapeInsetRectangle):
        (WebCore):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseBasicShapeInsetRectangle): Parse the
            inset-rectangle CSS property and create a
            CSSBasicShapeInsetRectangle.
        (WebCore::CSSParser::parseBasicShape): Add a call to parse
            inset-rectangle.
        * rendering/ExclusionShapeInsideInfo.cpp:
        (WebCore::ExclusionShapeInsideInfo::isEnabledFor): Disable
            inset-rectangles, since only the parsing has been implemented so
            far.
        * rendering/ExclusionShapeOutsideInfo.cpp:
        (WebCore::ExclusionShapeOutsideInfo::isEnabledFor): Disable
            inset-rectangles, since only the parsing has been implemented so
            far.
        * rendering/style/BasicShapes.cpp:
        (WebCore::BasicShapeInsetRectangle::path): Calculate the Path for an
            inset-rectangle.
        (WebCore::BasicShapeInsetRectangle::blend): Blend two inset rectangles
            together at a point depending on the "progress" and return the
            blended rectangle.
        * rendering/style/BasicShapes.h:
        (BasicShapeInsetRectangle): Add higher level inset rectangle class.
            This is used outside of the CSS representation. The methods below
            are just simple getters and setters, along with a constructor and
            a factory method.
        (WebCore::BasicShapeInsetRectangle::create):
        (WebCore::BasicShapeInsetRectangle::top):
        (WebCore::BasicShapeInsetRectangle::right):
        (WebCore::BasicShapeInsetRectangle::bottom):
        (WebCore::BasicShapeInsetRectangle::left):
        (WebCore::BasicShapeInsetRectangle::cornerRadiusX):
        (WebCore::BasicShapeInsetRectangle::cornerRadiusY):
        (WebCore::BasicShapeInsetRectangle::setTop):
        (WebCore::BasicShapeInsetRectangle::setRight):
        (WebCore::BasicShapeInsetRectangle::setBottom):
        (WebCore::BasicShapeInsetRectangle::setLeft):
        (WebCore::BasicShapeInsetRectangle::setCornerRadiusX):
        (WebCore::BasicShapeInsetRectangle::setCornerRadiusY):
        (WebCore::BasicShapeInsetRectangle::type):
        (WebCore::BasicShapeInsetRectangle::BasicShapeInsetRectangle):

2013-05-29  Andreas Kling  <akling@apple.com>

        Move computed style extraction out of CSSComputedStyleDeclaration.
        <http://webkit.org/b/116965>

        Reviewed by Antti Koivisto.

        Make it possible to get computed CSSValues from a Node without creating a CSSOM
        style declaration object.

        The bulk of the logic moves to a new class; ComputedStyleExtractor, which can be created
        on the stack, and takes the same setup variables as CSSComputedStyleDeclaration.

        This is prep to enable futuristic optimizations in editing and elsewhere.

        * css/CSSComputedStyleDeclaration.h:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):

            Create a ComputedStyleExtractor to do the work!

        (WebCore::ComputedStyleExtractor::currentColorOrValidColor):
        (WebCore::ComputedStyleExtractor::valueForFilter):
        (WebCore::ComputedStyleExtractor::ComputedStyleExtractor):
        (WebCore::ComputedStyleExtractor::valueForShadow):
        (WebCore::ComputedStyleExtractor::styledNode):
        (WebCore::ComputedStyleExtractor::propertyValue):
        (WebCore::ComputedStyleExtractor::getCSSPropertyValuesForShorthandProperties):
        (WebCore::ComputedStyleExtractor::getCSSPropertyValuesForSidesShorthand):
        (WebCore::ComputedStyleExtractor::getCSSPropertyValuesForGridShorthand):
        (WebCore::ComputedStyleExtractor::getBackgroundShorthandValue):
        * css/SVGCSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::adjustSVGPaintForCurrentColor):
        (WebCore::ComputedStyleExtractor::svgPropertyValue):

            Moved all of these from CSSComputedStyleDeclaration to the new class.

        * rendering/style/RenderStyle.h:
        * svg/SVGPaint.h:

            Have these two befriend ComputedStyleExtractor.

2013-05-29  Antti Koivisto  <antti@apple.com>

        Another attempt to fix windows build.
        
        Not reviewed.

        * css/CSSFontSelector.h:

2013-05-29  Antti Koivisto  <antti@apple.com>

        Try to fix window build.
        
        Not reviewed.

        * platform/graphics/FontCache.h:
        (WebCore::FontDescriptionFontDataCacheKey::computeHash):

2013-05-29  Simon Fraser  <simon.fraser@apple.com>

        Fix the firing of m_paintRelatedMilestonesTimer
        https://bugs.webkit.org/show_bug.cgi?id=116919

        Reviewed by Tim Horton.

        r150671 intended to change things so that paint-related milestones
        only fire when painting has actually happened, so that WebKit clients
        are notified when we actually have bits to present.
        
        However, it made an incorrect assumption that painting would happen
        inside of flushCompositingState(). This is not the case; flushCompositingState()
        will just dirty CALayers, and later on Core Animation will ask us to paint them.
        
        This incorrect assumption meant that we would never start the
        m_paintRelatedMilestonesTimer, so never fire the milestones.
        
        Fix by starting the m_paintRelatedMilestonesTimer via the RenderLayerBacking
        paintContents call back. At this time we know we're painting, so we can both
        set the FrameView's last paint time, and start up the timer. We also only
        want to start the timer if there are pending milestones.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::paintIntoLayer):
        (WebCore::RenderLayerBacking::paintContents):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
        (WebCore::RenderLayerCompositor::didPaintBacking):
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):

2013-05-29  Antti Koivisto  <antti@apple.com>

        Share FontGlyphs
        https://bugs.webkit.org/show_bug.cgi?id=116863

        Reviewed by Anreas Kling.

        Style system generates many Font objects that are identical or similar enough to have identical FontGlyphs. 
        We can figure out that the FontGlyphs are going to be the same and share them. This reduces memory usage.
        It also improves performance as the glyph cache and the width cache hang from FontGlyphs and their hit rate
        increases.
        
        On PLT3 this takes the number of live FontGlyphs at the end from 40k+ to <1k. Width cache hit rate improves
        from ~42% to ~55%.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::CSSFontSelector):
        
            Add unique id we can use in cache key.

        (WebCore::CSSFontSelector::dispatchInvalidationCallbacks):
        
            Bump the version number on invalidation so we don't reuse cache entries after web font is loaded.

        (WebCore::CSSFontSelector::resolvesFamilyFor):
        
            Test if FontSelector is needed for resolving a particular FontDescription.

        * css/CSSFontSelector.h:
        * page/Settings.cpp:
        (WebCore::setGenericFontFamilyMap):
        
            Invalidate the cache if standard font settings change.

        * platform/graphics/Font.cpp:
        (FontGlyphsCacheKey):
        (FontGlyphsCacheEntry):
        (WebCore::operator==):
        (WebCore::fontGlyphsCache):
        (WebCore::invalidateFontGlyphsCache):
        (WebCore::makeFontSelectorFlags):
        (WebCore::makeFontGlyphsCacheKey):
        
            The cache key consists of
            
            - all families.
            - shared key with the lower level FontData cache (FontCache), guaranteeing FontDatas would be identical.
            - font selector specific keys.

            These guarantee the FontData will be identical.

        (WebCore::computeFontGlyphsCacheHash):
        (WebCore::pruneUnreferencedFromFontGlyphsCache):
        
            Don't accumulate unused entries.

        (WebCore::retrieveOrAddCachedFontGlyphs):
        (WebCore::Font::update):
        * platform/graphics/Font.h:
        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
        (WebCore::FontPlatformDataCacheKey::operator==):
        (FontPlatformDataCacheKey):
        (WebCore::computeHash):
        (WebCore::FontCache::getCachedFontPlatformData):
        (WebCore::FontCache::purgeInactiveFontData):
        (WebCore::FontCache::invalidate):
        * platform/graphics/FontCache.h:
        (WebCore::FontDescriptionFontDataCacheKey::FontDescriptionFontDataCacheKey):
        (WebCore::FontDescriptionFontDataCacheKey::makeFlagKey):
        (WebCore::FontDescriptionFontDataCacheKey::operator==):
        (WebCore::FontDescriptionFontDataCacheKey::operator!=):
        (WebCore::FontDescriptionFontDataCacheKey::computeHash):
        
            Separate part of the key for sharing.

        (FontDescriptionFontDataCacheKey):
        * platform/graphics/FontFallbackList.cpp:
        (WebCore::FontGlyphs::FontGlyphs):
        (WebCore::FontGlyphs::releaseFontData):
        * platform/graphics/FontFallbackList.h:
        (WebCore::FontGlyphs::create):
        (WebCore::FontGlyphs::~FontGlyphs):
        
            Remove invalidate(). If FontGlyphs needs invalidation it is reconstructed.

        * platform/graphics/FontSelector.h:

2013-05-29  Nico Weber  <thakis@chromium.org>

        Remove unused file PlatformGestureEvent.cpp
        https://bugs.webkit.org/show_bug.cgi?id=116894

        Reviewed by Darin Adler.

        This was added in https://bugs.webkit.org/show_bug.cgi?id=49345 but
        not removed in https://bugs.webkit.org/show_bug.cgi?id=77492 which
        removed most of that code again.
        
        * platform/PlatformGestureRecognizer.cpp: Removed.

2013-05-29  Víctor Manuel Jáquez Leal  <vjaquez@igalia.com>

        [texmap][GStreamer][GTK] Composited Video support
        https://bugs.webkit.org/show_bug.cgi?id=86410

        Reviewed by Noam Rosenthal.

        Enable the video accelerated compositing using the WebKit's
        TextureMapper.

        This patch does not use hardware accelerated video decoding. It
        provides a generic path for system memory buffers.

        This new functionality is only available when the coordinated graphics
        system is not used.

        No new tests, already covered by existing tests.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore):
        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture): update the
        texture content with the new received video buffer.
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint): choose to
        use the accelerated compositing or the normal code path
        (WebCore::MediaPlayerPrivateGStreamerBase::paint): if accelerated
        compositing is used this method is halted.
        (WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper): get
        a texture from the pool and draws it if it is already available.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        (MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::platformLayer): returns itself
        (WebCore::MediaPlayerPrivateGStreamerBase::supportsAcceleratedRendering):
        returns true

2013-05-29  Peter Gal  <galpeter@inf.u-szeged.hu>

        [Qt] Missing files from build after r150853
        https://bugs.webkit.org/show_bug.cgi?id=116932

        Reviewed by Csaba Osztrogonác.

        * Target.pri: Added missing include path.

2013-05-29  Mihai Maerean  <mmaerean@adobe.com>

        [CSS Regions] Content that has overflow: scroll cannot be scrolled by dragging the scroll thumbs with the mouse
        https://bugs.webkit.org/show_bug.cgi?id=113703

        Reviewed by Darin Adler.

        The point inside a box that's inside a region has its coordinates relative to the region, not the FlowThread
        that is its container in the RenderObject tree.

        Previously, the coordinates were computed relatively to the FlowThread which doesn't really have a location in
        the page.

        Tests: fast/regions/drag-scrollbars-of-content.html
               fast/regions/hover-in-second-region.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::offsetFromContainer):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):

2013-05-29  Andreas Kling  <akling@apple.com>

        Fix dumb typo in r150879.

        * editing/htmlediting.cpp:
        (WebCore::nextLeafNode):

2013-05-29  Andreas Kling  <akling@apple.com>

        Move leaf Node traversal helpers to htmlediting.cpp
        <http://webkit.org/b/116940>

        Reviewed by Antti Koivisto.

        Move Node::previousLeafNode() and Node::nextLeafNode() to htmlediting.cpp along with their helpers.
        Fixes an 8-year old FIXME. \o/

        * dom/Node.h:
        * dom/Node.cpp:
        * dom/Position.cpp:
        (WebCore::nextRenderedEditable):
        (WebCore::previousRenderedEditable):
        * editing/VisibleUnits.cpp:
        (WebCore::previousLeafWithSameEditability):
        (WebCore::nextLeafWithSameEditability):
        * editing/htmlediting.h:
        * editing/htmlediting.cpp:
        (WebCore::previousNodeConsideringAtomicNodes):
        (WebCore::nextNodeConsideringAtomicNodes):
        (WebCore::previousLeafNode):
        (WebCore::nextLeafNode):

2013-05-29  Peter Gal  <galpeter@inf.u-szeged.hu>

        [Qt] Missing files from build after r150853
        https://bugs.webkit.org/show_bug.cgi?id=116932

        Reviewed by Csaba Osztrogonác.

        * Target.pri: Added the CFURLExtras.{cpp,h} files to the projectfile.

2013-05-29  Ryosuke Niwa  <rniwa@webkit.org>

        PresentationAttributeCacheCleaner::m_hitCount is never initialized
        https://bugs.webkit.org/show_bug.cgi?id=116946

        Reviewed by Andreas Kling.

        Merge https://chromium.googlesource.com/chromium/blink/+/70be7ddc41141ef6dec7795d37842c27dab2e194.

        * dom/StyledElement.cpp:
        (WebCore::PresentationAttributeCacheCleaner::PresentationAttributeCacheCleaner):

2013-05-29  Kent Tamura  <tkent@chromium.org>

        Remove ENABLE_INPUT_MULTIPLE_FIELDS_UI.
        https://bugs.webkit.org/show_bug.cgi?id=116796

        Reviewed by Ryosuke Niwa.

        This feature was used only by Chromium port.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * css/html.css:
        (input::-webkit-date-and-time-value):
        * dom/Element.cpp:
        * dom/Element.h:
        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
        * html/BaseChooserOnlyDateAndTimeInputType.h:
        * html/BaseMultipleFieldsDateAndTimeInputType.cpp: Removed.
        * html/BaseMultipleFieldsDateAndTimeInputType.h: Removed.
        * html/DateInputType.cpp:
        * html/DateInputType.h:
        (DateInputType):
        * html/DateTimeFieldsState.cpp: Removed.
        * html/DateTimeFieldsState.h: Removed.
        * html/DateTimeInputType.cpp:
        * html/DateTimeInputType.h:
        (DateTimeInputType):
        * html/DateTimeLocalInputType.cpp:
        * html/DateTimeLocalInputType.h:
        (DateTimeLocalInputType):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::HTMLInputElement):
        (WebCore):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        * html/InputType.h:
        (InputType):
        * html/MonthInputType.cpp:
        * html/MonthInputType.h:
        (MonthInputType):
        * html/TimeInputType.cpp:
        * html/TimeInputType.h:
        (TimeInputType):
        * html/WeekInputType.cpp:
        * html/WeekInputType.h:
        (WeekInputType):
        * html/shadow/ClearButtonElement.cpp: Removed.
        * html/shadow/ClearButtonElement.h: Removed.
        * html/shadow/DateTimeEditElement.cpp: Removed.
        * html/shadow/DateTimeEditElement.h: Removed.
        * html/shadow/DateTimeFieldElement.cpp: Removed.
        * html/shadow/DateTimeFieldElement.h: Removed.
        * html/shadow/DateTimeFieldElements.cpp: Removed.
        * html/shadow/DateTimeFieldElements.h: Removed.
        * html/shadow/DateTimeNumericFieldElement.cpp: Removed.
        * html/shadow/DateTimeNumericFieldElement.h: Removed.
        * html/shadow/DateTimeSymbolicFieldElement.cpp: Removed.
        * html/shadow/DateTimeSymbolicFieldElement.h: Removed.
        * html/shadow/PickerIndicatorElement.cpp: Removed.
        * html/shadow/PickerIndicatorElement.h: Removed.
        * page/ChromeClient.h:
        (ChromeClient):
        * platform/LocalizedStrings.h:
        (WebCore):
        * platform/text/PlatformLocale.cpp:
        * platform/text/PlatformLocale.h:
        (Locale):
        * rendering/RenderDetailsMarker.cpp:
        * rendering/RenderDetailsMarker.h:
        * rendering/RenderObject.h:
        (RenderObject):

2013-05-29  Ryosuke Niwa  <rniwa@webkit.org>

        Remove setFullScreenRendererSize and setFullScreenRendererBackgroundColor
        https://bugs.webkit.org/show_bug.cgi?id=116914

        Reviewed by Benjamin Poulain.

        Merge https://chromium.googlesource.com/chromium/blink/+/508eb21a07f69ed38b9be9ff92fe75dcb907861f

        * dom/Document.cpp:
        * dom/Document.h:

2013-05-29  Ryosuke Niwa  <rniwa@webkit.org>

        Make WidgetHierarchyUpdatesSuspensionScope use swap instead of copy
        https://bugs.webkit.org/show_bug.cgi?id=116927

        Reviewed by Andreas Kling.

        Merge https://chromium.googlesource.com/chromium/blink/+/1d577e1fd5c5716a06e4007e04fc3d9d0a88f5e4

        This is equivalent behavior code that is unambiguously better performance. swap is O(1) time and memory,
        copying a hash table is at least linear with the number of elements.

        * rendering/RenderWidget.cpp:
        (WebCore::WidgetHierarchyUpdatesSuspensionScope::moveWidgets):

2013-05-29  Andreas Kling  <akling@apple.com>

        Remove Document::nodeAbsIndex() and Document::nodeWithAbsIndex().

        Rubber-stamped by Antti "Lucky" Koivisto.

        * dom/Document.h:
        * dom/Document.cpp:

2013-05-28  Andreas Kling  <akling@apple.com>

        FocusController should operate on Elements internally.
        <http://webkit.org/b/116781>

        Reviewed by Antti Koivisto.

        Switch from Node* to Element* as much as possible inside FocusController.
        Mostly mechanical, gets rid of some unnecessary isElementNode() checks and casts.

        * page/FocusController.h:
        * page/FocusController.cpp:
        (WebCore::dispatchEventsOnWindowAndFocusedElement):
        (WebCore::isNonFocusableShadowHost):
        (WebCore::adjustedTabIndex):
        (WebCore::shouldVisit):
        (WebCore::FocusController::setFocused):
        (WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument):
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        (WebCore::FocusController::findFocusableElementAcrossFocusScope):
        (WebCore::FocusController::findFocusableElementRecursively):
        (WebCore::FocusController::findFocusableElement):
        (WebCore::FocusController::nextFocusableElement):
        (WebCore::FocusController::previousFocusableElement):
        (WebCore::FocusController::setActive):

2013-05-29  Radu Stavila  <stavila@adobe.com>

        [CSS Regions] Mouse over an element does not trigger :hover state for parent when the element is flowed in a region
        https://bugs.webkit.org/show_bug.cgi?id=111749

        Reviewed by Antti Koivisto.

        When searching for the hover ancestor and encountering a named flow thread,
        the search will continue with the DOM ancestor of the top-most element
        in the named flow thread.

        Tests: fast/regions/hover-in-region-grandparent.html
               fast/regions/hover-in-region-parent-skip.html
               fast/regions/hover-in-region-parent-skip-inlines-anonymous.html
               fast/regions/hover-on-child-in-region.html
               fast/regions/hover-on-child-in-region-in-region.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::hoverAncestor):
        * rendering/RenderObject.h:

2013-05-28  Nate Chapin  <japhet@chromium.org>

        Crash in WebCore::SubresourceLoader::releaseResources when connection fails
        https://bugs.webkit.org/show_bug.cgi?id=87743

        Don't do anything complicated in SubresourceLoader::releaseResources(),
        just clear variables. With this patch, releaseResources() will still
        assert in debug builds if it is called twice, but it will safely execute
        in release.

        Reviewed by Darin Adler.

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::cleanupForError): Pull shared cleanup code out of didFail()
            and cancel() into a helper.
        (WebCore::ResourceLoader::cancel): Merge a couple variables into an enum, check for
            reentrancy from within didCancel().
        * loader/ResourceLoader.h: Replace m_calledWillCancel and m_cancelled with an enum.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::didFinishLoading): Don't call ResourceLoader::didFinishLoading(),
            put finish() in the middle of the process.
        (WebCore::SubresourceLoader::didFail): Don't call ResourceLoader::didFail(), put finish()
            in the middle of the process.
        (WebCore::SubresourceLoader::didCancel):
        (WebCore::SubresourceLoader::notifyDone): Do the non-trivial work previous done in releaseResources(),
            most importantly calling loadDone().
        (WebCore::SubresourceLoader::releaseResources): Only do simple variable clearing here.
        * loader/SubresourceLoader.h:
        (SubresourceLoader):
        * loader/cache/CachedResource.cpp: Split stopLoading() into cancelLoad() (which notifies clients)
            and clearLoader() (which just nulls m_loader).
        * loader/cache/CachedResource.h:
        * loader/chromium/ResourceLoaderChromium.cpp:

2013-05-28  Seokju Kwon  <seokju.kwon@gmail.com>

        [GTK] Build fix after r150837
        https://bugs.webkit.org/show_bug.cgi?id=116904

        Unreviewed build fix.

        * GNUmakefile.am:

2013-05-28  Andy Estes  <aestes@apple.com>

        REGRESSION (r150169): Images from file: URLs display after a delay even though they were preloaded by JavaScript
        https://bugs.webkit.org/show_bug.cgi?id=116906
        <rdar://problem/13991927>

        Reviewed by Andreas Kling.

        Writing a test for this is blocked on https://webkit.org/b/116199.

        Some WebKit clients use JavaScript to preload images from disk so that
        subsequent loads will display immediately from the memory cache. By not
        caching non-HTTP sub-resources in memory, we break this common pattern.
        This change restricts r150169 to only apply to cached main resources.
        Sub-resources will again be cached indefinitely as they were prior to
        r150169.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::freshnessLifetime): If this is a non-HTTP
        main resource from a scheme that should not be cached indefinitely,
        return 0 for the freshness lifetime. For other non-HTTP cached
        resources, return an indefinite freshness lifetime.

2013-05-28  Dean Jackson  <dino@apple.com>

        Animations do not restart after exiting page cache
        https://bugs.webkit.org/show_bug.cgi?id=116900

        Reviewed by Tim Horton.

        Animations are suspended as they enter the page cache, but
        were not getting correctly resumed when exiting. The cause
        was an error in r149576 which was checking a global flag for suspension
        on the AnimationController and thus not trying to resume anything.

        Test: animations/resume-after-page-cache.html

        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::suspendAnimationsForDocument):
        (WebCore::AnimationControllerPrivate::resumeAnimationsForDocument):

2013-05-28  Chris Rogers  <crogers@google.com>

        Support multiple HRTFDatabases for different sample-rates
        https://bugs.webkit.org/show_bug.cgi?id=116183

        Reviewed by Kenneth Russell.

        Adapted from Blink:
        https://codereview.chromium.org/14636011/

        This removes the limitation which required OfflineAudioContexts to be created at native sample-rate

        * Modules/webaudio/AudioContext.h:
        (WebCore::AudioContext::hrtfDatabaseLoader):
        (AudioContext):
        * Modules/webaudio/OfflineAudioContext.cpp:
        (WebCore::OfflineAudioContext::create):
        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
        (WebCore::OfflineAudioDestinationNode::offlineRender):
        * Modules/webaudio/PannerNode.cpp:
        (WebCore::PannerNode::initialize):
        (WebCore::PannerNode::setPanningModel):
        * platform/audio/HRTFDatabaseLoader.cpp:
        (WebCore):
        (WebCore::HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary):
        (WebCore::HRTFDatabaseLoader::~HRTFDatabaseLoader):
        * platform/audio/HRTFDatabaseLoader.h:
        (HRTFDatabaseLoader):
        (WebCore::HRTFDatabaseLoader::loaderMap):
        * platform/audio/HRTFPanner.cpp:
        (WebCore::HRTFPanner::HRTFPanner):
        (WebCore::HRTFPanner::calculateDesiredAzimuthIndexAndBlend):
        (WebCore::HRTFPanner::pan):
        * platform/audio/HRTFPanner.h:
        (HRTFPanner):
        * platform/audio/Panner.cpp:
        (WebCore::Panner::create):
        * platform/audio/Panner.h:
        (WebCore):

2013-05-28  Alexey Proskuryakov  <ap@apple.com>

        Windows build fix.

        * platform/cf/KURLCFNet.cpp:
        (WebCore::KURL::createCFURL):

2013-05-28  Alexey Proskuryakov  <ap@apple.com>

        Freeze when loading a particular page on washingtonpost.com with NetworkProcess enabled
        https://bugs.webkit.org/show_bug.cgi?id=116887
        <rdar://problem/12965959>

        Reviewed by Darin Adler.

        Test: http/tests/uri/curly-braces-escaping.html

        The issue was that WebKit used an incorrect accessor to get a string out of CFURL,
        unlike WebCore.

        Centralized code for converting between CFURLs and strings in a place that WebKit
        can use directly.

        * WebCore.exp.in:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        Keeping things building.

        * platform/KURL.cpp: (WebCore::KURL::copyToBuffer):
        * platform/KURL.h:
        Updated for a new typedef name. The code was using Vector<char, 512> and CharBuffer
        inconsistently, and now URLs use URLCharBuffer.

        * platform/cf/CFURLExtras.cpp: Added.
        (WebCore::createCFURLFromBuffer):
        (WebCore::getURLBytes):
        * platform/cf/CFURLExtras.h: Added.
        * platform/cf/KURLCFNet.cpp:
        (WebCore::KURL::KURL):
        (WebCore::KURL::createCFURL):
        Extracted code for CFURL string manipulation that is not logcally part of KURL.

        * platform/mac/KURLMac.mm:
        (WebCore::KURL::KURL): Use the new getURLBytes function.
        (WebCore::KURL::operator NSURL *): Added a comment.
        (WebCore::KURL::createCFURL): Added a comment, and updated for new names and
        signatures.

        * platform/network/cf/ResourceErrorCF.cpp: (WebCore::ResourceError::platformLazyInit):
        Added a FIXME. We are still using CFURLGetString here. The difficulty is getting
        encodings right.

2013-05-28  Anders Carlsson  <andersca@apple.com>

        Create a html/forms subdirectory and move FileIconLoader there
        https://bugs.webkit.org/show_bug.cgi?id=116880

        Reviewed by Jessie Berlin.

        A lot (if not the majority) of files in html/ are forms related, so it makes sense to begin splitting
        them out into a separate subdirectory, html/forms.

        Begin my moving FileIconLoader from platform to html/forms. It is related to HTML forms (it's only used by
        the file upload element), and is not really a platform abstraction so it doesn't belong in platform.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * html/forms/FileIconLoader.cpp: Renamed from Source/WebCore/platform/FileIconLoader.cpp.
        * html/forms/FileIconLoader.h: Renamed from Source/WebCore/platform/FileIconLoader.h.

2013-05-28  Chris Fleizach  <cfleizach@apple.com>

        AX: WKView is unable to set AXFocused to YES and does not handle keyboard events as expected
        https://bugs.webkit.org/show_bug.cgi?id=116756

        Reviewed by Tim Horton.

        If AXFocused is set to true, but the WebView is not the first responder, then the call will
        not do anything. This change asks the Chrome to make the WebView the first responder before
        trying to set focus within the page.

        Was not able to make a test, it requires on interplay between areas outside the web view.

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):

2013-05-28  Jer Noble  <jer.noble@apple.com>

        Crash in DumpRenderTree at com.apple.WebCore: WebCore::RenderTextTrackCue::repositionGenericCue + 154
        https://bugs.webkit.org/show_bug.cgi?id=116882

        Reviewed by Eric Carlson.

        Remove an inappropriate assert. No cues coming through repositionGenericCue will be WebVTT ones.

        * rendering/RenderTextTrackCue.cpp:
        (WebCore::RenderTextTrackCue::repositionGenericCue):

2013-05-28  Alberto Garcia  <agarcia@igalia.com>

        [BlackBerry] GraphicsContext: add missing definitions.
        https://bugs.webkit.org/show_bug.cgi?id=115515

        Reviewed by Rob Buis.

        * platform/graphics/GraphicsContext.h:
        (Graphics):
        Add definition for PlatformGraphicsContext.
        * platform/graphics/blackberry/GraphicsContextBlackBerry.cpp:
        Include RoundedRect.h

2013-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Fix style issues in BlackBerry accelerated compositing backend
        https://bugs.webkit.org/show_bug.cgi?id=116604

        Reviewed by Carlos Garcia Campos.

        PR 273550, 99638

        Remove the "get" prefix from getters in the WebKit- and compositing-
        thread layer classes, as well as LayerRendererSurface. Clarify which
        geometry-related getters return normalized device coordinates by adding
        a comment.

        Also remove dead code related to LayerData::m_holePunchClipRect, which
        was part of an eventually disabled fix for video clipping in iframes,
        PR 99638. Since we now use AC layers for iframes, the bug is no longer
        reproducible, and the dead code will never need to be enabled again.

        No change in behavior, no new tests.

        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::setDrawTransform):
        (WebCore::LayerCompositingThread::transformedHolePunchRect):
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::drawSurface):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (WebCore::LayerCompositingThread::sublayers): Removed "get" prefix
        (LayerCompositingThread):
        (WebCore::LayerCompositingThread::boundingBox): Renamed from "getDrawRect"
        (WebCore::LayerCompositingThread::transformedBounds): Removed "get" prefix
        (WebCore::LayerCompositingThread::transformedHolePunchRect): Removed "get" prefix
        * platform/graphics/blackberry/LayerData.h:
        (LayerData): Removed unused data member "m_holePunchClipRect"
        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
        (WebCore::LayerFilterRenderer::applyActions):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::compositeLayers):
        (WebCore::LayerRenderer::drawDebugBorder):
        (WebCore::LayerRenderer::drawHolePunchRect):
        (WebCore::LayerRenderer::prepareFrameRecursive):
        (WebCore::LayerRenderer::updateLayersRecursive):
        (WebCore::collect3DPreservingLayers):
        (WebCore::LayerRenderer::compositeLayersRecursive):
        * platform/graphics/blackberry/LayerRendererSurface.cpp:
        (WebCore::LayerRendererSurface::boundingBox):
        * platform/graphics/blackberry/LayerRendererSurface.h:
        (WebCore::LayerRendererSurface::boundingBox): Renamed from "drawRect" because that sounds like a verb, and this is a getter
        * platform/graphics/blackberry/LayerWebKitThread.h:
        (WebCore::LayerWebKitThread::sublayers): Removed "get" prefix
        * platform/graphics/blackberry/VideoLayerWebKitThread.cpp:
        (WebCore::VideoLayerWebKitThread::setHolePunchRect):
        (WebCore::VideoLayerWebKitThread::boundsChanged):

2013-05-28  Jer Noble  <jer.noble@apple.com>

        Made AudioNode an EventTarget
        https://bugs.webkit.org/show_bug.cgi?id=116871

        Merge: https://chromium.googlesource.com/chromium/blink/+/ef37484162ddb95d677dcfdcdd778ec60590928b

        Reviewed by Darin Adler.

        Tests: webaudio/audionode-expected.txt:
               webaudio/audionode.html:

        Add the requisite boilerplate to allow AudioNode to become an EventTarget. Remove
        all that same boilerplate from ScriptProcessorNode now that it's base class
        is an EventTarget.

        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::interfaceName): Added boilerplate.
        (WebCore::AudioNode::scriptExecutionContext): Return the AudioContext's context.
        (WebCore::AudioNode::processIfNecessary): Whitespace.
        * Modules/webaudio/AudioNode.h:
        * Modules/webaudio/AudioNode.idl: Make AudioNode an EventTarget.
        * Modules/webaudio/ScriptProcessorNode.cpp: Remove EventTarget boilerplate.
        * Modules/webaudio/ScriptProcessorNode.h: Ditto.
        * Modules/webaudio/ScriptProcessorNode.idl: Ditto.
        * dom/EventTarget.h: Mark AudioNode as an EventTarget.
        * dom/EventTargetFactory.in: Ditto.

2013-05-28  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] backface-visibility: hidden doesn't work properly with masks and filters
        https://bugs.webkit.org/show_bug.cgi?id=116616

        Reviewed by Carlos Garcia Campos.

        The BlackBerry::Platform::Graphics::GraphicsContext generates geometry
        with a different winding order than the accelerated compositing backend
        of the BlackBerry port. So, when we switched from Skia to this new
        rendering engine, we switched from glFrontFace(GL_CCW) to
        glFrontFace(GL_CW), and all was well when drawing display lists.
        However, we forgot to update the winding order of geometry generated
        within the accelerated compositing backend, which is used for masks and
        filters, so they were getting erroneously culled out when
        backface-visibility: hidden was applied to them. Fixed by switching the
        winding order of all geometry generated up here, which has the added
        benefit of enabling us to use TransformationMatrix::mapQuad instead of
        transforming point-by-point.

        To further complicate matters, a right-side up transform is used when
        drawing layers into surfaces, reversing the winding order and requiring
        us to switch back to glFrontFace(GL_CCW) temporarily, when drawing
        layers to surfaces, or the layers will get culled out inside the
        surface.

        Also fix spelling error, "drawed" should be "drawn".

        No new tests, this is only detectable by pixel tests, which the
        BlackBerry port currently doesn't support.

        PR 341945.

        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::setDrawTransform):
        (WebCore::getTransformedRect):
        (WebCore::LayerCompositingThread::drawTextures):
        (WebCore::LayerCompositingThread::drawSurface):
        * platform/graphics/blackberry/LayerCompositingThread.h:
        (LayerCompositingThread):
        (WebCore::LayerCompositingThread::origin):
        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
        (WebCore):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::compositeLayers):
        (WebCore):
        (WebCore::LayerRenderer::drawLayersOnSurfaces):
        * platform/graphics/blackberry/LayerRendererSurface.cpp:
        (WebCore::LayerRendererSurface::drawRect):
        (WebCore::LayerRendererSurface::transformedBounds):
        * platform/graphics/blackberry/LayerRendererSurface.h:
        (WebCore::LayerRendererSurface::origin):
        (LayerRendererSurface):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore):
        (WebCore::loadBufferingImageData):
        (WebCore::MediaPlayerPrivate::drawBufferingAnimation):

2013-05-28  Andreas Kling  <akling@apple.com>

        Move Node::dispatchChangeEvent() to HTMLFormControlElement.
        <http://webkit.org/b/116866>

        Reviewed by Anders Carlsson.

        ...and devirtualize it, since it had no overrides.

        * dom/Node.h:
        * dom/Node.cpp:
        * html/HTMLFormControlElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::dispatchChangeEvent):
        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::setFiles):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::dispatchFormControlChangeEvent):

2013-05-28  Sergio Villar Senin  <svillar@igalia.com>

        Refactoring CSS grammar
        https://bugs.webkit.org/show_bug.cgi?id=116679

        Reviewed by Andreas Kling.

        From Blink r149948 by <serya@chromium.org>

        Added "closing_parenthesis:" and "error_recovery:" to avoid code
        duplication in a couple of error recovery rules. Some other rules
        were also refactored which allows to reduce the the number of
        shift/reduce conflicts by 2.

        No new tests required as this is just a refactoring, no new
        functionality added.

        * css/CSSGrammar.y.in:

2013-05-28  Sergio Villar Senin  <svillar@igalia.com>

        Invalid block doesn't make declaration invalid
        https://bugs.webkit.org/show_bug.cgi?id=115709

        Reviewed by Andreas Kling.

        From Blink r149446 by <serya@chromium.org>

        Added a new rule "declaration_recovery:" which covers any kind of
        "invalid_block_list maybe_space" sequence. By appending this new
        rule to every rule reductable to "declaration:" we can remove some
        redundant rules and improve error recovery of some others that
        were only accepting exactly one error.

        One of the rules being removed was preventing invalid blocks in a
        declaration to invalidate the whole declaration. The rule was
        reporting the syntax error but at the same time accepting the
        invalid block as part of a valid declaration.

        * css/CSSGrammar.y.in:

2013-05-28  Andreas Kling  <akling@apple.com>

        Move dispatching of focus-related events from Node to Element.
        <http://webkit.org/b/116864>

        Reviewed by Antti Koivisto.

        ...and pass around pointers to Element instead of Node.

        * dom/Node.cpp:
        * dom/Node.h:
        * dom/Element.h:
        * dom/Element.cpp:
        (WebCore::Element::dispatchFocusInEvent):
        (WebCore::Element::dispatchFocusOutEvent):
        (WebCore::Element::dispatchFocusEvent):
        (WebCore::Element::dispatchBlurEvent):

            Moved here from Node.

        * html/HTMLFormControlElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
        * html/HTMLSelectElement.h:
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::dispatchFocusEvent):
        (WebCore::HTMLSelectElement::dispatchBlurEvent):
        * html/HTMLTextFormControlElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):

            Update subclass overrides and sprinkle OVERRIDE/FINAL.

2013-05-28  Zan Dobersek  <zdobersek@igalia.com>

        Remove CachedResourceRequest::initiatorElement
        https://bugs.webkit.org/show_bug.cgi?id=116862

        Reviewed by Andreas Kling.

        The CachedResourceRequest::initiatorElement method is not used anywhere and should be removed.

        * loader/cache/CachedResourceRequest.cpp: Remove the initiatorElement method definition.
        * loader/cache/CachedResourceRequest.h:
        (CachedResourceRequest): Remove the initiatorElement method declaration.

2013-05-28  Andreas Kling  <akling@apple.com>

        Document::setFocusedNode() should be setFocusedElement().
        <http://webkit.org/b/116857>

        Reviewed by Antti Koivisto.

        Only Elements can be focused, so tighten Document's idea of what's focused.

        Most of this patch is just updating call sites for the new names and removing
        now-unnecessary isElementNode() checks and casts.

        * WebCore.exp.in:
        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::focusedUIElementForPage):
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::isFocused):
        (WebCore::AccessibilityRenderObject::setFocused):
        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
        * bindings/objc/DOM.mm:
        (-[DOMElement isFocused]):
        * dom/Document.cpp:
        (WebCore::Document::dispose):
        (WebCore::Document::detach):
        (WebCore::Document::focusedNodeRemoved):
        (WebCore::Document::removeFocusedNodeOfSubtree):
        (WebCore::Document::setFocusedElement):
        (WebCore::Document::updateFocusAppearanceTimerFired):
        (WebCore::eventTargetNodeForDocument):
        * dom/Document.h:
        (Document):
        (WebCore::Document::focusedElement):
        * dom/Element.cpp:
        (WebCore::Element::attach):
        (WebCore::Element::focus):
        (WebCore::Element::blur):
        (WebCore::Element::cancelFocusAppearanceUpdate):
        * dom/Node.cpp:
        (WebCore::Node::rendererIsEditable):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::focusedElement):
        * dom/UserTypingGestureIndicator.cpp:
        (WebCore::UserTypingGestureIndicator::UserTypingGestureIndicator):
        * editing/Editor.cpp:
        (WebCore::Editor::setBaseWritingDirection):
        (WebCore::Editor::setComposition):
        (WebCore::Editor::guessesForMisspelledOrUngrammatical):
        * editing/EditorCommand.cpp:
        (WebCore::verticalScrollDistance):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::selectAll):
        (WebCore::FrameSelection::focusedOrActiveStateChanged):
        (WebCore::FrameSelection::setFocusedElementIfNeeded):
        (WebCore::FrameSelection::currentForm):
        * history/CachedPage.cpp:
        (WebCore::CachedPage::restore):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateType):
        (WebCore::HTMLInputElement::attach):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::setValueCommon):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
        (WebCore::HTMLTextFormControlElement::selectionStart):
        (WebCore::HTMLTextFormControlElement::selectionEnd):
        (WebCore::HTMLTextFormControlElement::selectionDirection):
        * html/RadioInputType.cpp:
        (WebCore::RadioInputType::handleKeydownEvent):
        (WebCore::RadioInputType::isKeyboardFocusable):
        * html/shadow/DateTimeEditElement.cpp:
        (WebCore::DateTimeEditElement::focusedFieldIndex):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::stopLoading):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::focus):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::scrollOverflow):
        (WebCore::EventHandler::logicalScrollOverflow):
        (WebCore::EventHandler::dispatchMouseEvent):
        (WebCore::EventHandler::sendContextMenuEventForKey):
        (WebCore::EventHandler::capsLockStateMayHaveChanged):
        * page/FocusController.cpp:
        (WebCore::dispatchEventsOnWindowAndFocusedNode):
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        (WebCore::FocusController::setFocusedElement):
        (WebCore::FocusController::findFocusCandidateInContainer):
        (WebCore::FocusController::advanceFocusDirectionallyInContainer):
        (WebCore::FocusController::advanceFocusDirectionally):
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor):
        * plugins/PluginView.cpp:
        (WebCore::PluginView::focusPluginElement):
        * plugins/efl/PluginViewEfl.cpp:
        (WebCore::PluginView::setFocus):
        * plugins/mac/PluginViewMac.mm:
        (WebCore::PluginView::platformStart):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paintAreaElementFocusRing):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintItemForeground):
        (WebCore::RenderListBox::paintItemBackground):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isFocused):

2013-05-28  Sergio Villar Senin  <svillar@igalia.com>

        Web Inspector: Enable CSS logging
        https://bugs.webkit.org/show_bug.cgi?id=113401

        Reviewed by Benjamin Poulain.

        From Blink r149265 by <serya@chromium.org>

        CSS logging was disabled in r147028 to prevent message overflow in
        the inspector console. This change restores it by modifying the
        CSS grammar in order to reduce as much consecutive errors as
        possible in 'declaration_list' and 'decl_list' rules.

        This way, for rules like 'x { color: ### }' only the first '#'
        will be reported as error (instead of 3 identical errors).

        The rule 'declaration' still produces multiple errors, because it
        does not eat as much errors as possible. So in order not to create
        a complex risky patch we just disable logging in the parser for
        that rule.

        * css/CSSGrammar.y.in:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::CSSParser):
        (WebCore::CSSParser::parseSheet):
        (WebCore::CSSParser::syntaxError):
        (WebCore::CSSParser::isLoggingErrors):
        (WebCore::CSSParser::rewriteSpecifiers):
        * css/CSSParser.h:
        (CSSParser):

2013-05-27  Patrick Gansterer  <paroga@webkit.org>

        Build fix for WinCE after r150730.

        * platform/graphics/FontFallbackList.cpp:
        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):

2013-05-27  Patrick Gansterer  <paroga@webkit.org>

        Build fix for WinCE after r150772.

        * platform/win/ClipboardWin.cpp:
        (WebCore):
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::readFilenames):
        (WebCore):

2013-05-27  Darin Adler  <darin@apple.com>

        Fix build.

        * html/HTMLAnchorElement.cpp:
        (WebCore::hasNonEmptyBox): Fix typo.

2013-05-27  Darin Adler  <darin@apple.com>

        Move hasNonEmptyBoundingBox from Node to HTMLAnchorElement
        https://bugs.webkit.org/show_bug.cgi?id=116842

        Reviewed by Antti Koivisto.

        * dom/Node.cpp: Removed hasNonEmptyBoundingBox.
        * dom/Node.h: Ditto.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::isMouseFocusable): Fixed #if to be more readable and
        added more-explicit clearer comments. No behavior change.
        (WebCore::hasNonEmptyBox): Added.  Has the same code that was in
        Node::hasNonEmptyBoundingBox with some additional comments.
        (WebCore::HTMLAnchorElement::isKeyboardFocusable): Call hasNonEmptyBox.

2013-05-27  Darin Adler  <darin@apple.com>

        Move isBlockFlowElement and related functions out of the Node class into editing code
        https://bugs.webkit.org/show_bug.cgi?id=116846

        Reviewed by Antti Koivisto.

        * dom/Node.cpp: Removed isBlockFlowElement, enclosingBlockFlowElement, and
        inSameContainingBlockFlowElement. These are all editing functions that don't
        belong in the Node class, and mostly-deprecated ones to boot.
        * dom/Node.h: Ditto.

        * dom/Position.cpp:
        (WebCore::inSameEnclosingBlockFlowElement): Added. This editing-specific function
        is used only here, so put it here.
        (WebCore::Position::rendersInDifferentPosition): Updated to call new function above.
        (WebCore::Position::leadingWhitespacePosition): Ditto.

        * editing/InsertLineBreakCommand.cpp:
        (WebCore::InsertLineBreakCommand::insertNodeAfterPosition): Use
        deprecatedEnclosingBlockFlowElement at its new location.
        (WebCore::InsertLineBreakCommand::insertNodeBeforePosition): Ditto.

        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::doApplyForSingleParagraph): use
        isBlockFlowElement at its new location.
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::enclosingInline): Ditto.

        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::canonicalPosition): Use deprecatedEnclosingBlockFlowElement
        at its new location.
        (WebCore::enclosingBlockFlowElement): Ditto. Also added FIXME.
        * editing/VisibleSelection.cpp:
        (WebCore::makeSearchRange): Ditto.

        * editing/htmlediting.cpp:
        (WebCore::isBlockFlowElement): Added. Same as the Node::isBlockFlowElement
        function, but here because this is an editing function, not suitable as a Node member.
        (WebCore::deprecatedEnclosingBlockFlowElement): Ditto. Added "deprecated" to the name
        since the Node member function had a comment saying it was deprecated. Also changed so
        it tolerates a 0 for an argument, which made it easier for one caller.

        * editing/htmlediting.h: Added the two new functions.

2013-05-27  Seokju Kwon  <seokju.kwon@gmail.com>

        Add guard around paintForFixedRootBackground
        https://bugs.webkit.org/show_bug.cgi?id=116754

        Reviewed by Simon Fraser.

        paintForFixedRootBackground is only used when ACCELERATED_COMPOSITING is enabled.

        No new tests, no behavior change.

        * rendering/RenderLayer.cpp:
        (WebCore):

2013-05-27  Seokju Kwon  <seokju.kwon@gmail.com>

        Remove a leftover Pagepoup from PickerIndicatorElement.h
        https://bugs.webkit.org/show_bug.cgi?id=116801

        Reviewed by Anders Carlsson.

        No new tests, no behavior change.

        * html/shadow/PickerIndicatorElement.h:
        (WebCore):

2013-05-27  Claudio Saavedra  <csaavedra@igalia.com>

        [CSS] -webkit-var prefix is case-sensitive
        https://bugs.webkit.org/show_bug.cgi?id=116829

        Reviewed by Darin Adler.

        Tests: Added case to fast/css/variables/case-sensitive.html

        * css/CSSParser.cpp:
        (WebCore::isEqualToCSSCaseSensitiveIdentifier): Add variant to
        IsEqualToCSSIdentifier that respects case-sensitivity.
        (WebCore::CSSParser::realLex): Use the above method for CSS
        variable declarations.

2013-05-27  Zalan Bujtas  <zalan@apple.com>

        drop-shadow filter with overflow:hidden child misbehaves.
        https://bugs.webkit.org/show_bug.cgi?id=109783

        Reviewed by Simon Fraser.

        Applying CSS filters only to the scrollbar rect leaves rendering
        artefacts. Filters should skip such partial repaints.

        Tests: Test framework uses mock theme for scrollbars. Such scrollbars do not
        initiate partial repaints.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::setupFilters):
        (WebCore::RenderLayer::paintLayerContents):
        * rendering/RenderLayer.h:
        (RenderLayer):

2013-05-27  Xueqing Huang  <huangxueqing@baidu.com>

        Move Windows port off legacy clipboard.
        https://bugs.webkit.org/show_bug.cgi?id=116258

        Reviewed by Darin Adler.

        Clipboard refactor, no new tests.

        * dom/Clipboard.h:
        * page/win/EventHandlerWin.cpp:
        (WebCore::EventHandler::createDraggingClipboard): Create Clipboard instead of ClipboardWin.
        * platform/Pasteboard.h:
        (WebCore::Pasteboard::dataObject): Get IDataObject by Clipborad.
        (WebCore::Pasteboard::writableDataObject): Get WCDataObject by Clipborad.
        * platform/win/ClipboardWin.cpp:
        (WebCore::Clipboard::createDragImage): Change parameter name loc to dragLocation.
        (WebCore::Clipboard::declareAndWriteDragImage): Implement declareAndWriteDragImage use WCDataObject exposed by Pasteboard.
        * platform/win/ClipboardWin.h: Removed.
        * platform/win/EditorWin.cpp:
        (WebCore::Editor::newGeneralClipboard): Create Clipboard instead of ClipboardWin.
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::createForCopyAndPaste): Create a Pasteboard.
        (WebCore::Pasteboard::createPrivate): Ditto.
        (WebCore::Pasteboard::createForDragAndDrop): Ditto.
        (WebCore::Pasteboard::finishCreatingPasteboard): Create Pasteboard use Windows API.
        (WebCore::Pasteboard::Pasteboard):
        (WebCore::clipboardTypeFromMIMEType): Copied from ClipboardWin.cpp.
        (WebCore::Pasteboard::clear): Ditto.
        (WebCore::Pasteboard::hasData): Ditto.
        (WebCore::addMimeTypesForFormat): Ditto.
        (WebCore::Pasteboard::types): Ditto.
        (WebCore::Pasteboard::readString): Ditto.
        (WebCore::Pasteboard::readFilenames): Ditto.
        (WebCore::writeURL): Ditto.
        (WebCore::Pasteboard::writeString): Ditto.
        (WebCore::Pasteboard::setDragImage): Ditto.
        (WebCore::Pasteboard::writeRangeToDataObject): Write range to WCDataObject.
        (WebCore::Pasteboard::writeSelection):
        (WebCore::Pasteboard::writePlainTextToDataObject): Write PlainText to WCDataObject.
        (WebCore::Pasteboard::writePlainText):
        (WebCore::pathRemoveBadFSCharacters): Copied from ClipboardWin.cpp.
        (WebCore::filesystemPathFromUrlOrTitle): Ditto.
        (WebCore::writeFileToDataObject): Ditto.
        (WebCore::Pasteboard::writeURLToDataObject): Write URL to WCDataObject.
        (WebCore::Pasteboard::writeURL): Copied from ClipboardWin.cpp.
        (WebCore::Pasteboard::writePasteboard): Copied from Pasteboard::writeClipboard.
        (WebCore::Pasteboard::documentFragment): Copied from ClipboardWin.cpp.
        (WebCore::Pasteboard::setExternalDataObject): Clipboard can set new IDataObject.
        (WebCore::getCachedImage): Copied from ClipboardWin.cpp.
        (WebCore::createGlobalImageFileDescriptor): Ditto.
        (WebCore::createGlobalImageFileContent): Ditto.
        (WebCore::createGlobalHDropContent): Ditto.
        (WebCore::Pasteboard::writeImageToDataObject): Expose to make Clipboard implement declareAndWriteDragImage.
        (WebCore::Pasteboard::writeURLToWritableDataObject): Ditto.

2013-05-27  Tim Horton  <timothy_horton@apple.com>

        PDFPlugin: Main-frame PDFPlugin Accessibility
        https://bugs.webkit.org/show_bug.cgi?id=116563
        <rdar://problem/13458534>

        Reviewed by Sam Weinig.

        * WebCore.exp.in: Export AffineTransform::mapRect.

2013-05-27  Tiancheng Jiang  <tijiang@rim.com>

        Checkbox UX update.
        https://bugs.webkit.org/show_bug.cgi?id=116838.

        Reviewed by Rob Buis.

        BlackBerry PR 342302.
        Internally Reviewed by Jeff Rogers.
        Remove old background and change pressed checkmark image.

        * platform/blackberry/RenderThemeBlackBerry.cpp:
        (WebCore::RenderThemeBlackBerry::paintCheckbox):

2013-05-27  Sam Weinig  <sam@webkit.org>

        When the background is completely transparent we should be conservative and use the default scrollbar style, not the light one
        https://bugs.webkit.org/show_bug.cgi?id=116836
        <rdar://problem/13949905>

        Reviewed by Simon Fraser.

        * page/FrameView.cpp:
        (WebCore::FrameView::recalculateScrollbarOverlayStyle):
        Don't use the light style when the background is completely transparent.

2013-05-27  Patrick Gansterer  <paroga@webkit.org>

        Use ICU_INCLUDE_DIRS in BlackBerry CMake files
        https://bugs.webkit.org/show_bug.cgi?id=116210

        Reviewed by Rob Buis.

        Set and use the ICU_INCLUDE_DIRS variable to avoid
        duplicated adding of the ICU include directory.

        * PlatformBlackBerry.cmake:

2013-05-27  Antti Koivisto  <antti@apple.com>

        Tighten FontGlyphs::glyphDataAndPageForCharacter to take FontDescription
        https://bugs.webkit.org/show_bug.cgi?id=116823

        Reviewed by Andreas Kling.

        FontGlyphs does not need to know about Font anymore.

        * platform/graphics/Font.cpp:
        (WebCore::Font::Font):
        (WebCore::Font::operator=):
        * platform/graphics/Font.h:
        (WebCore::Font::isPlatformFont):
        (WebCore::Font::glyphDataAndPageForCharacter):
        (Font):
        * platform/graphics/FontCache.h:
        * platform/graphics/FontFallbackList.cpp:
        (WebCore::FontGlyphs::FontGlyphs):
        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
        * platform/graphics/FontFallbackList.h:
        (WebCore):
        (WebCore::FontGlyphs::createForPlatformFont):
        
            Tweaked the name.

        (WebCore::FontGlyphs::isForPlatformFont):
        
            Move knowledge about platform font to FontGlyphs as it is needed for resolving system fallback on Mac.

        * platform/graphics/blackberry/FontCacheBlackBerry.cpp:
        (WebCore::FontCache::systemFallbackForCharacters):
        * platform/graphics/freetype/FontCacheFreeType.cpp:
        (WebCore::FontCache::systemFallbackForCharacters):
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::FontCache::systemFallbackForCharacters):
        * platform/graphics/qt/FontCacheQt.cpp:
        (WebCore::FontCache::systemFallbackForCharacters):
        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::FontCache::systemFallbackForCharacters):
        * platform/graphics/wince/FontCacheWinCE.cpp:
        (WebCore::FontCache::systemFallbackForCharacters):
        
            More descriptive name and tighter interface.

2013-05-27  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Prevent unnecessary copy of LayoutRect objects
        https://bugs.webkit.org/show_bug.cgi?id=116828

        Reviewed by Andreas Kling.

        Use const references for parameter passing.
        No functional change, no new tests.

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::paintFlowThreadPortionInRegion):
        (WebCore::RenderFlowThread::hitTestFlowThreadPortionInRegion):
        * rendering/RenderFlowThread.h:
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
        * rendering/RenderRegion.h:

2013-05-27  Leo Yang  <leoyang@rim.com>

        [BlackBerry] Reveal HTTP error code for XHR even if there is no response body
        https://bugs.webkit.org/show_bug.cgi?id=116543

        Reviewed by Rob Buis.
        Reviewed internally by Joe Mason.

        It's a regression introduced by r132556.
        BlackBerry is doing friendly HTTP error handling: if there is no response body
        for an HTTP error it will display an error message made by the port. But for a
        XHR request, which usually does not result in displaying error messages to the
        end user, HTTP error code should be revealed to let the JavaScript know what
        the actual server error code is.

        Covered by existing tests:
        ManualTests/blackberry/head-xhr-nonexistant-file.html
        LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-check-head-readystate-for-404.html
        LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-check-get-readystate-for-404-without-body.html

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::shouldNotifyClientFailed):

2013-05-27  Tiancheng Jiang  <tijiang@rim.com>

        Adjust date input width.
        https://bugs.webkit.org/show_bug.cgi?id=100760.

        Reviewed by Rob Buis.

        BlackBerry PR 343497.
        Internally Reviewed by Jeff Rogers.

        Set width to auto to fit the string length.

        * css/themeBlackBerry.css:
        (input[type="date"], input[type="datetime"], input[type="datetime-local"], input[type="time"], input[type="month"]):

2013-05-27  Andreas Kling  <akling@apple.com>

        Document::setHoveredNode() should be setHoveredElement().
        <http://webkit.org/b/116819>

        Reviewed by Antti Koivisto.

        Only Elements can be hovered, teach Document about this.

        * dom/Document.h:
        * dom/Document.cpp:
        (WebCore::Document::dispose):
        (WebCore::Document::detach):

            m_hoverNode => m_hoveredElement.
            Removed hoverNode() and setHoverNode() since those were only used internally.

        (WebCore::Document::updateHoverActiveState):

            Updated for hovered things always being Elements.

        (WebCore::Document::hoveredElementDidDetach):
        * dom/Element.cpp:
        (WebCore::Element::detach):

            Renamed Document::hoveredNodeDetached() to hoveredElementDidDetach() and fix it up
            following the same pattern as elementInActiveChainDidDetach().

2013-05-27  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        [Qt] REGRESSION(r150716): It made 15 inspector and 1 mozilla test to assert
        https://bugs.webkit.org/show_bug.cgi?id=116822

        Reviewed by Andreas Kling.

        The input fontDescription may have more than one family defined.

        * platform/qt/RenderThemeQStyle.cpp:
        (WebCore::RenderThemeQStyle::adjustButtonStyle):

2013-05-27  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>

        [Qt][Win] Input events aren't mapped properly with windowless plugins.
        https://bugs.webkit.org/show_bug.cgi?id=116094

        Reviewed by Tor Arne Vestbø.

        The events are first sent properly but Flash then immediately repaints
        and this causes flickering painting.
        The issue is that Flash seems to be doing some input event tracking of
        its own internally, using the HWND returned through NPN_GetValue(NPNVnetscapeWindow).

        We are currently using two coordinate systems for windowless plugins on Windows with Qt:
        - FrameView coordinates: Used for input events and ajusted with the WM_WINDOWPOSCHANGED message
        - Drawable coordinates: Used by WM_PAINT and adjusted with NPP_SetWindow

        This patch fixes the bug by mapping input events to the native window returned
        as NPNVnetscapeWindow instead of the FrameView to ensure that those coordinates will match
        the ones used by Flash internally.
        With this we shouldn't be using FrameView coordinates anywhere for windowless plugins
        on Windows with Qt.

        * platform/qt/QWebPageClient.h:
        (QWebPageClient):
          Added mapToOwnerWindow to the interface, mapping from the FrameView up to the wrapping nativeParentWidget.
        * plugins/win/PluginViewWin.cpp:
        (WebCore::contentsToNativeWindow):
        (WebCore::PluginView::paintIntoTransformedContext):
        (WebCore::PluginView::handleMouseEvent):

2013-05-27  Antti Koivisto  <antti@apple.com>

        Tighten FontGlyphs interfaces to take FontDescription instead of Font
        https://bugs.webkit.org/show_bug.cgi?id=116818

        Reviewed by Andreas Kling.

        This gives better understanding of what the actual inputs are.

        * WebCore.exp.in:
        * platform/graphics/Font.h:
        (WebCore::Font::primaryFont):
        (WebCore::Font::fontDataAt):
        (WebCore::Font::isFixedPitch):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::getFontData):
        * platform/graphics/FontCache.h:
        * platform/graphics/FontFallbackList.cpp:
        (WebCore::FontGlyphs::determinePitch):
        (WebCore::FontGlyphs::realizeFontDataAt):
        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
        * platform/graphics/FontFallbackList.h:
        (WebCore::FontGlyphs::primaryFontData):
        (WebCore::FontGlyphs::isFixedPitch):
        (WebCore::FontGlyphs::primarySimpleFontData):
        * platform/graphics/blackberry/FontCacheBlackBerry.cpp:
        * platform/graphics/freetype/FontCacheFreeType.cpp:
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::FontCache::similarFontPlatformData):
        
            Drop get* naming and make this Mac only as no other platform has it.

        * platform/graphics/qt/FontCacheQt.cpp:
        * platform/graphics/win/FontCacheWin.cpp:
        * platform/graphics/wince/FontCacheWinCE.cpp:
        (WebCore):

2013-05-27  Andreas Kling  <akling@apple.com>

        Strengthen typing of detaching an Element from Document's :active chain.
        <http://webkit.org/b/116815>

        Reviewed by Antti Koivisto.

        Tiny cleanup now that the :active chain can only contain elements.
        Rename Document::activeChainNodeDetached() to elementInActiveChainDidDetach().

        * dom/Element.cpp:
        (WebCore::Element::detach):
        * dom/Document.h:
        * dom/Document.cpp:
        (WebCore::Document::elementInActiveChainDidDetach):

            Rename, take Element*, remove silly condition that was always true.

2013-05-27  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Remove the offsetFromLogicalTopOfFirstPage parameter from layout functions
        https://bugs.webkit.org/show_bug.cgi?id=116441

        Reviewed by David Hyatt.

        The patch changes the following things:
        - exposes offsetFromLogicalTopOfFirstPage() to all the RenderBoxes;
        - offsetFromLogicalTopOfFirstPage() is now safe to call from any box inside a flow thread, not only the
        currently being laid out;
        - removes the offsetFromLogicalTopOfFirstPage parameter from all the layout functions
        that didn't actually required it; when the value is necessary, the offsetFromLogicalTopOfFirstPage
        function is called instead;
        - RenderFlowThread now handles its own logic for obtaining the offset from logical top of the first
        region for a box, based on the layout states pushed on RenderView; it provides a better caching mechanism
        that can be used for all the ancestor containing blocks of the current box being laid out.

        The RenderBoxRegionInfo structures are cached only based on the box and the region. This means that
        passing around a value for offsetFromLogicalTopOfFirstPage different in some cases than others was
        risky. If there is a possibility of having a different box info result for a different offset
        then the cache is not working correctly.

        Tests: No function change, no tests.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
        (WebCore::RenderBlock::logicalLeftOffsetForContent):
        (WebCore::RenderBlock::logicalRightOffsetForContent):
        (WebCore::RenderBlock::getClearDelta):
        (WebCore::RenderBlock::lineWidthForPaginatedLineChanged):
        (WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage):
        (WebCore::RenderBlock::logicalWidthChangedInRegions):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::availableLogicalWidthForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::startOffsetForLine):
        (WebCore::RenderBlock::endOffsetForLine):
        (WebCore::RenderBlock::availableLogicalWidthForContent):
        (WebCore::RenderBlock::startOffsetForContent):
        (WebCore::RenderBlock::endOffsetForContent):
        (WebCore::RenderBlock::logicalLeftOffsetForContent):
        (WebCore::RenderBlock::logicalRightOffsetForContent):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::borderBoxRectInRegion):
        (WebCore::RenderBox::constrainLogicalWidthInRegionByMinMax):
        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
        (WebCore::RenderBox::containingBlockLogicalWidthForContentInRegion):
        (WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
        (WebCore::RenderBox::renderBoxRegionInfo):
        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
        (WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
        (WebCore::computeInlineStaticDistance):
        (WebCore::RenderBox::computePositionedLogicalWidth):
        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
        (WebCore::RenderBox::computePositionedLogicalHeight):
        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
        (WebCore::RenderBox::offsetFromLogicalTopOfFirstPage):
        * rendering/RenderBox.h:
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMainAxisExtentForChild):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock):
        (WebCore::RenderFlowThread::hasCachedOffsetFromLogicalTopOfFirstRegion):
        (WebCore::RenderFlowThread::cachedOffsetFromLogicalTopOfFirstRegion):
        (WebCore::RenderFlowThread::setOffsetFromLogicalTopOfFirstRegion):
        (WebCore::RenderFlowThread::clearOffsetFromLogicalTopOfFirstRegion):
        (WebCore::RenderFlowThread::currentActiveRenderBox):
        (WebCore::RenderFlowThread::pushFlowThreadLayoutState):
        (WebCore::RenderFlowThread::popFlowThreadLayoutState):
        (WebCore::RenderFlowThread::offsetFromLogicalTopOfFirstRegion):
        (WebCore::RenderFlowThread::adjustedPositionRelativeToOffsetParent):
        * rendering/RenderFlowThread.h:
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::updateLogicalWidth):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::pushLayoutState):
        (WebCore::RenderView::pushLayoutStateForCurrentFlowThread):
        (WebCore::RenderView::popLayoutStateForCurrentFlowThread):
        * rendering/RenderView.h:
        (WebCore::RenderView::pushLayoutState):
        (WebCore::RenderView::popLayoutState):

2013-05-27  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        Active DOM objects stopped twice
        https://bugs.webkit.org/show_bug.cgi?id=116524

        Reviewed by Alexey Proskuryakov.

        Only iterate over all active DOM object to stop them once.

        To ensure later created active DOM objects are stopped,
        suspendActiveDOMObjectIfNeeded now also stops active DOM objects
        if needed. This also fixes an existing bug when active DOM
        objects were created after stopActiveDOMObjects had been called.

        Two existing tests creates new active DOM objects after stopActiveDOMObjects
        has been called:
            fast/dom/xmlhttprequest-constructor-in-detached-document.html
            fast/dom/Window/timer-null-script-execution-context.html

        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
        (WebCore::ScriptExecutionContext::suspendActiveDOMObjectIfNeeded):

2013-05-27  Charles Wei  <charles.wei@torchmobile.com.cn>

        Remove redundant CachedRawResource::loader()
        https://bugs.webkit.org/show_bug.cgi?id=116805

        Reviewed by Andreas Kling.

        Just remove redundant code, no test case needed.

        * loader/cache/CachedRawResource.cpp:
        * loader/cache/CachedRawResource.h:

2013-05-27  Andreas Kling  <akling@apple.com>

        WinCE build TLC: Node::active() moved to Element.

        * rendering/RenderThemeWinCE.cpp:
        (WebCore::RenderThemeWinCE::paintSearchFieldCancelButton):

2013-05-26  Jaehun Lim  <ljaehun.lim@samsung.com>

        CSSParser::parseImageResolution doesn't need a parameter.
        https://bugs.webkit.org/show_bug.cgi?id=116755

        Reviewed by Darin Adler.

        parseImageResolution() can get CSSPraserValueList from m_valueList directly.

        No new tests, no behavior change.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseImageResolution):
        * css/CSSParser.h:

2013-05-26  Andreas Kling  <akling@apple.com>

        Turn TreeScope::focusedNode() into focusedElement().
        <http://webkit.org/b/116802>

        Reviewed by Darin Adler.

        For the hundredth time, only Elements can be focused!

        This change mostly reverts r121079 since that made things unnecessarily complicated
        just to tweak the behavior of ShadowRoot.activeElement, an API that we don't expose.
        Finding a TreeScope's focused element now does a simple walk up the parent chain instead
        of running the full Shadow DOM re-targeting algorithm.

        (WebCore::TreeScope::focusedElement):

            Simplify and return Element* instead of Node*.

        * dom/TreeScope.h:
        * dom/TreeScope.cpp:
        (WebCore::focusedFrameOwnerElement):

            Make this return Element* as the name already suggested.

        * dom/Document.cpp:
        (WebCore::Document::removeFocusedNodeOfSubtree):
        * dom/Element.cpp:
        (WebCore::Element::blur):
        * dom/ShadowRoot.h:
        (WebCore::ShadowRoot::activeElement):
        * html/HTMLDocument.cpp:
        (WebCore::HTMLDocument::activeElement):

            Simplified call sites that were paranoid about getting a non-Element focused node.

2013-05-26  Dean Jackson  <dino@apple.com>

        Plugins with no src but valid type should not snapshot
        https://bugs.webkit.org/show_bug.cgi?id=116799
        <rdar://problem/13695911>

        Reviewed by Simon Fraser.

        There are a few plug-ins around that don't take any source content
        via the src attribute, but rather just load the binary based on the
        mime-type. In those cases we shouldn't snapshot until we have a
        mechanism to do so.

        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn):
            Add MIMEType logging, and detect the case of no src but valid type.
        * html/HTMLPlugInImageElement.h: Add another SnapshotReason enum for
            this special case.

2013-05-26  Antti Koivisto  <antti@apple.com>

        Encapsulate FontGlyphs
        https://bugs.webkit.org/show_bug.cgi?id=116803

        Reviewed by Andreas Kling.

        FontGlyphs is unfriending Font. Give it a real class interface and some actual code.

        * platform/graphics/Font.cpp:
        (WebCore::Font::Font):
        * platform/graphics/Font.h:
        (WebCore::Font::glyphDataForCharacter):
        (WebCore::Font::glyphDataAndPageForCharacter):
        * platform/graphics/FontFallbackList.cpp:
        (WebCore::FontGlyphs::FontGlyphs):
        (WebCore::isInRange):
        (WebCore::shouldIgnoreRotation):
        (WebCore::glyphDataAndPageForNonCJKCharacterWithGlyphOrientation):
        
            Helpers from FontFastPath.cpp.

        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
        
            This is the primary interface. The code moves here from FontFastPath.cpp.

        * platform/graphics/FontFallbackList.h:
        (WebCore::FontGlyphs::createForPlatformData):
        
            Remove setPlatformData in favor of constructor.

        (WebCore::FontGlyphs::primarySimpleFontData):
        * platform/graphics/FontFastPath.cpp:
        * platform/graphics/GraphicsContext.h:

            Remove a stray function definition also called setPlatformFont().

        * rendering/svg/SVGTextRunRenderingContext.cpp:
        (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter):

2013-05-26  Seokju Kwon  <seokju.kwon@gmail.com>

        Remove a leftover CALENDAR_PICKER from LocaleNone.cpp
        https://bugs.webkit.org/show_bug.cgi?id=116800

        Reviewed by Kent Tamura.

        No new tests, no behavior change.

        * platform/text/LocaleNone.cpp:
        (LocaleNone):

2013-05-26  Antti Koivisto  <antti@apple.com>

        Rename FontFallbackList to FontGlyphs
        https://bugs.webkit.org/show_bug.cgi?id=116797

        Reviewed by Andreas Kling.

        Maybe it was a fallback list once. Nowadays its purpose is to cache realized glyphs and related data.
        
        File renaming will be done separately.

        * WebCore.exp.in:
        * platform/graphics/Font.cpp:
        (WebCore::Font::Font):
        (WebCore::Font::operator=):
        (WebCore::Font::operator==):
        
            Refactored to early return style.

        (WebCore::Font::update):
        (WebCore::Font::width):
        * platform/graphics/Font.h:
        (Font):
        (WebCore::Font::glyphs):
        (WebCore::Font::loadingCustomFonts):
        (WebCore::Font::primaryFont):
        (WebCore::Font::fontDataAt):
        (WebCore::Font::isFixedPitch):
        (WebCore::Font::fontSelector):
        * platform/graphics/FontCache.h:
        (FontCache):
        * platform/graphics/FontFallbackList.cpp:
        (WebCore::FontGlyphs::FontGlyphs):
        (WebCore::FontGlyphs::invalidate):
        (WebCore::FontGlyphs::releaseFontData):
        (WebCore::FontGlyphs::determinePitch):
        (WebCore::FontGlyphs::realizeFontDataAt):
        
            Renamed for clarity along with m_fontList -> m_realizedFontData.

        (WebCore::FontGlyphs::setPlatformFont):
        * platform/graphics/FontFallbackList.h:
        (FontGlyphs):
        (WebCore::FontGlyphs::GlyphPagesStateSaver::GlyphPagesStateSaver):
        (WebCore::FontGlyphs::GlyphPagesStateSaver::~GlyphPagesStateSaver):
        (GlyphPagesStateSaver):
        (WebCore::FontGlyphs::create):
        (WebCore::FontGlyphs::~FontGlyphs):
        (WebCore::FontGlyphs::primaryFontData):
        * platform/graphics/FontFastPath.cpp:
        (WebCore::Font::glyphDataAndPageForCharacter):
        * rendering/svg/SVGTextRunRenderingContext.cpp:
        (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter):

2013-05-26  Kent Tamura  <tkent@chromium.org>

        Remove ENABLE_CALENDAR_PICKER
        https://bugs.webkit.org/show_bug.cgi?id=116795

        Reviewed by Ryosuke Niwa.

        This feature was used only by Chromium port.

        * Resources/pagepopups/calendarPicker.css: Removed.
        * Resources/pagepopups/calendarPicker.js: Removed.
        * css/html.css:
        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU):
        (WebCore):
        * platform/text/LocaleICU.h:
        (LocaleICU):
        * platform/text/PlatformLocale.h:
        (Locale):
        * platform/text/mac/LocaleMac.h:
        (LocaleMac):
        * platform/text/mac/LocaleMac.mm:
        (WebCore::LocaleMac::monthLabels):
        * platform/text/win/LocaleWin.cpp:
        (WebCore::LocaleWin::LocaleWin):
        (WebCore::LocaleWin::monthLabels):
        * platform/text/win/LocaleWin.h:
        (LocaleWin):

2013-05-26  Andreas Kling  <akling@apple.com>

        Move :active chain participation state from Node to Element.
        <http://webkit.org/b/116786>

        Reviewed by Antti Koivisto.

        Only Elements can be in the :active chain so move the logic there from Node.

        * dom/Document.cpp:
        (WebCore::Document::updateHoverActiveState):

            Add isElementNode() type checks when updating the :active chain.

        * dom/Node.h:
        * dom/Node.cpp:
        (WebCore::Node::detach):
        * dom/Element.cpp:
        (WebCore::Element::detach):

            Move the remaining logic for detaching from the UserActionElementSet to Element.

        (WebCore::Element::isUserActionElementInActiveChain):
        * dom/Element.h:
        (WebCore::Element::inActiveChain):

            Move all the :active chain stuff from Node to Element.

        * dom/UserActionElementSet.cpp:
        (WebCore::UserActionElementSet::didDetach):
        * dom/UserActionElementSet.h:
        (WebCore::UserActionElementSet::isInActiveChain):
        (WebCore::UserActionElementSet::setInActiveChain):

            UserActionElementSet now only takes Element* in its API.

2013-05-26  Antti Koivisto  <antti@apple.com>

        Remove FontFamily.h/.cpp
        https://bugs.webkit.org/show_bug.cgi?id=116788

        Reviewed by Anders Carlsson.
        
        Empty files.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/FontDescription.h:
        * platform/graphics/FontFamily.cpp: Removed.
        * platform/graphics/FontFamily.h: Removed.

2013-05-26  Antti Koivisto  <antti@apple.com>

        Use Vector instead of custom linked list for font families
        https://bugs.webkit.org/show_bug.cgi?id=116783

        Reviewed by Andreas Kling.

        Get rid of FontFamily and SharedFontFamily.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::hasSameFont):
        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
        (getAttributeSetForAccessibilityObject):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::fontFamilyFromStyle):
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::ApplyPropertyFontFamily::applyInheritValue):
        (WebCore::ApplyPropertyFontFamily::applyInitialValue):
        (WebCore::ApplyPropertyFontFamily::applyValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForDocument):
        (WebCore::StyleResolver::initializeFontStyle):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::font):
        (WebCore::CanvasRenderingContext2D::setFont):
        * page/PrintContext.cpp:
        (WebCore::PrintContext::pageProperty):
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::systemFont):
        * platform/graphics/Font.h:
        (WebCore::Font::firstFamily):
        (WebCore::Font::familyCount):
        (WebCore::Font::familyAt):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::getFontData):
        * platform/graphics/FontDescription.cpp:
        (SameSizeAsFontDescription):
        * platform/graphics/FontDescription.h:
        (WebCore::FontDescription::FontDescription):
        (WebCore::FontDescription::familyCount):
        (WebCore::FontDescription::firstFamily):
        (WebCore::FontDescription::familyAt):
        (WebCore::FontDescription::families):
        (WebCore::FontDescription::useFixedDefaultSize):
        (WebCore::FontDescription::setOneFamily):
        (WebCore::FontDescription::setFamilies):
        (WebCore::FontDescription::adoptFamilies):
        (WebCore::FontDescription::operator==):
        * platform/graphics/FontFamily.cpp:
        * platform/graphics/FontFamily.h:
        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
        (PlatformCALayerWinInternal::displayCallback):
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::FontCache::getSimilarFontPlatformData):
        * platform/graphics/qt/FontCacheQt.cpp:
        (WebCore::FontCache::getLastResortFallbackFont):
        * platform/gtk/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::systemFont):
        * platform/mac/ThemeMac.mm:
        (WebCore::ThemeMac::controlFont):
        * platform/qt/RenderThemeQStyle.cpp:
        (WebCore::RenderThemeQStyle::adjustButtonStyle):
        * platform/text/transcoder/FontTranscoder.cpp:
        (WebCore::FontTranscoder::converterType):
        * platform/win/DragImageWin.cpp:
        (WebCore::dragLabelFont):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::styleDidChange):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::computeIntrinsicLogicalWidths):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::preferredContentLogicalWidth):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::systemFont):
        (WebCore::RenderThemeMac::setFontFromControlSize):
        * rendering/RenderThemeSafari.cpp:
        (WebCore::RenderThemeSafari::systemFont):
        (WebCore::RenderThemeSafari::setFontFromControlSize):
        * rendering/RenderThemeWin.cpp:
        (WebCore::fillFontDescription):

2013-05-26  Andreas Kling  <akling@apple.com>

        Move "active" state logic from Node to Element.
        <http://webkit.org/b/116785>

        Reviewed by Antti Koivisto.

        Resolve another 7 year old FIXME by merging the "active" state logic from Node and ContainerNode
        and moving it all to Element instead.

        * dom/UserActionElementSet.h:
        (WebCore::UserActionElementSet::isActive):
        (WebCore::UserActionElementSet::setActive):
        * dom/ContainerNode.cpp:
        * dom/ContainerNode.h:
        * dom/Node.cpp:
        * dom/Node.h:
        * dom/Element.h:
        (WebCore::Element::active):
        * dom/Element.cpp:
        (WebCore::Element::isUserActionElementActive):
        (WebCore::Element::setActive):

            Moved here from Node/ContainerNode.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::isPressed):
        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        (WebCore::Document::updateHoverActiveState):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isPressed):
        (WebCore::RenderTheme::isSpinUpButtonPartPressed):
        * rendering/RenderThemeMac.mm:
        (WebCore::getMediaUIPartStateFlags):
        (WebCore::RenderThemeMac::updatePressedState):
        * platform/qt/RenderThemeQt.cpp:
        (WebCore::RenderThemeQt::getMediaControlForegroundColor):

            Check that the inspected Node is an Element before asking if it's active.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::setActive):

            Call the right superclass.

        * html/HTMLAnchorElement.h:
        * html/HTMLLabelElement.h:
        * html/shadow/MediaControlElementTypes.h:

            Sprinkle OVERRIDE>

2013-05-26  Andreas Kling  <akling@apple.com>

        Move Node::dispatchSimulatedClick() to Element.
        <http://webkit.org/b/116784>

        Reviewed by Antti Koivisto.

        Only Elements use the dispatchSimulatedClick() functionality, so move it there.

        * dom/Node.cpp:
        * dom/Node.h:
        * dom/Element.h:
        * dom/Element.cpp:
        (WebCore::Element::dispatchSimulatedClick):
        * dom/EventDispatcher.h:
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchSimulatedClick):

2013-05-26  Andreas Kling  <akling@apple.com>

        TreeScope::rootNode() should return a ContainerNode.
        <http://webkit.org/b/116782>

        Reviewed by Antti Koivisto.

        The rootNode() of a TreeScope is always a ContainerNode, so update pointer types to reflect that.
        This lets us take advantage of Antti's optimized traversal functions.

        * dom/ContainerNode.h:
        (WebCore::Node::isTreeScope):
        * dom/Document.cpp:
        (WebCore::Document::buildAccessKeyMap):
        * dom/Node.cpp:
        (WebCore::Node::containingShadowRoot):
        * dom/Node.h:
        * dom/TreeScope.h:
        (WebCore::TreeScope::rootNode):
        (TreeScope):
        * page/FocusController.cpp:
        (WebCore::FocusNavigationScope::rootNode):
        (WebCore::FocusNavigationScope::owner):
        * page/FocusController.h:
        (FocusNavigationScope):

2013-05-26  Andreas Kling  <akling@apple.com>

        FocusController::setFocusedNode() should be setFocusedElement().
        <http://webkit.org/b/116780>

        Reviewed by Antti Koivisto.

        Only Elements can have focus, so make the public API of FocusController take Element*.

        * WebCore.exp.in:
        * page/FocusController.h:
        * page/FocusController.cpp:
        (WebCore::FocusController::setFocusedElement):

            Out with the setFocusedNode(), in with the setFocusedElement().

        * dom/Element.cpp:
        (WebCore::Element::focus):
        (WebCore::Element::blur):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchMouseEvent):
        * plugins/PluginView.cpp:
        (WebCore::PluginView::focusPluginElement):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::setFocusedNodeIfNeeded):

            Tweak for FocusController taking Element* instead of Node*.

        (WebCore::FrameSelection::setFocusedElementIfNeeded):

            Renamed from setFocusedNodeIfNeeded().

        * editing/htmlediting.h:
        * editing/htmlediting.cpp:
        (WebCore::enclosingAnchorElement):

            Cleaned up the loop for readability and made it return an Element.

2013-05-26  Andreas Kling  <akling@apple.com>

        Move some form control things from Element to HTMLFormControlElement.
        <http://webkit.org/b/116779>

        Reviewed by Antti Koivisto.

        The following methods sit better on HTMLFormControlElement than on Element:

            - formControlType()
            - wasChangedSinceLastFormControlChangeEvent()
            - setChangedSinceLastFormControlChangeEvent()
            - dispatchFormControlChangeEvent()

        Moved them, and devirtualized as much as possible.

        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):

            Check if the old focus target is an Element before (possibly) dispatching a change event.

        * dom/Element.cpp:
        * dom/Element.h:

            Removed some stub methods that were only used by HTMLFormControlElement subclasses.

        * html/HTMLFormControlElement.cpp:
        * html/HTMLFormControlElement.h:
        (WebCore::isHTMLFormControlElement):
        (WebCore::toHTMLFormControlElement):

            Add toHTMLFormControlElement() helper with ASSERT_WITH_SECURITY_IMPLICATION.

        * html/HTMLTextFormControlElement.h:

            Sprinkle OVERRIDE.

2013-05-25  Andreas Kling  <akling@apple.com>

        Move Node::supportsFocus() to Element.
        <http://webkit.org/b/116778>

        Reviewed by Antti Koivisto.

        Node never supports focus, so move supportsFocus() to Element instead.

        * dom/Element.h:
        * dom/Node.cpp:
        * dom/Node.h:

            Removed Node::supportsFocus(), it always returned false anyway.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):

            Check that the underlying Node is an Element before asking if it supports focus.

        * html/HTMLAnchorElement.h:
        * html/HTMLAreaElement.h:
        * html/HTMLBodyElement.h:
        * html/HTMLElement.h:
        * html/HTMLFieldSetElement.h:
        * html/HTMLFormControlElement.h:
        * html/HTMLFrameElementBase.h:
        * html/HTMLMediaElement.h:
        * html/HTMLOptGroupElement.h:
        * html/HTMLOptionElement.h:
        * html/HTMLOutputElement.h:
        * svg/SVGAElement.h:
        * svg/SVGCircleElement.h:
        * svg/SVGEllipseElement.h:
        * svg/SVGGElement.h:
        * svg/SVGImageElement.h:
        * svg/SVGLineElement.h:
        * svg/SVGPathElement.h:
        * svg/SVGPolyElement.h:
        * svg/SVGRectElement.h:
        * svg/SVGSVGElement.h:
        * svg/SVGSwitchElement.h:
        * svg/SVGSymbolElement.h:
        * svg/SVGTextElement.h:
        * svg/SVGUseElement.h:

            OVERRIDE ALL THE THINGS!

2013-05-25  Andreas Kling  <akling@apple.com>

        Move Node::isFocusable() to Element.
        <http://webkit.org/b/116777>

        Reviewed by Anders Carlsson.

        Nodes cannot be focusable, so move isFocusable() from Node to Element.

        * dom/Node.cpp:
        * dom/Node.h:
        * dom/Element.h:
        * dom/Element.cpp:
        (WebCore::Element::isFocusable):

            Moved here from Node.

        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::determineAccessibilityRole):

            Check that the underlying node is an Element before asking if it's focusable.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor):

            Renamed the 'anchorNode' variable to 'anchorElement' because reasons.

        * html/HTMLAreaElement.h:
        * html/HTMLFormControlElement.h:
        * html/HTMLLabelElement.h:
        * html/HTMLOptionElement.h:
        * svg/SVGAElement.h:

            Sprinkle OVERRIDE.

        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::setMessage):

            Update a comment to refer to Element::isFocusable() instead of Node.

2013-05-25  Andreas Kling  <akling@apple.com>

        Move Node::tabIndex() to Element.
        <http://webkit.org/b/116772>

        Reviewed by Ryosuke Niwa.

        Since only Elements are keyboard-focusable, it doesn't make sense for Node to have a tabIndex().

        * dom/Element.h:
        * dom/Node.cpp:
        * dom/Node.h:

            A Node can't have a tab index, so move tabIndex() to Element.

        * page/FocusController.h:
        * page/FocusController.cpp:
        (WebCore::adjustedTabIndex):
        (WebCore::FocusController::findElementWithExactTabIndex):
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::previousElementWithLowerTabIndex):
        (WebCore::FocusController::nextFocusableNode):
        (WebCore::FocusController::previousFocusableNode):

            Make this code deal in Element* when doing tab index stuff. FocusController needs
            more Node->Element cleanup, but let's do that separately.

        * html/HTMLAnchorElement.h:
        * html/HTMLElement.h:
        * html/HTMLFormControlElement.h:

            Sprinkle OVERRIDE.

2013-05-25  Andreas Kling  <akling@apple.com>

        Don't instantiate ChildNodeLists just to get a child count.
        <http://webkit.org/b/116776>

        Reviewed by Ryosuke Niwa.

        Use ContainerNode::childNodeCount() instead of Node::childNodes()->length().

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):

2013-05-25  Andreas Kling  <akling@apple.com>

        PluginDocument::pluginNode() should be pluginElement() instead.
        <http://webkit.org/b/116774>

        Reviewed by Anders Carlsson.

        Make PluginDocument hand out a HTMLPlugInElement* instead of a Node*.

        * dom/Document.cpp:
        (WebCore::eventTargetNodeForDocument):
        * html/PluginDocument.h:
        * html/PluginDocument.cpp:
        (WebCore::PluginDocumentParser::createDocumentStructure):
        (WebCore::PluginDocument::pluginWidget):
        (WebCore::PluginDocument::setPluginElement):
        (WebCore::PluginDocument::detach):

2013-05-25  Andreas Kling  <akling@apple.com>

        Remove Document::getFocusableNodes().
        <http://webkit.org/b/116773>

        Reviewed by Joseph Pecoraro.

        This was added in r42191 and there are no remaining clients of the API.

        * dom/Document.cpp:
        * dom/Document.h:
        * WebCore.exp.in:

2013-05-25  Andreas Kling  <akling@apple.com>

        Move Node::focusDelegate() to Element.
        <http://webkit.org/b/116768>

        Reviewed by Anders Carlsson.

        Only Element can be a focus delegate (it's currently only ever HTMLInputElement actually)
        so move Node::focusDelegate() to Element. Sprinkled isElementNode() checks as needed.

        * dom/Node.cpp:
        * dom/Node.h:
        * dom/Element.h:
        * dom/Element.cpp:
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::focusDelegate):
        * html/shadow/SliderThumbElement.h:
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isFocused):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSliderThumb):

2013-05-25  Alberto Garcia  <agarcia@igalia.com>

        Path: clean up addPathForRoundedRect()
        https://bugs.webkit.org/show_bug.cgi?id=116765

        Reviewed by Andreas Kling.

        Reorganize code that is a bit redundant.

        No new tests, no behavior change.

        * platform/graphics/Path.cpp:
        (WebCore::Path::addPathForRoundedRect):

2013-05-25  Simon Fraser  <simon.fraser@apple.com>

        Unprefix Page Visibility API
        https://bugs.webkit.org/show_bug.cgi?id=102340

        Reviewed by Tim Horton.
        
        Remove prefixes from the document properties, and the visibilitychanged event.
        
        Rename the "preview" state to "unloaded". The "unloaded" state is never
        reached yet (see https://bugs.webkit.org/show_bug.cgi?id=116769).
        
        Add some comments to places where we should update the visibility state
        when going in and out of the page cache, but cannot safely do so yet.

        Tested by existing Page Visibility tests.

        * dom/Document.cpp:
        (WebCore::Document::pageVisibilityState):
        (WebCore::Document::visibilityState):
        (WebCore::Document::hidden):
        (WebCore::Document::dispatchVisibilityStateChangeEvent):
        * dom/Document.h:
        * dom/Document.idl:
        * dom/EventNames.h:
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::stopLoading):
        * page/Page.cpp:
        (WebCore::Page::setVisibilityState):
        * page/PageVisibilityState.cpp:
        (WebCore::pageVisibilityStateString):
        * page/PageVisibilityState.h:

2013-05-25  Andreas Kling  <akling@apple.com>

        Move Node::isMouseFocusable() to Element.
        <http://webkit.org/b/116762>

        Reviewed by Anders Carlsson.

        Node::isMouseFocusable() would just return isFocusable(), which is never true for a non-Element
        since Node::supportsFocus() always returns false. So move it to Element!

        * dom/Node.h:
        * dom/Node.cpp:
        * dom/Element.h:
        * dom/Element.cpp:
        (WebCore::Element::isMouseFocusable):

            Moved here from Node.

        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::setFocusedNodeIfNeeded):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchMouseEvent):

            Walk up the parent chain with parentOrShadowHostElement() instead of parentOrShadowHostNode().
            Removed a misleading no-op hunk about mouse-focusable ShadowRoots, since ShadowRoots are not
            Elements and thus cannot be mouse-focusable.

        * page/TouchAdjustment.cpp:
        (WebCore::TouchAdjustment::nodeRespondsToTapGesture):

            Check that the Node is an Element before asking if it's mouse-focusable.

        * html/HTMLAnchorElement.h:
        * html/HTMLAreaElement.h:
        * html/HTMLFormControlElement.h:
        * html/HTMLInputElement.h:
        * html/HTMLMediaElement.h:
        * html/HTMLSelectElement.h:
        * html/HTMLTextAreaElement.h:
        * html/shadow/ClearButtonElement.h:
        * html/shadow/TextControlInnerElements.h:
        * svg/SVGAElement.h:
        * svg/SVGStyledElement.h:

            Sprinkle OVERRIDE.

2013-05-25  Andreas Kling  <akling@apple.com>

        Move Node::isKeyboardFocusable() to Element.
        <http://webkit.org/b/116761>

        Reviewed by Antti Koivisto.

        Only Elements can be keyboard-focusable. Move the base isKeyboardFocusable() implementation to Element
        and sprinkle OVERRIDE on subclass overrides.
        FocusController gets some temporary type checks that will go away as that code moves to dealing in
        Elements instead of Node.

        * dom/Node.h:
        * dom/Node.cpp:
        * dom/Element.h:
        * dom/Element.cpp:
        (WebCore::Element::isKeyboardFocusable):

            Move isKeyboardFocusable() from Node to Element.

        * page/FocusController.cpp:
        (WebCore::isNonFocusableShadowHost):
        (WebCore::isFocusableShadowHost):
        (WebCore::shouldVisit):
        (WebCore::FocusController::advanceFocusInDocumentOrder):

            Check that the inspected Node is an Element before querying isKeyboardFocusable().

        * html/HTMLAnchorElement.h:
        * html/HTMLAreaElement.h:
        * html/HTMLFormControlElement.h:
        * html/HTMLFrameOwnerElement.h:
        * html/HTMLInputElement.h:
        * html/HTMLPlugInElement.h:
        * html/HTMLSelectElement.h:
        * html/HTMLTextAreaElement.h:
        * svg/SVGAElement.h:
        * svg/SVGStyledElement.h:

            Sprinkle OVERRIDE.

2013-05-25  Andreas Kling  <akling@apple.com>

        Begin moving "focus" state logic from Node to Element.
        <http://webkit.org/b/116760>

        Reviewed by Antti Koivisto.

        Only Elements can be focused, so merge the "focus" state logic from Node and ContainerNode
        and move it into Element. There's a lot more iceberg under this tip, but we'll be starting
        with setFocus(bool) and focused().

        * dom/Node.h:
        * dom/ContainerNode.cpp:
        * dom/ContainerNode.h:
        * dom/Element.cpp:
        (WebCore::Element::isUserActionElementFocused):
        (WebCore::Element::setFocus):
        * dom/Element.h:
        (WebCore::Element::focused):
        * dom/Node.cpp:

            Move focused() and setFocus(bool) from Node/ContainerNode to Element.

        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchMouseEvent):

            Check if the inspected Node is an Element before asking if it's focused.

2013-05-25  Noam Rosenthal  <noam.rosenthal@nokia.com>

        Direct pattern compositing breaks when no-repeat is set on a large layer
        https://bugs.webkit.org/show_bug.cgi?id=116140

        Reviewed by Antti Koivisto.

        In some cases the directly composited background color logic overrides the layer's
        contentsRect, which results in wrong rendering of tiled images.
        This patch makes sure that the background image is applied after the solid color,
        which ensures the correct contentsRect.

        Test: compositing/patterns/direct-pattern-compositing-contain-no-repeat.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateDirectlyCompositedContents):

2013-05-24  Andreas Kling  <akling@apple.com>

        Move "hover" state logic from Node to Element.
        <http://webkit.org/b/116757>

        Reviewed by Antti Koivisto.

        Resolve a 7 year old FIXME by merging the "hover" state logic from Node and ContainerNode
        and moving it all to Element instead.

        * dom/Node.cpp:
        (WebCore::Node::detach):
        * dom/Element.cpp:
        (WebCore::Element::detach):

            Move Document::hoveredNodeDetached() call from Node::detach() to Element::detach().

        (WebCore::Element::isUserActionElementHovered):
        (WebCore::Element::setHovered):
        * dom/Element.h:
        (WebCore::Element::hovered):

            Moved here from Node/ContainerNode.

        * dom/UserActionElementSet.h:
        (WebCore::UserActionElementSet::setHovered):
        (WebCore::UserActionElementSet::setFlags):

            Make setHovered() take an Element* instead of a Node*. I'd like to do this will all
            of these methods eventually, so added a setFlags() helper with the tighter type.

        * html/HTMLLabelElement.h:
        * html/shadow/SpinButtonElement.h:

            Sprinkle OVERRIDE on setHovered() overrides.

        * dom/Document.cpp:
        (WebCore::Document::updateHoverActiveState):
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::isHovered):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isHovered):

            Check if the inspected Node is an element before asking if it's hovered.

2013-05-25  Andreas Kling  <akling@apple.com>

        Document::formController() should return a reference.
        <http://webkit.org/b/116758>

        Reviewed by Antti Koivisto.

        The formController() is created on demand, so return a reference instead.

        * dom/Document.h:
        * dom/Document.cpp:
        (WebCore::Document::formController):
        (WebCore::Document::setStateForNewFormElements):
        * html/HTMLFormControlElementWithState.cpp:
        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
        (WebCore::HTMLFormControlElementWithState::didMoveToNewDocument):
        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::~HTMLFormElement):
        (WebCore::HTMLFormElement::finishParsingChildren):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::~HTMLInputElement):
        (WebCore::HTMLInputElement::didMoveToNewDocument):
        (WebCore::HTMLInputElement::checkedRadioButtons):

2013-05-25  Sergio Villar Senin  <svillar@igalia.com>

        Reducing CSS code duplication in declaration list error recovery
        https://bugs.webkit.org/show_bug.cgi?id=115157

        Reviewed by Andreas Kling.

        From Blink r148974 by <serya@chromium.org>

        Refactor "invalid_block_list error | /* empty */" in a new
        decl_list_recovery rule that allows to remove 4 redundant rules.

        No new test required as we're just refactoring code, no new behaviour.

        * css/CSSGrammar.y.in:

2013-05-24  Ryosuke Niwa  <rniwa@webkit.org>

        Build fix after r150664.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore):

2013-05-24  Sergio Villar Senin  <svillar@igalia.com>

        Fixing invalid block recovery in some declaration list.
        https://bugs.webkit.org/show_bug.cgi?id=115159

        Reviewed by Darin Adler.

        From Blink r148889 by <serya@chromium.org>

        Improves the detection of some invalid block declarations inside a
        declaration list. This allows the parser not to completely discard
        a whole declaration list that contains an invalid block. In
        particular grammar failed in tests 8, 12, 13, 15, 16 and 17 in the
        new test added by this change.

        Test: fast/css/parsing-invalid-block-recovery.html

        * css/CSSGrammar.y.in:


2013-05-24  Beth Dakin  <bdakin@apple.com>

        DidFirstFlushForHeaderLayer can be called too soon on pages that redirect
        https://bugs.webkit.org/show_bug.cgi?id=116749
        -and corresponding-
        <rdar://problem/13886753>

        Reviewed by Simon Fraser.

        Only start m_paintRelatedMilestonesTimer if we have actually painted.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):

2013-05-24  Anders Carlsson  <andersca@apple.com>

        Fix Windows build.

        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:

2013-05-24  Tim Horton  <timothy_horton@apple.com>

        Animated GIFs don't repaint after TiledCoreAnimationDrawingArea un-suspends painting
        https://bugs.webkit.org/show_bug.cgi?id=116744
        <rdar://problem/13973514>

        Reviewed by Simon Fraser.

        * WebCore.exp.in: Export FrameView::resumeAnimatingImages.
        * page/FrameView.cpp:
        (WebCore::FrameView::setIsInWindow):
        (WebCore::FrameView::resumeAnimatingImages):
        Factor the code to restart animated images out of frameView::setIsInWindow.

        * page/FrameView.h:
        (FrameView):

2013-05-24  Anders Carlsson  <andersca@apple.com>

        Move history property list writer to WebKit
        https://bugs.webkit.org/show_bug.cgi?id=116746

        Reviewed by Tim Horton.

        Remove files from the Xcode project and remove symbols that now live in WebKit.

        * WebCore.exp.in:
        * WebCore.xcodeproj/project.pbxproj:

2013-05-24  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Global constructors exposed in worker environment have wrong attributes
        https://bugs.webkit.org/show_bug.cgi?id=116708

        Reviewed by Geoffrey Garen.

        Fix JSC bindings generator so that Global constructors exposed in worker environment
        have the following attributes:
        { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }

        This is now consistent with global constructors on DOMWindow and with the Web IDL
        specification:
        http://dev.w3.org/2006/webapi/WebIDL/#es-interfaces

        Test: fast/js/global-constructors-attributes-worker.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateAttributesHashTable):

2013-05-24  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Remove custom code for webkitAudioContext global constructor getter
        https://bugs.webkit.org/show_bug.cgi?id=116530

        Reviewed by Geoffrey Garen.

        Get rid of custom code for webkitAudioContext global constructor getter. The
        global DOMWindow attribute is now automatically generated by leveraging support
        for [EnabledAtRuntime] extended attribute and the existing methods in
        RuntimeEnabledFeatures class.

        No new tests, no behavior change.

        * GNUmakefile.list.am: Remove JSDOMWindowWebAudioCustom.*.
        * Modules/webaudio/AudioContext.idl:
        Remove [NoInterfaceObject] extended attribute so that the global constructor is
        automatically generated instead of automatically added. Add [EnabledAtRuntime]
        extended attribute since this global constructor can be disabled at runtime and
        so that we can getter rid of the [CustomGetter] for the corresponding global
        constructor. Use [InterfaceName] extended attribute so that the interface name
        matches the global constructor on DOMWindow (webkitAudioContext).

        * Target.pri: Remove JSDOMWindowWebAudioCustom.*.
        * UseJSC.cmake: Remove JSDOMWindowWebAudioCustom.*.
        * WebCore.exp.in: Export additional symbol.
        * WebCore.order: Export additional symbol.
        * WebCore.vcproj/WebCore.vcproj: Remove JSDOMWindowWebAudioCustom.*.
        * WebCore.vcxproj/WebCore.vcxproj: Remove JSDOMWindowWebAudioCustom.*.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Remove JSDOMWindowWebAudioCustom.*.
        * WebCore.xcodeproj/project.pbxproj: Remove JSDOMWindowWebAudioCustom.*.
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setWebAudioEnabled):
        * bindings/js/JSBindingsAllInOne.cpp: Remove JSDOMWindowWebAudioCustom.*.
        * bindings/js/JSDOMWindowWebAudioCustom.cpp: Removed. We no longer need any custom code for
        the WebAudio global constructor getter because we use [EnabledAtRuntime] support in the
        bindings generator now.
        * page/DOMWindow.idl: Remove global constructor for AudioContext as it is now automatically
        generated.
        * page/Settings.in: Remove webAudioEnabled setting as we use the existing setting
        in RuntimeEnabledFeatures now.

2013-05-24  Seokju Kwon  <seokju.kwon@gmail.com>

        [AC] Needs to be guarded by USE(ACCELERATED_COMPOSITING)
        https://bugs.webkit.org/show_bug.cgi?id=116712

        Reviewed by Andreas Kling.

        renderView is used when ACCELERATED_COMPOSITING is enabled.
        So, this patch allows it to be guarded by USE(ACCELERATED_COMPOSITING).

        No new tests, no behavior change.

        * page/FrameView.cpp:
        (WebCore::FrameView::setFrameRect):

2013-05-24  Thomas Deniau  <deniau@apple.com>

        Add more lines to the context during Dictionary lookups
        https://bugs.webkit.org/show_bug.cgi?id=115256

        Reviewed by Ryosuke Niwa.

        No new tests - no new functionality.

        * WebCore.exp.in: Export a few methods in VisibleUnits needed to be able
        to call previousLinePosition(), nextLinePosition(), startOfLine() and
        endOfLine() in WebPageMac.mm when determining the context while looking
        up a dictionary definition. These symbols used to be exported for iOS
        only, export them on the desktop too.

2013-05-24  Anders Carlsson  <andersca@apple.com>

        Remove PagePopup code
        https://bugs.webkit.org/show_bug.cgi?id=116732

        Reviewed by Andreas Kling.

        Remove all page popup code.

        * GNUmakefile.list.am:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/ContextFeatures.cpp:
        * dom/ContextFeatures.h:
        * loader/EmptyClients.h:
        * page/ChromeClient.h:
        * page/DOMWindowPagePopup.cpp: Removed.
        * page/DOMWindowPagePopup.h: Removed.
        * page/DOMWindowPagePopup.idl: Removed.
        * page/PagePopup.h: Removed.
        * page/PagePopupClient.cpp: Removed.
        * page/PagePopupClient.h: Removed.
        * page/PagePopupController.cpp: Removed.
        * page/PagePopupController.h: Removed.
        * page/PagePopupController.idl: Removed.
        * page/PagePopupDriver.h: Removed.
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore):
        * testing/Internals.h:
        (WebCore):
        (Internals):
        * testing/Internals.idl:
        * testing/MockPagePopupDriver.cpp: Removed.
        * testing/MockPagePopupDriver.h: Removed.

2013-05-24  Jer Noble  <jer.noble@apple.com>

        Mac: Set the default audio buffer size to a large value for <video> elements.
        https://bugs.webkit.org/show_bug.cgi?id=116342

        Reviewed by Eric Carlson.
        Roll-in rubber stamped by Eric Carlson.

        To enable power savings by waking up the audio hardware less often, set the
        requested buffer frame size to a large value, such as 4096. Since this results
        in approximately 100ms worth of buffer, set the buffer size to a much lower
        value when playing WebAudio, which is much more sensitive to latency than video
        or audio elements.

        Introduce a new class, AudioSessionManager, as well as a helper class,
        AudioSessionManagerToken. Audio elements, video elements, and WebAudio destination
        nodes will create and retain a token, and release the token in their destructor.
        This allows the AudioSessionManager to track how many of what type of audio-
        generating objects are in existence.

        This requires implementing AudioSession for Mac platforms. Move the implementation
        for retrieving the hardware sample rate and setting the buffer duration into
        AudioSessionMac from AudioDestinationMac, to be shared with AudioSessionManagerMac.

        Change the AudioSession method preferredBufferLength() into preferredBufferSize(),
        as the callers really want to specify a buffer size, not a buffer duration. On iOS,
        where the available API requires a duration, perform the conversion from duration to
        size on behalf of the caller.

        However, since the original version of this patch caused media test
        failures on the Mac ML and Lion bots, only enable the buffer size
        change for OS X > ML.

        * html/HTMLMediaElement.h:  Add a AudioSessionManagerToken member.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize the token.
        * platform/audio/AudioSession.cpp:
        (WebCore::AudioSession::preferredBufferSize): Renamed from preferredBufferLength.
        (WebCore::AudioSession::setPreferredBufferSize): Renamed from setPreferredBufferLength.
        * platform/audio/AudioSession.h:
        * platform/audio/AudioSessionManager.cpp:
        (AudioSessionManagerToken::create): Simple factory method.
        (AudioSessionManagerToken::AudioSessionManagerToken): Call AudioSessionManager::incrementCount().
        (AudioSessionManagerToken::~AudioSessionManagerToken): Call AudioSessionManager::decrementCount().
        (AudioSessionManager::sharedManager): Simple singleton method.
        (AudioSessionManager::AudioSessionManager): Simple constructor.
        (AudioSessionManager::has): Return whether the type is present.
        (AudioSessionManager::incrementCount): Increment, then call updateSessionState()
        (AudioSessionManager::decrementCount): Decrement, then call updateSessionState()
        (AudioSessionManager::updateSessionState): Stub, does nothing.
        * platform/audio/AudioSessionManager.h:
        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::AudioDestinationIOS::configure): Call setPreferredBufferSize() instead of setPreferredBufferLength()
        * platform/audio/ios/AudioSessionIOS.mm:
        (WebCore::AudioSession::preferredBufferSize): Renamed from preferredBufferLength.
        (WebCore::AudioSession::setPreferredBufferSize): Renamed from setPreferredBufferLength
        * platform/audio/mac/AudioDestinationMac.cpp:
        (WebCore::AudioDestination::hardwareSampleRate): Call AudioSession::sampleRate().
        (WebCore::AudioDestinationMac::AudioDestinationMac): Create the AudioSessionManagerToken.
        (WebCore::AudioDestinationMac::configure): Do not set the buffer size (this is done in AudioSessionManagerMac).
        * platform/audio/mac/AudioDestinationMac.h:
        * platform/audio/mac/AudioSessionMac.cpp: Added.
        (WebCore::defaultDevice): Added, returns the default audio device.
        (WebCore::AudioSession::AudioSession): Simple constructor.
        (WebCore::AudioSession::~AudioSession): Simple destructor.
        (WebCore::AudioSession::category): Stub, unimplemented.
        (WebCore::AudioSession::setCategory): Ditto.
        (WebCore::AudioSession::categoryOverride): Ditto.
        (WebCore::AudioSession::setCategoryOverride): Ditto.
        (WebCore::AudioSession::numberOfOutputChannels): Ditto.
        (WebCore::AudioSession::setActive): Ditto.
        (WebCore::AudioSession::sampleRate): Use the HAL to return the default audio device sample rate.
        (WebCore::AudioSession::preferredBufferSize): Return the current HAL setting.
        (WebCore::AudioSession::setPreferredBufferSize): Set the buffer size.
        * platform/audio/mac/AudioSessionManagerMac.cpp:
        (AudioSessionManager::updateSessionState): Set the buffer size depending on what audio outputs are present.
        * WebCore.xcodeproj/project.pbxproj: Add the new files to the project.

2013-05-24  Alberto Garcia  <agarcia@igalia.com>

        Path: upstream the missing bits from the BlackBerry port
        https://bugs.webkit.org/show_bug.cgi?id=116658

        Reviewed by Xan Lopez.

        PathBlackBerry was upstreamed a while ago (r144612) but a few bits
        were missing from the cross-platform code.

        * platform/graphics/Path.cpp:
        (WebCore::Path::addPathForRoundedRect):
        * platform/graphics/Path.h:
        (Graphics):
        (Path):

2013-05-24  Noam Rosenthal  <noam@webkit.org>

        WebProcess is crashing on http://achicu.github.io/css-presentation when direct pattern compositing is enabled
        https://bugs.webkit.org/show_bug.cgi?id=115135

        Reviewed by Antti Koivisto.

        Issue is invoked when there is a visibility:hidden layer with a non-compositable
        background image (e.g. a radial gradient).
        The layer is treated as a no-contents layer because of its visibility, however
        updateDirectlyCompositedBackgroundImage() later mistakenly treats it as a layer
        with direct background-image compositing.

        Fixed by returning early from updating directly composited contents for layers
        with hidden contents.

        Test: compositing/patterns/direct-pattern-compositing-hidden-radial-gradient.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateDirectlyCompositedContents):
        (WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundImage):
        (WebCore::RenderLayerBacking::paintsChildren):
        (WebCore::RenderLayerBacking::isDirectlyCompositedImage):

2013-05-24  Robert Hogan  <robert@webkit.org>

        Refactor shouldAddBorderPaddingMargin()
        https://bugs.webkit.org/show_bug.cgi?id=98803

        Reviewed by Ryosuke Niwa.

        Make this helper function less clever-stupid in its misguided sacrifice of intelligibility
        for the sake of concision.

        No new tests, refactoring.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::shouldAddBorderPaddingMargin):
        (WebCore::inlineLogicalWidth):

2013-05-24  Xiaobo Wang  <xiaobwang@blackberry.com>

        [BlackBerry] DRT - crashed on GraphicsContext3D::makeContextCurrent
        https://bugs.webkit.org/show_bug.cgi?id=116654

        Reviewed by Carlos Garcia Campos.

        PR 331552.
        Internally reviewed and amended by Arvid Nilsson.

        No new tests, this patch is to fix DRT crashes in fast/canvas/webgl.
        The instance of GraphicsContext3D has already been destroyed but
        WebGLLayerWebKitThread is not aware of that. This is because compositor
        layer of the WebGL graphics context was referenced outside the context.
        So when destructing GraphicsContext3D the compositing layer was not
        destructed.
        Fix by setting m_webGLContext to 0 when destructing GrapthicsContext3D
        after releasing the compositor layer, so that it won't be de-referenced
        again later.

        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
        (WebCore::GraphicsContext3D::~GraphicsContext3D):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp:
        (WebCore::WebGLLayerWebKitThread::~WebGLLayerWebKitThread):
        (WebCore::WebGLLayerWebKitThread::webGLContextDestroyed):
        (WebCore):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.h:
        (WebGLLayerWebKitThread):

2013-05-24  Andreas Kling  <akling@apple.com>

        Typing in Safari's unified field causes unnecessary web content repaints.
        <http://webkit.org/b/116703>

        Reviewed by Andy Estes.

        Break out an alternate version of Page::markAllMatchesForText() that only counts the number of times
        a string occurs in the page, but doesn't try to mark the occurrences.
        This allows Safari to count matches for the 'Find "foo" on This Page' functionality in the unified
        location bar without causing tile repaints.

        * WebCore.exp.in:
        * page/Page.h:
        * page/Page.cpp:
        (WebCore::Page::findMatchesForText):
        (WebCore::Page::markAllMatchesForText):
        (WebCore::Page::countFindMatches):

            Renamed markAllMatchesForText() to findMatchesForText() and gave it a boolean parameter to control whether
            matches should be marked or not. countFindMatches() is the new helper that doesn't mark.

2013-05-23  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=116702
        REGRESSION (r150399): Scrollbar missing for all overflow scroll
        -and corresponding-
        <rdar://problem/13963712>

        Reviewed by Simon Fraser.

        This was a silly copy-paste error.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollbarAnimationsAreSuppressed):

2013-05-23  peavo@outlook.com  <peavo@outlook.com>

        [WinCairo] Build fails to link.
        https://bugs.webkit.org/show_bug.cgi?id=116671

        Reviewed by Brent Fulgham.

        * page/FrameView.h: Added guard for ACCELERATED_COMPOSITING.

2013-05-23  Roger Fong  <roger_fong@apple.com>

        Unreviewed. Modify WebCore for AppleWin 2010 production build.

        * WebCore.vcxproj/WebCoreGenerated.make:
        (WebCore::AXObjectCache::frameLoadingEventPlatformNotification):
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:

2013-05-23  Yongjun Zhang  <yongjun_zhang@apple.com>

        We need to clear main resource when detaching DocumentLoader from the frame.
        https://bugs.webkit.org/show_bug.cgi?id=116680

        Normally, when we detach the documentLoader in DocumentLoader::detachFromFrame, main resource is also cleared
        in stopLoading().  There is possibility that main resource not being cleared, and this could cause crash later
        since docLoader could still receive resource callbacks.  To avoid that, we can remove docLoader from main resource's
        client set in detachFromFrame.

        Reviewed by Brady Eidson.

        No new tests, this doesn't happen on OS X.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::detachFromFrame):
        (WebCore::DocumentLoader::clearMainResource):
        * loader/cache/CachedResource.h: make hasClient accessible publicly.
        (WebCore::CachedResource::hasClient):
        (CachedResource):

2013-05-23  Mihai Maerean  <mmaerean@adobe.com>

        assertion failed: !node || node->isElementNode() in WebCore::RenderBlock::clone
        https://bugs.webkit.org/show_bug.cgi?id=116614

        Reviewed by David Hyatt.

        Add a test for flow threads so they don't end up being cloned in region based multi columns with columns:1 where
        the only child has column-span:all.

        Test: fast/multicol/newmulticol/direct-child-column-span-all.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):

2013-05-23  Anders Carlsson  <andersca@apple.com>

        Crash in convertMainResourceLoadToDownload when downloading file by option-return
        https://bugs.webkit.org/show_bug.cgi?id=116451

        Reviewed by Andreas Kling.

        Handle MainResourceLoader being null here which will happen when loading a cached main resource.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::continueAfterContentPolicy):

2013-05-23  Benjamin Poulain  <bpoulain@apple.com>

        KURL::createCFURL() should return a RetainPtr<CFURLRef>
        https://bugs.webkit.org/show_bug.cgi?id=116644

        Reviewed by Andreas Kling.

        For consistency with the other createCFType() APIs in WebKit, KURL should
        return a RetainPtr<> instead of raw +1 CFURLRef.

        No leak were discovered while making this change.

        * platform/KURL.h:
        * platform/cf/KURLCFNet.cpp:
        (WebCore):
        (WebCore::createCFURLFromBuffer):
        (WebCore::KURL::createCFURL):
        (WebCore::KURL::fileSystemPath):
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::AVFWrapper::createAssetForURL):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::setURLForRect):
        * platform/mac/KURLMac.mm:
        (WebCore):
        (WebCore::KURL::operator NSURL *):
        (WebCore::KURL::createCFURL):
        * platform/network/cf/CookieJarCFNet.cpp:
        (WebCore::setCookiesFromDOM):
        (WebCore::cookiesForDOM):
        (WebCore::cookieRequestHeaderFieldValue):
        (WebCore::getRawCookies):
        (WebCore::deleteCookie):
        * platform/network/cf/DNSCFNet.cpp:
        (WebCore::DNSResolveQueue::platformProxyIsEnabledInSystemPreferences):
        * platform/network/cf/ProxyServerCFNet.cpp:
        (WebCore::addProxyServersForURL):
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doUpdatePlatformRequest):
        (WebCore::ResourceRequest::doUpdatePlatformHTTPBody):
        * platform/network/cf/ResourceResponseCFNet.cpp:
        (WebCore::ResourceResponse::cfURLResponse):
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):

2013-05-18  Robert Hogan  <robert@webkit.org>

        The ellipsis in a text overflow should not avoid floats
        https://bugs.webkit.org/show_bug.cgi?id=115746

        Reviewed by David Hyatt.

        When placing an ellipsis for text overflow we shouldn't avoid any floats on the line.
        That is to say, if there is a float in the box we overflow we should let our no-wrap text,
        including the ellipsis, render inside the float just as we would if overflow was hidden but
        a text-overflow rendering had not been specified.

        Test: fast/css/text-overflow-ellipsis-behind-floats.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::checkLinesForTextOverflow):

2013-05-23  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Unreviewed, rolling out r150586.
        http://trac.webkit.org/changeset/150586
        https://bugs.webkit.org/show_bug.cgi?id=116660

        Those constructors should be exposed on the WorkerContext, not
        the DOMWindow

        * fileapi/FileReaderSync.idl:
        * workers/WorkerLocation.idl:

2013-05-23  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Remove [NoInterfaceObject] from FileReaderSync and WorkerLocation
        https://bugs.webkit.org/show_bug.cgi?id=116660

        Reviewed by Kentaro Hara.

        Remove [NoInterfaceObject] from FileReaderSync and WorkerLocation to match their
        respective specifications:
        - http://dev.w3.org/2006/webapi/FileAPI/#FileReaderSync
        - http://dev.w3.org/html5/workers/#workerlocation

        No new tests, covered by existing tests.

        * fileapi/FileReaderSync.idl:
        * workers/WorkerLocation.idl:

2013-05-23  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Remove special case for MessagePortArray from bindings generator
        https://bugs.webkit.org/show_bug.cgi?id=116653

        Reviewed by Kentaro Hara.

        Use MessagePort[] instead of MessagePortArray type in the IDL as MessagePortArray
        is not defined on IDL side. This allows us to remove the special case for
        MessagePortArray from the bindings generator.

        No new tests, no behavior change.

        * bindings/js/JSMessageEventCustom.cpp:
        (WebCore::JSMessageEvent::data):
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Remove special case for MessagePortArray.
        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.h:
        (WebDOMTestSerializedScriptValueInterface):
        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp:
        (webkit_dom_test_serialized_script_value_interface_get_property):
        (webkit_dom_test_serialized_script_value_interface_class_init):
        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::jsTestSerializedScriptValueInterfacePorts):
        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.mm:
        * bindings/scripts/test/TestSerializedScriptValueInterface.idl: Replace MessagePortArray
        by MessagePort[].
        * dom/MessageEvent.h:
        (WebCore::MessageEvent::ports): The method should return a Vector, not a Vector*
        as the array on JavaScript side is not nullable.
        * dom/MessageEvent.idl: Replace MessagePortArray by MessagePort[].

2013-05-23  Michał Pakuła vel Rutka  <m.pakula@samsung.com>

        [EFL] Back, Forward and Stop should be hidden in context menu
        https://bugs.webkit.org/show_bug.cgi?id=116615

        Reviewed by Christophe Dumez.

        Context menu items: Back, Forward, Stop, Reload, should be shown only when
        they are able to perform action.

        No new tests - no new functionality.

        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::populate):

2013-05-22  Dean Jackson  <dino@apple.com>

        Rolling out r150555. It borked about 30 media tests.

        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        * html/HTMLMediaElement.h:
        * platform/audio/AudioSession.cpp:
        (WebCore):
        (WebCore::AudioSession::AudioSession):
        (WebCore::AudioSession::preferredBufferDuration):
        (WebCore::AudioSession::setPreferredBufferDuration):
        * platform/audio/AudioSession.h:
        * platform/audio/AudioSessionListener.h:
        (AudioSessionListener):
        * platform/audio/AudioSessionManager.cpp: Removed.
        * platform/audio/AudioSessionManager.h: Removed.
        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::AudioDestinationIOS::configure):
        * platform/audio/ios/AudioSessionIOS.mm:
        (WebCore::AudioSession::preferredBufferDuration):
        (WebCore::AudioSession::setPreferredBufferDuration):
        * platform/audio/mac/AudioDestinationMac.cpp:
        (WebCore::AudioDestination::hardwareSampleRate):
        (WebCore::AudioDestinationMac::AudioDestinationMac):
        (WebCore::AudioDestinationMac::configure):
        * platform/audio/mac/AudioDestinationMac.h:
        (AudioDestinationMac):
        * platform/audio/mac/AudioSessionMac.cpp: Removed.
        * platform/audio/mac/AudioSessionManagerMac.cpp: Removed.

2013-05-20  Jeffrey Pfau  <jpfau@apple.com>

        Active DOM object resumption should match reason for suspending
        https://bugs.webkit.org/show_bug.cgi?id=116476

        Add a reason to the arguments for resuming active DOM object and
        scheduled tasks and ensure that it matches the suspend reason before
        actually resuming the objects.

        Reviewed by Joseph Pecoraro.

        No new tests, no change in functionality.

        * bindings/js/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::setJavaScriptPaused): Add matching resume reason
        * dom/Document.cpp:
        (WebCore::Document::resumeActiveDOMObjects): Check for matching resume reason
        (WebCore::Document::resumeScheduledTasks): Check for matching resume reason
        * dom/Document.h:
        (Document):
        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects): Check for matching resume reason
        * dom/ScriptExecutionContext.h:
        (ScriptExecutionContext):
        (WebCore::ScriptExecutionContext::reasonForSuspendingActiveDOMObjects): Expose suspend reason to subclasses
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore): Add matching resume reason
        * page/Frame.cpp:
        (WebCore::Frame::resumeActiveDOMObjectsAndAnimations): Add matching resume reason
        * page/PageGroupLoadDeferrer.cpp:
        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer): Add matching resume reason

2013-05-22  Dean Jackson  <dino@apple.com>

        Don't snapshot plugins that can't be snapshotted
        https://bugs.webkit.org/show_bug.cgi?id=116490

        Reviewed by Tim Horton.

        Some plugins, such as QuickTime, don't support snapshotting. We're
        planning on another way to capture snapshots, but in the meantime make
        sure that they don't fail to initialise because they were told to
        not use accelerated rendering.

        * WebCore.exp.in: Export restartSnapshottedPlugin so that it can be used from WK2.
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::restartSimilarPlugIns): Don't set the play state before restarting.
        (WebCore::HTMLPlugInImageElement::userDidClickSnapshot): Make sure we indicated that this snapshotted plugin was clicked.
        * html/HTMLPlugInImageElement.h: Move restartSnapshottedPlugin from protected to public.
        * rendering/RenderSnapshottedPlugIn.cpp:
        (WebCore::RenderSnapshottedPlugIn::handleEvent): Don't set play state here. Let the restart functions do it.

2013-05-22  Max Vujovic  <mvujovic@adobe.com>

        [CSS Shaders] valueForCustomFilterTransformParameter should check that renderer is a RenderBox
        https://bugs.webkit.org/show_bug.cgi?id=116464

        Reviewed by Alexandru Chiculita.

        If the renderer is not a RenderBox, we just use a zero size to compute the transform,
        like in CSSComputedStyleDeclaration::computedTransform.

        Test: css3/filters/custom/custom-filter-crash-inline-computed-style.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForCustomFilterTransformParameter):

2013-05-22  Simon Fraser  <simon.fraser@apple.com>

        Fix assertion in the getComputedStyle-background-shorthand.html test
        https://bugs.webkit.org/show_bug.cgi?id=116639

        Reviewed by Ryosuke Niwa.

        getComputedStyle-background-shorthand.html was asserting under the newly added
        code in willBeRemovedFromTree(). The assertion was caused by too many calls to
        FrameView::removeSlowRepaintObject(), which happened because we called it for
        RenderTexts, which share style with their parent renderer.
        
        RenderText overrides styleWillChange() to do nothing, so we never
        call add/removeSlowRepaintObject() for them. Thus we should also skip this
        work in willBeRemovedFromTree() for RenderTexts.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willBeRemovedFromTree):

2013-05-22  Bem Jones-Bey  <bjonesbe@adobe.com>

        Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
        https://bugs.webkit.org/show_bug.cgi?id=116626

        Reviewed by David Hyatt.

        This is a port of a Blink bug fix by Emil Eklund.

        Account for saturated estimated position in RenderBlock::layoutBlockChild.

        If the estimated top position is saturated the comparison with oldLogicalTop
        might yield a false negative as adding and removing margins, borders etc from
        a saturated number might yield incorrect results. If this is the case always
        mark for layout.

        Minimal test case impractical. See bug for raw fuzzer test case.

        * platform/LayoutUnit.h:
        (WebCore::LayoutUnit::mightBeSaturated): Add helper method for checking whether
            a number might be saturated.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlockChild): Check if logicalTopEstimate is likely
            to be saturated and if so mark for layout.

2013-05-22  Benjamin Poulain  <benjamin@webkit.org>

        Remove CSSPropertySourceData emptyCSSPropertySourceData
        https://bugs.webkit.org/show_bug.cgi?id=116517

        Reviewed by Darin Adler.

        This was added for chromium and does not seem to be used
        anywhere anymore.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::CSSParser):
        * css/CSSPropertySourceData.cpp:
        * css/CSSPropertySourceData.h:

2013-05-22  Csaba Osztrogonác  <ossy@webkit.org>

        Buildfix for !ENABLE(FULLSCREEN_API) platforms.

        Rubber-stamped by Ryosuke Niwa.

        * rendering/RenderInline.cpp: Missing #if guard added.
        (WebCore::RenderInline::splitInlines):

2013-05-22  Ryosuke Niwa  <rniwa@webkit.org>

        Fix a typo in 150469.

        * editing/Editor.cpp:
        (WebCore::dispatchEditableContentChangedEvents):

2013-05-22  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION: ASSERTION FAILED: obj->isRenderInline() || obj == this, Bad cast in WebCore::RenderBlock::createLineBoxes
        https://bugs.webkit.org/show_bug.cgi?id=110622

        Reviewed by David Hyatt.

        Merge https://chromium.googlesource.com/chromium/blink/+/998ad358eed702b873dd54697b3fa3f952e0feb7

        Inserting an element before the fullscreened element could crash if it caused a containing inline to be split,
        since the splitting logic doesn't expect the fullscreened element to be wrapped in a RenderFullScreen. This patch changes
        inline splitting to be aware of RenderFullScreen.

        Test: fullscreen/full-screen-inline-split-crash.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::splitInlines):

2013-05-22  Simon Fraser  <simon.fraser@apple.com>

        Fix issues with focus rings on search fields
        https://bugs.webkit.org/show_bug.cgi?id=116591

        Reviewed by Darin Adler.
        
        On a future OS, the rect returned by _focusRingVisibleRect should
        be in the coordinate system of the that NSView, not the base
        coordinate system, so fix the code that sets and reads the global
        focusRingClipRect variable accordingly.

        * platform/graphics/mac/WebLayer.mm:
        (drawLayerContents):
        * platform/mac/ThemeMac.mm:
        (-[WebCoreFlippedView _focusRingVisibleRect]):

2013-05-22  Simon Fraser  <simon.fraser@apple.com>

        New Flickr doesn't get fast scrolling but should
        https://bugs.webkit.org/show_bug.cgi?id=116514

        Reviewed by Darin Adler.
        
        RenderObject increments and decrements a counter of slow repaint objects on
        FrameView when it sees style changes related to background-attachment:fixed.
        However, it omitted to decrement the count when a renderer with a fixed background
        was destroyed.
        
        This caused Flickr to never fall into fast scrolling mode, since it toggled
        display:none on an element with a fixed background during loading, then removed
        the fixed background.
        
        Did some minor cleanup of #ENABLE(FAST_MOBILE_SCROLLING) crap.

        Tests: platform/mac-wk2/tiled-drawing/slow-scrolling-background-toggle.html
               platform/mac-wk2/tiled-drawing/slow-scrolling-hidden-background-toggle.html
               platform/mac-wk2/tiled-drawing/slow-scrolling.html

        * rendering/RenderObject.cpp:
        (WebCore::shouldRepaintFixedBackgroundsOnScroll):
        (WebCore::RenderObject::styleWillChange):
        (WebCore::RenderObject::willBeRemovedFromTree):

2013-05-22  Robert Hogan  <robert@webkit.org>

        Need to Remove Anonymous Wrappers When All Children Become Inline
        https://bugs.webkit.org/show_bug.cgi?id=115687

        Reviewed by David Hyatt.

        Remove a simple subset of anonymous wrappers, i.e. anonymous blocks without continuations,
        when a block becoming float or positioned removes the need for them.

        Test: fast/block/remove-anonymous-wrappers-when-element-changes-to-float-or-positioned.html

        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderObject.cpp:
        (WebCore):
        (WebCore::RenderObject::removeAnonymousWrappersFromLineIfNecessary):
        (WebCore::RenderObject::styleWillChange):
        (WebCore::RenderObject::styleDidChange):
        * rendering/RenderObject.h:
        (RenderObject):

2013-05-22  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>

        [css] Update ETextDecorations enum to TextDecorations
        https://bugs.webkit.org/show_bug.cgi?id=116581

        Reviewed by Andreas Kling.

        Currently, ETextDecorations enum uses a C-like coding style for its
        enumeration values, as well as a 'E' prefix that surely had some meaning
        in the past, but not nowadays.

        No behavior changes, covered by existing tests.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::hasPlainText):
        (WebCore::AccessibilityRenderObject::hasUnderline):
        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
        (getAttributeSetForAccessibilityObject):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (AXAttributeStringSetStyle):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (AXAttributeStringSetStyle):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::renderTextDecorationFlagsToCSSValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::operator TextDecoration):
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::ApplyPropertyTextDecoration::applyValue):
        (WebCore::ApplyPropertyTextDecoration::createHandler):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::fontAttributesForSelectionStart):
        * platform/mac/HTMLConverter.mm:
        (+[WebHTMLConverter editingAttributedStringFromRange:]):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paint):
        (WebCore::InlineTextBox::paintDecoration):
        * rendering/InlineTextBox.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::getTextDecorationColors):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        (WebCore::operator|):
        (WebCore::operator|=):
        * rendering/style/StyleVisualData.h:
        (StyleVisualData):
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::paint):
        (WebCore::positionOffsetForDecoration):
        (WebCore::thicknessForDecoration):
        (WebCore::findRenderObjectDefininingTextDecoration):
        (WebCore::SVGInlineTextBox::paintDecoration):
        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
        * rendering/svg/SVGInlineTextBox.h:

2013-05-22  Lori Anderson  <lori@rkymtnhi.com>

        [GStreamer] Allow multiple log levels in media player
        https://bugs.webkit.org/show_bug.cgi?id=116618

        Reviewed by Philippe Normand.

        No new tests, just changing logging.

        * platform/graphics/gstreamer/GStreamerUtilities.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::load):
        (WebCore::MediaPlayerPrivateGStreamer::pause):
        (WebCore::MediaPlayerPrivateGStreamer::seek):
        (WebCore::MediaPlayerPrivateGStreamer::setRate):
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):

2013-05-22  Beth Dakin  <bdakin@apple.com>

        The LayoutMilestones didLayout callback sometimes fires with a milestone value of 0
        https://bugs.webkit.org/show_bug.cgi?id=116623

        Reviewed by Geoffrey Garen.

        Make sure we have actually achieved some milestones before calling didLayout().
        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2013-05-22  Mario Sanchez Prada  <mario.prada@samsung.com>

        [GTK] Reimplement atk_text_get_text_*_offset for CHAR boundary
        https://bugs.webkit.org/show_bug.cgi?id=114870

        Reviewed by Martin Robinson.

        Re-implement this functions without using GailTextUtil nor Pango.

        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
        (webkitAccessibleTextGetChar): New function.
        (webkitAccessibleTextGetTextForOffset): Call the new function for CHAR.

2013-05-22  Antoine Quint  <graouts@apple.com>

        [Mac] Captions menu isn't internationalized, doesn't use rtl layout for rtl languages
        https://bugs.webkit.org/show_bug.cgi?id=116605

        Reviewed by Eric Carlson.

        Ensure that rtl languages are properly recognized by the captions menu such that text
        layout and alignment is natural.

        * css/mediaControls.css:
        (::-webkit-media-controls):
        Remove the forced "direction: ltr" property which was forcing all layout to be
        left-to-right.

        * css/mediaControlsQuickTime.css:
        (video::-webkit-media-controls-closed-captions-track-list):
        Remove the forced "text-align: left" property which was forcing all caption
        titles to be left-aligned.

        (video::-webkit-media-controls-closed-captions-track-list h3):
        Use "-webkit-margin-start" instead of "padding-left" to position the heading
        such that it adds the margin on the left for ltr languages and on the right
        for rtl languages.

        (video::-webkit-media-controls-closed-captions-track-list li):
        Set "position: relative" such that the ::before pseudo-class can use "position: absolute"
        to position itself relative to the caption title rather than the list element.

        (video::-webkit-media-controls-closed-captions-track-list li.selected::before):
        (video::-webkit-media-controls-closed-captions-track-list li.selected:hover::before):
        Make the checkmarks a ::before pseudo-class rather than a background-image such that
        we may control its positioning using the internationlization-friendly "-webkit-margin-start"
        property.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsContainerElement::create):
        Set the "dir" attribute to "auto" such that rtl languages are correctly handled. This
        means that the first string displayed within the captions container, currently the
        "Subtitles" <h3> element, defines the direction for the whole container. It is therefore
        crucial that this string is properly localized in rtl languages as falling back to
        english would mean the entire caption container is using ltr.

2013-05-22  Hugo Parente Lima  <hugo.lima@openbossa.org>

        WebCore fails to compile with -Werror=maybe-uninitialized on GCC 4.8.0
        https://bugs.webkit.org/show_bug.cgi?id=116340

        Reviewed by Christophe Dumez.

        No new tests, just a simple build fix.

        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore::InspectorDOMStorageAgent::setDOMStorageItem): Init frame variable.
        (WebCore::InspectorDOMStorageAgent::removeDOMStorageItem): Init frame variable.

2013-05-22  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Have IDL interface names match their global constructor
        https://bugs.webkit.org/show_bug.cgi?id=116520

        Reviewed by Kentaro Hara.

        Have IDL interface names match their global constructor name on DOMWindow.idl
        using [InterfaceName] extended attribute. This affects in particular webkit
        prefixed constructors. This is mandated by Web IDL specification:
        http://dev.w3.org/2006/webapi/WebIDL/#es-interfaces

        As a consequence, we can now get rid of [NoInterfaceObject] extended attribute
        for those interfaces and have their global constructors automatically generated
        by the bindings generator.

        No new tests, no behavior change for layout tests.

        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/speech/SpeechGrammar.idl:
        * Modules/speech/SpeechGrammarList.idl:
        * Modules/speech/SpeechRecognition.idl:
        * Modules/speech/SpeechRecognitionError.idl:
        * Modules/speech/SpeechRecognitionEvent.idl:
        * Modules/webaudio/OfflineAudioContext.idl:
        * Modules/webaudio/PannerNode.idl:
        * dom/ShadowRoot.idl:
        * page/DOMWindow.idl:

2013-05-21  Mihai Tica  <mitica@adobe.com>
        
        Update the background blending implementation to match the changes done
        in the spec. This implies that background color blending is removed and
        the background layers won't blend with the content behind the element
        any more.
        https://bugs.webkit.org/show_bug.cgi?id=116212

        Reviewed by Dean Jackson.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::paintFillLayers):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):

2013-05-21  Ryosuke Niwa  <rniwa@webkit.org>

        Use-after-free in DOMSelection::containsNode
        https://bugs.webkit.org/show_bug.cgi?id=116468

        Reviewed by Andreas Kling.

        Retain the node pointer. Also bail out early if the node was not in the document
        since Range::compareBoundaryPoints sets ec to WRONG_DOCUMENT_ERR otherwise.

        Test: editing/selection/contains-node-crash.html

        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::containsNode):
        * page/DOMSelection.h:
        (DOMSelection):

2013-05-21  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: InspectorFrontendHost::loadResourceSynchronously() builds ASCII-only results
        https://bugs.webkit.org/show_bug.cgi?id=116569

        Merge: https://chromium.googlesource.com/chromium/blink/+/7f1cfecfe34f4dbc6ce1ef0250b13f2058128eeb

        Reviewed by Timothy Hatcher.

        Test: inspector/load-resource-synchronously-utf8.html

        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::loadResourceSynchronously):

2013-05-21  Andy Estes  <aestes@apple.com>

        Allow session storage for third-party origins even if third-party data access is blocked.
        https://bugs.webkit.org/show_bug.cgi?id=116532

        Reviewed by Anders Carlsson.

        In http://trac.webkit.org/changeset/149326 we relaxed our policy for
        localStorage when third-party data blocking is enabled to create a
        transient, session-scoped storage area for the third-party origin
        instead of throwing an exception. Since this gives essentially the same
        behavior as sessionStorage, we might as well also allow sessionStorage
        for third-party origins.

        Test: http/tests/security/cross-origin-session-storage-third-party-blocked.html

        * WebCore.exp.in: Updated the symbol for
        SecurityOrigin::canAccessStorage.
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::sessionStorage): Called canAccessSessionStorage()
        rather than canAccessLocalStorage().
        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canAccessStorage): Passed in an enum
        indicating if access should be allowed from third-party origins.
        * page/SecurityOrigin.h:
        (WebCore::SecurityOrigin::canAccessSessionStorage): Called
        canAccessStorage() with AlwaysAllowFromThirdParty.
        (SecurityOrigin):

2013-05-21  Hugo Parente Lima  <hugo.lima@openbossa.org>

        [EFL] Add missing #if guards on drag support methods
        https://bugs.webkit.org/show_bug.cgi?id=116574

        Reviewed by Christophe Dumez.

        * platform/efl/PasteboardEfl.cpp:
        (WebCore):

2013-05-21  Antti Koivisto  <antti@apple.com>

        Remove stub HTMLContentElement
        https://bugs.webkit.org/show_bug.cgi?id=116580

        Reviewed by Andreas Kling.

        Inherit DetailsContentElement and DetailsSummaryElement directly from InsertionPoint instead.

        * html/HTMLDetailsElement.cpp:
        (WebCore::DetailsContentElement::DetailsContentElement):
        (WebCore::DetailsSummaryElement::DetailsSummaryElement):
        * html/HTMLSummaryElement.cpp:
        (WebCore::SummaryContentElement::SummaryContentElement):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::HTMLContentElement::contentTagName):
        * html/shadow/HTMLContentElement.h:
        (WebCore::isHTMLContentElement):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::setResetStyleInheritance):
        * html/shadow/InsertionPoint.h:
        
            Also remove some leftover selector code.

        (WebCore::InsertionPoint::insertionPointType):

2013-05-21  Andreas Kling  <akling@apple.com>

        Robustify repaint of previous caret node when moving FrameSelection.
        <http://webkit.org/b/116558>

        Reviewed by Ryosuke Niwa.

        As a follow-up to r150396, also repaint the caret rects if the previous node is contenteditable.

        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::recomputeCaretRect):

2013-05-21  Ryosuke Niwa  <rniwa@webkit.org>

        Unreviewed build fix after r150469. We need to bail out here when DOM is mutated by an event listener such that
        the split text nodes no longer exist right next to each other.

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCo