2012-05-22  Vitaly Buka  <vitalybuka@chromium.org>

        Fix iframe printing.
        https://bugs.webkit.org/show_bug.cgi?id=85118

        Reviewed by Darin Adler, Eric Seidel.

        Patch fixed two issues by disabling special handling of subframes for printing.
        1. Regression. Division by zero when forceLayoutForPagination called for subframes
        and page sizes set to zero.
        2. Old issue. RendererView adjusted layout of subframes for printing and set invalid
        dimensions. Sometimes it caused missing iframe when printed.

        Test: printing/iframe-print.html

        * page/Frame.cpp:
        (WebCore::Frame::setPrinting): Calls forceLayoutForPagination for root frames only.
        (WebCore::Frame::resizePageRectsKeepingRatio): Added ASSERTs to catch division by zero.
        * rendering/RenderView.cpp: Replaced printing() with shouldUsePrintingLayout() for most calls.
        (WebCore::RenderView::computeLogicalHeight):
        (WebCore::RenderView::computeLogicalWidth):
        (WebCore::RenderView::layout):
        (WebCore::RenderView::shouldUsePrintingLayout): Returns true only if printing enabled and it's a root frame.
        (WebCore::RenderView::viewRect):
        (WebCore::RenderView::viewHeight):
        (WebCore::RenderView::viewWidth):
        * rendering/RenderView.h:

2012-05-22  Rafael Brandao  <rafael.lobo@openbossa.org>

        [Qt] canvas/philip/tests/2d.path.stroke.overlap.html fails with Qt-4.6.2 or higher
        https://bugs.webkit.org/show_bug.cgi?id=40362

        Reviewed by Noam Rosenthal.

        Before drawing the stroke from a certain path, it should make the union of the stroke areas.
        The previous implementation didn't consider that so the intersection was painted twice.
        By using QPainterPathStroker, we create a QPainterPath on top of the platform path, and
        then we fill it with the expected brush. This way we avoid repainting areas.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::fillPathStroke):
        (WebCore):
        (WebCore::GraphicsContext::strokePath):

2012-05-21  Gavin Barraclough  <barraclough@apple.com>

        Disable private names by default in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=87088

        Reviewed by Geoff Garen.

        r117859 introduced a preliminary implementation of ES6-like private name objects to JSC.
        These are probably not yet ready to be web-facing, so disabling by default in WebCore.
        Opting-in for JSC & DumpRenderTree so that we can still run the fast/js/names.html test.

        * WebCore.exp.in:
            - Added export.
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore):
        (WebCore::JSDOMWindowBase::javaScriptExperimentsEnabled):
            - Override default from JSC, enable based on corresponding Setting.
        * bindings/js/JSDOMWindowBase.h:
        (JSDOMWindowBase):
            - Added declaration for javaScriptExperimentsEnabled. 
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::setJavaScriptExperimentsEnabled):
        (WebCore):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::javaScriptExperimentsEnabled):
            - Added Setting, reflecting WebPreference.

2012-05-22  Adam Barth  <abarth@webkit.org>

        !HAVE(ACCESSIBILITY) depends on AccessibilityObject::actionVerb in the Chromium Android build
        https://bugs.webkit.org/show_bug.cgi?id=87141

        Reviewed by Eric Seidel.

        In the Chromium Android build there is still one remaining dependency
        on object files in the accessibility directory:
        AccessibilityObject::actionVerb. I missed this function in my previous
        patch, but this patch changes it to be an inline stub.

        * accessibility/AccessibilityObject.cpp:
        (WebCore):
        * accessibility/AccessibilityObject.h:
        (WebCore):
        (WebCore::actionVerb):
        (WebCore::AccessibilityObject::lineForPosition):
        (WebCore::AccessibilityObject::updateBackingStore):

2012-05-22  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Support Array-type key paths
        https://bugs.webkit.org/show_bug.cgi?id=84207

        Reviewed by Tony Chang.

        Implement IDB spec behavior that key paths can be arrays of strings; when 
        evaluated, these yield arrays of keys, providing compound key support. Also
        changes exception types to match the spec.

        Test: storage/indexeddb/keypath-arrays.html
        Test: storage/indexeddb/keypath-basics.html

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::createObjectStore): Look for both string and array in option dict,
        throw exceptions for forbidden combinations of key generator and key paths.
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::createIndex): Handle special cases (accepted and forbidden).
        (WebCore):
        * Modules/indexeddb/IDBObjectStore.h:
        (IDBObjectStore):
        (WebCore::IDBObjectStore::createIndex): Overloads to satisfy IDL overloads and optional dicts.
        * Modules/indexeddb/IDBObjectStore.idl: Add DOMString array overload.
        * bindings/v8/IDBBindingUtilities.cpp: Implement spec logic for evaluating array key paths.
        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
        (WebCore):

2012-05-22  Martin Robinson  <mrobinson@igalia.com>

        [GTK] REGRESSION(r116135): Keys that confirm composition trigger a default action
        https://bugs.webkit.org/show_bug.cgi?id=86925

        Reviewed by Gustavo Noronha Silva.

        No new tests. Creating tests for GTK+ input methods is quite difficult, as they
        can differ from machine to machine. It's also hard to simulate composition
        sequences.

        * platform/gtk/CompositionResults.h: Instead of holding composition results, just
        keep a flag describing whether or not this event had results.
        (CompositionResults):

2012-05-22  Abhishek Arya  <inferno@chromium.org>

        Assertion failure (toRenderBox() called on a RenderInline) beneath RenderBlock::blockBeforeWithinSelectionRoot()
        https://bugs.webkit.org/show_bug.cgi?id=86500

        Reviewed by Ojan Vafai.

        Patch by Dan Bernstein<mitz@apple.com>. I just added the test.

        Test: fast/block/line-layout/selection-highlight-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::blockBeforeWithinSelectionRoot): Demoted the object local variable to
        RenderObject, changed use of parentBox() to parent(), and added toRenderBlock() in two places.

2012-05-22  Rob Buis  <rbuis@rim.com>

        ASSERTs in RenderInline::layout()
        https://bugs.webkit.org/show_bug.cgi?id=63365

        Reviewed by Nikolas Zimmermann.

        Do not allow creation of renderers for text content children in elements by default.
        Subclasses like SVGTextElement override this behavior.
        This also fixes the <a><textPath</a> case because the <a> parent decides to allow <textPath> or not:
        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#linking-text-environment

        Test: svg/custom/disallowed-text-content-rendering.svg

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::childShouldCreateRenderer):
        * svg/SVGElement.h:
        (SVGElement):

2012-05-22  Takashi Sakamoto  <tasak@google.com>

        Implement DOM_KEY_LOCATION_LEFT and RIGHT of KeyboardEvent's location property
        https://bugs.webkit.org/show_bug.cgi?id=86694

        As KeyboardEvent for left/right location key, e.g. left-control,
        right-control, provides DOM_KEY_LOCATION_STANDARD as keyLocation property,
        modified KeyCodeConversion to make PlatformKeyboardEvent
        provide virtual keycodes with location information, e.g. VK_LCONTROL or
        VK_RCONTROL, and modified KeyboardEvent to generate location information
        from the virtual keycodes, e.g. genrating DOM_KEY_LOCATION_LEFT for
        VK_LCONTROL. KeyboardEvent also removes location information from
        the virtual keycodes, e.g. genrating VK_CONTROL for VK_LCONTROL.
        The location property is defined in the W3C DOM3 specification:
        http://www.w3.org/TR/DOM-Level-3-Events/#events-keyboardevents

        Reviewed by Alexey Proskuryakov.

        Test: fast/events/keydown-leftright-keys.html

        * dom/KeyboardEvent.cpp:
        (WebCore::windowsVirtualKeyCodeWithoutLocation):
        Added a function which removes location information from a given
        keycode. For example, when VK_LCONTROL is given, returns VK_CONTROL.
        (WebCore::keyLocationCode):
        Added a function which provides location information from a given
        keycode. For example, when VK_LCONTROL is given,
        returns DOM_KEY_LOCATION_LEFT.
        (WebCore::KeyboardEvent::KeyboardEvent):
        Initialized m_keyLocation by using the above keyLocationCode.
        (WebCore::KeyboardEvent::keyCode):
        Modified to use the above two functions to initialize keycode property
        and keylocation property.
        * platform/chromium/KeyCodeConversionAndroid.cpp:
        (WebCore::windowsKeyCodeForKeyEvent):
        * platform/chromium/KeyCodeConversionGtk.cpp:
        (WebCore::windowsKeyCodeForKeyEvent):
        * platform/cocoa/KeyEventCocoa.mm:
        (WebCore::windowsKeyCodeForKeyCode):
        Modified these keycode conversions to return keycodes with location
        information, e.g. modified keycode conversions returns VK_LCONTROL
        for left control.

2012-05-22  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: provide content-related actions on the sources panel.
        https://bugs.webkit.org/show_bug.cgi?id=87144

        Reviewed by Vsevolod Vlasov.

        Now that the authoring focus moved to the Source panel, context menu actions should follow:
        - refactored context menu actions to be provider-based
        - edited call sites to add applicable actions.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/ContextMenu.js:
        (WebInspector.ContextMenu.prototype.appendApplicableItems):
        * inspector/front-end/HandlerRegistry.js:
        (WebInspector.HandlerRegistry.prototype.unregisterHandler):
        (WebInspector.HandlerRegistry.prototype.appendApplicableItems.doSave):
        (WebInspector.HandlerRegistry.prototype.appendApplicableItems.save):
        (WebInspector.HandlerRegistry.prototype.appendApplicableItems):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.populateTextAreaContextMenu):
        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorView.prototype.handleContextMenu):
        (WebInspector.BaseNavigatorTreeElement.prototype.onattach):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkPanel):
        (WebInspector.NetworkPanel.prototype.searchCanceled):
        (WebInspector.NetworkPanel.prototype.appendApplicableItems.reveal):
        (WebInspector.NetworkPanel.prototype.appendApplicableItems):
        * inspector/front-end/ResourceView.js:
        (WebInspector.ResourceSourceFrame.prototype._contentChanged):
        (WebInspector.ResourceSourceFrame.prototype.populateTextAreaContextMenu):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.FrameResourceTreeElement.prototype._handleContextMenuEvent):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.appendApplicableItems):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.populateTextAreaContextMenu):
        * inspector/front-end/TextViewer.js:
        (WebInspector.TextViewer.prototype._contextMenu):
        * inspector/front-end/UIUtils.js:
        * inspector/front-end/externs.js:
        * inspector/front-end/inspector.js:
        (WebInspector._doLoadedDoneWithCapabilities.get if):

2012-05-22  Nico Weber  <thakis@chromium.org>

        Give FileInputType a setFiles() method, let Drag-n-Drop call it.
        https://bugs.webkit.org/show_bug.cgi?id=87139

        Reviewed by Ojan Vafai.

        filesChosen(), the FileChooserClient callback, used to modify
        m_fileList directly. Instead, convert the FileChooserClient
        data to a FileList and pass that to a factored-out setFiles()
        method. This is in preparation to making the files property
        writable.

        Pure refactoring, no functionality change.

        * html/FileInputType.cpp:
        (WebCore::FileInputType::toFileList):
        (WebCore::FileInputType::setFiles):
        (WebCore::FileInputType::filesChosen):
        (WebCore):
        * html/FileInputType.h:
        (FileInputType):

2012-05-22  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: JavaScriptSourceFrame should be based on JavaScriptSource not UISourceCode.
        https://bugs.webkit.org/show_bug.cgi?id=87135

        Reviewed by Pavel Feldman.

        Renamed _uiSourceCode to _javaScriptSource in JavaScriptSourceFrame.
        Removed unused uiSourceCode getter from JavaScriptSourceFrame.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype.canEditSource):
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._onContentChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.populateLineGutterContextMenu):
        (WebInspector.JavaScriptSourceFrame.prototype.populateTextAreaContextMenu):
        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointAdded):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointRemoved):
        (WebInspector.JavaScriptSourceFrame.prototype.onTextViewerContentLoaded):
        (WebInspector.JavaScriptSourceFrame.prototype._setBreakpoint):
        (WebInspector.JavaScriptSourceFrame.prototype._continueToLine):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):

2012-05-22  Lu Guanqun  <guanqun.lu@intel.com>

        add OVERRIDE annotations to classes derived from CCAnimationCurve
        https://bugs.webkit.org/show_bug.cgi?id=87073

        Reviewed by James Robinson.

        No new tests required.

        * platform/graphics/chromium/cc/CCAnimationCurve.h:

2012-05-22  Lu Guanqun  <guanqun.lu@intel.com>

        add OVERRIDE annotations to CCThreadTask
        https://bugs.webkit.org/show_bug.cgi?id=87074

        Reviewed by James Robinson.

        No new tests required.

        * platform/graphics/chromium/cc/CCThreadTask.h:

2012-05-22  Julien Chaffraix  <jchaffraix@webkit.org>

        Centralize and clean-up table column iteration
        https://bugs.webkit.org/show_bug.cgi?id=87051

        Reviewed by Eric Seidel.

        Tests: fast/table/caption-between-column-and-column-group.html
               fast/table/caption-between-column-group-and-column.html
               fast/table/caption-between-columns.html

        The existing code had duplications between different classes and some
        of the iterating functions could use a better place. That's what this
        change solves, along with several renamings.

        * rendering/RenderTableCol.h:
        (WebCore::RenderTableCol::isTableColumnGroupWithColumnChildren):
        Renamed isTableColGroup to this to better reflect what it checks.
        Also added a new function: nextColumn.

        * rendering/FixedTableLayout.cpp:
        (WebCore::FixedTableLayout::calcWidthArray):
        Updated after isTableColGroup renaming.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::firstColumn):
        Added this new function to get the first column (or column group).

        (WebCore::RenderTable::colElement):
        Cleaned up this function: switched the loop to a 'for' now that the
        helper functions make it easy. Cleaned up the ordering and the naming.

        * rendering/RenderTable.h:
        Added firstColumn.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::styleOrColLogicalWidth):
        Updated to use nextColumn().

        * rendering/RenderTableCol.cpp:
        (WebCore::RenderTableCol::nextColumn):
        Added this new helper function to centralize the code to iterate over columns.

2012-05-22  Hao Zheng  <zhenghao@chromium.org>

        [chromium] Make color of spelling check marker cross-platform.
        https://bugs.webkit.org/show_bug.cgi?id=87095

        Reviewed by Adam Barth.

        Pixel layout is RGBA on Android, while it is BGRA on other platforms.

        No new tests. To run tests on Android.

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForDocumentMarker):

2012-05-22  Dana Jansens  <danakj@chromium.org>

        [chromium] Expand damage from the background-blurred layer to ensure readback is only including pixels below that layer
        https://bugs.webkit.org/show_bug.cgi?id=86884

        Reviewed by Adrienne Walker.

        Consider layers in back-to-front order A, B, and C, where layer B has
        a blur background filter applied, and C exactly covers A. When B does
        its readback to perform its blur, it should include the pixels of A
        not C. With partial swap, if B is damaged, that damaged area will read
        pixels from outside of the damage rect. Those pixels should use the
        contents of A, not C, so we must expand the damage to ensure we redraw
        all pixels that are going to be included in the blur for the current
        frame.

        Also, when a layer below B has damage outside the contentBounds of B
        but within its blur radius, then that damage will be blurred inside B,
        so expand all damage within B's blurred contentBounds.

        Unit test: CCDamageTrackerTest.verifyDamageForBackgroundBlurredChild

        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::expandRectWithFilters):
        (WebCore::expandDamageRectInsideRectWithFilters):
        (WebCore::CCDamageTracker::updateDamageTrackingState):
        (WebCore::CCDamageTracker::extendDamageForRenderSurface):

2012-05-22  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Add region styling support for color property
        https://bugs.webkit.org/show_bug.cgi?id=85633

        Reviewed by David Hyatt.

        Test: fast/regions/region-style-color.html

        This patch extends the region styling support. In addition to background-color, it adds
        the possibility of styling color in regions.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::removeFlowChildInfo):
        (WebCore::RenderFlowThread::addRegionToThread):
        (WebCore::RenderFlowThread::removeRegionFromThread):
        (WebCore::RenderFlowThread::clearRenderObjectCustomStyle):
        (WebCore::RenderFlowThread::setRegionRangeForBox):
        (WebCore):
        (WebCore::RenderFlowThread::checkRegionsWithStyling):
        * rendering/RenderFlowThread.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::updateAlwaysCreateLineBoxes):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::paintReplaced):
        (WebCore::RenderRegion::styleDidChange):
        (WebCore::RenderRegion::setRegionObjectsRegionStyle):
        (WebCore::RenderRegion::restoreRegionObjectsOriginalStyle):
        (WebCore::RenderRegion::computeStyleInRegion):
        (WebCore):
        (WebCore::RenderRegion::computeChildrenStyleInRegion):
        (WebCore::RenderRegion::setObjectStyleInRegion):
        (WebCore::RenderRegion::clearObjectStyleInRegion):
        * rendering/RenderRegion.h:
        (RenderRegion):
        (ObjectRegionStyleInfo):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove GenerateSetDOMException() from CodeGeneratorV8.pm
        https://bugs.webkit.org/show_bug.cgi?id=87114

        Reviewed by Nate Chapin.

        GenerateSetDOMException() is used by only one place. This patch removes it.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):

2012-05-22  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Fire error when there are problems opening a DB
        https://bugs.webkit.org/show_bug.cgi?id=85579

        We used to either fire success or get into an infinite loop.

        Reviewed by Tony Chang.

        New unit test in
        Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp

        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
        (WebCore::IDBDatabaseBackendImpl::openInternal):
        (WebCore::IDBDatabaseBackendImpl::openConnection):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
        (WebCore::IDBDatabaseBackendImpl::create):
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
        (WebCore::IDBFactoryBackendImpl::deleteDatabase):
        (WebCore::IDBFactoryBackendImpl::openInternal):
        * Modules/indexeddb/IDBFactoryBackendImpl.h:
        (IDBFactoryBackendImpl):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):

2012-05-22  Nikolas Zimmermann  <nzimmermann@rim.com>

        Not reviewed.

        Follow-up patch after r117975, as the strict approach fires assertions.
        CSS generated content can violate the ASSERT(child->isSVGInline() || child->isSVGInlineText()) logic.

        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::subtreeChildWasAdded):
        (WebCore::RenderSVGText::subtreeChildWillBeRemoved):

2012-05-22  Dominic Mazzoni  <dmazzoni@google.com>

        Chromium AX: Crash when menulist adds selected option via document.write
        https://bugs.webkit.org/show_bug.cgi?id=87028

        Reviewed by Chris Fleizach.

        Test: platform/chromium/accessibility/add-to-menu-list-crashes.html

        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::addChild):

2012-05-22  Nikolas Zimmermann  <nzimmermann@rim.com>

        Crash in WebCore::SVGTextLayoutAttributesBuilder::fillCharacterDataMap
        https://bugs.webkit.org/show_bug.cgi?id=86781

        Reviewed by Rob Buis.

        Always invalidate the text positioning element cache if the <text> render subtree mutates.
        Currently only RenderSVGInlineText renderers are tracked correctly, RenderSVGInline
        renderers like RenderSVGTSpan didn't cause text positioning element cache mutations
        so far. Fix that.

        Test: svg/custom/bug86781.html

        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::removeChild):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::subtreeChildWasAdded):
        (WebCore::RenderSVGText::subtreeChildWillBeRemoved):
        (WebCore::RenderSVGText::removeChild):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):

2012-05-22  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: make "Go to source" shortcut accessible from all panels.
        https://bugs.webkit.org/show_bug.cgi?id=87132

        Reviewed by Vsevolod Vlasov.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.AdvancedSearchController.prototype.handleShortcut):
        * inspector/front-end/FilteredItemSelectionDialog.js:
        (WebInspector.OpenResourceDialog.filterOutEmptyURLs):
        (WebInspector.OpenResourceDialog.compareFunction):
        (WebInspector.OpenResourceDialog):
        (WebInspector.OpenResourceDialog.prototype.itemTitleAt):
        (WebInspector.OpenResourceDialog.prototype.itemKeyAt):
        (WebInspector.OpenResourceDialog.prototype.itemsCount):
        (WebInspector.OpenResourceDialog.prototype.requestItems):
        (WebInspector.OpenResourceDialog.prototype.selectItem):
        (WebInspector.OpenResourceDialog.show):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.appendApplicableItems):
        (WebInspector.ScriptsPanel.prototype.showGoToSourceDialog):
        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController.prototype.handleShortcut):
        * inspector/front-end/inspector.js:
        (WebInspector._registerShortcuts):
        (WebInspector.documentKeyDown):

2012-05-22  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapSnapshot: speedUp buildAggregates.
        https://bugs.webkit.org/show_bug.cgi?id=87131

        Engine can't inline getters and use fast-case if the function has for(i in object) loops.

        Reviewed by Yury Semikhatsky.

        No logic changes.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.classIndex):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._calculateClassesRetainedSize):

2012-05-22  Nikolas Zimmermann  <nzimmermann@rim.com>

        Crash in WebCore::RenderSVGContainer::paint
        https://bugs.webkit.org/show_bug.cgi?id=86392

        Reviewed by Rob Buis.

        Modernize the <marker> code, switch to the same design pattern used for handling zero-length subpaths.
        Decouple the generation of the marker start/mid/end positions from the actual usage of these information.
        Only generate those marker positions if the underlying Path changes, and never else.

        When figuring out the bounds for a shape, access to current set of RenderSVGResourceMarker start/mid/end resources
        and ask the marker resources for their bounds using the previously figured out marker positions on the Path.
        Drawing markers is handled in the same way.

        Remove SVGMarkerLayoutInfo alltogether which stored raw pointers to the RenderSVGResourceMarkers.
        We assumed that those objects would stay alive from layout() to paint(), but that assumption is wrong.

        Tests: svg/custom/bug86392.html
               svg/custom/marker-zero-length-linecaps-expected.svg
               svg/custom/marker-zero-length-linecaps.svg

        * CMakeLists.txt: Remove SVGMarkerLayoutInfo.*.
        * GNUmakefile.list.am: Ditto.
        * Target.pri: Ditto.
        * WebCore.gypi: Ditto.
        * WebCore.order: Ditto.
        * WebCore.vcproj/WebCore.vcproj: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * rendering/svg/RenderSVGAllInOne.cpp: Ditto.
        * rendering/svg/RenderSVGShape.cpp: Handle markers just like the existing zero leng subpath code, which is superior.
        (WebCore::RenderSVGShape::createShape):
        (WebCore::RenderSVGShape::layout):
        (WebCore::RenderSVGShape::shouldGenerateMarkerPositions):
        (WebCore::RenderSVGShape::paint):
        (WebCore::markerForType):
        (WebCore::RenderSVGShape::markerRect):
        (WebCore::RenderSVGShape::inflateWithStrokeAndMarkerBounds):
        (WebCore::RenderSVGShape::drawMarkers):
        (WebCore::RenderSVGShape::processMarkerPositions):
        * rendering/svg/RenderSVGShape.h:
        (RenderSVGShape):
        * rendering/svg/SVGMarkerData.h:
        (WebCore::MarkerPosition::MarkerPosition):
        (MarkerPosition):
        (WebCore::SVGMarkerData::SVGMarkerData):
        (WebCore::SVGMarkerData::updateFromPathElement):
        (WebCore::SVGMarkerData::pathIsDone):
        (SVGMarkerData):
        (WebCore::SVGMarkerData::currentAngle):
        * rendering/svg/SVGMarkerLayoutInfo.cpp: Removed.
        * rendering/svg/SVGMarkerLayoutInfo.h: Removed.
        * rendering/svg/SVGResourcesCache.cpp:
        (WebCore::resourcesCacheFromRenderObject):
        (WebCore::SVGResourcesCache::cachedResourcesForRenderObject):
        * rendering/svg/SVGResourcesCache.h:
        (SVGResourcesCache):

2012-05-22  Alexander Pavlov  <apavlov@chromium.org>

        [Chromium] Implement the ContextMenuItem SubMenu type
        https://bugs.webkit.org/show_bug.cgi?id=86625

        Reviewed by Pavel Feldman.

        This change is the WebKit part of a two-sided patch that adds subMenuItems to ContextMenuItem
        and introduces code needed to handle it properly.

        * platform/ContextMenuItem.h:
        (PlatformMenuItemDescription): Add a Vector for subMenuItems.
        * platform/PlatformMenuDescription.h:
        (WebCore): Introduce a meaningful typedef for PlatformMenuDescription in Chromium.
        * platform/chromium/ContextMenuChromium.cpp:
        (WebCore::ContextMenu::itemWithAction): Search submenus when looking up a requested action id.
        (WebCore::ContextMenu::platformDescription): Return a real PlatformMenuDescription rather than 0.
        * platform/chromium/ContextMenuItemChromium.cpp:
        (WebCore::ContextMenuItem::ContextMenuItem): Set submenu if one has been passed in.
        (WebCore::ContextMenuItem::platformSubMenu): Return real subMenuItems instead of an empty PlatformMenuDescription.
        (WebCore::ContextMenuItem::setSubMenu): Implemented.
        (WebCore):

2012-05-22  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: use canvas to render timeline category strips in overview pane
        https://bugs.webkit.org/show_bug.cgi?id=87109

        Reviewed by Pavel Feldman.

        - use canvas, not DOM to represent timeline category strips in the default overview mode

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane):
        (WebInspector.TimelineOverviewPane.prototype._setVerticalOverview): propagate to TimelineCategoryStrips;
        (WebInspector.TimelineOverviewPane.prototype._onCategoryVisibilityChanged): force update of category strips;
        (WebInspector.TimelineOverviewPane.prototype._update):
        (WebInspector.TimelineOverviewPane.prototype.setShowShortEvents):
        (WebInspector.TimelineCategoryStrips):
        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord): process one record;
        (WebInspector.TimelineCategoryStrips.prototype.update): re-draw everything;
        (WebInspector.TimelineCategoryStrips.prototype.setShowShortEvents):
        (WebInspector.TimelineCategoryStrips.prototype._renderBar): render single bar;
        (WebInspector.TimelineVerticalOverview):
        (WebInspector.TimelineVerticalOverview.prototype._renderBar):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        (WebInspector.TimelinePresentationModel.createFillStyle): utility methods to create gradients for category bars;
        (WebInspector.TimelinePresentationModel.createFillStyleForCategory):
        (WebInspector.TimelineCategory):

2012-05-22  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: [regression] dynamically created script tab is bound to the document resource.
        https://bugs.webkit.org/show_bug.cgi?id=87119

        Reviewed by Vsevolod Vlasov.

        Test: inspector/debugger/dynamic-script-tag.html

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.Breakpoint.prototype._setInDebugger.didSetBreakpoint):
        (WebInspector.BreakpointManager.Breakpoint.prototype._setInDebugger):
        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel.prototype.rawLocationToUILocation):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.addScript):
        (WebInspector.ResourceScriptMapping.prototype._shouldBindScriptToContentProvider):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.rawLocationToUILocation):
        (WebInspector.Script.Location.prototype.update):

2012-05-22  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: JavaScript breakpoints disappear when Ctrl+S is pressed for the script without changes.
        https://bugs.webkit.org/show_bug.cgi?id=87121

        Reviewed by Pavel Feldman.

        JavaScriptSourceFrame and StylesSourceFrame should not commit working copy unless UISourceCode is dirty.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSourceFrame.prototype.commitEditing):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):

2012-05-22  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapSnapshot: speed-up calculateRetainedSize functon.
        https://bugs.webkit.org/show_bug.cgi?id=87124

        I found that in all dominators related functions we use nodeOrdinals.
        At the moment we divide nodeIndex to nodeFieldCount and this operation too expensive for these simple algorithms.

        Reviewed by Yury Semikhatsky.

        Covered by existing tests.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.get dominatorIndex):
        (WebInspector.HeapSnapshot.prototype._init):
        (WebInspector.HeapSnapshot.prototype._buildPostOrderIndex):
        (WebInspector.HeapSnapshot.prototype._buildDominatorTree):
        (WebInspector.HeapSnapshot.prototype._calculateRetainedSizes):
        (WebInspector.HeapSnapshot.prototype._buildDominatedNodes):

2012-05-22  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: annotate InjectedScriptSource.js for closure compiler
        https://bugs.webkit.org/show_bug.cgi?id=87120

        Reviewed by Pavel Feldman.

        Annotated InjectedScriptSource.js for closure compiler. Replaced call of undefined
        _isPrimitiveValue function with isPrimitiveValue.

        * inspector/InjectedScriptExterns.js: Added. External APIs used in InjectedScriptSource.js
        (console.log):
        (InjectedScriptHost.prototype.storageId):
        (InjectedScriptHost.prototype.functionDetails):
        (InjectedScriptHost.prototype.isHTMLAllCollection):
        (InjectedScriptHost.prototype.internalConstructorName):
        (InjectedScriptHost.prototype.copyText):
        (InjectedScriptHost.prototype.clearConsoleMessages):
        (InjectedScriptHost.prototype.inspectedObject):
        (InjectedScriptHost.prototype.databaseId):
        (InjectedScriptHost.prototype.inspect):
        (InjectedScriptHost.prototype.type):
        (InjectedScriptHost.prototype.getEventListeners):
        (JavaScriptCallFrame.prototype.scopeType):
        * inspector/InjectedScriptSource.js:

2012-05-22  Ian Vollick  <vollick@chromium.org>

        [chromium] Speed up CCLayerTreeHostTestTickAnimationWhileBackgrounded
        https://bugs.webkit.org/show_bug.cgi?id=86871

        Reviewed by James Robinson.

        With this patch, the background animation timer is lazily created,
        allowing for different time intervals to be used. In particular, a
        very short interval for unit tests.

        Unit tests: CCLayerTreeHostTestTickAnimationWhileBackgrounded.runSingleThread
                    CCLayerTreeHostTestTickAnimationWhileBackgrounded.runMultiThread

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::setBackgroundTickingEnabled):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::setVisible):
        (WebCore::CCLayerTreeHostImpl::animateLayers):
        (WebCore::CCLayerTreeHostImpl::lowFrequencyAnimationInterval):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::setVisible):

2012-05-22  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Styles] Odd synthetic shorthands may appear in the style
        https://bugs.webkit.org/show_bug.cgi?id=87081

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype.onpopulate):

2012-05-22  Hayato Ito  <hayato@chromium.org>

        Fix crashes when a mouse points a <svg> element in shadow DOM subtree.
        https://bugs.webkit.org/show_bug.cgi?id=86795

        Reviewed by Nikolas Zimmermann.

        <svg> elements in shadow dom subtree are still not supported.
        This fixes only crashes.

        Test: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/EventDispatcher.cpp:
        (WebCore::eventTargetRespectingSVGTargetRules):
        * page/EventHandler.cpp:
        (WebCore::instanceAssociatedWithShadowTreeElement):

2012-05-22  Andreas Kling  <kling@webkit.org>

        DOM Attr objects pointing to "style" attribute should force reification when read.
        <http://webkit.org/b/87076>

        Reviewed by Antti Koivisto.

        Make sure that the "style" attribute is reserialized as needed when it gets retrieved
        through an Attr object. This fixes a bug where updating an element's inline style
        through the CSSOM API, and then retrieving the style attribute through an Attr node
        that was previously created by element.getAttributeNode() would return the old style
        attribute value.

        Test: fast/dom/attr-style-too-lazy.html

        * dom/Attr.cpp:
        (WebCore::Attr::value):

2012-05-22  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapProfiler: upstream retainedSize calculation.
        https://bugs.webkit.org/show_bug.cgi?id=87107

        This patch upstreams V8::HeapSnapshotGenerator::CalculateRetainedSizes function to front-end.
        After that we will be able to drop retainedSize field from the snapshot serialized data.
        See meta-bug https://bugs.webkit.org/show_bug.cgi?id=87089

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.get retainedSize):
        (WebInspector.HeapSnapshot.prototype._init):
        (WebInspector.HeapSnapshot.prototype._calculateRetainedSizes):

2012-05-22  Emil A Eklund  <eae@chromium.org>

        Change RenderBlock to user RenderBox/RenderInline writing mode logic
        https://bugs.webkit.org/show_bug.cgi?id=87040

        Reviewed by Eric Seidel.

        Remove unnecessary writing mode logic in RenderBlock and use the
        implementation in RenderBox and RenderInline instead.

        No new tests, no change in functionality.

        * rendering/RenderBlock.cpp:
        (WebCore):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::marginBeforeForChild):
        (WebCore::RenderBlock::marginAfterForChild):
        (WebCore::RenderBlock::marginStartForChild):
        (WebCore::RenderBlock::marginEndForChild):
        (WebCore::RenderBlock::setMarginStartForChild):
        (WebCore::RenderBlock::setMarginEndForChild):
        (WebCore::RenderBlock::setMarginBeforeForChild):
        (WebCore::RenderBlock::setMarginAfterForChild):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::marginBefore):
        (WebCore::RenderBox::marginAfter):
        (WebCore::RenderBox::marginStart):
        (WebCore::RenderBox::marginEnd):
        (WebCore::RenderBox::setMarginStart):
        (WebCore::RenderBox::setMarginEnd):
        (WebCore::RenderBox::setMarginBefore):
        (WebCore::RenderBox::setMarginAfter):
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::marginStart):
        (WebCore::RenderInline::marginEnd):
        (WebCore::RenderInline::marginBefore):
        (WebCore::RenderInline::marginAfter):
        * rendering/RenderInline.h:
        (RenderInline):

2012-05-22  Li Yin  <li.yin@intel.com>

        [WebSocket] WebSocket object should fire a simple event named error when it is required to fail the websocket connection.
        https://bugs.webkit.org/show_bug.cgi?id=86958

        Reviewed by Kent Tamura.

        Spec:http://dev.w3.org/html5/websockets/#feedback-from-the-protocol
        If the user agent was required to fail the websocket connection or the 
        WebSocket connection is closed with prejudice, fire a simple event 
        named error at the WebSocket object.

        Tests: http/tests/websocket/tests/hybi/close.html

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::didReceiveMessageError):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::fail):

2012-05-22  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: allow showing selected object in another heap profiler view
        https://bugs.webkit.org/show_bug.cgi?id=87098

        Reviewed by Vsevolod Vlasov.

        Added 2 context menu actions: 1) to jump from a node in the heap snapshot summary
        view to the same node in the dominators view; 2) to jump from a node in the dominators
        view to the same node in the summary view.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotSortableDataGrid): "sorting complete" event is only dispatched on
        when the data grid is populated. If we switch to already populated data grid the event is not
        dispatched. However when switching between different views of a heap snapshot we want to track
        the moment when the data grid is shown and populated. I added
        WebInspector.HeapSnapshotSortableDataGrid.Events.ContentShown for such cases. The event will always
        be dispatched after the data grid is shown and its content is populated.
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.wasShown):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype._sortingComplete):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.revealInDominatorsView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu.else.revealInSummaryView):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.populateContextMenu):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype._performSorting):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGenericObjectNode.prototype._createObjectCell):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype.populateContextMenu):
        (WebInspector.HeapSnapshotView.prototype.changeView.dataGridContentShown):
        (WebInspector.HeapSnapshotView.prototype.changeView):
        (WebInspector.HeapSnapshotView.prototype._onSelectedViewChanged):
        (WebInspector.HeapSnapshotView.prototype._changeView):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._handleContextMenuEvent):

2012-05-22  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: show more button node should have height multiple of row height
        https://bugs.webkit.org/show_bug.cgi?id=87104

        Reviewed by Vsevolod Vlasov.

        Made "show more" button height multiple of the data grid row height.

        * inspector/front-end/ShowMoreDataGridNode.js:
        (WebInspector.ShowMoreDataGridNode.prototype.nodeHeight):
        * inspector/front-end/dataGrid.css:
        (.data-grid button):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Add an optional 'isolate' argument to throwTypeError()
        https://bugs.webkit.org/show_bug.cgi?id=87070

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch adds an optional 'isolate' argument to throwTypeError(),
        and passes Isolate to throwTypeError()s. In a following patch,
        I'll pass Isolate to all throwTypeError("message")s.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrSetter):
        (GenerateOverloadedFunctionCallback):
        (GenerateParametersCheck):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::overloadedMethodCallback):
        (WebCore::TestObjV8Internal::overloadedMethod1Callback):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::throwTypeError):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::constructorCallback):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::V8SVGLength::valueAccessorSetter):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
        (WebCore::V8WebGLRenderingContext::getUniformCallback):
        (WebCore::vertexAttribAndUniformHelperf):
        (WebCore::uniformHelperi):
        (WebCore::uniformMatrixHelper):

2012-05-22  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms][Meter][Progress] Change function signature of parseToDoubleForNumberType
        https://bugs.webkit.org/show_bug.cgi?id=87077

        Reviewed by Hajime Morita.

        This patch changes function signature of parseToDoubleForNumberType and
        parseToDoubleForNumberTypeWithDecimalPlaces to return double value instead
        of bool for reducing code in call sites for ease of maintenance. This patch
        also allows to use functional style of using these functions.

        No new tests. This patch doesn't change behavior.

        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::min): Changed for using double return value.
        (WebCore::HTMLMeterElement::max): Changed for using double return value.
        (WebCore::HTMLMeterElement::value): Changed for using double return value.
        (WebCore::HTMLMeterElement::low): Changed for using double return value.
        (WebCore::HTMLMeterElement::high): Changed for using double return value.
        (WebCore::HTMLMeterElement::optimum): Changed for using double return value.
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::value): Changed for using double return value.
        (WebCore::HTMLProgressElement::max): Changed for using double return value.
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::typeMismatchFor): Changed for using double return value.
        (WebCore::NumberInputType::sizeShouldIncludeDecoration): Changed for using double return value.
        (WebCore::NumberInputType::parseToDouble): Changed for using double return value.
        (WebCore::NumberInputType::parseToDoubleWithDecimalPlaces): Changed for using double return value.
        (WebCore::NumberInputType::visibleValue): Changed for using double return value.
        (WebCore::NumberInputType::sanitizeValue): Changed for using double return value.
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::parseToDouble): Changed for using double return value.
        * html/StepRange.cpp:
        (WebCore::StepRange::parseStep): Changed for using double return value.
        * html/StepRange.h:
        (WebCore::StepRange::defaultValue): Added "const" attribute
        (WebCore::StepRange::proportionFromValue): Added "const" attribute
        (WebCore::StepRange::valueFromProportion): Added "const" attribute
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseToDoubleForNumberType): Changed for using double return value. Added one parameter function.
        (WebCore::parseToDoubleForNumberTypeWithDecimalPlaces): Changed for using double return value. Added function for providing default fallback value.
        * html/parser/HTMLParserIdioms.h: Changed function prototype and added one parameter prototypes.
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderPosition): Changed for using double return value.

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"
        https://bugs.webkit.org/show_bug.cgi?id=86991

        Reviewed by Ojan Vafai.

        Original Chromium bug: http://code.google.com/p/chromium/issues/detail?id=128723

        Consider the following html:

        <html><body><form>
        <input type="hidden" name="arguments"></input>
        <div onclick="onclicked()" id="divInsideForm">Click here</div>
        </form></body>
        <script>
        function onclicked() {
          alert("onclicked");
        }
        </script>
        </html>

        If we click "Click here", JavaScript throws "Uncaught TypeError: undefined has no properties".

        This is a regression caused by r110315. V8LazyEventListener should not use
        'arguments' to retrieve the execution contexts, since 'arguments' can be
        shadowed by JavaScript.

        This patch changes V8LazyEventListener so that it retrieves contexts
        by this[2], this[1] and this[0].

        Test: fast/forms/form-input-named-arguments.html

        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] setDOMException() should return v8::Handle<v8::Value>()
        https://bugs.webkit.org/show_bug.cgi?id=87083

        Reviewed by Adam Barth.

        The following patterns are used here and there in V8 bindings:

            setDOMException();
            return v8::Handle<v8::Value>();

        and

            setDOMException();
            return v8::Undefined();

        By returning v8::Handle<v8::Value>() from setDOMException(), we can simplify the above patterns into this:

            return setDOMException();

        This patch just replaces the code in CodeGeneratorV8.pm. I'll replace
        all other custom bindings in a follow-up patch.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateSetDOMException):
        (GenerateFunctionCallback):
        (GenerateFunctionCallString):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::TestEventTargetV8Internal::itemCallback):
        (WebCore::TestEventTargetV8Internal::dispatchEventCallback):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::TestInterfaceV8Internal::supplementalMethod2Callback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::attrWithGetterExceptionAttrGetter):
        (WebCore::TestObjV8Internal::stringAttrWithGetterExceptionAttrGetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::methodThatRequiresAllArgsAndThrowsCallback):
        (WebCore::TestObjV8Internal::methodWithExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptStateVoidExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptStateObjExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateObjExceptionCallback):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        (WebCore::TestObjV8Internal::strictFunctionCallback):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::setDOMException):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):

2012-05-22  MORITA Hajime  <morrita@google.com>

        Unreviewed expectations update against r117989.

        * bindings/scripts/test/V8/V8Float64Array.cpp:
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        * bindings/scripts/test/V8/V8TestException.cpp:
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        * bindings/scripts/test/V8/V8TestNode.cpp:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:

2012-05-21  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: migrate dominatorIndex code to the front-end calculated dominatorsTree.
        https://bugs.webkit.org/show_bug.cgi?id=87024

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.get dominatorIndex):
        (WebInspector.HeapSnapshot.prototype._init):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace 'throwError(); return Undefined();' with 'return throwError()'
        https://bugs.webkit.org/show_bug.cgi?id=87079

        Reviewed by Adam Barth.

        This patch replaces

            throwError();
            return v8::Undefined();

        with

            return throwError();

        No tests. No change in behavior.

        * bindings/v8/DateExtension.cpp:
        (WebCore::DateExtension::OnSleepDetected):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::openCallback):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
        (WebCore::V8WebGLRenderingContext::getUniformCallback):
        (WebCore::vertexAttribAndUniformHelperf):
        (WebCore::uniformHelperi):
        (WebCore::uniformMatrixHelper):

2012-05-22  Kenneth Russell  <kbr@google.com>

        Must set/reset pixel unpack alignment to 1 during texSubImage2D
        https://bugs.webkit.org/show_bug.cgi?id=86877

        Reviewed by James Robinson.

        Set pixel unpack alignment to 1 during upload, resetting afterward.

        Tests: fast/canvas/webgl/tex-image-and-sub-image-2d-with-canvas-rgb565.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-canvas-rgba4444.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-canvas-rgba5551.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-canvas.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-data-rgb565.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-data-rgba4444.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-data-rgba5551.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgb565.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgba4444.html
               fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-rgba5551.html

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::texSubImage2DImpl):
        (WebCore::WebGLRenderingContext::texSubImage2D):
            Set pixel unpack alignment to 1 during upload; reset afterward.

2012-05-21  Sam D  <dsam2912@gmail.com>

        Web Inspector: "Deactivate All Breakpoints" should visually get reflected in Breakpoints pane.
        https://bugs.webkit.org/show_bug.cgi?id=86844

        Reviewed by Pavel Feldman.

        Added an option for activate/deactivate breakpoints into Breakpoints
        pane section. Style properties has been attached with
        breakpoint list to reflect active state of breakpoints.

        No new tests. UI Change.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/BreakpointsSidebarPane.js:
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointContextMenu):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._breakpointsActiveStateChanged):
        * inspector/front-end/inspector.css:
        (.breakpoints-list-deactivated):

2012-05-21  Alexis Menard  <alexis.menard@openbossa.org>

        Web Inspector: Remove some dead code in CSSStyleModel.js.
        https://bugs.webkit.org/show_bug.cgi?id=87048

        Reviewed by Pavel Feldman.

        Remove dead and unused code in CSSStyleModel.js.

        No new tests : the code is supposedly dead so we should not have
        any regressions.

        * inspector/front-end/CSSStyleModel.js:

2012-05-21  Adam Barth  <abarth@webkit.org>

        !HAVE(ACCESSIBILITY) should be able to build without linking in any code from WebCore/accessibility
        https://bugs.webkit.org/show_bug.cgi?id=87035

        Reviewed by Chris Fleizach.

        The OS(ANDROID) already builds with !HAVE(ACCESSIBILITY), but because
        there are a few straggling references to objects in the
        WebCore/accessibility directory, we end up pulling in a bunch of code
        into the binary that we don't need.

        This patch stubs out a few more functions for !HAVE(ACCESSIBILITY) so
        we can link without any objects from WebCore/accessibility. This patch
        also locks in that property by actually excluding the
        WebCore/accessibility directory from the build on OS(ANDROID).

        * WebCore.gyp/WebCore.gyp:
        * accessibility/AXObjectCache.h:
        (AXObjectCache):
        (WebCore::AXObjectCache::enableAccessibility):
        (WebCore::AXObjectCache::setEnhancedUserInterfaceAccessibility):
        (WebCore::AXObjectCache::accessibilityEnabled):
        (WebCore::AXObjectCache::accessibilityEnhancedUserInterfaceEnabled):
        (WebCore::AXObjectCache::AXObjectCache):
        (WebCore::AXObjectCache::~AXObjectCache):
        (WebCore::AXObjectCache::get):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::rootObject):
        (WebCore::AXObjectCache::rootObjectForFrame):
        (WebCore::AXObjectCache::rootAXEditableElement):
        (WebCore::AXObjectCache::childrenChanged):
        (WebCore::AXObjectCache::contentChanged):
        (WebCore::AXObjectCache::detachWrapper):
        (WebCore::AXObjectCache::handleActiveDescendantChanged):
        (WebCore::AXObjectCache::handleAriaRoleChanged):
        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
        (WebCore::AXObjectCache::handleScrolledToAnchor):
        (WebCore::AXObjectCache::nodeTextChangeNotification):
        (WebCore::AXObjectCache::nodeTextChangePlatformNotification):
        (WebCore::AXObjectCache::postNotification):
        (WebCore::AXObjectCache::postPlatformNotification):
        (WebCore::AXObjectCache::remove):
        (WebCore::AXObjectCache::selectedChildrenChanged):
        * accessibility/AccessibilityObject.h:
        (WebCore):
        (WebCore::AccessibilityObject::updateBackingStore):
        (WebCore::AccessibilityObject::lineForPosition):
        (WebCore::AccessibilityObject::children):

2012-05-21  Andreas Kling  <kling@webkit.org>

        Use stack-allocated BitArray in StylePropertySet serialization.
        <http://webkit.org/b/87071>

        Reviewed by Anders Carlsson.

        Use BitArray instead of BitVector to track seen properties in StylePropertySet::asText().
        This removes two heap allocations from this path.

        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::asText):

2012-05-21  Hajime Morrita  <morrita@chromium.org>

        Unreviewed Qt build fix against r117898.

        * Target.pri:

2012-05-21  Hajime Morrita  <morrita@chromium.org>

        [V8] Shadow DOM should be per-window-configurable.
        https://bugs.webkit.org/show_bug.cgi?id=86555

        Reviewed by Kentaro Hara.

        This change introduces an IDL attribute named "V8EnabledAtContext"
        which allows DOMWindow properties to be turned on or off per
        windows basis. RuntimeEnabledFeatures::xxxAllowed() method decides the availability.

        - CodeGeneratorV8.pm now accepts V8EnabledAtContext and allows such properties
          to be configured per-Object basis, instead of per-ObjectTemplate basis.
          The script generates V8Window::installPerContextProperties(), which injects such
          per-object-turnable properties to newly created DOMWindow wrapper.
        - Added RuntimeEnabledFeatures::shadowDOMAllowed(DOMWindow*) which is used to
          decide the shadow dom availability of Shadow DOM feature.
          It delegates the call to FrameLoaderClient::shadowDOMAllowed() to make the decision.
        - The new IDL attribute is applied to DOMWindow.WebKitShadowRoot.
        - Updated existing shadowDOMEnabled() call sites with shadowDOMAllowed().

        No new tests except run-bindings-test. This isn't testable from
        DRT and this change itself doesn't chagne the behaviour.  It needs
        a client implementation.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/generic/ContextEnabledFeatures.cpp: Added.
        (WebCore):
        (WebCore::ContextEnabledFeatures::shadowDOMEnabled):
        * bindings/generic/ContextEnabledFeatures.h: Added.
        (WebCore):
        (ContextEnabledFeatures):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GetContextEnableFunction):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::enabledAtContextAttr1AttrGetter):
        (TestObjV8Internal):
        (WebCore::TestObjV8Internal::enabledAtContextAttr1AttrSetter):
        (WebCore::TestObjV8Internal::enabledAtContextAttr2AttrGetter):
        (WebCore::TestObjV8Internal::enabledAtContextAttr2AttrSetter):
        (WebCore::V8TestObj::installPerContextProperties):
        * bindings/scripts/test/V8/V8TestObj.h:
        (V8TestObj):
        * bindings/v8/V8DOMWindowShell.cpp:
        (WebCore::V8DOMWindowShell::installDOMWindow): Adopted installPerContextProperties()
        * bindings/v8/V8Proxy.h:
        (WebCore):
        (WebCore::configureAttribute): Generalized to accept both ObjectTemplate and Object.
        * dom/Position.cpp: Adopted ContextEnabledFeatures
        (WebCore::Position::Position):
        (WebCore::Position::findParent):
        * dom/ShadowRoot.idl:
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::getSelection):
        * html/shadow/HTMLContentElement.cpp: Adopted ContextEnabledFeatures
        (WebCore::contentTagName):
        (WebCore::HTMLContentElement::create):
        * loader/FrameLoaderClient.h:
        (FrameLoaderClient):
        (WebCore::FrameLoaderClient::shadowDOMAllowed): Added with a default behavior.
        * page/DOMWindow.cpp:
        * page/DOMWindow.idl:


2012-05-21  Tony Chang  <tony@chromium.org>

        auto margins on flexbox should allocate space in the flex direction
        https://bugs.webkit.org/show_bug.cgi?id=83086

        Reviewed by Ojan Vafai.

        Test: css3/flexbox/flex-flow-auto-margins.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::autoMarginOffsetInMainAxis):
        (WebCore):
        (WebCore::RenderFlexibleBox::updateAutoMarginsInMainAxis):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Update the margins on the RenderBox *after* we do the final child layout.
        * rendering/RenderFlexibleBox.h:

2012-05-21  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        [EFL] Add inital mediaControlsEflfullscreen.css for fullscreen control UI
        https://bugs.webkit.org/show_bug.cgi?id=86988

        Reviewed by Eric Carlson.

        In order to support fullscreen feature, EFL port needs to have new css file for fullscreen media control UI.

        No new tests because this patch is covered by existing tests.

        * PlatformEfl.cmake:
        * css/mediaControlsEflFullscreen.css: Added.
        (video::-webkit-media-controls-panel):
        (video:-webkit-full-page-media::-webkit-media-controls-panel):
        (video::-webkit-media-controls-mute-button):
        (video::-webkit-media-controls-play-button):
        (video::-webkit-media-controls-timeline-container):
        (video::-webkit-media-controls-current-time-display):
        (video::-webkit-media-controls-time-remaining-display):
        (video::-webkit-media-controls-timeline):
        (video::-webkit-media-controls-volume-slider-container):
        (video::-webkit-media-controls-volume-slider):
        (video::-webkit-media-controls-seek-back-button):
        (video::-webkit-media-controls-seek-forward-button):
        (video::-webkit-media-controls-fullscreen-button):
        (video::-webkit-media-controls-rewind-button):
        (video::-webkit-media-controls-return-to-realtime-button):
        (video::-webkit-media-controls-toggle-closed-captions-button):
        * platform/efl/RenderThemeEfl.cpp:
        (WebCore):
        (WebCore::RenderThemeEfl::extraFullScreenStyleSheet):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):

2012-05-21  Kentaro Hara  <haraken@chromium.org>

        [V8] Remove V8Proxy::notHandledByInterceptor()
        https://bugs.webkit.org/show_bug.cgi?id=86831

        Reviewed by Adam Barth.

        This patch replaces 'return V8Proxy::notHandledByInterceptor()'
        with 'return v8::Handle<v8::Value>()'. See the discussion in
        https://bugs.webkit.org/show_bug.cgi?id=85330 for more details.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateOverloadedFunctionCallback):
        (GenerateParametersCheck):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::overloadedMethodCallback):
        (WebCore::TestObjV8Internal::overloadedMethod1Callback):
        * bindings/v8/V8Collection.h:
        (WebCore::collectionNamedPropertyGetter):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
        * bindings/v8/V8NPObject.cpp:
        (WebCore::npObjectSetProperty):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::runScript):
        (WebCore::V8Proxy::throwError):
        * bindings/v8/V8Proxy.h:
        (WebCore):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::setWebGLArrayHelper):
        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::V8CSSStyleDeclaration::namedPropertyGetter):
        (WebCore::V8CSSStyleDeclaration::namedPropertySetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertyGetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::indexedPropertyGetter):
        (WebCore::V8DOMWindow::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
        (WebCore::V8HTMLAllCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
        (WebCore::V8HTMLCollection::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
        (WebCore::V8HTMLFormElement::indexedPropertyGetter):
        (WebCore::V8HTMLFormElement::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
        (WebCore::V8HTMLOptionsCollection::indexedPropertyGetter):
        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
        (WebCore::npObjectNamedGetter):
        (WebCore::npObjectNamedSetter):
        (WebCore::npObjectIndexedGetter):
        (WebCore::npObjectIndexedSetter):
        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
        (WebCore::V8HTMLSelectElement::indexedPropertyGetter):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::V8NamedNodeMap::indexedPropertyGetter):
        (WebCore::V8NamedNodeMap::namedPropertyGetter):
        * bindings/v8/custom/V8NodeListCustom.cpp:
        (WebCore::V8NodeList::namedPropertyGetter):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageGetter):
        (WebCore::V8Storage::namedPropertyGetter):
        (WebCore::storageSetter):
        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
        (WebCore::V8StyleSheetList::namedPropertyGetter):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
        (WebCore::V8WebGLRenderingContext::getUniformCallback):
        (WebCore::vertexAttribAndUniformHelperf):
        (WebCore::uniformHelperi):
        (WebCore::uniformMatrixHelper):

2012-05-21  Rob Buis  <rbuis@rim.com>

        Shrink FontDescription object size
        https://bugs.webkit.org/show_bug.cgi?id=86950

        Reviewed by Alexey Proskuryakov.

        Reduce object size of FontDescription by 8 bytes on 64-bit, 4 bytes on 32-bit systems.
        Note that this means Font, StyleInheritedData and RenderSVGInlineText shrink too.

        * platform/graphics/FontDescription.cpp:
        * platform/graphics/FontDescription.h:
        (WebCore::FontDescription::script):
        (FontDescription):

2012-05-21  Abhishek Arya  <inferno@chromium.org>

        Regression(r117482): Run-in crashes relating to generated content and inline line box clearing.
        https://bugs.webkit.org/show_bug.cgi?id=86879

        Reviewed by Julien Chaffraix.

        Tests: fast/runin/generated-content-crash.html
               fast/runin/move-run-in-original-position-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): Use the new helper
        placeRunInIfNeeded. Do not place the run-in if it is a generated container since
        the caller such as updateBeforeAfterContent might be keeping a reference to it
        and adding children to it later.
        (WebCore::destroyRunIn): Add ability to clear line box tree for inlines.
        (WebCore::RenderBlock::placeRunInIfNeeded): Helper to place run-in. Add an
        argument to not modify generated content during addChild, it should be moved
        only at end of updateBeforeAfterContent.
        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded): 
        (WebCore::RenderBlock::runInIsPlacedIntoSiblingBlock): helper to tell if this run-in
        is actually placed into the next sibling block.
        (WebCore::RenderBlock::moveRunInToOriginalPosition):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::deleteLineBoxTree): like RenderBlock, add a helper
        for deleteLineBoxTree. Virtualizing this might not be good, since this is
        the only call site for inline line box tree clearing and RenderBlock::deleteLineBoxTree
        is called a lot.
        * rendering/RenderObjectChildList.cpp:
        (WebCore::createRendererForBeforeAfterContent): fix a typo.
        (WebCore::RenderObjectChildList::updateBeforeAfterContent): If insertBefore is equal
        to the intruded run-in, then set it to next sibling so that new child will come after it. At
        the end, place the generatedContainer if it is a run-in.

2012-05-21  James Robinson  <jamesr@chromium.org>

        [chromium] Port chromium compositor to use WebFilterOperation(s)
        https://bugs.webkit.org/show_bug.cgi?id=87046

        Reviewed by Adrienne Walker.

        This converts all compositor implementation logic to use WebFilterOperation(s) directly instead of the WebCore
        types. GraphicsLayerChromium bridges between a WebCore::FilterOperations to WebFilterOperations, doing the
        necessary type conversions and checking for filters that our compositor implementation supports. This cleans up
        the chromium compositor's dependencies and removes any thread constraints from WebCore::FilterOperation /
        WebCore::FilterOperations.

        Covered by existing layout tests and unit tests in FilterOperationsTest.cpp

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * platform/chromium/support/WebFilterOperations.cpp: Moved to Source/Platform/chromium/src/
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::copyWebCoreFilterOperationsToWebFilterOperations):
        (WebCore):
        (WebCore::GraphicsLayerChromium::setFilters):
        (WebCore::GraphicsLayerChromium::setBackgroundFilters):
        (WebCore::GraphicsLayerChromium::updateTransform):
        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setFilters):
        (WebCore::LayerChromium::setBackgroundFilters):
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        (WebCore::LayerChromium::filters):
        (WebCore::LayerChromium::backgroundFilters):
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (WebCore::RenderSurfaceChromium::setFilters):
        (WebCore::RenderSurfaceChromium::filters):
        (WebCore::RenderSurfaceChromium::setBackgroundFilters):
        (WebCore::RenderSurfaceChromium::backgroundFilters):
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
        (WebCore::expandDamageRectWithFilters):
        (WebCore::expandDamageRectInsideRectWithFilters):
        (WebCore::CCDamageTracker::updateDamageTrackingState):
        * platform/graphics/chromium/cc/CCDamageTracker.h:
        (WebKit):
        (WebCore):
        (CCDamageTracker):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::setFilters):
        (WebCore::CCLayerImpl::setBackgroundFilters):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):
        (WebCore::CCLayerImpl::filters):
        (WebCore::CCLayerImpl::backgroundFilters):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::applyFilters):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore::CCRenderSurface::setFilters):
        (WebCore::CCRenderSurface::filters):
        (CCRenderSurface):
        (WebCore::CCRenderSurface::setBackgroundFilters):
        (WebCore::CCRenderSurface::backgroundFilters):
        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
        (WebCore::CCRenderSurfaceFilters::apply):
        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.h:
        (WebKit):
        (CCRenderSurfaceFilters):
        * testing/Internals.cpp:
        (WebCore::Internals::setBackgroundBlurOnNode):

2012-05-15  Gavin Barraclough  <barraclough@apple.com>

        Add support for private names
        https://bugs.webkit.org/show_bug.cgi?id=86509

        Reviewed by Oliver Hunt.

        The spec isn't final, but we can start adding support to allow property maps
        to contain keys that aren't identifiers.

        Test: fast/js/names.html

        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
        (WebCore::cssPropertyIDForJSCSSPropertyName):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::findAtomicString):
        (WebCore::objectToStringFunctionGetter):
        * bindings/js/JSDOMBinding.h:
        (WebCore::propertyNameToString):
        (WebCore::propertyNameToAtomicString):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::nonCachingStaticFunctionGetter):
        * bindings/js/JSHistoryCustom.cpp:
        (WebCore::nonCachingStaticBackFunctionGetter):
        (WebCore::nonCachingStaticForwardFunctionGetter):
        (WebCore::nonCachingStaticGoFunctionGetter):
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::nonCachingStaticReplaceFunctionGetter):
        (WebCore::nonCachingStaticReloadFunctionGetter):
        (WebCore::nonCachingStaticAssignFunctionGetter):
        * bridge/c/c_class.cpp:
        (JSC::Bindings::CClass::methodsNamed):
        (JSC::Bindings::CClass::fieldNamed):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CInstance::getMethod):
        * bridge/jni/jsc/JavaClassJSC.cpp:
        (JavaClass::methodsNamed):
        (JavaClass::fieldNamed):
        * bridge/jni/jsc/JavaInstanceJSC.cpp:
        * bridge/objc/objc_class.mm:
        (JSC::Bindings::ObjcClass::methodsNamed):
        (JSC::Bindings::ObjcClass::fieldNamed):
        (JSC::Bindings::ObjcClass::fallbackObject):
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::setValueOfUndefinedField):
        (ObjcInstance::getValueOfUndefinedField):
            - Removed PropertyName::impl(), call publicName() to get the string associated with a name.

2012-05-21  Tim Horton  <timothy_horton@apple.com>

        GeneratorGeneratedImage should cache intermediate images
        https://bugs.webkit.org/show_bug.cgi?id=86906
        <rdar://problem/11484852>

        Reviewed by Dean Jackson.

        Cache generated images in GeneratorGeneratedImage. The cache is invalidated:
            a) if the Generator's hash changes.
            b) if the rendered size changes.
            c) if the cached image is incompatible with the destination context (acceleration state or CTM scale).
            d) after one second of disuse.

        Add a hash() function to Generator, which should be implemented in subclasses
        to provide a straightforward way to determine if Generators have been mutated
        in a way that will affect the resultant rendering.

        No new tests, performance optimization. Correctness is covered by the multitude of existing gradient tests.

        * platform/graphics/Generator.h:
        (Generator):
        * platform/graphics/GeneratorGeneratedImage.cpp:
        (WebCore::GeneratorGeneratedImage::drawPattern):
        * platform/graphics/GeneratorGeneratedImage.h:
        (WebCore):
        (GeneratorGeneratedImage):
        (WebCore::GeneratorGeneratedImage::~GeneratorGeneratedImage):
        (WebCore::GeneratorGeneratedImage::GeneratorGeneratedImage):
        (GeneratedImageCacheTimer):
        (WebCore::GeneratorGeneratedImage::GeneratedImageCacheTimer::GeneratedImageCacheTimer):
        (WebCore::GeneratorGeneratedImage::GeneratedImageCacheTimer::restart):
        * platform/graphics/Gradient.cpp:
        (WebCore::Gradient::Gradient):
        (WebCore::Gradient::addColorStop):
        (WebCore::Gradient::sortStopsIfNecessary):
        (WebCore::Gradient::setSpreadMethod):
        (WebCore::Gradient::setGradientSpaceTransform):
        (WebCore::Gradient::hash):
        * platform/graphics/Gradient.h:
        (WebCore::Gradient::setP0):
        (WebCore::Gradient::setP1):
        (WebCore::Gradient::setStartRadius):
        (WebCore::Gradient::setEndRadius):
        (Gradient):
        (WebCore::Gradient::clearHashCache):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::isCompatibleWithBuffer):
        (WebCore):
        * platform/graphics/GraphicsContext.h:
        (GraphicsContext):

2012-05-21  Emil A Eklund  <eae@chromium.org>

        Fix bug in paintNinePieceImage exposed by subpixel change
        https://bugs.webkit.org/show_bug.cgi?id=87060

        Reviewed by Levi Weintraub.

        Fix rounding in paintNinePieceImage where the left/right images where
        drawn on subpixel bounds.

        Covered by existing tests.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintNinePieceImage):

2012-05-21  Emil A Eklund  <eae@chromium.org>

        Move padding/margin/offset writing mode logic from RenderStyle to LengthBox
        https://bugs.webkit.org/show_bug.cgi?id=86970

        Reviewed by Eric Seidel.

        Move writing mode and bidi logic for paddings, margins and offsets from
        RenderStyle to LengthBox. This way the same logic can be used for all
        three removing unnecessary code duplication.

        No new tests, no change in functionality.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/LengthBox.cpp: Added.
        * platform/LengthBox.h:
        * rendering/style/RenderStyle.cpp:
        * rendering/style/RenderStyle.h:

2012-05-21  Mike West  <mkwst@chromium.org>

        Improving console error for CSP-blocked  `setTimeout` and `setInterval` evaluation.
        https://bugs.webkit.org/show_bug.cgi?id=86943

        Reviewed by Adam Barth.

        If the inspector is open, a stack trace is generated before calling
        ContentSecurityPolicy::allowEval, and passed through to
        ContentSecurityPolicy::reportViolation for use in the console message.

        Test: http/tests/inspector-enabled/contentSecurityPolicy-blocks-setInterval.html
              http/tests/inspector-enabled/contentSecurityPolicy-blocks-setTimeout.html

        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::create):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::WindowSetTimeoutImpl):
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::reportViolation):
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
        (WebCore::CSPDirectiveList::allowEval):
        (WebCore):
        (WebCore::isAllowedByAllWithCallStack):
        (WebCore::isAllowedByAllWithURL):
        (WebCore::ContentSecurityPolicy::allowEval):
        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
        (WebCore::ContentSecurityPolicy::allowImageFromSource):
        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
        (WebCore::ContentSecurityPolicy::allowFontFromSource):
        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
        (WebCore::ContentSecurityPolicy::allowConnectToSource):
        * page/ContentSecurityPolicy.h:
        (WebCore):

2012-05-21  Antoine Labour  <piman@chromium.org>

        Don't force rendering in finishAllRendering
        https://bugs.webkit.org/show_bug.cgi?id=86919

        Reviewed by James Robinson.

        After we acquire the texture layers on the main thread, we can't draw.
        In particular if we destroyed the texture ids used previously by
        TextureLayerChromium, drawing before a commit would cause a
        bind-after-destroy.

        Tested by CCLayerTreeHostTestFinishAllRendering.

        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::finishAllRenderingOnImplThread):
        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):

2012-05-21  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Store key paths in IDBKeyPath type instead of String
        https://bugs.webkit.org/show_bug.cgi?id=85298

        Reviewed by Tony Chang, Kentaro Hara and James Robinson.

        Migrate from storing key paths as (nullable) Strings to a dedicated IDBKeyPath
        type. Prep work for supporting array-type key paths: http://webkit.org/b/84207

        Only functional change is handling of null/undefined parameters for key paths,
        to align with IDB spec, covered by layout test.

        Test: storage/indexeddb/keypath-basics.html
        Test: WebKit/chromium/IDBLevelDBCodingTest.cpp

        * Modules/indexeddb/IDBAny.cpp: Allow IDBAny to yield DOMStrings.
        (WebCore::IDBAny::createString):
        (WebCore):
        (WebCore::IDBAny::string):
        (WebCore::IDBAny::set):
        * Modules/indexeddb/IDBAny.h:
        (IDBAny):
        * Modules/indexeddb/IDBBackingStore.h: Switch from String to IDBKeyPath.
        (IDBBackingStore):
        * Modules/indexeddb/IDBDatabase.cpp: Switch from String to IDBKeyPath.
        (WebCore::IDBDatabase::createObjectStore):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Switch from String to IDBKeyPath.
        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
        (WebCore::IDBDatabaseBackendImpl::loadObjectStores):
        * Modules/indexeddb/IDBDatabaseBackendImpl.h: Switch from String to IDBKeyPath.
        (IDBDatabaseBackendImpl):
        * Modules/indexeddb/IDBDatabaseBackendInterface.h: Switch from String to IDBKeyPath.
        (WebCore):
        (IDBDatabaseBackendInterface):
        * Modules/indexeddb/IDBIndex.h: Switch from String to IDBAny (via IDBKeyPath).
        (WebCore::IDBIndex::keyPath):
        * Modules/indexeddb/IDBIndex.idl: Switch from DOMString? to IDBAny.
        * Modules/indexeddb/IDBIndexBackendImpl.cpp: Switch from String to IDBKeyPath.
        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl):
        * Modules/indexeddb/IDBIndexBackendImpl.h: Switch from String to IDBKeyPath.
        (WebCore::IDBIndexBackendImpl::create):
        (WebCore::IDBIndexBackendImpl::keyPath):
        (IDBIndexBackendImpl):
        * Modules/indexeddb/IDBIndexBackendInterface.h: Switch from String to IDBKeyPath.
        (WebCore):
        (IDBIndexBackendInterface):
        * Modules/indexeddb/IDBKeyPath.cpp: Non-trivial method implementations.
        (WebCore::IDBKeyPath::isValid):
        (WebCore):
        (WebCore::IDBKeyPath::operator PassRefPtr<IDBAny>):
        * Modules/indexeddb/IDBKeyPath.h: Introduce IDBKeyPath type.
        (IDBKeyPath):
        (WebCore::IDBKeyPath::IDBKeyPath):
        (WebCore::IDBKeyPath::type):
        (WebCore::IDBKeyPath::array):
        (WebCore::IDBKeyPath::string):
        (WebCore::IDBKeyPath::isNull):
        (WebCore):
        * Modules/indexeddb/IDBKeyPathBackendImpl.cpp: Switch from String to IDBKeyPath.
        (WebCore::IDBKeyPathBackendImpl::createIDBKeysFromSerializedValuesAndKeyPath):
        (WebCore::IDBKeyPathBackendImpl::injectIDBKeyIntoSerializedValue):
        * Modules/indexeddb/IDBKeyPathBackendImpl.h: Switch from String to IDBKeyPath.
        (WebCore):
        (IDBKeyPathBackendImpl):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp: Switch from String to IDBKeyPath, with back-compat.
        (WebCore):
        (WebCore::putIDBKeyPath):
        (WebCore::IDBLevelDBBackingStore::getObjectStores):
        (WebCore::IDBLevelDBBackingStore::createObjectStore):
        (WebCore::IDBLevelDBBackingStore::getIndexes):
        (WebCore::IDBLevelDBBackingStore::createIndex):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBLevelDBCoding.cpp: New coding scheme for key paths (with back-compat).
        (IDBLevelDBCoding):
        (WebCore::IDBLevelDBCoding::encodeIDBKeyPath):
        (WebCore::IDBLevelDBCoding::decodeIDBKeyPath):
        * Modules/indexeddb/IDBLevelDBCoding.h: Add key-path-specific methods.
        (WebCore):
        (IDBLevelDBCoding):
        * Modules/indexeddb/IDBObjectStore.cpp: Switch from String to IDBKeyPath.
        (WebCore::IDBObjectStore::keyPath):
        (WebCore::IDBObjectStore::createIndex):
        (WebCore):
        * Modules/indexeddb/IDBObjectStore.h: Switch from String to IDBAny (via IDBKeyPath).
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStore.idl: Switch from DOMString? to IDBAny.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Switch from String to IDBKeyPath.
        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl):
        (WebCore::fetchKeyFromKeyPath):
        (WebCore::injectKeyIntoKeyPath):
        (WebCore::IDBObjectStoreBackendImpl::createIndex):
        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Switch from String to IDBKeyPath.
        (WebCore::IDBObjectStoreBackendImpl::create):
        (WebCore::IDBObjectStoreBackendImpl::keyPath):
        (IDBObjectStoreBackendImpl):
        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Switch from String to IDBKeyPath.
        (WebCore):
        (IDBObjectStoreBackendInterface):
        * bindings/v8/Dictionary.cpp: Add getter for DOMString[] (i.e. Vector<String>)
        (WebCore):
        (WebCore::Dictionary::get):
        * bindings/v8/Dictionary.h:
        (Dictionary):
        * bindings/v8/IDBBindingUtilities.cpp: Switch from String to IDBKeyPath.
        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
        (WebCore::injectIDBKeyIntoSerializedValue):
        * bindings/v8/IDBBindingUtilities.h: Switch from String to IDBKeyPath.
        (WebCore):
        * bindings/v8/custom/V8IDBAnyCustom.cpp: Support String/DOMString.
        (WebCore::toV8):
        * dom/DOMStringList.h: Allow easy (const) access to strings.
        (WebCore::DOMStringList::operator const Vector<String>&):
        (DOMStringList):
        * inspector/InspectorIndexedDBAgent.cpp: Temporary shim for non-strings: see http://webkit.org/b/84303
        (WebCore):
        * platform/chromium/PlatformSupport.h: Switch from String to IDBKeyPath.
        (WebCore):
        (PlatformSupport):
        * storage/chromium/IDBKeyPathBackendImpl.cpp: Switch from String to IDBKeyPath.
        (WebCore::IDBKeyPathBackendImpl::createIDBKeysFromSerializedValuesAndKeyPath):
        (WebCore::IDBKeyPathBackendImpl::injectIDBKeyIntoSerializedValue):

2012-05-21  Zhenyao Mo  <zmo@google.com>

        Restore WebGL's framebuffer binding after DrawingBuffer's prepareBackBuffer()
        https://bugs.webkit.org/show_bug.cgi?id=87032

        Reviewed by James Robinson.

        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBuffer::prepareBackBuffer): restore the user's framebuffer binding if there is one.

2012-05-21  Ryosuke Niwa  <rniwa@webkit.org>

        isStartOfDocument and isEndOfDocument are poorly named
        https://bugs.webkit.org/show_bug.cgi?id=86649

        Reviewed by Levi Weintraub.

        Renamed isEndOfDocument to isEndOfEditableOrNonEditableContent because that's what this function checks.

        Also added new versions of isStartOfDocument and isEndOfDocument that correctly cross editing boundaries
        to be used in selectFrameElementInParentIfFullySelected.

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary):
        * editing/Editor.cpp:
        (WebCore::Editor::insertLineBreak):
        (WebCore::Editor::insertParagraphSeparator):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply):
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
        * editing/visible_units.cpp:
        (WebCore::isEndOfEditableOrNonEditableContent):
        * editing/visible_units.h:

2012-05-21 Anna Cavender  <annacc@chromium.org>

        Only render text track cues if kind=captions or kind=subtitles.
        https://bugs.webkit.org/show_bug.cgi?id=83321

        Reviewed by Eric Carlson.

        No new tests. Modification to media/track/track-kind.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::textTrackKindChanged):
           If the kind changes from a 'visible' kind to a 'non-visible' kind,
           update the track's mode to HIDDEN.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTextTrackContainerElement::updateDisplay):
            Do not render cues from tracks that are not captions or subtitles.

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::setMode):
            If the track's mode changes from SHOWING to HIDDEN or DISABLED,
            ensure any currently visible cues will no longer be rendered.

        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::removeDisplayTree): New method.
        * html/track/TextTrackCue.h:
        (TextTrackCue):
 
2012-05-21  Andreas Kling  <kling@webkit.org>

        CSS: Move duplicate property elimination to parser.
        <http://webkit.org/b/86948>

        Reviewed by Antti Koivisto.

        Remove the StylePropertySet constructor that handled elimination of duplicate
        properties and move that to a new parser method, CSSParser::filteredProperties().
        Call sites are converted to using StylePropertySet(const Vector<CSSProperty>&).

        Instead of building a hashmap of seen properties, use the new WTF::BitArray class
        to track whether a given property ID has been seen, and whether we have an
        !important entry for a given ID.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseDeclaration):
        (WebCore::CSSParser::filteredProperties):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createKeyframe):
        * css/CSSParser.h:
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::StylePropertySet):
        (WebCore::StylePropertySet::addParsedProperties):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::create):
        (StylePropertySet):
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::rebuildFontFace):

2012-05-21  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Index key paths that yield invalid keys should not fail an add/put
        https://bugs.webkit.org/show_bug.cgi?id=86122

        Reviewed by Tony Chang.

        A clause was removed from the IDB spec. Previously, on add/put, if evaluating an
        index's key path yielded a value that was not a valid key, an exception would be
        raised. Now, it is treated the same as if no value was yielded.

        Test: storage/indexeddb/index-basics.html
        Test: storage/indexeddb/index-basics-workers.html
        Test: storage/indexeddb/objectstore-basics.html
        Test: storage/indexeddb/objectstore-basics-workers.html

        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::put): Preconditions removed
        (WebCore::IDBObjectStoreBackendImpl::putInternal): Treat invalid keys the same as missing keys.

2012-05-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: refactor revision history to not include resource itself.
        https://bugs.webkit.org/show_bug.cgi?id=87026

        Reviewed by Vsevolod Vlasov.

        This change makes resource contain pure revisions, it stops updating Resources upon free flow editing.

        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent.didFormatContent):
        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent):
        (WebInspector.JavaScriptSource.prototype.setFormatted):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._onContentChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype.addRevision):
        (WebInspector.Resource.prototype._innerRequestContent.callback):
        (WebInspector.Resource.prototype._innerRequestContent):
        (WebInspector.Resource.prototype.revertToOriginal):
        (WebInspector.ResourceRevision.prototype.revertToThis):
        (WebInspector.ResourceRevision.prototype.requestContent):
        (WebInspector.ResourceRevision.prototype.searchInContent):
        (WebInspector.ResourceRevision.prototype._persistRevision):
        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded):
        (WebInspector.RevisionHistoryTreeElement):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype.setScriptSnippetContent):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSourceFrame.prototype.commitEditing):
        (WebInspector.StyleSourceFrame.prototype._didEditContent):
        (WebInspector.StyleSourceFrame.prototype._onContentChanged):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype._revisionAdded):
        (WebInspector.UISourceCode.prototype.contentChanged):
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
        * inspector/front-end/inspector.js:
        (WebInspector._doLoadedDoneWithCapabilities.get if):

2012-05-21  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        GCC 4.7 and C++11
        https://bugs.webkit.org/show_bug.cgi?id=86465

        Reviewed by Darin Adler.

        Avoid triggering C++11 string literals and use nullptr for correct type casting.

        * bindings/js/JSNodeFilterCondition.cpp:
        (WebCore::JSNodeFilterCondition::JSNodeFilterCondition):
        * platform/sql/SQLiteFileSystem.cpp:
        (WebCore::SQLiteFileSystem::getFileNameForNewDatabase):

2012-05-18  Michael Nordman  <michaeln@google.com>

        [chromium] DomStorage events handling needs TLC (2)
        https://bugs.webkit.org/show_bug.cgi?id=85221
        Alter the StorageArea virtual interface such that the mutators no longer
        return old values. This is to allow implementations of the interface to operate
        more asynchronously.

        Reviewed by Adam Barth.

        No new tests. Existing tests cover this.

        * storage/StorageArea.h: Alter the interface so the mutators no longer return previous values
        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::disabledByPrivateBrowsingInFrame):  removed an unneeded PLATFORM(CHROMIUM) guard
        (WebCore::StorageAreaImpl::setItem): no longer return the old value
        (WebCore::StorageAreaImpl::removeItem): no longer return the old value
        (WebCore::StorageAreaImpl::clear): no longer return whether something was cleared
        * storage/StorageAreaImpl.h: match StorageArea's virtual interface


2012-05-21  MORITA Hajime  <morrita@google.com>

        [Refactoring] Node should have youngestShadowRoot.
        https://bugs.webkit.org/show_bug.cgi?id=86427

        Reviewed by Dimitri Glazkov.

        This change adds Node::youngestShadowRoot() and replaced
        ElementShadow::youngestShadowRoot() with it if appropriate.

        By introducing this, traversal across node and its shadow tree can
        look more fluent and idiomatic. There are a few non-trivial traversal
        remaining like ElementShadow::recalcStyle() and attach().
        But they should be flattened out eventually.

        No new tests. Refactoring.

        * dom/ContainerNodeAlgorithms.cpp:
        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoTree):
        * dom/Document.cpp:
        (WebCore::Document::buildAccessKeyMap):
        * dom/ElementShadow.cpp:
        * dom/ElementShadow.h:
        (ElementShadow):
        (WebCore::Node::youngestShadowRoot):
        (WebCore):
        * dom/Node.h:
        (Node):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        (WebCore::TreeScopeAdopter::moveTreeToNewDocument):
        * dom/TreeScopeAdopter.h:
        (TreeScopeAdopter):
        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::getDecorationRootAndDecoratedRoot):

2012-05-21  Christophe Dumez  <christophe.dumez@intel.com>

        Add support for MessagePortArray type to JSC
        https://bugs.webkit.org/show_bug.cgi?id=84093

        Reviewed by Adam Barth.

        Add support for MessagePortArray type to JSC code generator similarly
        to what was done for the V8 generator in r114319.

        Update bindings test results to reflect to change to the bindings
        generator.

        * CMakeLists.txt: Add new DeliveredIntent files to CMake.
        * bindings/js/JSDOMBinding.h:
        (WebCore):
        (WebCore::jsArray): Tweak jsArray() so that it accepts MessagePortArray as argument.
        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        (NativeToJSValue):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionSerializedValue):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::constructJSTestSerializedScriptValueInterface):
        (WebCore::jsTestSerializedScriptValueInterfacePorts):
        (WebCore::setJSTestSerializedScriptValueInterfaceValue):
        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
        (WebCore::jsTestSerializedScriptValueInterfacePrototypeFunctionAcceptTransferList):
        (WebCore::jsTestSerializedScriptValueInterfacePrototypeFunctionMultiTransferList):

2012-05-21  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Styles] Cannot tab from selector of inherited rule, which in turn has leading inherited properties
        https://bugs.webkit.org/show_bug.cgi?id=87014

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype._moveEditorFromSelector):

2012-05-21  Greg Billock  <gbillock@google.com>

        Add suggestions field to web intents API.
        https://bugs.webkit.org/show_bug.cgi?id=86791

        Reviewed by Adam Barth.

        The |suggestions| field is used by the client to avoid an empty
        web intents selection window (picker). The UA can add the given
        suggestions to the picker if it would otherwise be empty. See
        http://dvcs.w3.org/hg/web-intents/raw-file/tip/spec/Overview.html#intent-parameters-dictionary

        * Modules/intents/DeliveredIntent.cpp:
        (WebCore::DeliveredIntent::DeliveredIntent):
        * Modules/intents/Intent.cpp:
        (WebCore::Intent::create):
        (WebCore::Intent::Intent):
        * Modules/intents/Intent.h:
        (WebCore::Intent::suggestions):
        (Intent):

2012-05-21  Stephen Chenney  <schenney@chromium.org>

        SVGAnimatedPropertyTearOff does not clear a self pointer on deletion
        https://bugs.webkit.org/show_bug.cgi?id=86119

        Reviewed by Nikolas Zimmermann.

        SVGAnimatedPropertyTearOff contains two SVGPropertyTearOff objects
        that have a pointer back to the SVGAnimatedPropertyTearOff. JS may
        also have a reference to these SVGPropertyTearOff objects. When the
        SVGAnimatedPropertyTearOff is deleted, the SVGPropertyTearOff objects
        may live on, but the pointer back to the deleted animated property
        tear off is left invalid. This patch clears the pointers on destruction
        of the SVGAnimatedPropertyTearOff.

        Test: svg/custom/bug86119.html

        * svg/properties/SVGAnimatedPropertyTearOff.h:
        (WebCore::SVGAnimatedPropertyTearOff::~SVGAnimatedPropertyTearOff):
        (SVGAnimatedPropertyTearOff):

2012-05-21  Stephen Chenney  <schenney@chromium.org>

        [Chromium] REGRESSION: Assertion failure on svg/custom/acid3-test-77.html
        https://bugs.webkit.org/show_bug.cgi?id=86715

        Reviewed by Nikolas Zimmermann.

        Calls to clear the text positioning elements in RenderSVGText must be
        protected with a FontCachePurgeProtector so that fonts are not removed
        before the SVG metrics are rebuilt. The protection must cover both the
        cache clearing and the reconstruction calls.

        Patch fixes existing tests.

        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::subtreeChildWasAdded):
        (WebCore::RenderSVGText::subtreeChildWasRemoved):
        (WebCore::RenderSVGText::subtreeTextDidChange):
        (WebCore::RenderSVGText::removeChild):

2012-05-21  Stephen Chenney  <schenney@chromium.org>

        SVGTextRunRenderingContext can return null font, calling code asserts not null
        https://bugs.webkit.org/show_bug.cgi?id=86738

        Reviewed by Nikolas Zimmermann.

        SVGTextRunRenderingContext::glyphDataForCharacter was returning a glyph with
        null font data for numerous code paths. It seems that it was doing so
        whenever it detected null fontData, rather than try to continue.
        Calling code would then immediately assert on this null fontData.

        This patch refactors SVGTextRunRenderingContext::glyphDataForCharacter
        so that it never returns null font data, adding an assertion to that
        effect. In particular, when the font data is null the code will reach
        the fallback glyph calculations.

        Refactoring covered by existing tests. A previously crashing test, svg/custom/acid3-test-77.html, no longer crashes.

        * rendering/svg/SVGTextRunRenderingContext.cpp:
        (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter):

2012-05-21  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: switch buildDominatedNodes function to front-end calculated _dominatorsTree
        https://bugs.webkit.org/show_bug.cgi?id=87022

        The new version is using _dominatorsTree array that was build at front-end.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._init):
        (WebInspector.HeapSnapshot.prototype._buildDominatedNodes):

2012-05-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: change WebCore/English.lproj/locallizedStrings encoding from UTF-16 to UTF-8.
        https://bugs.webkit.org/show_bug.cgi?id=86822

        Reviewed by Yury Semikhatsky.

        * English.lproj/localizedStrings.js:

2012-05-21  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Move working copy support to UISourceCode and use it for both styles and scripts.
        https://bugs.webkit.org/show_bug.cgi?id=87021

        Reviewed by Pavel Feldman.

        UISourceCode now listens for RevisionAdded event.
        Virtual methods workingCopyChanged and workingCopyCommitted added to UISourceCode and implemented in descendants.
        DebuggerResourceBinding does not call contentChanged on UISourceCode explicitly anymore.

        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.SnippetJavaScriptSource.prototype.workingCopyCommitted):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSource.prototype.workingCopyCommitted):
        (WebInspector.StyleSource.prototype.workingCopyChanged):
        (WebInspector.StyleSourceFrame):
        (WebInspector.StyleSourceFrame.prototype.commitEditing):
        (WebInspector.StyleSourceFrame.prototype.afterTextChanged):
        (WebInspector.StyleSourceFrame.prototype._didEditContent):
        (WebInspector.StyleSourceFrame.prototype._onContentChanged):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.UISourceCode.prototype._revisionAdded):
        (WebInspector.UISourceCode.prototype.contentChanged):
        (WebInspector.UISourceCode.prototype.workingCopy):
        (WebInspector.UISourceCode.prototype.setWorkingCopy):
        (WebInspector.UISourceCode.prototype.workingCopyChanged):
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
        (WebInspector.UISourceCode.prototype.workingCopyCommitted):

2012-05-21  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: [refactoring] promote fill/border colors used by timeline's frame overview to TimelineCategory
        https://bugs.webkit.org/show_bug.cgi?id=87016

        Reviewed by Pavel Feldman.

        - drop unused 'color' field from TimelineCategory;
        - add borderColor and fillColorStop[0-1] to TimelineCategory;
        - fix style in a handful of places.

        Note we store textual values for color stops, not premade gradients so we can build gradients with different
        orientations rather than transforming a gradient.

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.HeapGraph):
        (WebInspector.HeapGraph.prototype.get element):
        (WebInspector.HeapGraph.prototype.get visible):
        (WebInspector.HeapGraph.prototype.show):
        (WebInspector.HeapGraph.prototype.hide):
        (WebInspector.HeapGraph.prototype._clear):
        (WebInspector.TimelineCategoryStrips):
        (WebInspector.TimelineVerticalOverview):
        (WebInspector.TimelineVerticalOverview.prototype._renderBar):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        (WebInspector.TimelinePresentationModel.recordStyle):
        (WebInspector.TimelineCategory):

2012-05-21  'Pavel Feldman'  <pfeldman@chromium.org>

        Web Inspector: declare setFormatted on UISourceCode (otherwise fails for styles).

        Not reviewed: front-end fix as a follow up to r117751.

        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.consoleMessagesCleared):
        (WebInspector.UISourceCode.prototype.setFormatted):

2012-05-21  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Fix Closure compiler error after r117753.

        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId.didGetNodePosition):

2012-05-21  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        Move setEditingBehavior() from layoutTestController to window.internals
        https://bugs.webkit.org/show_bug.cgi?id=42689

        Reviewed by Hajime Morita and Kenneth Rohde Christiansen.

        Add setEditingBehavior() to window.internals.settings. No new tests, but this
        change will allow more tests to run in WebKitTestRunner.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setEditingBehavior):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-21  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Temporary UISourceCode should be replaced each time another inline script is added in RawSourceCode with pending request.
        https://bugs.webkit.org/show_bug.cgi?id=87003

        Reviewed by Pavel Feldman.

        This is needed to correctly show document content when debugger stops on several breakpoints in different scripts during page load.

        * inspector/front-end/RawSourceCode.js:
        (WebInspector.RawSourceCode.prototype.addScript):
        (WebInspector.RawSourceCode.prototype._finishedLoading):

2012-05-20  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: Remove WebCore::revealFolderInOS() which is no longer used anywhere
        https://bugs.webkit.org/show_bug.cgi?id=86993

        Reviewed by Adam Barth.

        No new tests as this must be just removing dead code.

        * platform/FileSystem.h:
        * platform/chromium/FileSystemChromium.cpp:
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-05-21  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Annotate CSSStyleModel.js for the closure compiler
        https://bugs.webkit.org/show_bug.cgi?id=86858

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleDeclaration.parseComputedStylePayload):
        (WebInspector.CSSStyleDeclaration.prototype.newBlankProperty):
        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
        (WebInspector.CSSProperty.parsePayload):
        (WebInspector.CSSProperty.prototype.setText):
        (WebInspector.CSSProperty.prototype.setDisabled):
        (WebInspector.CSSStyleSheet.prototype.setText):
        (WebInspector.CSSStyleModelResourceBinding.prototype._innerSetContent.callbackWrapper):
        (WebInspector.CSSStyleModelResourceBinding.prototype._innerSetContent):
        (WebInspector.CSSStyleModelResourceBinding.prototype._loadStyleSheetHeaders):

2012-05-21  Rakesh KN  <rakesh.kn@motorola.com>

        [Forms] Refactor HTMLFormCollection
        https://bugs.webkit.org/show_bug.cgi?id=86602

        Reviewed by Kent Tamura.

        Modify HTMLFormCollection to be independent of HTMLFormElement which is needed
        for implementing HTMLFieldSetElement's element attribute.

        Covered by existing tests.

        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        Modified to take more generic HTMLElement* instead of HTMLFormElement* so that
        HTMLFormCollection for HTMLFieldSetElement can also be created.
        (WebCore::HTMLFormCollection::create): Ditto.
        (WebCore::HTMLFormCollection::formControlElements):
        Helper function for getting the array of FormAssociatedElements for this form.
        (WebCore::HTMLFormCollection::formImageElements):
        Helper function for getting the array of image elements for this form.
        (WebCore::HTMLFormCollection::numberOfFormControlElements):
        Helper function for getting the number of elements in this form.
        (WebCore::HTMLFormCollection::calcLength):
        Modified to use new helper functions defined for getting the FormAssociatedElements
        and image elements array instead of static_cast to HTMLFormElement.
        (WebCore::HTMLFormCollection::item): Ditto.
        (WebCore::HTMLFormCollection::getNamedFormItem): Ditto.
        (WebCore::HTMLFormCollection::updateNameCache): Ditto.
        * html/HTMLFormCollection.h:
        (WebCore):
        (HTMLFormCollection):
        * html/HTMLFormElement.h:
        (WebCore::HTMLFormElement::imageElements):
        New accessor for image elements array of form element.
        Also HTMLFormCollection is not needed to be friend of HTMLFormElement as collection
        does not access the form element memebers directly now.

2012-05-21  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: expand only neighbors of the highlighted node when revealing it in heap snapshot
        https://bugs.webkit.org/show_bug.cgi?id=86998

        Reviewed by Pavel Feldman.

        Only nearest nodes are expanded when a node is revealed in heap snapshot
        summary view.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.highlightNode):
        (WebInspector.HeapSnapshotViewportDataGrid.prototype.highlightNode):
        (WebInspector.HeapSnapshotViewportDataGrid.prototype._isScrolledIntoView):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId):
        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId.didGetNodePosition):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.showProfile):

2012-05-21  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>

        [EFL] PlatformKeyboardEventEfl is missing ESC key handling.
        https://bugs.webkit.org/show_bug.cgi?id=86837

        Reviewed by Kenneth Rohde Christiansen.

        Added ESC key handling.

        * platform/efl/EflKeyboardUtilities.cpp:
        (WebCore::createKeyMap):
        (WebCore::singleCharacterString):

2012-05-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: move sources panel out of experimental.
        https://bugs.webkit.org/show_bug.cgi?id=86997

        Reviewed by Yury Semikhatsky.

        This change moves sources panel out of experimental, removes revision support from the resources panel.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype._onContentChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._continueToLine):
        * inspector/front-end/ResourceView.js:
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype._showResourceView):
        (WebInspector.FrameTreeElement.prototype.appendResource):
        (WebInspector.FrameResourceTreeElement):
        (WebInspector.FrameResourceTreeElement.prototype.sourceView):
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.ScriptsNavigator):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.get toolbarItemLabel):
        (WebInspector.ScriptsPanel.prototype.appendApplicableItems):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype._setTextViewerDecorations):
        * inspector/front-end/textViewer.css:
        * inspector/front-end/utilities.js:

2012-05-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: implement revision history view.
        https://bugs.webkit.org/show_bug.cgi?id=86966

        Reviewed by Yury Semikhatsky.

        Added revision view into the drawer. It now lists all the revisions
        along with the inline diffs. Once source panel is enabled by default,
        this view will completely substitute the one in the resources panel.
        See the screenshot attached. View is updated when revisions are added
        and when editor view is switched.

        * English.lproj/localizedStrings.js:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.FileBasedSearchResultsPane.prototype._appendSearchMatches):
        * inspector/front-end/ContextMenu.js:
        (WebInspector.ContextMenu.prototype._itemSelected):
        (WebInspector.ContextMenu.prototype.appendApplicableItems):
        (WebInspector.ContextMenu.Provider.prototype.appendApplicableItems):
        (WebInspector.ContextMenu.registerProvider):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.populateTextAreaContextMenu):
        * inspector/front-end/Resource.js:
        (WebInspector.ResourceRevision.prototype.revertToThis):
        * inspector/front-end/RevisionHistoryView.js: Added.
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.showHistory):
        (WebInspector.RevisionHistoryView.uiSourceCodeSelected):
        (WebInspector.RevisionHistoryView.prototype._revisionAdded):
        (WebInspector.RevisionHistoryView.prototype._onclose):
        (WebInspector.RevisionHistoryTreeElement.else.revert):
        (WebInspector.RevisionHistoryTreeElement):
        (WebInspector.RevisionHistoryTreeElement.prototype.onexpand.step1):
        (WebInspector.RevisionHistoryTreeElement.prototype.onexpand.step2):
        (WebInspector.RevisionHistoryTreeElement.prototype.onexpand):
        (WebInspector.RevisionHistoryTreeElement.prototype._createLine):
        (WebInspector.RevisionHistoryTreeElement.prototype._diff.popsym):
        (WebInspector.RevisionHistoryTreeElement.prototype._diff):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._editorSelected):
        (WebInspector.ScriptsPanel.prototype.registerUISourceCodeProvider):
        (WebInspector.ScriptsPanel.prototype._showLocalHistory):
        (WebInspector.ScriptsPanel.prototype.appendApplicableItems):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSourceFrame.prototype._contentChanged):
        (WebInspector.StyleSourceFrame.prototype.populateTextAreaContextMenu):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.css:
        (#search-results-pane-file-based .search-result):
        (#search-results-pane-file-based .search-result:hover):
        (#search-results-pane-file-based .search-match:hover):
        (#search-results-pane-file-based .search-match .search-match-content):
        * inspector/front-end/inspector.html:
        * inspector/front-end/scriptsPanel.css:
        (.outline-disclosure.revision-history-drawer):
        (.outline-disclosure.revision-history-drawer ol):
        (.outline-disclosure.revision-history-drawer > ol):
        (.outline-disclosure.revision-history-drawer li):
        (.outline-disclosure.revision-history-drawer li.parent):
        (.revision-history-link):
        (.outline-disclosure.revision-history-drawer .revision-history-line):
        (.revision-history-drawer .webkit-line-number):
        (.revision-history-line-added):
        (.revision-history-line-removed):
        * inspector/front-end/textViewer.css:
        (.webkit-added-line.webkit-line-number):
        (.webkit-removed-line.webkit-line-number):
        (.webkit-changed-line.webkit-line-number):

2012-05-18  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: upstream build dominators tree procedure from v8.
        https://bugs.webkit.org/show_bug.cgi?id=86640

        The idea is to reduce transfer size and move all the post-processing steps to the front-end.
        The JS implementation is ~1.5 times slower.

        Reviewed by Yury Semikhatsky.

        Covered by existing tests and performance tests.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._init):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._buildPostOrderIndex):
        (WebInspector.HeapSnapshot.prototype._buildDominatorTree):
        (WebInspector.HeapSnapshot.prototype._markPageOwnedNodes):
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
        (WebInspector.HeapSnapshot.prototype._calculateFlags):

2012-05-21  Mike Lawther  <mikelawther@chromium.org>

        Crash in -webkit-calc
        https://bugs.webkit.org/show_bug.cgi?id=86954

        Reviewed by Abhishek Arya.

        Ensure that both ends of a blend are checked for being Calculated. The current
        check did not cover the case where the 'from' end was Calculated and nonzero,
        and the 'to' end was zero and not Calculated. 

        Blending doesn't work with calculated expressions and is being tracked in
        bug http://webkit.org/b/86160

        Tests: css3/calc/transition-crash3.html
               css3/calc/transition-crash4.html

        * platform/Length.h:
        (WebCore::Length::blend):

2012-05-21  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: make search results view more dense
        https://bugs.webkit.org/show_bug.cgi?id=86937

        Reviewed by Yury Semikhatsky.

        - moved search field to the 'drawer status bar'
        - search view is now shown on scripts panel only
        - switching from the scripts panel closes the search view
        - beautified the looks (see the screenshot)

        * English.lproj/localizedStrings.js:
        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.AdvancedSearchController.prototype.handleShortcut):
        (WebInspector.AdvancedSearchController.prototype.show):
        (WebInspector.AdvancedSearchController.prototype.close):
        (WebInspector.SearchView):
        (WebInspector.FileBasedSearchResultsPane):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.willHide):
        * inspector/front-end/externs.js:
        (WebInspector.showViewInDrawer):
        (WebInspector.closeViewInDrawer):
        * inspector/front-end/inspector.css:
        (.search-drawer-header input[type="search"].search-config-search):
        (.search-drawer-header label.search-config-label):
        (.search-drawer-header input[type="checkbox"].search-config-checkbox):
        (body:not(.platform-mac) .search-drawer-header input[type="checkbox"].search-config-checkbox):
        (body.platform-mac .search-drawer-header input[type="checkbox"].search-config-checkbox):
        (.drawer-header):
        (.drawer-header-close-button):
        (.drawer-header-close-button:hover):
        (.drawer-header-close-button:active):
        (.search-view .search-results):
        (#search-results-pane-file-based li):
        (#search-results-pane-file-based ol):
        (#search-results-pane-file-based ol.children):
        (#search-results-pane-file-based ol.children.expanded):
        (#search-results-pane-file-based li.parent::before):
        (#search-results-pane-file-based li.parent.expanded::before):
        (#search-results-pane-file-based .search-result):
        (#search-results-pane-file-based .show-more-matches):
        * inspector/front-end/inspector.js:
        (WebInspector.showViewInDrawer.closeButtonPressed):
        (WebInspector.showViewInDrawer):
        (WebInspector.closeViewInDrawer):
        (WebInspector.postDocumentKeyDown):

2012-05-18  Andreas Kling  <kling@webkit.org>

        REGRESSION(r117501): IconDatabase asserts on startup in synchronousIconForPageURL().
        <http://webkit.org/b/86935>
        <rdar://problem/11480012>

        Reviewed by Anders Carlsson.

        - Correctly set m_retainOrReleaseIconRequested to true in retainIconForPageURL().
          This was causing the assertions, as we would end up doing nothing until the first
          icon release request came in.

        - Require that m_urlsToRetainOrReleaseLock be held when accessing m_retainOrReleaseIconRequested.
          This removes a possible race condition in double checked locking.

        - Swap over the retain/release work queues while holding m_urlsToRetainOrReleaseLock
          and release it right away to avoid sitting on the lock while updating the database.

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::synchronousIconForPageURL):
        (WebCore::IconDatabase::retainIconForPageURL):
        (WebCore::IconDatabase::releaseIconForPageURL):
        (WebCore::IconDatabase::retainedPageURLCount):
        (WebCore::IconDatabase::performURLImport):
        (WebCore::IconDatabase::syncThreadMainLoop):
        (WebCore::IconDatabase::performPendingRetainAndReleaseOperations):
        * loader/icon/IconDatabase.h:
        (IconDatabase):

2012-05-21  Kent Tamura  <tkent@chromium.org>

        Unreviewed, build fix.

        * html/StepRange.cpp:
        (WebCore::StepRange::parseStep): Remove bogus asssetions.

2012-05-21  Kent Tamura  <tkent@chromium.org>

        Unreviewed, build fix.

        * html/StepRange.cpp:
        (WebCore::StepRange::StepRange): Remove another ASSERT_NOT_REACHED.

2012-05-21  Kent Tamura  <tkent@chromium.org>

        Unreviewed, build fix.

        * html/StepRange.h:
        (WebCore::StepRange::StepDescription::StepDescription):
        Remove ASSERT_NOT_REACHED.

2012-05-21  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move numeric related methods in HTMLInputElement class to another place
        https://bugs.webkit.org/show_bug.cgi?id=82034

        Reviewed by Kent Tamura.

        This patch moves step and range related methods into StepRange class
        for ease of using step calculation other than double floating point
        number arithmetic, e.g. decimal, long double, and so on.

        New class StepRange::StepDescription holds values for calculating
        stepped value, defaultStep, defaultStepBase, integer rounding flags,
        step scale factor instead of virtual methods in InputType class.

        No new tests because of this patch doesn't change behavior.

        * WebCore.xcodeproj/project.pbxproj: Set attribute of StepRange.h to "Private" for including it in HTMLInputElement.cpp.
        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::InputType::rangeOverflow): Moved to use InputType class.
        (WebCore::InputType::rangeUnderflow): Moved to use InputType class.
        (WebCore::BaseDateAndTimeInputType::stepMismatch): Moved to use stepRange.
        * html/BaseDateAndTimeInputType.h:
        (BaseDateAndTimeInputType): Removed method declaration for stepBase.
        * html/DateInputType.cpp:
        (WebCore::DateInputType::setupStepRange): Added.
        * html/DateInputType.h:
        (DateInputType): Removed method declarations.
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::defaultStep): Removed.
        (WebCore::DateTimeInputType::maximum): Removed.
        (WebCore::DateTimeInputType::minimum): Removed.
        (WebCore::DateTimeInputType::setupStepRange): Added
        (WebCore::DateTimeInputType::stepScaleFactor): Removed.
        * html/DateTimeInputType.h:
        (DateTimeInputType): Removed deprecated method declarations.
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::defaultStep): Removed.
        (WebCore::DateTimeLocalInputType::maximum): Removed.
        (WebCore::DateTimeLocalInputType::minimum): Removed.
        (WebCore::DateTimeLocalInputType::setupStepRange): Added.
        (WebCore::DateTimeLocalInputType::stepScaleFactor): Removed.
        * html/DateTimeLocalInputType.h:
        (DateTimeLocalInputType):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isInRange): Changed to call InputType::isInRange.
        (WebCore::HTMLInputElement::isOutOfRange): Changed to call InputType::isOutOfRange.
        (WebCore::HTMLInputElement::setupStepRange): Added.
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore::InputType::acceptableError): Moved to StepRange class.
        (WebCore::InputType::alignValueForStep): Moved to StepRange class.
        (WebCore::InputType::minimum): Changed to use StepRange class.
        (WebCore::InputType::maximum): Changed to use StepRange class.
        (WebCore::InputType::parseToDouble): Changed to have ASSERT_NOT_REACHED.
        (WebCore::InputType::stepBaseWithDecimalPlaces): Changed to use StepRange class.
        (WebCore::InputType::validationMessage):  Changed to use StepRange class.
        (WebCore::InputType::applyStep):  Changed to use StepRange class.
        (WebCore::InputType::getAllowedValueStep):  Changed to use StepRange class.
        (WebCore::InputType::isInRange): Added.
        (WebCore::InputType::isOutOfRange): Added.
        (WebCore::InputType::rangeOverflow): Changed to use StepRange class.
        (WebCore::InputType::rangeUnderflow): Changed to use StepRange class.
        (WebCore::InputType::setupStepRange): Added.
        (WebCore::InputType::stepUpFromRenderer):  Changed to use StepRange class.
        (WebCore::InputType::stepMismatch): Changed to use StepRange class.
        * html/InputType.h:
        (InputType):
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::defaultStep): Removed.
        (WebCore::MonthInputType::maximum): Removed.
        (WebCore::MonthInputType::minimum): Removed.
        (WebCore::MonthInputType::setupStepRange): Added.
        (WebCore::MonthInputType::stepScaleFactor): Removed.
        * html/MonthInputType.h:
        (MonthInputType):
        * html/NumberInputType.cpp:
        (WebCore):
        (WebCore::NumberInputType::defaultStep): Removed.
        (WebCore::NumberInputType::maximum): Removed.
        (WebCore::NumberInputType::minimum): Removed.
        (WebCore::NumberInputType::rangeOverflow): Moved to InputType class.
        (WebCore::NumberInputType::rangeUnderflow): Moved to InputType class.
        (WebCore::NumberInputType::setupStepRange): Added.
        (WebCore::NumberInputType::stepMismatch): Moved to InputType class.
        (WebCore::NumberInputType::stepBaseWithDecimalPlaces): Changed to use StepRange class.
        (WebCore::NumberInputType::stepScaleFactor): Removed.
        * html/NumberInputType.h:
        (NumberInputType):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::defaultStep): Removed.
        (WebCore::RangeInputType::maximum): Removed.
        (WebCore::RangeInputType::minimum): Removed.
        (WebCore::RangeInputType::setupStepRange): Added.
        (WebCore::RangeInputType::stepScaleFactor): Removed.
        (WebCore::RangeInputType::handleKeydownEvent): Changed to use StepRange class.
        (WebCore::RangeInputType::fallbackValue): Changed to use StepRange class.
        (WebCore::RangeInputType::sanitizeValue): Changed to use StepRange class.
        * html/RangeInputType.h:
        (RangeInputType):
        * html/StepRange.cpp:
        (WebCore::StepRange::StepRange): Added.
        (WebCore::StepRange::clampValue): Changed for member variable name changes.
        (WebCore::StepRange::hasStep): Added.
        (WebCore::StepRange::maximum): Added.
        (WebCore::StepRange::minimum): Added.
        (WebCore::StepRange::step): Added.
        (WebCore::StepRange::stepBase): Added.
        (WebCore::StepRange::stepDecimalPlaces): Added.
        (WebCore::StepRange::stepScaleFactor): Added.
        (WebCore::StepRange::setHasStep): Added.
        (WebCore::StepRange::setup): Added.
        (WebCore::StepRange::parse): Added.
        * html/StepRange.h:
        (StepDescription): Added
        (WebCore::StepRange::StepDescription::StepDescription):
        (WebCore::StepRange::acceptableError): Moved from InputType class.
        (WebCore::StepRange::alignValueForStep): Moved from InputType class.
        (WebCore::StepRange::defaultValue): Changed for member variable name changes.
        (WebCore::StepRange::proportionFromValue): Changed for member variable name changes.
        (WebCore::StepRange::valueFromProportion): Changed for member variable name changes.
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::defaultStep): Removed.
        (WebCore::TimeInputType::maximum): Removed.
        (WebCore::TimeInputType::minimum): Removed.
        (WebCore::TimeInputType::setupStepRange): Added.
        (WebCore::TimeInputType::stepScaleFactor): Removed.
        * html/TimeInputType.h:
        (TimeInputType):
        * html/WeekInputType.cpp:
        (WebCore):
        (WebCore::WeekInputType::defaultStep): Removed.
        (WebCore::WeekInputType::maximum): Removed.
        (WebCore::WeekInputType::minimum): Removed.
        (WebCore::WeekInputType::setupStepRange): Added.
        (WebCore::WeekInputType::stepScaleFactor): Removed.
        * html/WeekInputType.h:
        (WeekInputType):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderPosition): Changed to use StepRange class.
        (WebCore::SliderThumbElement::setPositionFromPoint): Changed to use StepRange class.

2012-05-21  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to throwNotEnoughArgumentsError()
        https://bugs.webkit.org/show_bug.cgi?id=86983

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to throwNotEnoughArgumentsError().

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateArgumentsCountCheck):
        (GenerateEventConstructorCallback):
        * bindings/scripts/test/V8/V8Float64Array.cpp:
        (WebCore::Float64ArrayV8Internal::fooCallback):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
        (WebCore::TestActiveDOMObjectV8Internal::postMessageCallback):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
        (WebCore::TestCustomNamedGetterV8Internal::anotherFunctionCallback):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::V8TestEventConstructor::constructorCallback):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::TestEventTargetV8Internal::itemCallback):
        (WebCore::TestEventTargetV8Internal::dispatchEventCallback):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::TestInterfaceV8Internal::supplementalMethod2Callback):
        (WebCore::V8TestInterface::constructorCallback):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
        (WebCore::TestMediaQueryListListenerV8Internal::methodCallback):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructorCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::voidMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::intMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::objMethodWithArgsCallback):
        (WebCore::TestObjV8Internal::methodWithSequenceArgCallback):
        (WebCore::TestObjV8Internal::methodReturningSequenceCallback):
        (WebCore::TestObjV8Internal::methodThatRequiresAllArgsAndThrowsCallback):
        (WebCore::TestObjV8Internal::serializedValueCallback):
        (WebCore::TestObjV8Internal::idbKeyCallback):
        (WebCore::TestObjV8Internal::optionsObjectCallback):
        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndOptionalArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndTwoOptionalArgsCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonCallbackArgAndCallbackArgCallback):
        (WebCore::TestObjV8Internal::overloadedMethod1Callback):
        (WebCore::TestObjV8Internal::overloadedMethod2Callback):
        (WebCore::TestObjV8Internal::overloadedMethod3Callback):
        (WebCore::TestObjV8Internal::overloadedMethod4Callback):
        (WebCore::TestObjV8Internal::overloadedMethod5Callback):
        (WebCore::TestObjV8Internal::overloadedMethod6Callback):
        (WebCore::TestObjV8Internal::overloadedMethod7Callback):
        (WebCore::TestObjV8Internal::overloadedMethod11Callback):
        (WebCore::TestObjV8Internal::overloadedMethod12Callback):
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod1Callback):
        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod2Callback):
        (WebCore::TestObjV8Internal::convert1Callback):
        (WebCore::TestObjV8Internal::convert2Callback):
        (WebCore::TestObjV8Internal::convert3Callback):
        (WebCore::TestObjV8Internal::convert4Callback):
        (WebCore::TestObjV8Internal::convert5Callback):
        (WebCore::TestObjV8Internal::strictFunctionCallback):
        (WebCore::V8TestObj::constructorCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
        * bindings/v8/ScriptController.cpp:
        (WebCore::setValueAndClosePopupCallback):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::throwNotEnoughArgumentsError):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::getInt8Callback):
        (WebCore::V8DataView::getUint8Callback):
        (WebCore::V8DataView::setInt8Callback):
        (WebCore::V8DataView::setUint8Callback):
        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
        (WebCore::V8DirectoryEntry::getDirectoryCallback):
        (WebCore::V8DirectoryEntry::getFileCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::getObjectParameter):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getExtensionCallback):
        (WebCore::V8WebGLRenderingContext::getFramebufferAttachmentParameterCallback):
        (WebCore::V8WebGLRenderingContext::getParameterCallback):
        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
        (WebCore::V8WebGLRenderingContext::getUniformCallback):
        (WebCore::vertexAttribAndUniformHelperf):
        (WebCore::uniformHelperi):
        (WebCore::uniformMatrixHelper):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::constructorCallback):
        (WebCore::V8WebKitMutationObserver::observeCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        (WebCore::V8WebSocket::sendCallback):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::openCallback):

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to throwError()s in V8 custom bindings (Part 2)
        https://bugs.webkit.org/show_bug.cgi?id=86981

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to throwError()s in V8 custom bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::pushStateCallback):
        (WebCore::V8History::replaceStateCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
        (WebCore::V8NotificationCenter::createNotificationCallback):
        (WebCore::V8NotificationCenter::requestPermissionCallback):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
        (WebCore::V8SQLTransaction::executeSqlCallback):
        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
        (WebCore::V8SQLTransactionSync::executeSqlCallback):
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageSetter):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::constructorCallback):
        (WebCore::V8WebKitMutationObserver::observeCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        (WebCore::V8WebSocket::sendCallback):
        (WebCore::V8WebSocket::closeCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::V8WorkerContext::importScriptsCallback):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::V8XMLHttpRequest::constructorCallback):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::responseTextAccessorGetter):
        (WebCore::V8XMLHttpRequest::openCallback):
        (WebCore::V8XMLHttpRequest::sendCallback):

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to throwError()s in V8 custom bindings (Part 1)
        https://bugs.webkit.org/show_bug.cgi?id=86980

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to throwError()s in V8 custom bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::V8CSSStyleDeclaration::namedPropertySetter):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::clearDataCallback):
        (WebCore::V8Clipboard::setDragImageCallback):
        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
        (WebCore::V8DOMFormData::appendCallback):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::V8DOMStringMap::namedPropertySetter):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
        (WebCore::handlePostMessageCallback):
        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
        (WebCore::V8DirectoryEntry::getDirectoryCallback):
        (WebCore::V8DirectoryEntry::getFileCallback):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::V8Document::evaluateCallback):

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to V8NPObject::npObjectGetProperty() and V8NPObject::npObjectSetProperty()
        https://bugs.webkit.org/show_bug.cgi?id=86979

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to V8NPObject::npObjectGetProperty()
        and V8NPObject::npObjectSetProperty().

        No tests. No change in behavior.

        * bindings/v8/V8NPObject.cpp:
        (WebCore::npObjectGetProperty):
        (WebCore::npObjectNamedPropertyGetter):
        (WebCore::npObjectIndexedPropertyGetter):
        (WebCore::npObjectGetNamedProperty):
        (WebCore::npObjectGetIndexedProperty):
        (WebCore::npObjectQueryProperty):
        (WebCore::npObjectSetProperty):
        (WebCore::npObjectNamedPropertySetter):
        (WebCore::npObjectIndexedPropertySetter):
        (WebCore::npObjectSetNamedProperty):
        (WebCore::npObjectSetIndexedProperty):
        * bindings/v8/V8NPObject.h:
        (WebCore):
        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
        (WebCore::npObjectNamedGetter):
        (WebCore::npObjectNamedSetter):
        (WebCore::npObjectIndexedGetter):
        (WebCore::npObjectIndexedSetter):

2012-05-20  Ryosuke Niwa  <rniwa@webkit.org>

        Using createContextualFragment to insert a <script> does not cause the script to execute
        https://bugs.webkit.org/show_bug.cgi?id=12234

        Reviewed by Adam Barth.

        Renamed FragmentScriptingAllowed and FragmentScriptingNotAllowed to DisallowScriptingContent
        and AllowScriptingContent as these two flags are used in code for non-fragment cases and they
        indicate whether attributes and elements that can invoke scripting should be removed or not.

        To fix the bug, added a new value AllowScriptingContentAndDoNotMarkAlreadyStarted unset
        already-started and parser-inserted flags [1] on script elements in addition to allowing
        scripting contents.

        While the HTML5 specification and the DOM Parsing and Serialization specification [2] state that
        we should set these flags in the parser and later unset them, doing so would require traversing
        the parsed fragment to find relevant script elements. We short circuit this logic by simply not
        setting parser-inserted and already-started flags in createContextualFragment.

        [1] http://www.whatwg.org/specs/web-apps/current-work/multipage/scripting-1.html#already-started
        [2] http://html5.org/specs/dom-parsing.html#dom-range-createcontextualfragment

        Tests: fast/dom/Range/create-contextual-fragment-script-not-ran.html
               fast/dom/Range/create-contextual-fragment-script-unmark-already-started.html

        * dom/DocumentFragment.h:
        (DocumentFragment):
        * dom/Element.cpp:
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::setAttributeNS):
        * dom/Element.h:
        (Element):
        * dom/FragmentScriptingPermission.h:
        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment): Removed FragmentScriptingPermission from the argument
        list since no one uses it. Always use AllowScriptingContentAndDoNotMarkAlreadyStarted instead.
        * dom/Range.h:
        * editing/markup.h:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::HTMLConstructionSite):
        (WebCore::HTMLConstructionSite::insertScriptElement): Pass false to both parserInserted and
        alreadyStarted when the scripting permission is AllowScriptingContentAndDoNotMarkAlreadyStarted.
        Also call parserSetAttributes when the scripting permission is either AllowScriptingContent or
        AllowScriptingContentAndDoNotMarkAlreadyStarted.
        * html/parser/HTMLDocumentParser.h:
        (HTMLDocumentParser):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext):
        (WebCore::HTMLTreeBuilder::processEndTag):
        * html/parser/HTMLTreeBuilder.h:
        (FragmentParsingContext):
        * platform/blackberry/PasteboardBlackBerry.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/chromium/DragDataChromium.cpp:
        (WebCore::DragData::asFragment):
        * platform/chromium/PasteboardChromium.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/gtk/PasteboardGtk.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::documentFragment):
        * platform/qt/DragDataQt.cpp:
        (WebCore::DragData::asFragment):
        * platform/qt/PasteboardQt.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/win/ClipboardUtilitiesWin.cpp:
        (WebCore::fragmentFromCFHTML):
        (WebCore::fragmentFromHTML):
        * xml/XMLErrors.cpp:
        (WebCore::createXHTMLParserErrorHeader):
        (WebCore::XMLErrors::insertErrorMessageBlock):
        * xml/parser/NewXMLDocumentParser.h:
        (NewXMLDocumentParser):
        * xml/parser/XMLDocumentParser.h:
        (XMLDocumentParser):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):
        (WebCore::XMLDocumentParser::endElementNs):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):
        (WebCore::XMLDocumentParser::parseEndElement):

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to V8Utilities::createFunctionCallback()
        https://bugs.webkit.org/show_bug.cgi?id=86978

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to V8Utilities::createFunctionCallback().

        No tests. No change in behavior.

        * bindings/v8/V8Utilities.cpp:
        (WebCore::throwTypeMismatchException):
        * bindings/v8/V8Utilities.h:
        (WebCore):
        (WebCore::createFunctionOnlyCallback):
        * bindings/v8/custom/V8GeolocationCustom.cpp:
        (WebCore::V8Geolocation::getCurrentPositionCallback):
        (WebCore::V8Geolocation::watchPositionCallback):
        * bindings/v8/custom/V8NotificationCustom.cpp:
        (WebCore::V8Notification::requestPermissionCallback):

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to throwError()s in bindings/v8/*.{h,cpp}
        https://bugs.webkit.org/show_bug.cgi?id=86977

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to throwError()s in bindings/v8/*.{h,cpp}
        except for a couple of non-trivial cases. I'll upload a follow-up patch
        for the non-trivial cases.

        No tests. No change in behavior.

        * bindings/v8/DateExtension.cpp:
        (WebCore::DateExtension::OnSleepDetected):
        * bindings/v8/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::transferArrayBuffers):
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        * bindings/v8/SerializedScriptValue.h:
        * bindings/v8/V8NPObject.cpp:
        (WebCore::npObjectInvokeImpl):
        (WebCore::npObjectPropertyEnumerator):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::checkNewLegal):

2012-05-20  Keishi Hattori  <keishi@webkit.org>

        [Chromium] Enable datalist for input type email
        https://bugs.webkit.org/show_bug.cgi?id=85356

        Reviewed by Kent Tamura.

        No new tests. Covered in fast/forms/datalist/input-list.html

        * rendering/RenderThemeChromiumCommon.cpp:
        (WebCore::RenderThemeChromiumCommon::supportsDataListUI):

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to throwError()s in CodeGeneratorV8.pm
        https://bugs.webkit.org/show_bug.cgi?id=86976

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to throwError()s in CodeGeneratorV8.pm.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateNormalAttrSetter):
        (GenerateParametersCheck):
        (GenerateConstructorCallback):
        (GenerateNamedConstructorCallback):
        (GenerateFunctionCallString):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::V8TestInterface::constructorCallback):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructorCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::withScriptStateAttributeAttrSetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter):
        (WebCore::TestObjV8Internal::withScriptStateVoidCallback):
        (WebCore::TestObjV8Internal::withScriptStateObjCallback):
        (WebCore::TestObjV8Internal::withScriptStateVoidExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptStateObjExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateObjExceptionCallback):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateWithSpacesCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithNonCallbackArgAndCallbackArgCallback):
        (WebCore::TestObjV8Internal::methodWithCallbackAndOptionalArgCallback):
        (WebCore::TestObjV8Internal::overloadedMethod5Callback):
        (WebCore::V8TestObj::constructorCallback):

2012-05-20  George Staikos  <staikos@webkit.org>

        [BlackBerry] Implement the Screen functions to get DPI.
        https://bugs.webkit.org/show_bug.cgi?id=86967

        Reviewed by Antonio Gomes.

        * platform/blackberry/PlatformScreenBlackBerry.cpp:
        (WebCore::screenHorizontalDPI):
        (WebCore::screenVerticalDPI):

2012-05-20  Shinya Kawanaka  <shinyak@chromium.org>

        [Refactoring] Node::shadowHost() and Node::setShadowHost() can be moved to ShadowRoot.
        https://bugs.webkit.org/show_bug.cgi?id=86585

        Reviewed by Hajime Morita.

        Since Node::shadowHost() and Node::setShadowHost() are valid only if Node is ShadowRoot,
        they should be moved to ShadowRoot.

        However, Node::setParent cannot be called from ShadowRoot, we add Node::setParentOrHostNode
        to call it as Node::parentOrHostNode() calls Node::parent(). Node::setParent() is now private.
        We also add SVGElementInstance::setParentOrHostNode() to share ContainerNodeAlgorithm.

        No new tests, no change in behavior.

        * dom/Attr.cpp:
        (WebCore::Attr::createTextChild):
        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::insertBeforeCommon):
        (WebCore::ContainerNode::removeBetween):
        (WebCore::ContainerNode::removeChildren):
        * dom/ContainerNodeAlgorithms.h:
        (WebCore::appendChildToContainer):
        (WebCore::Private::addChildNodesToDeletionQueue):
        * dom/ElementShadow.cpp:
        (WebCore::validateShadowRoot):
        (WebCore::ElementShadow::addShadowRoot):
        (WebCore::ElementShadow::removeAllShadowRoots):
        * dom/EventDispatcher.cpp:
        (WebCore::eventTargetRespectingSVGTargetRules):
        (WebCore::EventDispatcher::ensureEventAncestors):
        (WebCore::EventDispatcher::determineDispatchBehavior):
        * dom/EventDispatcher.h:
        (WebCore):
        (EventDispatcher):
        * dom/Node.cpp:
        (WebCore::Node::parentOrHostElement):
        * dom/Node.h:
        (Node):
        (WebCore::Node::setParentOrHostNode):
        (WebCore):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        * dom/ShadowRoot.h:
        (WebCore::ShadowRoot::host):
        (WebCore):
        (WebCore::ShadowRoot::setHost):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::focusedNode):
        * html/shadow/ContentSelectorQuery.cpp:
        (WebCore::ContentSelectorQuery::matches):
        * page/DragController.cpp:
        (WebCore::asFileInput):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::instanceAssociatedWithShadowTreeElement):
        (WebCore::EventHandler::dispatchMouseEvent):
        * page/FocusController.cpp:
        (WebCore::FocusScope::owner):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::hasLineIfEmpty):
        * svg/SVGElementInstance.h:
        (WebCore::SVGElementInstance::setParentOrHostNode):
        (SVGElementInstance):
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::title):
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGShadowText::willRecalcTextStyle):

2012-05-20  Joe Thomas  <joethomas@motorola.com>

        Unsupported commands should have queryCommandValue() = "", not false
        https://bugs.webkit.org/show_bug.cgi?id=86964

        Reviewed by Ryosuke Niwa.

        queryCommandValue for unsupported commands should return empty string.
        The specification related to this can be located at http://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#methods-to-query-and-execute-commands

        Test: editing/execCommand/queryCommandValue-unsupported-commands.html

        * dom/Document.idl:

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        Unreviewed. Rebaselined run-bindings-tests results.

        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::setJSTestInterfaceSupplementalStr2):
        (WebCore::setJSTestInterfaceSupplementalStr3):
        (WebCore::setJSTestInterfaceSupplementalNode):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjShortAttr):
        (WebCore::setJSTestObjUnsignedShortAttr):
        (WebCore::setJSTestObjIntAttr):
        (WebCore::setJSTestObjLongLongAttr):
        (WebCore::setJSTestObjUnsignedLongLongAttr):
        (WebCore::setJSTestObjStringAttr):
        (WebCore::setJSTestObjTestObjAttr):
        (WebCore::setJSTestObjSequenceAttr):
        (WebCore::setJSTestObjIntSequenceAttr):
        (WebCore::setJSTestObjShortSequenceAttr):
        (WebCore::setJSTestObjLongSequenceAttr):
        (WebCore::setJSTestObjLongLongSequenceAttr):
        (WebCore::setJSTestObjUnsignedIntSequenceAttr):
        (WebCore::setJSTestObjUnsignedShortSequenceAttr):
        (WebCore::setJSTestObjUnsignedLongSequenceAttr):
        (WebCore::setJSTestObjUnsignedLongLongSequenceAttr):
        (WebCore::setJSTestObjFloatSequenceAttr):
        (WebCore::setJSTestObjDoubleSequenceAttr):
        (WebCore::setJSTestObjBooleanSequenceAttr):
        (WebCore::setJSTestObjVoidSequenceAttr):
        (WebCore::setJSTestObjDateSequenceAttr):
        (WebCore::setJSTestObjXMLObjAttr):
        (WebCore::setJSTestObjCreate):
        (WebCore::setJSTestObjReflectedStringAttr):
        (WebCore::setJSTestObjReflectedIntegralAttr):
        (WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
        (WebCore::setJSTestObjReflectedBooleanAttr):
        (WebCore::setJSTestObjReflectedURLAttr):
        (WebCore::setJSTestObjReflectedCustomIntegralAttr):
        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
        (WebCore::setJSTestObjReflectedCustomURLAttr):
        (WebCore::setJSTestObjAttrWithGetterException):
        (WebCore::setJSTestObjAttrWithSetterException):
        (WebCore::setJSTestObjStringAttrWithGetterException):
        (WebCore::setJSTestObjStringAttrWithSetterException):
        (WebCore::setJSTestObjCustomAttr):
        (WebCore::setJSTestObjWithScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
        (WebCore::setJSTestObjWithScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
        (WebCore::setJSTestObjConditionalAttr1):
        (WebCore::setJSTestObjConditionalAttr2):
        (WebCore::setJSTestObjConditionalAttr3):
        (WebCore::setJSTestObjConditionalAttr4Constructor):
        (WebCore::setJSTestObjConditionalAttr5Constructor):
        (WebCore::setJSTestObjConditionalAttr6Constructor):
        (WebCore::setJSTestObjMutablePoint):
        (WebCore::setJSTestObjImmutablePoint):
        (WebCore::setJSTestObjStrawberry):
        (WebCore::setJSTestObjStrictFloat):
        (WebCore::setJSTestObjId):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::setJSTestSerializedScriptValueInterfaceValue):
        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):

2012-05-20  George Staikos  <staikos@webkit.org>

        Use reinterpret_cast_ptr<> to fix an alignment warning.
        https://bugs.webkit.org/show_bug.cgi?id=80790

        Reviewed by Rob Buis.

        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (WebCore::error_exit):

2012-05-20  Takashi Sakamoto  <tasak@google.com>

        Needs style recalculation by changing applyAuthorStyles dynamically
        https://bugs.webkit.org/show_bug.cgi?id=84251

        Modifying setApplyAuthorStyles to invoke owner()'s
        setNeedsRedistributing if applyAuthorStyles changes.

        Reviewed by Hajime Morita.

        No new tests. Adding new tests to existing
        fast/dom/shadow/shadow-root-applyAuthorStyles.html to test this
        feature.

        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setApplyAuthorStyles):
        If applyAuthorStyles changes, invoke owner's setNeedsRedistributing to
        recalculate styles of the shadow root's child elements.

2012-05-20  Philip Rogers  <pdr@google.com>

        Accumulate SVG animations into first contributing element
        https://bugs.webkit.org/show_bug.cgi?id=86385

        Reviewed by Nikolas Zimmermann.

        Previously we were accumulating animations into the first animation element when
        there were multiple animations for a single element. This crashed if the first
        animation ended first because the first animation was prematurely cleaned up.
        This change accumulates animations into the first _contributing_ animation element.

        Tests: svg/animations/multiple-animations-ending.html
               svg/animations/svg-two-animate-elements-crash-expected.svg
               svg/animations/svg-two-animate-elements-crash.svg

        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::updateAnimations):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::progress):

2012-05-20  Philip Rogers  <pdr@google.com>

        Fix hit testing on non-scaling strokes
        https://bugs.webkit.org/show_bug.cgi?id=82628

        Reviewed by Nikolas Zimmermann.

        This change fixes hit testing on non-scaling strokes. It contains fixes for 3 bugs:
        1) RenderSVGRect::shapeDependentStrokeContains was not falling back to shape-based hit testing.
        2) m_strokeAndMarkerBoundingBox did not account for non-scaling strokes.
        3) RenderSVGShape::shapeDependentStrokeContains did not have any support for non-scaling strokes.

        This change also contains some refactoring/cleanup of the non-scale-stroke codepaths.

        Test: svg/hittest/svg-shapes-non-scale-stroke.html

        * rendering/svg/RenderSVGEllipse.cpp:
        (WebCore::RenderSVGEllipse::createShape):
        * rendering/svg/RenderSVGRect.cpp:
        (WebCore::RenderSVGRect::createShape):
        (WebCore::RenderSVGRect::shapeDependentStrokeContains):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::shapeDependentStrokeContains):
        (WebCore::RenderSVGShape::shapeDependentFillContains):
        (WebCore::RenderSVGShape::nonScalingStrokePath):
        (WebCore):
        (WebCore::RenderSVGShape::setupNonScalingStrokeContext):
        (WebCore::RenderSVGShape::nonScalingStrokeTransform):
        (WebCore::RenderSVGShape::strokePath):
        (WebCore::RenderSVGShape::fillAndStrokePath):
        (WebCore::RenderSVGShape::updateCachedBoundaries):
        (WebCore::RenderSVGShape::inflateWithStrokeAndMarkerBounds):
        * rendering/svg/RenderSVGShape.h:
        (WebCore::RenderSVGShape::hasNonScalingStroke):
        (RenderSVGShape):

2012-05-19  Emil A Eklund  <eae@chromium.org>

        Simplify RenderOverflow by using Rects
        https://bugs.webkit.org/show_bug.cgi?id=86894

        Reviewed by Eric Seidel.

        Simplify the RenderOverflow class and the uses of it by storing the
        overflow values in rects and using the rects instead of the individual
        values where it makes sense.

        No new tests, no change in functionality.

        * page/FrameView.cpp:
        (WebCore::FrameView::adjustPageHeightDeprecated):
        Change to use layoutOverflowRect().maxX() and replace C style casts with
        C++ style to comply with style guide.
        
        * rendering/InlineFlowBox.h:
        (WebCore::InlineFlowBox::logicalLeftLayoutOverflow):
        (WebCore::InlineFlowBox::logicalRightLayoutOverflow):
        (WebCore::InlineFlowBox::logicalTopLayoutOverflow):
        (WebCore::InlineFlowBox::logicalBottomLayoutOverflow):
        (WebCore::InlineFlowBox::logicalLeftVisualOverflow):
        (WebCore::InlineFlowBox::logicalRightVisualOverflow):
        (WebCore::InlineFlowBox::logicalTopVisualOverflow):
        (WebCore::InlineFlowBox::logicalBottomVisualOverflow):
        Change methods to use layoutOverflowRect() and visualOverflowRect().
        
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::scrollWidth):
        (WebCore::RenderBox::scrollHeight):
        Change methods to use visualOverflowRect().
        
        (WebCore::RenderBox::clearLayoutOverflow):
        Use setLayoutOverflow instead of resetLayoutOverflow (which has been
        removed as it did exactly the same thing as the set method).
        
        * rendering/RenderBox.h:
        (WebCore::RenderBox::maxLayoutOverflow):
        (WebCore::RenderBox::logicalLeftLayoutOverflow):
        (WebCore::RenderBox::logicalRightLayoutOverflow):
        (WebCore::RenderBox::logicalLeftVisualOverflow):
        (WebCore::RenderBox::logicalRightVisualOverflow):
        Remove minYLayoutOverflow, maxYLayoutOverflow, minXLayoutOverflow and
        maxXLayoutOverflow and update the remaining methods to use
        layoutOverflowRect().
        
        * rendering/RenderMarquee.cpp:
        (WebCore::RenderMarquee::computePosition):
        Change to use layoutOverflowRect().
        
        * rendering/RenderOverflow.h:
        (WebCore::RenderOverflow::RenderOverflow):
        (WebCore::RenderOverflow::layoutOverflowRect):
        (WebCore::RenderOverflow::visualOverflowRect):
        (RenderOverflow):
        (WebCore::RenderOverflow::setMinYLayoutOverflow):
        (WebCore::RenderOverflow::setMaxYLayoutOverflow):
        (WebCore::RenderOverflow::setMinXLayoutOverflow):
        (WebCore::RenderOverflow::setMaxXLayoutOverflow):
        (WebCore::RenderOverflow::setMinYVisualOverflow):
        (WebCore::RenderOverflow::setMaxYVisualOverflow):
        (WebCore::RenderOverflow::setMinXVisualOverflow):
        (WebCore::RenderOverflow::setMaxXVisualOverflow):
        (WebCore):
        (WebCore::RenderOverflow::move):
        (WebCore::RenderOverflow::addLayoutOverflow):
        (WebCore::RenderOverflow::addVisualOverflow):
        (WebCore::RenderOverflow::setLayoutOverflow):
        (WebCore::RenderOverflow::setVisualOverflow):
        Change RenderOverflow to use two rects instead of two sets of four
        values. Remove [min|max][Layout|Visual]Overflow getters and change the
        layoutOverflowRect and visualOverflowRect methods to return the rects.
        
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::shouldPaint):
        Change to use visualOverflowRect().
        
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::layout):
        Change to use visualOverflowRect().
        
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
        Change to use visualOverflowRect().
        
        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeLayers):
        Change to use layoutOverflowRect().

2012-05-19  Rob Buis  <rbuis@rim.com>

        Remove bbox caching from SVGPathElement
        https://bugs.webkit.org/show_bug.cgi?id=86233

        Reviewed by Nikolas Zimmermann.

        Remove caching of path bounding box, since SVGLocatable::getBBox is not used much at all.
        This saves 200k of memory for worldcup.svg on 64-bit machine.

        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::SVGPathElement):
        (WebCore::SVGPathElement::svgAttributeChanged):
        (WebCore::SVGPathElement::pathSegListChanged):
        (WebCore::SVGPathElement::getBBox):
        * svg/SVGPathElement.h:
        (SVGPathElement):

2012-05-19  Andy Estes  <aestes@apple.com>

        Fix build errors found when disabling ENABLE_DRAG_SUPPORT
        https://bugs.webkit.org/show_bug.cgi?id=86947

        Reviewed by Jon Honeycutt.

        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::passMouseMoveEventToSubframe):
        * platform/mac/ClipboardMac.mm:
        (WebCore):

2012-05-19  Joe Thomas  <joethomas@motorola.com>

        The order of CSS properties is wrong in background shorthand
        https://bugs.webkit.org/show_bug.cgi?id=86152

        Reviewed by Ryosuke Niwa.

        Corrected the order of properties returned in StylePropertySet::getPropertyValue for background shorthand property to match the specification  
        http://www.w3.org/TR/css3-background/#background.

        * css/StylePropertyShorthand.cpp:
        (WebCore::backgroundShorthand):

2012-05-19  Ryosuke Niwa  <rniwa@webkit.org>

        Touch Internals.* in an attempt to fix Windows builds after r117646.

        * testing/Internals.cpp:
        * testing/Internals.h:
        * testing/Internals.idl:

2012-05-18  Ryosuke Niwa  <rniwa@webkit.org>

        WebKit erroneously add 1px padding in input elements
        https://bugs.webkit.org/show_bug.cgi?id=86784

        Reviewed by Kent Tamura.

        Fixed the bug by removing the code that added left and right paddings in input elements.
        The code was added in r13567 to match a very old version of Internet Explorer but this quirk
        does not seem to exists in IE9 (both in quirks and standard modes).

        A lot of tests need to be rebaselined due to 1px difference inside input elements, and 2px
        differences for the width of input elements. (In some extreme cases, line breaking changed
        due to the width change).

        Test: fast/forms/input-textarea-padding-match.html

        * css/html.css:
        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):

2012-05-18  Adrienne Walker  <enne@google.com>

        [chromium] Add diagnostic CRASH calls for tiler crashes
        https://bugs.webkit.org/show_bug.cgi?id=86930

        Reviewed by James Robinson.

        These lines would normally crash on their own due to null pointers,
        but having an explicit CRASH call will help us differentiate what the
        real problem might be in the crash report.

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::createTile):
        (WebCore::TiledLayerChromium::updateTiles):

2012-05-18  Aaron Colwell  <acolwell@chromium.org>

        Update Media Source implementation to reflect changes in 0.5 spec.
        https://bugs.webkit.org/show_bug.cgi?id=83607

        Reviewed by Darin Fisher.

        Tests: http/tests/media/media-source/video-media-source-event-attributes.html
               http/tests/media/media-source/webm/video-media-source-abort.html
               http/tests/media/media-source/webm/video-media-source-add-and-remove-ids.html

        * html/HTMLAttributeNames.in: Add onwebkitsourcexxx event attribute names.
        * html/HTMLMediaElement.cpp: 
        (WebCore::HTMLMediaElement::parseAttribute): Add code to register event listeners for the onwebkitsourcexxx attributes.
        (WebCore::HTMLMediaElement::pauseInternal):
        (WebCore):
        (WebCore::HTMLMediaElement::webkitSourceAddId): Changed code to pass the parsed type & codecs to m_player instead of the whole MIME-type string. This was done to allow some simple parsing & validation code to be shared in WebKit instead of reimplemented in every port.
        (WebCore::HTMLMediaElement::webkitSourceBuffered): New method in the v0.5 spec. It validates the parameters & that it is being called in the correct state. If so it forwards the call to m_player.
        (WebCore::HTMLMediaElement::webkitSourceAppend): Adds id parameter to match v0.5 signature. Minor logic changes that avoid calling m_player for 0 byte arrays and fixes exceptions reported for a null array and a parse error so they match the spec text.
        (WebCore::HTMLMediaElement::webkitSourceAbort): New method in the v0.5 spec. It validates the parameter & that it is being called in athe correct state. If so it forwards the call to m_player.
        * html/HTMLMediaElement.h:
        (HTMLMediaElement): Added new methods, signature updates, and onwebitsourcexxx event listener attributes.
        * html/HTMLMediaElement.idl: Added new methods, signature updates, and onwebitsourcexxx event listener attributes.
        * platform/ContentType.cpp:
        (WebCore::ContentType::codecs): A new method that parses the codecs parameter into a vector of codec strings.
        (WebCore):
        * platform/ContentType.h: 
        (ContentType):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::sourceAddId): Update the signature to take the parsed type and codecs vector.
        (WebCore::NullMediaPlayerPrivate::sourceBuffered): Add default implementation for this new method.
        (WebCore::NullMediaPlayerPrivate::sourceRemoveId): Remove id parameter name to match other methods.
        (WebCore::NullMediaPlayerPrivate::sourceAppend): Updated signature to include id parameter.
        (WebCore::NullMediaPlayerPrivate::sourceAbort): Add default implementation for this new method.
        (WebCore::NullMediaPlayerPrivate::sourceEndOfStream): Remove parameter name to match other methods.
        (WebCore::MediaPlayer::sourceAddId): Update the signature to take the parsed type and codecs vector.
        (WebCore):
        (WebCore::MediaPlayer::sourceBuffered): Add implementation for new method that forwards the call to the MediaPlayerPrivate interface.
        (WebCore::MediaPlayer::sourceAppend): Update method to forward the new id parameter in the signature.
        (WebCore::MediaPlayer::sourceAbort): Add implementation for new method that forwards the call to the MediaPlayerPrivate interface.
        * platform/graphics/MediaPlayer.h: Update interface to include new methods and updated signatures.
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::sourceAddId): Update the signature to take the parsed type and codecs vector.
        (WebCore::MediaPlayerPrivateInterface::sourceBuffered): Add default implementation for new method.
        (WebCore::MediaPlayerPrivateInterface::sourceAppend): Update method to forward the new id parameter in the signature.
        (WebCore::MediaPlayerPrivateInterface::sourceAbort): Add default implementation for new method.

2012-05-18  Levi Weintraub  <leviw@chromium.org>

        Revert to float method of selection rect alignment for line box tree
        https://bugs.webkit.org/show_bug.cgi?id=86904

        Reviewed by Eric Seidel.

        In r117491, we introduced a new method of alignment for the selection rect in the sub-pixel case.
        It turns out there is at least one case on Mac where this leaves a gap when painting selection rects
        originating in the line box tree. This patch reverts us to the float method for the line box tree,
        but retains the LayoutRect snapping for gap rects.

        No new tests. Covered by existing tests with sub-pixel layout enabled.

        * rendering/EllipsisBox.cpp:
        (WebCore::EllipsisBox::paintSelection): Re-enabling the FloatRect flavor of
        alignSelectionRectToDevicePixels for the line box tree.
        * rendering/InlineTextBox.cpp:
        (WebCore::alignSelectionRectToDevicePixels): Moving LayoutRect flavor to RenderBlock.
        (WebCore::InlineTextBox::paintSelection): Happily clearing up the bifurcation of algorithms for
        sub-pixel layout.
        * rendering/InlineTextBox.h: Re-enabling the FloatRect flavor of alignSelectionRectToDevicePixels
        for the line box tree.
        * rendering/RenderBlock.cpp:
        (WebCore::alignSelectionRectToDevicePixels): Re-seating the LayoutRect version of
        alignSelectionRectToDevicePixels for use with GapRects.

2012-05-18  Eric Seidel  <eric@webkit.org>

        Assertion failure in BidiResolver::commitExplicitEmbedding() (!inIsolate() || m_currentExplicitEmbeddingSequence.isEmpty()) at wikipedia.org
        https://bugs.webkit.org/show_bug.cgi?id=76574

        Reviewed by Levi Weintraub.

        Consider this example:
        <span style="unicode-bidi: embed"><span style="unicode-bidi: isolate">a</span></span>
        Before this patch, we would ASSERT when computing the text runs, as we would have encountered
        the "embed LTR" directive from the outer span, but not try to "commit" this embedding until
        we encountered the first charater (an optimization to avoid creating unnecessary bidi embedding contexts).
        The ASSERT we were hitting was to ensure that embedding directives inside an isolated span
        did not bleed out and effect the surrounding text.

        bidi "isolate" support uses a multi-pass Unicode Bidi Algorithm (UBA), which when encountering
        "isolated" sections of text ignores them in the first pass, and then goes back and runs
        a separate instance of the UBA on those isolated sections.

        Once we scan into an "isolate" section (during an outer UBA application) we should not respect
        any embedding directives inside that "isolate" section.

        However, in the above example, our "don't commit embeddings until we need them" and
        "assert we don't respect embeddings inside isolated spans" were conflicting.
        The fix is to make sure we always commit any pending embedding directives *before*
        we enter an isolate section.

        Luckly there was no functional bug here as we were still respecting
        the embedding directives we were belatedly committing. After this change we're commiting
        those directives at a more appropriate time, thus avoiding the ASSERT.

        Test: fast/text/bidi-isolate-embedding-crash.html

        * platform/text/BidiResolver.h:
        (WebCore::::commitExplicitEmbedding):
        * rendering/InlineIterator.h:
        (WebCore::notifyObserverEnteredObject):
        (WebCore::IsolateTracker::commitExplicitEmbedding):

2012-05-18  Pratik Solanki  <psolanki@apple.com>

        BitmapImage::BitmapImage(CGImageRef, ImageObserver*) needs to set m_sizeRespectingOrientation
        https://bugs.webkit.org/show_bug.cgi?id=86915

        Reviewed by Oliver Hunt.

        Set m_sizeRespectingOrientation to be the same as m_size. Otherwise it stays at 0x0 since
        this constructor also sets m_haveSize to true for the BitmapImage.

        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::BitmapImage::BitmapImage):

2012-05-18  Dan Bernstein  <mitz@apple.com>

        Build fix after r117607.

        * platform/mac/WebCoreNSCellExtras.m:

2012-05-18  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        Fix remaining uses of JSValue::toBoolean()
        https://bugs.webkit.org/show_bug.cgi?id=86912

        Reviewed by Filip Pizlo.

        And unbreak Qt build.

        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
        (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjCreate):
        (WebCore::setJSTestObjReflectedBooleanAttr):
        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
        (WebCore::jsTestObjPrototypeFunctionAddEventListener):
        (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::convertValueToQVariant):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::convertValueToQVariant):

2012-04-27  Filip Pizlo  <fpizlo@apple.com>

        DFG should have control flow graph simplification
        https://bugs.webkit.org/show_bug.cgi?id=84553

        Reviewed by Oliver Hunt.

        Merged r115512 from dfgopt.

        JSValue::toBoolean(ExecState*) -> JSValue::toBoolean()
        
        No new tests, because no new behavior.

        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
        (WebCore::JSSQLStatementErrorCallback::handleEvent):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::addEventListener):
        (WebCore::JSDOMWindow::removeEventListener):
        * bindings/js/JSDataViewCustom.cpp:
        (WebCore::getDataViewMember):
        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
        * bindings/js/JSDeviceOrientationEventCustom.cpp:
        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDirectoryEntryCustom.cpp:
        (WebCore::JSDirectoryEntry::getFile):
        (WebCore::JSDirectoryEntry::getDirectory):
        * bindings/js/JSDirectoryEntrySyncCustom.cpp:
        (WebCore::getFlags):
        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::JSHTMLCanvasElement::getContext):
        * bindings/js/JSInspectorFrontendHostCustom.cpp:
        (WebCore::JSInspectorFrontendHost::showContextMenu):
        * bindings/js/JSMessageEventCustom.cpp:
        (WebCore::handleInitMessageEvent):
        * bindings/js/JSWebGLRenderingContextCustom.cpp:
        (WebCore::dataFunctionMatrix):
        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::open):
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::hasBreakpoint):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateEventListenerCall):
        (GenerateImplementation):
        (JSValueToNative):
        * bridge/c/c_utility.cpp:
        (JSC::Bindings::convertValueToNPVariant):
        * bridge/jni/jni_jsobject.mm:
        (JavaJSObject::convertValueToJObject):

2012-05-18  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] add back-face visibility check for renderSurfaces
        https://bugs.webkit.org/show_bug.cgi?id=86870

        Reviewed by Adrienne Walker.

        Test added CCLayerTreeHostCommonTest::verifyBackFaceCullingWithPreserves3dForFlatteningSurface

        Chromium was not checking back-face visibility for renderSurfaces
        that needed it. This patch adds that check and the appropriate
        unit test.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::layerIsInExisting3DRenderingContext):
        (WebCore):
        (WebCore::subtreeShouldRenderToSeparateSurface):
        (WebCore::calculateDrawTransformsAndVisibilityInternal):

2012-05-18  Levi Weintraub  <leviw@chromium.org>

        Standalone table-columns should be wrapped in anonymous tables
        https://bugs.webkit.org/show_bug.cgi?id=86671

        Reviewed by Julien Chaffraix.

        The CSS2 spec specifies that table-columns misparented outside of a table or
        table-column-group should be wrapped in an anonymous table. Updating 
        RenderObject::addChild to follow the spec.
        see http://www.w3.org/TR/CSS2/tables.html#anonymous-boxes for details.

        Tests: fast/table/table-column-generates-anonymous-table.html
               fast/table/table-column-group-generates-anonymous-table.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::addChild):

2012-05-18  Keyar Hood  <keyar@chromium.org>

        Support imageSmoothingEnabled
        https://bugs.webkit.org/show_bug.cgi?id=82804

        Reviewed by Stephen White.

        Test: fast/canvas/canvas-imageSmoothingEnabled.html

        Added the imageSmoothingEnabled parameter to the
        CanvasRenderingContext2D object. When it is set to false, it sets
        InterpolationQuality to InterpolationNone. When set to true, it sets
        the InterpolationQuality to DefaultInterpolationQuality (as that is the
        only other value used).

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
        (WebCore::CanvasRenderingContext2D::webkitImageSmoothingEnabled):
        (WebCore):
        (WebCore::CanvasRenderingContext2D::setWebkitImageSmoothingEnabled):
        * html/canvas/CanvasRenderingContext2D.h:
        (CanvasRenderingContext2D):
        * html/canvas/CanvasRenderingContext2D.idl:

2012-05-18  Terry Anderson  <tdanderson@chromium.org>

        Percentage height replaced elements sometimes cause overflow of table contents
        https://bugs.webkit.org/show_bug.cgi?id=85581

        Reviewed by Eric Seidel.

        Test: fast/replaced/table-replaced-element.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        This change guarantees that the containing block of a replaced element with percentage
        height will be marked as having a percentage height descendant.

2012-05-18  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>

        [Qt] REGRESSION(r117501): It made almost all tests assert in debug mode
        https://bugs.webkit.org/show_bug.cgi?id=86854

        Reviewed by Andreas Kling.

        Initialize boolean flag in constructor and recheck the flag which can be 
        modified by another thread under mutex.

        No new tests, fixes regression that caused layout test crash.

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::IconDatabase):
        (WebCore::IconDatabase::syncThreadMainLoop):

2012-05-18  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] Web Intents code is not compiling
        https://bugs.webkit.org/show_bug.cgi?id=85364

        Reviewed by Adam Barth.

        Add missing implementation for
        JSIntentConstructor::constructJSIntent() in JS bindings.

        * CMakeLists.txt:
        * UseJSC.cmake:
        * bindings/js/JSIntentConstructor.cpp: Added.
        (WebCore):
        (WebCore::JSIntentConstructor::constructJSIntent):

2012-05-18  Joe Thomas  <joethomas@motorola.com>

        background-size specified by a single value in background shorthand fails to parse.
        https://bugs.webkit.org/show_bug.cgi?id=86739

        Reviewed by Tony Chang.

        While parsing the background shorthand property, if the second parsedValue is not a valid unit,
        parseFillSize should return the first parsedValue instead of failing.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFillSize):

2012-05-18  Tony Chang  <tony@chromium.org>

        remove the CSS_GRID_LAYOUT compiler define, but default grid layout to off
        https://bugs.webkit.org/show_bug.cgi?id=86767

        Reviewed by Ojan Vafai.

        We disable grid by ignoring the display type at CSS parse time.

        Test: fast/css-grid-layout/grid-disabled-by-default.html

        * Configurations/FeatureDefines.xcconfig:
        * css/CSSComputedStyleDeclaration.cpp: Remove compile checks.
        (WebCore):
        (WebCore::valueForGridPosition):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore::isValidKeywordPropertyAndValue): Move display into parseValue.
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue): Ignore while parsing if not enabled.
        (WebCore::CSSParser::parseGridTrackList):
        (WebCore::CSSParser::cssGridLayoutEnabled):
        (WebCore):
        * css/CSSParser.h:
        * css/CSSParserMode.h:
        (CSSParserContext):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * dom/Document.cpp:
        (WebCore::Document::cssGridLayoutEnabled): Added to keep track of whether grid is enabled or not.
        (WebCore):
        * dom/Document.h:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setCSSGridLayoutEnabled): Added.
        (WebCore::Settings::cssGridLayoutEnabled): Added.
        (Settings):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::createObject):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::RenderStyle):
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleGridData.cpp:
        * rendering/style/StyleGridData.h:
        * rendering/style/StyleGridItemData.cpp:
        * rendering/style/StyleGridItemData.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (WebCore):
        (StyleRareNonInheritedData):

2012-05-18  Martin Robinson  <mrobinson@igalia.com>

        OOM running webgl/sdk/tests/conformance/context/context-creation-and-destruction.html
        https://bugs.webkit.org/show_bug.cgi?id=80509

        Reviewed by Alejandro G. Castro.

        No new tests. This is covered by by context-creation-and-destruction.html
        Khronos conformance test which will be part of the WebKit repository once
        bug 44310 is closed.

        Rework the ownership of GLContexts. Instead of having them managed by the
        state of window mapping or removed by calling a static method, always have
        them owned by the callers. This makes all GLContext creators factory methods
        that return PassOwnPtr.

        This change also switches the sharing context for a WebView from the window
        context to a global shared context. This simplifies things greatly, allowing
        the removal of GLContextGtk and makes the factory change easier.

        * GNUmakefile.list.am: Remove GLContextGtk.cpp from the source list.
        * platform/graphics/cairo/GLContext.cpp:
        (WebCore::GLContext::sharingContext): Added, getter for the global sharing context.
        (WebCore::GLContext::createContextForWindow): Added, a factory method for creating
        window contexts.
        (WebCore::GLContext::createOffscreenContext): Allow passing a sharing context here.
        (WebCore::GLContext::makeContextCurrent): Assert that this is the main thread, to
        increase the guarantee that we are only using these contexts on the main thread.
        (WebCore::GLContext::getCurrent): Ditto.
        * platform/graphics/cairo/GLContext.h: Update the above method signatures and remove
        createOffscreenContext, which has just been subsumed into the other factory methods.
        * platform/graphics/cairo/GraphicsContext3DCairo.cpp: The HostWindow is no longer needed
        to get the sharing context, so we can simplify things quite a bit and make a platform
        independent implementation here.
        * platform/graphics/cairo/GraphicsContext3DPrivate.cpp: Ditto.
        * platform/graphics/glx/GLContextGLX.cpp: Modify all the factory methods to return PassOwnPtr.
        * platform/graphics/glx/GLContextGLX.h: Ditto.
        * platform/graphics/gtk/GLContextGtk.cpp: Removed.

2012-05-18  Pablo Flouret  <pablof@motorola.com>

        Script elements inserted while fragment parsing should have their "already started" flag set.
        https://bugs.webkit.org/show_bug.cgi?id=86376

        Reviewed by Ryosuke Niwa.

        Step 3 of:
        http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#scriptTag

        Test: fast/parser/script-already-started-flag-in-fragment-parsing-mode.html

        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::create):
        * html/HTMLScriptElement.h:
        (HTMLScriptElement):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertScriptElement):

2012-05-18  Shezan Baig  <shezbaig.wk@gmail.com>

        Expose FrameSelection::absoluteCaretBounds via window.internals
        https://bugs.webkit.org/show_bug.cgi?id=86390

        Reviewed by Ryosuke Niwa.

        Add 'absoluteCaretBounds' method to Internals, which returns the
        FrameSelection::absoluteCaretBounds.

        Test: editing/selection/internal-caret-rect.html

        * WebCore.exp.in: Export the necessary symbols.
        * testing/Internals.cpp:
        (WebCore::Internals::absoluteCaretBounds): Implementation of new method.
        (WebCore):
        * testing/Internals.h: Declare the new method.
        (Internals):
        * testing/Internals.idl: Declare the new method.

2012-05-18  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11467250> No focus ring around popup buttons

        Reviewed by Anders Carlsson.

        The exact same issue was fixed for buttons drawn in ThemeMac.mm in <rdar://problem/10542095>.
        This change extends the fix to also cover buttons drawn in RenderThemeMac.mm.

        * WebCore.xcodeproj/project.pbxproj: Added WebCoreNSCellExtras.{h.m}.
        * platform/mac/ThemeMac.mm: Removed the definitions of BUTTON_CELL_DRAW_WITH_FRAME_DRAWS_FOCUS_RING
        and -[NSCell _web_drawFocusRingWithFrame:inView:] from here. They are now in WebCoreNSCellExtras.
        * platform/mac/WebCoreNSCellExtras.h: Added.
        * platform/mac/WebCoreNSCellExtras.m: Added.
        (-[NSCell _web_drawFocusRingWithFrame:inView:]): Moved from ThemeMac.mm here.
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintMenuList): Changed to use -_web_drawFocusRingWithFrame:inView:.
        (WebCore::RenderThemeMac::setPopupButtonCellState): Removed call to updateFocusedState() when
        the focus ring is drawn separately.

2012-05-18  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Fix early return of the mimeTypeCache function after r117207.

        Rubber-stamped by Martin Robinson.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp: Set
        typeListInitialized to true after the cache has been filled so
        that next call to the function goes through the early return path.

2012-05-18  Martin Robinson  <mrobinson@igalia.com>

        Get IndexedDB closer to building for GTK+.

        Reviewed by Philippe Normand.

        No new tests. This is only a build fix.

        * GNUmakefile.am: Add the appropriate option to enable LevelDB support.
        * GNUmakefile.list.am: Add missing indexed database files to the source list.

2012-05-18  Dan Bernstein  <mitz@apple.com>

        Removed stale references in the Xcode project after r117369.

        * WebCore.xcodeproj/project.pbxproj: Removed references to CSSStyleDeclaration.cpp.

2012-05-18  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Add resource to UISourceCode constructor.
        https://bugs.webkit.org/show_bug.cgi?id=86853

        Reviewed by Pavel Feldman.

        This is a first step of merging resource revision support into UISourceCode.

        * inspector/front-end/CompilerScriptMapping.js:
        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource):
        * inspector/front-end/DebuggerScriptMapping.js:
        (WebInspector.DebuggerScriptMapping.prototype._debuggerReset):
        * inspector/front-end/JavaScriptSource.js:
        * inspector/front-end/RawSourceCode.js:
        (WebInspector.RawSourceCode.prototype._createUISourceCode):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.addScript):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.isAnonymousScript):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
        (WebInspector.SnippetJavaScriptSource):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSource):
        (WebInspector.StyleSourceFrame):
        (WebInspector.StyleSourceFrame.prototype.commitEditing):
        (WebInspector.StyleSourceFrame.prototype.afterTextChanged):
        (WebInspector.StyleSourceFrame.prototype._contentChanged):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.UISourceCode.prototype.resource):

2012-05-18  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: error when expanding an HTMLAllCollection object in the console
        https://bugs.webkit.org/show_bug.cgi?id=86741

        Reviewed by Pavel Feldman.

        RuntimeAgent.callFunctionOn should work correcly with arguments of type HTMLAllCollection.

        * inspector/InjectedScriptSource.js:

2012-05-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: resource revision content is not rendered properly. Resource content is shown instead.
        https://bugs.webkit.org/show_bug.cgi?id=86856

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/ResourceView.js:
        (WebInspector.ResourceRevisionSourceFrame):
        (WebInspector.ResourceRevisionSourceFrame.prototype.get resource):

2012-05-18  Yi Shen  <yi.4.shen@nokia.com>

        REGRESSION (r102553): Smart links do not work
        https://bugs.webkit.org/show_bug.cgi?id=85463

        Reviewed by NOBODY Ryosuke Niwa.

        To fix the regression of smart links, we need to check TextCheckingTypeLink option in
        Editor::markAndReplaceFor().

        Test: editing/inserting/typing-space-to-trigger-smart-link.html

        * editing/Editor.cpp:
        (WebCore::Editor::markAndReplaceFor):

2012-05-18  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: empty CSS Declaration is generated by clicking the left space of 'user agent stylesheet' on Styles sidebar of Elements panel
        https://bugs.webkit.org/show_bug.cgi?id=86850

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype._handleSelectorContainerClick):

2012-05-18  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Remove console.error() call committed by mistake.

        * inspector/front-end/View.js:
        (WebInspector.View._assert):

2012-05-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: live edit resets cursor to 0,0
        https://bugs.webkit.org/show_bug.cgi?id=86851

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource):

2012-05-18  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: exception in console when pressing % button in CPU profile view
        https://bugs.webkit.org/show_bug.cgi?id=86849

        Reviewed by Pavel Feldman.

        Use root node to get children, not DataGrid object.

        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileView.prototype.refreshVisibleData):

2012-05-18  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: remove unnecessary indirection from profile types
        https://bugs.webkit.org/show_bug.cgi?id=86845

        Reviewed by Pavel Feldman.

        Introduced CSSProfileHeader and CPUProfileHeader, moved view creation from
        the type to corresponding profile headers. Removed some inderection and
        private fields assigned in random places. Added type annotations.

        * inspector/front-end/CPUProfileView.js:
        (WebInspector.CPUProfileType.prototype.createTemporaryProfile):
        (WebInspector.CPUProfileType.prototype.createProfile):
        (WebInspector.CPUProfileHeader):
        (WebInspector.CPUProfileHeader.prototype.createSidebarTreeElement):
        (WebInspector.CPUProfileHeader.prototype.createView):
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.stopRecordingProfile):
        (WebInspector.CSSSelectorProfileType.prototype.createTemporaryProfile):
        (WebInspector.CSSSelectorProfileType.prototype.createProfile):
        (WebInspector.CSSProfileHeader):
        (WebInspector.CSSProfileHeader.prototype.createSidebarTreeElement):
        (WebInspector.CSSProfileHeader.prototype.createView):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotProfileType.prototype.createTemporaryProfile):
        (WebInspector.HeapSnapshotProfileType.prototype.createProfile):
        (WebInspector.HeapProfileHeader):
        (WebInspector.HeapProfileHeader.prototype.createSidebarTreeElement):
        (WebInspector.HeapProfileHeader.prototype.createView):
        (WebInspector.HeapProfileHeader.prototype.load):
        (WebInspector.HeapProfileHeader.prototype.saveToFile):
        * inspector/front-end/ProfileLauncherView.js:
        (WebInspector.ProfileLauncherView):
        (WebInspector.ProfileLauncherView.prototype.addProfileType):
        (WebInspector.ProfileLauncherView.prototype._profileTypeChanged):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType):
        (WebInspector.ProfileHeader):
        (WebInspector.ProfileHeader.prototype.profileType):
        (WebInspector.ProfileHeader.prototype.createSidebarTreeElement):
        (WebInspector.ProfileHeader.prototype.existingView):
        (WebInspector.ProfileHeader.prototype.view):
        (WebInspector.ProfileHeader.prototype.createView):
        (WebInspector.ProfilesPanel.prototype._reset):
        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
        (WebInspector.ProfilesPanel.prototype._removeProfileHeader):
        (WebInspector.ProfilesPanel.prototype.showProfile):
        (WebInspector.ProfilesPanel.prototype.getProfiles):
        (WebInspector.ProfilesPanel.prototype.findTemporaryProfile):
        (WebInspector.ProfilesPanel.prototype._searchableViews):
        * inspector/front-end/View.js:
        (WebInspector.View._assert):

2012-05-18  Kentaro Hara  <haraken@chromium.org>

        [V8][Refactoring] Remove V8Proxy::throwError(const char*, ErrorType, v8::Isolate*=0)
        https://bugs.webkit.org/show_bug.cgi?id=86802

        Reviewed by Adam Barth.

        As commented here (https://bugs.webkit.org/show_bug.cgi?id=84074#c5),
        I am refactoring a series of confusing throwError()s. This would be
        the final patch for the refactoring.

        This patch removes V8Proxy::throwError(const char*, ErrorType, v8::Isolate*=0).
        Also this patch refactors up a couple of throwError()s that I've forgot to
        refactor in the previous patches.

        No tests. No change in behavior.

        * bindings/v8/V8NodeFilterCondition.cpp:
        (WebCore::V8NodeFilterCondition::acceptNode):
        * bindings/v8/V8Proxy.h:
        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):

2012-05-18  MORITA Hajime <morrita@google.com>

        Unreviewed attempt to fix build breakage on r117572

        * editing/Editor.cpp:
        (WebCore::Editor::willDetachPage):

2012-05-18  MORITA Hajime  <morrita@google.com>

        https://bugs.webkit.org/show_bug.cgi?id=85515
        Stale frame in WebCore::SpellChecker::didCheckSucceeded

        Reviewed by Ryosuke Niwa.

        Added EditorClient::frameWillDetachPage() notification to give a
        change to invalidate pending spellcheck requests on the client.

        Test: editing/spelling/spellcheck-async-remove-frame.html

        * editing/Editor.cpp:
        (WebCore::Editor::Editor):
        * editing/Editor.h:
        (Editor):
        * loader/EmptyClients.h:
        (WebCore::EmptyEditorClient::frameWillDetachPage):
        * page/EditorClient.h:
        (EditorClient):

2012-05-18  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: add ContentProvider::contentType and use it when rendering navigator tree.
        https://bugs.webkit.org/show_bug.cgi?id=86833

        Reviewed by Vsevolod Vlasov.

        Added ContentProvider::contentType, regactored NavigatorView to use the icon defined by the content type.

        * inspector/front-end/CompilerScriptMapping.js:
        * inspector/front-end/ContentProvider.js:
        (WebInspector.ContentProvider.prototype.contentType):
        * inspector/front-end/ContentProviders.js:
        (WebInspector.ConcatenatedScriptsContentProvider.prototype.contentType):
        (WebInspector.CompilerSourceMappingContentProvider):
        (WebInspector.CompilerSourceMappingContentProvider.prototype.contentType):
        (WebInspector.CompilerSourceMappingContentProvider.prototype.requestContent):
        (WebInspector.StaticContentProvider):
        (WebInspector.StaticContentProvider.prototype.contentType):
        (WebInspector.StaticContentProvider.prototype.requestContent):
        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorTreeOutline.prototype.scriptTreeElements):
        (WebInspector.NavigatorSourceTreeElement):
        * inspector/front-end/NetworkRequest.js:
        (WebInspector.NetworkRequest.prototype.contentType):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype.contentType):
        (WebInspector.Resource.prototype.canonicalMimeType):
        (WebInspector.ResourceRevision.prototype.contentType):
        * inspector/front-end/ResourceType.js:
        (WebInspector.ResourceType.prototype.toString):
        (WebInspector.ResourceType.prototype.canonicalMimeType):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.contentType):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.SnippetContentProvider):
        * inspector/front-end/StylesPanel.js:
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.contentType):
        * inspector/front-end/navigatorView.css:
        (.navigator-stylesheet-tree-item .icon):
        (.navigator-document-tree-item .icon):

2012-05-18  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r117556.
        http://trac.webkit.org/changeset/117556
        https://bugs.webkit.org/show_bug.cgi?id=86825

        Wrong fix. IE still adds 1px padding. We're missing that in
        textarea (Requested by rniwa on #webkit).

        * css/html.css:
        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):

2012-05-17  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: remove File abstraction from the AdvancedSearchController, migrate it to UISourceCode.
        https://bugs.webkit.org/show_bug.cgi?id=86809

        Reviewed by Yury Semikhatsky.

        This change migrates AdvancedSearchController from "Object" to "UISourceCode".
        I don't see why we need this abstraction and as a side effect, it makes search
        across scripts work for styles.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.SearchResult):
        (WebInspector.FileBasedSearchResultsPane.prototype._createAnchor):
        (WebInspector.FileBasedSearchResultsPane.prototype.addSearchResult):
        (WebInspector.FileBasedSearchResultsPane.prototype._appendSearchMatches):
        (WebInspector.FileBasedSearchResultsPane.prototype._regexMatchRanges):
        (WebInspector.FileBasedSearchResultsPane.SearchResult):
        * inspector/front-end/ScriptsSearchScope.js:
        (WebInspector.ScriptsSearchScope.prototype.createSearchResultsPane):
        * inspector/front-end/inspector.js:
        (WebInspector._registerShortcuts):

2012-05-17  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add an option to show last N hidden children of node in heap profiler
        https://bugs.webkit.org/show_bug.cgi?id=86757

        Reviewed by Pavel Feldman.

        Renamed "Show next N" to "Show N before" and added "Show N after" button. Also
        when all 3 buttons would have equal effect there is now only "Show all N" button.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/ShowMoreDataGridNode.js:
        (WebInspector.ShowMoreDataGridNode):
        (WebInspector.ShowMoreDataGridNode.prototype._showLastChunk):
        (WebInspector.ShowMoreDataGridNode.prototype._updateLabels):
        (WebInspector.ShowMoreDataGridNode.prototype.createCells):

2012-05-17  Ryosuke Niwa  <rniwa@webkit.org>

        WebKit erroneously add 1px padding in input elements
        https://bugs.webkit.org/show_bug.cgi?id=86784

        Reviewed by Kent Tamura.

        Fixed the bug by removing the code that added left and right paddings in input elements.
        The code was added in r13567 to match a very old version of Internet Explorer but this quirk
        does not seem to exists in IE9 (both in quirks and standard modes).

        A lot of tests need to be rebaselined due to 1px difference inside input elements, and 2px
        differences for the width of input elements. (In some extreme cases, line breaking changed
        due to the width change).

        Test: fast/forms/input-textarea-padding-match.html

        * css/html.css:
        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):

2012-05-18  Zalan Bujtas  <zbujtas@gmail.com>

        [Qt] Gesture tap highlighter needs to take overflow clip into account.
        https://bugs.webkit.org/show_bug.cgi?id=84989

        Reviewed by Kenneth Rohde Christiansen.

        Apply overflow clip on the focus ring if needed.

        Follow up patches are needed to address the following cases.

        [Qt] Gesture tap highlighter should take parent iframe's transform into account.
        https://bugs.webkit.org/show_bug.cgi?id=86645

        [Qt] Gesture tap highlighter needs to take frame clipping into account.
        https://bugs.webkit.org/show_bug.cgi?id=86646

        [Qt] Gesture tap highlighter's overflow clip is not always correct when
        nested enclosing containers have transforms.
        https://bugs.webkit.org/show_bug.cgi?id=86641

        Manual test: ManualTests/qt/tap-highlighting-overflow-hidden.html

        * page/GestureTapHighlighter.cpp:
        (WebCore::GestureTapHighlighter::pathForNodeHighlight):

2012-05-17  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] KURL::fileSystemPath() should strip the query of the uri
        https://bugs.webkit.org/show_bug.cgi?id=86721

        Reviewed by Martin Robinson.

        * platform/gtk/KURLGtk.cpp:
        (WebCore::KURL::fileSystemPath): Use the already parsed path to
        create the GFile instead of the whole URL string. The parsed path
        doesn't include neither the fragment (#) nor the query (?) parts.

2012-05-17  Kentaro Hara  <haraken@chromium.org>

        [V8][Refactoring] Remove V8Proxy::deletionNotHandledByInterceptor()
        https://bugs.webkit.org/show_bug.cgi?id=86803

        Reviewed by Dimitri Glazkov.

        V8Proxy::deletionNotHandledByInterceptor() is used by V8StorageCustom.cpp
        only, just in order to return v8::Handle<v8::Boolean>(). In such cases,
        other custom bindings are hard-coding 'return v8::Handle<v8::Boolean>()'.
        Thus we can hard-code 'return v8::Handle<v8::Boolean>()' in V8StorageCustom.cpp
        too, and remove V8Proxy::deletionNotHandledByInterceptor().

        No tests. No change in behavior.

        * bindings/v8/V8Proxy.h:
        * bindings/v8/custom/V8StorageCustom.cpp:
        (WebCore::storageDeleter):

2012-05-17  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: speed-up markQueriableHeapObjects function.
        https://bugs.webkit.org/show_bug.cgi?id=86732

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._flagsOfNode):
        (WebInspector.HeapSnapshot.prototype._markDetachedDOMTreeNodes):
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
        (WebInspector.HeapSnapshot.prototype._calculateFlags):

2012-05-15  Kinuko Yasuda  <kinuko@chromium.org>

        Some Spelling Mistakes Result in Compile Errors with ENABLE(FILE_SYSTEM) in LocalFileSystem.cpp
        https://bugs.webkit.org/show_bug.cgi?id=86103

        Reviewed by Rob Buis.

        Added build fixes and some (limited) common implementation for non-chromium ports.

        No new tests as this should have no functionality changes.

        * Modules/filesystem/DOMFileSystemBase.cpp:
        (WebCore::DOMFileSystemBase::isValidType): Added common implementation for non-chromium ports.
        (WebCore::DOMFileSystemBase::crackFileSystemURL): Ditto.
        (WebCore::DOMFileSystemBase::supportsToURL): Ditto.
        (WebCore::DOMFileSystemBase::createFileSystemURL): Ditto.
        * Modules/filesystem/LocalFileSystem.cpp:
        (WebCore::LocalFileSystem::readFileSystem): Fixed.
        (WebCore::LocalFileSystem::requestFileSystem): Fixed.
        * platform/blackberry/AsyncFileSystemBlackBerry.cpp:
        (WebCore::AsyncFileSystem::openFileSystem): Fixed.
        * platform/gtk/AsyncFileSystemGtk.cpp:
        (WebCore::AsyncFileSystem::openFileSystem): Fixed.

2012-05-17  Wei James  <james.wei@intel.com>

        AudioBufferSourceNode and MediaElementAudioSourceNode should support multi-channel > stereo
        https://bugs.webkit.org/show_bug.cgi?id=75119

        Reviewed by Chris Rogers.

        As multiple channel support in AudioBus and other places is already
        implemented, the check can be removed here.  

        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
        (WebCore::MediaElementAudioSourceNode::setFormat):

2012-05-17  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11419933> Problems with flipped writing modes and compositing
        https://bugs.webkit.org/show_bug.cgi?id=86032

        Reviewed by Anders Carlsson.

        Test: compositing/bounds-in-flipped-writing-mode.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateLayerBounds): Apply a writing-mode flip to the bounding box
        if needed.

2012-05-17  Kentaro Hara  <haraken@chromium.org>

        [V8][Refactoring] Remove V8Proxy::throwError(const char*, v8::Isolate* = 0)
        https://bugs.webkit.org/show_bug.cgi?id=86794

        Reviewed by Adam Barth.

        As commented here (https://bugs.webkit.org/show_bug.cgi?id=84074#c5),
        I am refactoring a series of confusing throwError()s.
        This patch removes V8Proxy::throwError(const char*, v8::Isolate* = 0).

        No tests. No change in behavior.

        * bindings/v8/V8Utilities.cpp:
        (WebCore::extractTransferables):
        (WebCore::getMessagePortArray):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp:
        (WebCore::V8AudioBufferSourceNode::bufferAccessorSetter):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::setDragImageCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::openCallback):
        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionStartAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorSetter):
        (WebCore::V8HTMLInputElement::setSelectionRangeCallback):
        * bindings/v8/custom/V8HTMLMediaElementCustom.cpp:
        (WebCore::V8HTMLMediaElement::controllerAccessorSetter):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):

2012-05-17  Dana Jansens  <danakj@chromium.org>

        [chromium] Scale all compositor output by the defaultDeviceScaleFactor
        https://bugs.webkit.org/show_bug.cgi?id=86051

        Reviewed by James Robinson.

        On initialization, give the defaultDeviceScaleFactor to the compositor
        to have it scale all output from WebCore's layout size to physical
        pixels. This allows us to scale up to high-dpi devices without using
        fixed-layout, so we can leave the WebCore frame size in layout pixels,
        while drawing the frame into a larger physical pixel size.

        CCLayerTreeHost becomes aware of the deviceScaleFactor and scales all
        output by this factor by scaling the viewport and all drawing
        transforms.

        Anything that works in physical pixels (content space), uses the
        deviceViewportSize() in place of the viewportSize(), since when
        deviceScaleFactor != 1 in CCLayerTreeHost, the WebCore viewport
        is no longer physical pixels.

        Scroll positions are in layout pixels, and must be scaled to/from
        content space within the compositor.

        Unit tests: CCLayerTreeHostTestDeviceScaleFactorScalesViewportAndLayers

        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromiumClient):
        (WebCore::LayerRendererChromium::viewportSize):
        (WebCore::LayerRendererChromium::viewportWidth):
        (WebCore::LayerRendererChromium::viewportHeight):
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::setViewportSize):
        (WebCore::CCLayerTreeHost::updateLayers):
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCSettings::CCSettings):
        (CCSettings):
        (CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::deviceViewportSize):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::CCLayerTreeHostImpl::setViewportSize):
        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
        (WebCore::CCLayerTreeHostImpl::scrollBegin):
        (WebCore::CCLayerTreeHostImpl::computePinchZoomDeltas):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore::CCLayerTreeHostImpl::viewportSize):
        (CCLayerTreeHostImpl):

2012-05-17  Hayato Ito  <hayato@chromium.org>

        [Shadow DOM] Add an assertion to make sure a visited node is not an active insertion point.
        https://bugs.webkit.org/show_bug.cgi?id=86708

        Reviewed by Eric Seidel.

        Since InsertionPoint now has isActive() member function,
        we can add an assertion to ComposedShadowTreeWalker::assertPrecondition()
        using that function.

        No new tests, no change in behavior.

        * dom/ComposedShadowTreeWalker.h:
        (WebCore::ComposedShadowTreeWalker::assertPrecondition):

2012-05-17  Ami Fischman  <fischman@chromium.org>

        [Chromium] Store HTTP version in WebURLResponse
        https://bugs.webkit.org/show_bug.cgi?id=86522

        Reviewed by Adam Barth.

        No new tests; this isn't exposed to the web platform.

        * platform/chromium/support/WebURLResponse.cpp:
        (WebKit::WebURLResponse::httpVersion):
        (WebKit):
        (WebKit::WebURLResponse::setHTTPVersion):
        * platform/network/chromium/ResourceResponse.h:
        (ResourceResponse):
        (WebCore::ResourceResponse::ResourceResponse):
        (WebCore::ResourceResponse::httpVersion):
        (WebCore::ResourceResponse::setHTTPVersion):

2012-05-17  Levi Weintraub  <leviw@chromium.org>

        Floor y coordinate in Chromium's GraphicsContext::drawLineForText to avoid anti-aliasing
        https://bugs.webkit.org/show_bug.cgi?id=86775

        Reviewed by Eric Seidel.

        Despite operating in floats, we always want to draw lines for text aligned to pixel boundaries.
        There are similar functions to do this in other platforms, but to get proper results, we only
        need to floor the y value, as we always draw these lines horizontally.

        No tests. No change in behavior prior to sub-pixel change.

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForText):

2012-05-17  Michael Moss  <mmoss@chromium.org>

        Linux amd64 platform reported as i686
        https://bugs.webkit.org/show_bug.cgi?id=86778
        http://code.google.com/p/chromium/issues/detail?id=128167

        Remove the old hard-coded gyp define and allow the more recent (but
        still quite old) code in Source/WebCore/page/NavigatorBase.cpp to take
        precedence and detect this at runtime.

        Reviewed by Tony Chang.

        No new tests because it's hardware dependent.

        * WebCore.gyp/WebCore.gyp:

2012-05-17  Vangelis Kokkevis  <vangelis@chromium.org>

        [chromium] Expose layer tiling size options to WebSettings.
        https://bugs.webkit.org/show_bug.cgi?id=86425

        Removing hardcoded tile size and max untiled layer size from TiledLayerChromium
        and instead have the values passed in via the LTH CCSettings. This will allow
        different compositor instances to adjust tiling parameters as needed and makes
        it possible to set the values via command line arguments.

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::TiledLayerChromium):
        (WebCore::TiledLayerChromium::updateTileSizeAndTilingOption):
        Made some additional adjustments to the single-tile heuristic
        to make it work better with arbitrary sizes while still avoiding
        to create unreasonably large layers.
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCSettings::CCSettings):
        (CCSettings):

2012-05-17  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        Memory leak in NetworkInfoClient
        https://bugs.webkit.org/show_bug.cgi?id=86603

        Reviewed by Adam Barth.

        Fix a memory leak in NetworkInfoClient by using OwnPtr and
        change the class not to inherite from RefCounted.

        * Modules/networkinfo/NetworkInfoClient.h:

2012-05-17  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Remove IDBIndex.storeName
        https://bugs.webkit.org/show_bug.cgi?id=86676

        Reviewed by Tony Chang.

        Older versions of the IDB spec exposed IDBIndex.storeName. While it's been removed
        from the IDL, the additional storage/plumbing are unnecessary clutter. Nuke it!

        No new tests - no functional changes.

        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl): Remove storeName parameter, and
        const declaration on object store param. The former was used to get a non-const pointer
        via indirection in openCursorInternal.
        (WebCore::IDBIndexBackendImpl::openCursorInternal): Use store pointer directly, don't
        look it up by name in the transaction.
        * Modules/indexeddb/IDBIndexBackendImpl.h:
        (WebCore::IDBIndexBackendImpl::create): Remove storeName parameters.
        (IDBIndexBackendImpl): Remove storeName() method.
        * Modules/indexeddb/IDBIndexBackendInterface.h:
        (IDBIndexBackendInterface): Remove storeName parameter.
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::createIndex): Remove storeName parameter.
        (WebCore::IDBObjectStoreBackendImpl::loadIndexes): Remove storeName parameter.

2012-05-17  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Implement IDBObjectStore.autoIncrement
        https://bugs.webkit.org/show_bug.cgi?id=86662

        Reviewed by Dimitri Glazkov.

        Simple boolean accessor defined in the IDB spec, which reflects the
        object store's internal autoIncrement flag.

        Test: storage/indexeddb/objectstore-basics.html

        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::autoIncrement): Forward call to back end.
        (WebCore):
        * Modules/indexeddb/IDBObjectStore.h: Expose attribute as method.
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStore.idl: Define the attribute.
        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Expose in interface.
        (IDBObjectStoreBackendInterface):

2012-05-17  Kentaro Hara  <haraken@chromium.org>

        [V8][Refactoring] Remove throwError("message", XXXError) from CodeGeneratorV8.pm
        https://bugs.webkit.org/show_bug.cgi?id=86744

        Reviewed by Adam Barth.

        As commented in https://bugs.webkit.org/show_bug.cgi?id=84074#c5,
        I am refactoring a series of confusing throwError()s.

        This patch removes throwError("message", XXXError) in CodeGeneratorV8.pm
        and replaces it with throwTypeError("message") or throwError(XXXError, "message").

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateParametersCheck):
        (GenerateConstructorCallback):
        (GenerateEventConstructorCallback):
        (GenerateNamedConstructorCallback):
        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
        (WebCore::V8TestEventConstructor::constructorCallback):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::V8TestInterface::constructorCallback):
        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
        (WebCore::V8TestNamedConstructorConstructorCallback):
        * bindings/scripts/test/V8/V8TestNode.cpp:
        (WebCore::V8TestNode::constructorCallback):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::optionsObjectCallback):
        (WebCore::V8TestObj::constructorCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback):
        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):

2012-05-17  Gregg Tavares  <gman@google.com>

        Add more descriptive warnings for framebuffer incomplete conditions
        https://bugs.webkit.org/show_bug.cgi?id=86774

        Reviewed by Kenneth Russell.

        No new tests as there is no new functionality

        * html/canvas/WebGLFramebuffer.cpp:
        (WebCore::WebGLFramebuffer::checkStatus):
        (WebCore::WebGLFramebuffer::onAccess):
        (WebCore::WebGLFramebuffer::initializeRenderbuffers):
        * html/canvas/WebGLFramebuffer.h:
        (WebGLFramebuffer):
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::checkFramebufferStatus):
        (WebCore::WebGLRenderingContext::clear):
        (WebCore::WebGLRenderingContext::copyTexImage2D):
        (WebCore::WebGLRenderingContext::copyTexSubImage2D):
        (WebCore::WebGLRenderingContext::drawArrays):
        (WebCore::WebGLRenderingContext::drawElements):
        (WebCore::WebGLRenderingContext::readPixels):
        (WebCore::WebGLRenderingContext::printGLWarningToConsole):
        * html/canvas/WebGLRenderingContext.h:

2012-05-17  Oliver Hunt  <oliver@apple.com>

        Endeavour to make the windows test bot actually able to run tests.
        https://bugs.webkit.org/show_bug.cgi?id=86772

        Reviewed by Sam Weinig.

        Use WEBKIT_EXPORT to get correct export behaviour on windows, rather than
        relying on the .def files.

        * bindings/js/JSDOMGlobalObject.h:
        (JSDOMGlobalObject):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):

2012-05-17  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86266
        r112643/r116697 break Webview form input fields
        -and corresponding-
        <rdar://problem/11400430>

        Reviewed by Dan Bernstein.

        There is a recent history of changes in this are that seem worth documenting. 
        First was the change to switch to using NSTextFieldCell to draw text fields: 
        http://trac.webkit.org/changeset/104240

        That led to problems because of the clear background that I thought at the time 
        were specific to MountainLion. To fix that, I made this change:
        http://trac.webkit.org/changeset/110480

        But that change resulted in styled text fields getting an un-themed border, which 
        led to this change on the branch: http://trac.webkit.org/changeset/112643 and a 
        change on TOT that was identical for Lion and SnowLeopard but introduced new 
        behavior for MountainLion: http://trac.webkit.org/changeset/116697

        And that brings us to this bug, where it turns out the clear background is a 
        problem on Lion and SnowLeopard too. This patch fixes the bug by using the 
        original WebCoreSystemInterface function to paint all text fields on Lion and 
        SnowLeopard that are styled. This is what we used to paint all text fields before 
        r104240, which is the first change listed above. Un-styled text fields will still 
        use NSTextFieldCell on these platforms, but with a hardcoded white background. 
        * rendering/RenderThemeMac.h:
        (RenderThemeMac):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintTextField):
        (WebCore::RenderThemeMac::textField):

2012-05-15  Andreas Kling  <kling@webkit.org>

        IconDatabase: Move icon retain/release off of the main thread.
        <http://webkit.org/b/85799>
        <rdar://problem/9507113>

        Reviewed by Brady Eidson.

        Batch up the retain/release operations and execute them as part of the sync thread loop.
        The batch execution is guarded by a new mutex (m_urlsToRetainOrReleaseLock.)
        This avoids blocking the main thread on m_urlAndIconLock for basic retain/release.

        There is one exception; if there are pending retain/release operations in synchronousIconForPageURL,
        it will acquire the lock and flush the operations.

        There should be no behavior change, this is only meant to reduce lock contention.

        * loader/icon/PageURLRecord.h:
        (WebCore::PageURLRecord::retain):
        (WebCore::PageURLRecord::release):

            Added a 'count' argument to these so we can batch up the operations in IconDatabase.

        * loader/icon/IconDatabase.h:
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::performScheduleOrDeferSyncTimer):
        (WebCore::IconDatabase::performScheduleOrDeferSyncTimerOnMainThread):
        (WebCore::IconDatabase::scheduleOrDeferSyncTimer):

            Perform the the timer scheduling on the main thread as it can be done on a different
            thread by way of retainIconForPageURL or releaseIconForPageURL.

        (WebCore::IconDatabase::synchronousIconForPageURL):
        (WebCore::IconDatabase::retainIconForPageURL):
        (WebCore::IconDatabase::performRetainIconForPageURL):
        (WebCore::IconDatabase::releaseIconForPageURL):
        (WebCore::IconDatabase::performReleaseIconForPageURL):
        (WebCore::IconDatabase::retainedPageURLCount):
        (WebCore::IconDatabase::IconDatabase):
        (WebCore::IconDatabase::performURLImport):
        (WebCore::IconDatabase::syncThreadMainLoop):
        (WebCore::IconDatabase::performPendingRetainAndReleaseOperations):

2012-05-17  Julien Chaffraix  <jchaffraix@webkit.org>

        Kill RenderLayer::relativePositionOffset(LayoutUnit& relX, LayoutUnit& relY) and cleanup RenderInline::clippedOverflowRectForRepaint
        https://bugs.webkit.org/show_bug.cgi?id=86551

        Reviewed by Abhishek Arya.

        No test since there is no expected change in behavior.

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::clippedOverflowRectForRepaint):
        Changed the function to use LayoutRect arithmetics instead of calculating
        top / left manually. While at it, improved the naming, removed some local
        variables and removed an unneeded style() NULL-check.

        * rendering/RenderLayer.h: Removed the function.

2012-05-17  Rob Buis  <rwlbuis@webkit.org>

        [BlackBerry] Fix linking errors
        https://bugs.webkit.org/show_bug.cgi?id=86768

        Reviewed by Antonio Gomes.

        Add some missing stubs so we can link again.

        * platform/blackberry/ContextMenuBlackBerry.cpp:
        (WebCore::ContextMenu::itemCount):
        (WebCore):
        * platform/blackberry/PlatformScreenBlackBerry.cpp:
        (WebCore::screenHorizontalDPI):
        (WebCore):
        (WebCore::screenVerticalDPI):

2012-05-17  Emil A Eklund  <eae@chromium.org>

        Fix rounding in paintSelection
        https://bugs.webkit.org/show_bug.cgi?id=86693

        Reviewed by Eric Seidel.

        Break out rounding logic from InlineTextBox::paintSelection into separate
        function and use it for all the EllipsisBox paintSelection implementation
        and selection gap calculation. This ensures that selections are painted
        without gaps and overlaps once we turn on subpixel layout.

        No new tests, covered by existing tests in editing/selection and
        editing/style.

        * rendering/EllipsisBox.cpp:
        (WebCore::EllipsisBox::paintSelection):
        * rendering/InlineTextBox.cpp:
        (WebCore::alignSelectionRectToDevicePixels):
        (WebCore):
        (WebCore::InlineTextBox::paintSelection):
        * rendering/InlineTextBox.h:
        (WebCore):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::logicalLeftSelectionGap):
        (WebCore::RenderBlock::logicalRightSelectionGap):

2012-05-17  Michal Mocny  <mmocny@google.com>

        [chromium] Limiting render surface texture manager memory to 0 when contentsMemoryUseBytes is large.
        https://bugs.webkit.org/show_bug.cgi?id=86764

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::beginDrawingFrame):

2012-05-17  Dan Bernstein  <mitz@apple.com>

        In vertical writing modes, pagination may split a line after a block shifts
        https://bugs.webkit.org/show_bug.cgi?id=86763

        Reviewed by Sam Weinig.

        Test: fast/multicol/pageLogicalOffset-vertical.html

        LayoutState::pageLogicalOffset() was returning bogus results in vertical writing modes,
        because it was always using physical heights. Changed it to take a RenderBox and use its
        writing mode to choose between heights and widths.

        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::pageLogicalOffset):
        (WebCore::LayoutState::addForcedColumnBreak):
        * rendering/LayoutState.h:
        (LayoutState):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlock):
        (WebCore::RenderBlock::markForPaginationRelayoutIfNeeded):
        (WebCore::RenderBlock::layoutColumns):
        (WebCore::RenderBlock::applyBeforeBreak):
        (WebCore::RenderBlock::applyAfterBreak):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::layout):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::layout):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):

2012-05-17  Abhishek Arya  <inferno@chromium.org>

        Move run-in handling to addChild, instead of in layout.
        https://bugs.webkit.org/show_bug.cgi?id=86387

        Reviewed by Julien Chaffraix.

        Tests: fast/runin/insert-before-run-in.html
               fast/runin/run-in-after-run-in.html
               fast/runin/run-in-parent-add-child.html
               fast/runin/run-in-parent-block-child-add-and-intrude.html
               fast/runin/run-in-parent-block-child-add.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): handle run-ins here
        instead of layout. We do run-in handling when we see a new child with run-in display
        or add a new block whose previous sibling is run-in.
        (WebCore::RenderBlock::makeChildrenNonInline): if we will have block children, need
        to move run-in back to its original position.
        (WebCore::RenderBlock::handleSpecialChild): no longer need to handle run-ins during layout.
        (WebCore::destroyRunIn): helper to destroy a block or inline run-in.
        (WebCore):
        (WebCore::RenderBlock::createReplacementRunIn): helper to create the new replacement run-in.
        For moveRunInUnderSiblingBlockIfNeeded, it will be used to create a new inline run-in
        that goes into the next sibling block. For moveRunInToOriginalPosition, it creates a new
        block run-in that goes back to where it came from.
        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded): almost same as previous
        handleRunInChild function, but with the return type removed. Also, we don't allow
        a run-in to intrude into a block that already has a run-in.
        (WebCore::RenderBlock::moveRunInToOriginalPosition): moves run-in back to where it came from.
        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderBox.cpp:
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderBoxModelObject.cpp: move all moveChild* functions from RenderBox, since
        they can now be used to move children of inlines.
        (WebCore::RenderBoxModelObject::moveChildTo): same.
        (WebCore):
        (WebCore::RenderBoxModelObject::moveChildrenTo): same.
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):
        (WebCore::RenderBoxModelObject::moveChildTo): same.
        (WebCore::RenderBoxModelObject::moveAllChildrenTo): same.
        (WebCore::RenderBoxModelObject::moveChildrenTo): same.

2012-05-17  Mikhail Naganov  <mnaganov@chromium.org>

        Support Copy ... actions for the Web Inspector remote debugging mode.
        https://bugs.webkit.org/show_bug.cgi?id=86621

        Reviewed by Pavel Feldman.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/InspectorFrontendHostStub.js:
        (.WebInspector.InspectorFrontendHostStub):
        (.WebInspector.InspectorFrontendHostStub.prototype.documentCopy):
        (.WebInspector.InspectorFrontendHostStub.prototype.copyText):
        (.WebInspector.clipboardAccessDeniedMessage):
        (.WebInspector.ClipboardAccessDeniedScreen):
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector.documentCopy):
        (WebInspector.documentCopyEventFired):

2012-05-02  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: table-height-algorithm-023 and -024 fail
        https://bugs.webkit.org/show_bug.cgi?id=85405

        Reviewed by Eric Seidel.

        Treat vertical-align: [length] the same as vertical-align: baseline.

        Tests: css2.1/20110323/table-height-algorithm-023.htm
               css2.1/20110323/table-height-algorithm-024.htm
               fast/table/mozilla-bug10296-vertical-align-1.html
               fast/table/mozilla-bug10296-vertical-align-2.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcRowLogicalHeight):
        (WebCore::RenderTableSection::layoutRows):

2012-05-17  Emil A Eklund  <eae@chromium.org>

        Fix rounding in RenderFlowThread::paintIntoRegion
        https://bugs.webkit.org/show_bug.cgi?id=86695

        Reviewed by Eric Seidel.

        Fix rounding of offset in paintIntoRegion to ensure that we paint on
        device pixel boundaries.

        Covered by existing tests in fast/regions.

        * platform/graphics/FractionalLayoutPoint.h:
        (WebCore::roundedIntPoint):
        Add roundedIntPoint(FractionalLayoutSize) function.
        (WebCore):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::paintIntoRegion):

2012-05-17  Andreas Kling  <kling@webkit.org>

        Parser: Avoid unnecessary ref count churn in token constructors.
        <http://webkit.org/b/86667>

        Reviewed by Antti Koivisto.

        Pass AtomicString by const reference to avoid useless ref count churn
        in AtomicHTMLToken() and AtomicXMLToken().

        * html/parser/HTMLToken.h:
        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
        * xml/parser/MarkupTokenBase.h:
        (WebCore::AtomicMarkupTokenBase::AtomicMarkupTokenBase):
        * xml/parser/XMLToken.h:
        (WebCore::AtomicXMLToken::AtomicXMLToken):

2012-05-16  Andreas Kling  <kling@webkit.org>

        Make PluginInfoStore properly thread-safe.
        <http://webkit.org/b/86648>
        <rdar://problem/11451178>

        Reviewed by Darin Adler.

        * plugins/PluginData.h:
        (WebCore::MimeClassInfo::isolatedCopy):
        (WebCore::PluginInfo::isolatedCopy):

2012-05-17  Hironori Bono  <hbono@chromium.org>

        [Refactoring] Move platform-specific code in Editor::respondToChangedSelection to the WebKit layer
        https://bugs.webkit.org/show_bug.cgi?id=86591

        Reviewed by Ryosuke Niwa.

        This change adds a TextCheckerClient::shouldEraseMarkersAfterChangeSelection
        function to remove platform-specific code from Editor::respondToChangedSelection
        function.

        No new tests, no change in behavior.

        * editing/Editor.cpp:
        (WebCore::Editor::respondToChangedSelection):
        * loader/EmptyClients.h:
        (WebCore::EmptyTextCheckerClient::shouldEraseMarkersAfterChangeSelection):
        * platform/text/TextCheckerClient.h:
        (TextCheckerClient):

2012-05-11  James Robinson  <jamesr@chromium.org>

        [chromium] Convert GraphicsLayerChromium to use WebLayer types
        https://bugs.webkit.org/show_bug.cgi?id=86269

        Reviewed by Adrienne Walker.

        This converts GraphicsLayerChromium over to use WebLayer and WebContentLayer. The conversion is not completely
        as the Web*Layer APIs are not yet quite complete enough to use everywhere, and the PlatformLayer typedef is not
        changed in this patch. The places where we have to punch out through API layer are marked by
        unwrap<*LayerChromium>() calls and FIXME's in the Web*Layer.h files.  There aren't many.

        Refactor only, existing tests apply.

        * platform/chromium/support/WebTransformationMatrix.cpp:
        (WebKit):
        (WebKit::WebTransformationMatrix::reset):
        (WebKit::WebTransformationMatrix::projectPoint):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
        (WebCore::GraphicsLayerChromium::willBeDestroyed):
        (WebCore::GraphicsLayerChromium::setName):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::removeFromParent):
        (WebCore::GraphicsLayerChromium::setSize):
        (WebCore::GraphicsLayerChromium::setTransform):
        (WebCore::GraphicsLayerChromium::setBackgroundColor):
        (WebCore::GraphicsLayerChromium::clearBackgroundColor):
        (WebCore::GraphicsLayerChromium::setContentsOpaque):
        (WebCore::GraphicsLayerChromium::setFilters):
        (WebCore::GraphicsLayerChromium::setMaskLayer):
        (WebCore::GraphicsLayerChromium::setBackfaceVisibility):
        (WebCore::GraphicsLayerChromium::setOpacity):
        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
        (WebCore::GraphicsLayerChromium::setContentsToImage):
        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::pauseAnimation):
        (WebCore::GraphicsLayerChromium::removeAnimation):
        (WebCore::GraphicsLayerChromium::suspendAnimations):
        (WebCore::GraphicsLayerChromium::resumeAnimations):
        (WebCore::GraphicsLayerChromium::setContentsToMedia):
        (WebCore::GraphicsLayerChromium::hostLayerForChildren):
        (WebCore::GraphicsLayerChromium::layerForParent):
        (WebCore::GraphicsLayerChromium::platformLayer):
        (WebCore::GraphicsLayerChromium::setDebugBackgroundColor):
        (WebCore::GraphicsLayerChromium::setDebugBorder):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::updateLayerPosition):
        (WebCore::GraphicsLayerChromium::updateLayerSize):
        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
        (WebCore::GraphicsLayerChromium::updateTransform):
        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
        (WebCore::GraphicsLayerChromium::updateMasksToBounds):
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
        (WebCore::GraphicsLayerChromium::updateLayerBackgroundColor):
        (WebCore::GraphicsLayerChromium::updateContentsRect):
        (WebCore::GraphicsLayerChromium::updateContentsScale):
        (WebCore::GraphicsLayerChromium::setupContentsLayer):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore::GraphicsLayerChromium::hasContentsLayer):
        (WebCore::GraphicsLayerChromium::contentsLayer):
        (WebCore::GraphicsLayerChromium::primaryLayer):
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):

2012-05-17  Tony Chang  <tony@chromium.org>

        remove bit rotted comment about css properties
        https://bugs.webkit.org/show_bug.cgi?id=86750

        Reviewed by Alexis Menard.

        It's not clear to me what the first block was even referring to.
        Aural doesn't seem to exist anymore. It might be worth keeping,
        "All the CSS properties are not supported by the renderer at the
        moment.", but it seems obvious to me.

        No new tests, just removing a comment.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):

2012-05-17  Adrienne Walker  <enne@google.com>

        Insert source file and line number for v8 function calls into tracing
        https://bugs.webkit.org/show_bug.cgi?id=84613

        Reviewed by Kentaro Hara.

        The trace for v8 function calls doesn't include any information about
        what function is being called. Pass this information along so it can
        be less opaque.

        * bindings/v8/V8Proxy.cpp:
        (WebCore::resourceInfo):
        (WebCore):
        (WebCore::resourceString):
        (WebCore::V8Proxy::instrumentedCallFunction):
        * platform/chromium/TraceEvent.h:
        (WebCore::TraceEvent::TraceStringWithCopy::TraceStringWithCopy):

2012-05-17  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        [Qt] REGRESSION(101967): It made editing/style/iframe-onload-crash-mac.html timeout
        https://bugs.webkit.org/show_bug.cgi?id=73802

        Reviewed by Ryosuke Niwa.

        Timeout was caused by an infinite in the outer loop of
        pushDownInlineStyleAroundNode(). The outer loop variable 'current' should point at the
        node containing 'targetNode'. The inner loop traverse the children of 'current'
        and discover the children that contains 'targetNode'.

        However, before the inner loop, we call removeInlineStyleFromElement() that can
        potentially remove the 'current' node from the tree, moving its children to
        'current' former parent. For that reason 'child' and 'lastChild' are collected
        before this call.

        The tricky part is that changing the 'current' children parent, we might trigger
        further side-effects, that can remove either 'child' or 'lastChild' from the tree
        too. The infinite loop was due to 'child' being off the document, so it's
        nextSibling() is 0, and we go another run of outer loop without changing
        'current' because the 'targetNode' wasn't in the first child that inner loop
        couldn't reach.

        When testing Qt on Mac, there was also a crash in RenderTextControl when the font
        family was empty, this patch fixes it as well.

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode): Use NodeVector
        instead of relying on first/last child being valid after
        removeInlineStyleFromElement() is called. Skip the child if it has no parent,
        this is an indication that it was removed from the tree.

        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::hasValidAvgCharWidth): Empty AtomicStrings aren't
        supported by HashSet, so we have to early return in this case.

2012-05-17  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: implement Go To selector for stylesheet files.
        https://bugs.webkit.org/show_bug.cgi?id=86751

        Reviewed by Yury Semikhatsky.

        StyleSheetOutlineDialog is introduced.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/FilteredItemSelectionDialog.js:
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createDebugToolbar):
        (WebInspector.ScriptsPanel.prototype._createButtonAndRegisterShortcuts):
        (WebInspector.ScriptsPanel.prototype._showOutlineDialog):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSheetOutlineDialog):
        (WebInspector.StyleSheetOutlineDialog.show):
        (WebInspector.StyleSheetOutlineDialog.prototype.itemTitleAt):
        (WebInspector.StyleSheetOutlineDialog.prototype.itemKeyAt):
        (WebInspector.StyleSheetOutlineDialog.prototype.itemsCount):
        (WebInspector.StyleSheetOutlineDialog.prototype.requestItems):
        (WebInspector.StyleSheetOutlineDialog.prototype.requestItems.didGetStyleSheet):
        (WebInspector.StyleSheetOutlineDialog.prototype.selectItem):
        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer.prototype._generateTabId):
        (WebInspector.TabbedEditorContainer.prototype.currentFile):

2012-05-17  Dan Bernstein  <mitz@apple.com>

        REGRESSION (r117428): WebKit API/SPI was removed
        https://bugs.webkit.org/show_bug.cgi?id=86748

        Reverted r117428.

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setMediaPlaybackRequiresUserGesture):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-17  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: create SourceFrames with content providers.
        https://bugs.webkit.org/show_bug.cgi?id=86742

        Reviewed by Vsevolod Vlasov.

        Simple refactoring.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
        * inspector/front-end/ResourceView.js:
        (WebInspector.ResourceSourceFrame):
        (WebInspector.ResourceSourceFrame.prototype.get resource):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame):
        (WebInspector.SourceFrame.prototype._ensureContentLoaded):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StyleSourceFrame):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.contentURL):

2012-05-17  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: error when expanding an HTMLAllCollection object in the console
        https://bugs.webkit.org/show_bug.cgi?id=86741

        Reviewed by Pavel Feldman.

        Test: inspector/console/inspect-html-all-collection.html

        * inspector/InjectedScriptSource.js: take into account that typeof HTMLAllCollection is "undefined"
        when checking if object resolved by id is valid.

2012-05-17  Kinuko Yasuda  <kinuko@chromium.org>

        Unreviewed build fix attempt. Changing class to struct in forward declaration.

        * fileapi/File.h:
        (WebCore):

2012-05-17  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: convert styles panel into UISourceCodeProvider in the scripts panel.
        https://bugs.webkit.org/show_bug.cgi?id=86734

        Reviewed by Vsevolod Vlasov.

        This change also makes Scripts render ans Source Code under that experiment.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.ScriptsNavigator):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.get toolbarItemLabel):
        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StylesUISourceCodeProvider):
        (WebInspector.StylesUISourceCodeProvider.prototype.uiSourceCodes):
        (WebInspector.StylesUISourceCodeProvider.prototype._initialize):
        (WebInspector.StylesUISourceCodeProvider.prototype._resourceAdded):
        (WebInspector.StylesUISourceCodeProvider.prototype._reset):
        (WebInspector.StyleSource):
        (WebInspector.StyleSourceFrame):
        (WebInspector.StyleSourceFrame.prototype.canEditSource):
        (WebInspector.StyleSourceFrame.prototype.requestContent):
        (WebInspector.StyleSourceFrame.prototype.commitEditing):
        (WebInspector.StyleSourceFrame.prototype.afterTextChanged):
        (WebInspector.StyleSourceFrame.prototype._clearIncrementalUpdateTimer):
        (WebInspector.StyleSourceFrame.prototype._contentChanged):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection):
        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode):
        * inspector/front-end/UISourceCode.js:
        * inspector/front-end/inspector.js:
        (WebInspector._createPanels):

2012-05-17  Antti Koivisto  <antti@apple.com>

        Frame flattening should not expand tiny frames
        https://bugs.webkit.org/show_bug.cgi?id=86736

        Reviewed by Kenneth Rohde Christiansen.
        
        If a frame has so small fixed size that it is not usefully scrollable on desktop it is probably
        not meant to be scrolled. Displaying any otherwise invisible content by expanding the frame
        may end up looking like a rendering error.

        The patch prevents expansion of frames that have fixed width or height less than 8px.

        Test: fast/frames/flattening/iframe-tiny.html

        * rendering/RenderFrameBase.cpp:
        (WebCore::shouldExpandFrame):
        (WebCore):
        (WebCore::RenderFrameBase::layoutWithFlattening):

2012-05-17  Yury Semikhatsky  <yurys@chromium.org>

        [Chromium] Web Inspector: assertion failure when inspecting a shared worker in debug mode
        https://bugs.webkit.org/show_bug.cgi?id=86726

        Reviewed by Pavel Feldman.

        No need to keep RefPtr to WorkerThread in a task that will be executed on
        that thread, raw pointer can be used instead.

        * inspector/WorkerDebuggerAgent.cpp:

2012-05-17  Kentaro Hara  <haraken@chromium.org>

        [V8][Refactoring] Support an optional 'message' argument for throwTypeError()
        https://bugs.webkit.org/show_bug.cgi?id=86576

        Reviewed by Adam Barth.

        As commented in https://bugs.webkit.org/show_bug.cgi?id=84074#c5,
        I am planning to refactor a series of confusing throwError()s into
        throwError() and throwTypeError().

        This patch supports an optional 'message' argument for V8Proxy::throwTypeError().
        Also this patch replaces throwError("message", V8Proxy::TypeError) in custom bindings
        with V8Proxy::throwTypeError("message").

        No tests. No change in behavior.

        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::throwTypeError):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
        (WebCore::V8DOMFormData::constructorCallback):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::constructorCallback):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
        (WebCore::V8MessageChannel::constructorCallback):
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::V8NotificationCenter::requestPermissionCallback):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::constructorCallback):
        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
        (WebCore::V8WebKitPoint::constructorCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::V8XMLHttpRequest::constructorCallback):

2012-05-16  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: [Extensions API] pages shown in sidebar are limited in height to 150px
        https://bugs.webkit.org/show_bug.cgi?id=86659

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionView):
        (WebInspector.ExtensionSidebarPane.prototype.setPage): set default iframe height to 150px, unless already set by user.
        * inspector/front-end/inspector.css: set extension view and iframe elements to "fill", iframe to 100% height.
        (iframe.extension):

2012-05-17  Sam D  <dsam2912@gmail.com>

        Web Inspector: Hover on a breakpoint in breakpoint-pane does not get differentiated.
        https://bugs.webkit.org/show_bug.cgi?id=86711

        Changed color values with background on hover over breakpoints.

        Reviewed by Yury Semikhatsky.

        UI change, No new tests.

        * inspector/front-end/inspector.css:
        (.breakpoint-list li:hover):

2012-05-17  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: DOM Breakpoints Pane should allow to Remove All the breakpoints
        https://bugs.webkit.org/show_bug.cgi?id=86716

        Reviewed by Yury Semikhatsky.

        Added a new context menu to provide Remove All DOM breakpoint option.

        UI Feature. Tests not required.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/DOMBreakpointsSidebarPane.js:
        (WebInspector.DOMBreakpointsSidebarPane.prototype._removeAllBreakpoints):
        (WebInspector.DOMBreakpointsSidebarPane.prototype._contextMenu):

2012-05-17  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapSnapshot: speed-up calculateObjectToWindowDistance
        https://bugs.webkit.org/show_bug.cgi?id=86718

        The idea is to switch from nodeIndex2distance array to nodeOrdinal2distance external array.
        Due to nature of nodeIndex values the original array was sparsed.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.get distanceToWindow):
        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
        (WebInspector.HeapSnapshot.prototype._bfs):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):

2012-05-11  Kinuko Yasuda  <kinuko@chromium.org>

        Allow FileSystem API implementation to pass snapshot metadata at File creation time
        https://bugs.webkit.org/show_bug.cgi?id=78879

        Reviewed by Jian Li.

        We query File metadata (e.g. size and modifiedTime) when File.size,
        lastModifiedTime or webkitSlice() is accessed / called, but in some
        platform-specific filesystems it may not be feasible since synchronous
        metadata query could take very long time.

        This patch adds new File constructor which takes metadata argument
        to allow each FileSystem API implementation to pass snapshot metadata
        so that File object could cache the given metadata not to make
        synchronous query.

        We only call this constructor if the filesystem type is neither
        Temporary nor Persistent, therefore this patch should not affect
        existing code behavior.

        Test: fast/filesystem/file-read-after-write.html

        * Modules/filesystem/DOMFileSystem.cpp:
        (WebCore::DOMFileSystem::createFile):
        * Modules/filesystem/DOMFileSystemSync.cpp:
        * fileapi/Blob.cpp:
        (WebCore::Blob::webkitSlice): Updated implementation.
        * fileapi/Blob.h:
        * fileapi/File.cpp:
        (WebCore::File::File): Added new constructor.
        (WebCore::File::lastModifiedDate): Updated implementation.
        (WebCore::File::size): Updated implementation.
        (WebCore::File::captureSnapshot): Updated implementation.
        * fileapi/File.h:
        (WebCore::File::createForFileSystemFile): Added.
        * platform/AsyncFileSystem.h:
        (AsyncFileSystem): Updated comment.

2012-05-17  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Convert setDomainRelaxationForbiddenForURLScheme to use InternalSettings interface
        https://bugs.webkit.org/show_bug.cgi?id=86704

        Reviewed by Eric Seidel.

        Add setDomainRelaxationForbiddenForURLScheme functions, because it is able to work in the
        cross-port way by means of the InternalSettings interface.

        No new tests, since we are improving here the infra-structure for testing
        a specific method.

        * testing/InternalSettings.cpp:
        (WebCore):
        (WebCore::InternalSettings::setDomainRelaxationForbiddenForURLScheme):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-17  Shinya Kawanaka  <shinyak@chromium.org>

        ShadowRoot.selection should be ShadowRoot.getSelection()
        https://bugs.webkit.org/show_bug.cgi?id=86598

        Reviewed by Hajime Morita.

        In the latest spec, ShadowRoot.selection is changed to ShadowRoot.getSelection().
        So update the implementation.

        * dom/ShadowRoot.cpp:
        * dom/ShadowRoot.h:
        (ShadowRoot):
        * dom/ShadowRoot.idl:

2012-05-17  Shinya Kawanaka  <shinyak@chromium.org>

        [Refactoring] Remove TreeScopeAdjuster
        https://bugs.webkit.org/show_bug.cgi?id=86599

        Reviewed by Hajime Morita.

        It seems the right place of the method of TreeScopeAdjuster are in VisibleSelection
        and TreeScope. So we can remove TreeScopeAdjuster.

        No new tests, no change in behavior.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/DOMAllInOne.cpp:
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::ancestorInThisScope):
        (WebCore):
        * dom/TreeScope.h:
        (TreeScope):
        * dom/TreeScopeAdjuster.cpp: Removed.
        * dom/TreeScopeAdjuster.h: Removed.
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::adjustPositionBefore):
        (WebCore):
        (WebCore::VisibleSelection::adjustPositionAfter):
        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):
        * editing/VisibleSelection.h:
        (VisibleSelection):
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::shadowAdjustedNode):
        (WebCore::DOMSelection::shadowAdjustedOffset):

2012-05-17  Zoltan Herczeg  <zherczeg@webkit.org>

        NEON intrinsic should be used with arithmetic mode of composite filter
        https://bugs.webkit.org/show_bug.cgi?id=86622

        Reviewed by Nikolas Zimmermann.

        Rewrite hand written assembly code to increase portability and readibility
        of the code. Remove the unnecessary FECompositeArithmeticNEON.cpp from the
        project

        Existing tests cover this issue.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/filters/FEComposite.cpp:
        (WebCore):
        (WebCore::computeArithmeticPixels):
        (WebCore::arithmeticSoftware):
        (WebCore::FEComposite::platformArithmeticSoftware):
        * platform/graphics/filters/FEComposite.h:
        * platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp: Removed.
        * platform/graphics/filters/arm/FECompositeArithmeticNEON.h:
        (WebCore):
        (WebCore::FEComposite::computeArithmeticPixelsNeon):
        (WebCore::FEComposite::platformArithmeticNeon):

2012-05-17  Takashi Sakamoto  <tasak@google.com>

        showNodePath will be useful for debugging purpose.
        https://bugs.webkit.org/show_bug.cgi?id=86450

        This patch implements showNodePath, which outputs node information in
        a xpath-like format, e.g. /HTML/BODY/DIV[@id="test" and position()=0]/P[0]

        Reviewed by Hajime Morita.

        No new tests, just adding debugging interface.

        * dom/Node.cpp:
        (WebCore::Node::showNodePathForThis):
        (WebCore):
        (showNodePath):
        * dom/Node.h:
        (Node):

2012-05-17  Pravin D  <pravind.2k4@gmail.com>

        REGRESSION (r116331): RSS Headlines/links are missing (-webkit-box-flex broken?)
        https://bugs.webkit.org/show_bug.cgi?id=85991

        Fix for regression failures on deprecated flex box test cases. 

        Reviewed by Eric Seidel.

        Test: fast/css/deprecated-flex-box-zero-width-intrinsic-max-width.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computePreferredLogicalWidths):
        Fix to use intrinsic width when the fixed width:0 , for deprecated flex boxes.

2012-05-17  Uday Kiran  <udaykiran@motorola.com>

        CSS3 Multicolumn: Content in normal flow extending into column gaps should be clipped at middle of column-gap
        https://bugs.webkit.org/show_bug.cgi?id=86441

        Reviewed by Eric Seidel.

        Content in the normal flow that extends into column gaps (e.g., long words or images)
        is clipped in the middle of the column gap.
        http://www.w3.org/TR/css3-multicol/#overflow-inside-multicol-elements

        Test: fast/multicol/overflow-into-columngap.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintColumnContents):

2012-05-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r117372.
        http://trac.webkit.org/changeset/117372
        https://bugs.webkit.org/show_bug.cgi?id=86710

        "triggerring crashes" (Requested by morrita on #webkit).

        * Modules/webaudio/AudioParam.cpp:
        (WebCore::AudioParam::calculateSampleAccurateValues):
        (WebCore::AudioParam::calculateAudioRateSignalValues):
        (WebCore::AudioParam::connect):
        (WebCore::AudioParam::disconnect):
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::context):
        (WebCore::AudioParam::hasSampleAccurateValues):
        (WebCore::AudioParam::AudioParam):
        (AudioParam):

2012-05-16  Hayato Ito  <hayato@chromium.org>

        Implement a Shadow DOM spec's section 6 'Events'.
        https://bugs.webkit.org/show_bug.cgi?id=78586

        Reviewed by Dimitri Glazkov.

        This implements a Shadow DOM spec's section 6 'Events', introducing a new
        algorithm so that event dispatching use a composed shadow DOM tree,
        instead of normal DOM tree, in dispatching events to each node.

        The spec is here: http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#events

        Summary of changes:
        - Attaching shadow DOM does not affect an event dispatching
        behavior of enclosing DOM tree. This applies even if some nodes
        are distributed to insertion points. We keep a compatibility of
        existing event dispatching mechanism so that we won't break Web.
        - Event ancestors, which are used in dispatching events in capture (or
        bubble) phase, are now the result of traversing ancestors in composed
        shadow DOM tree order, instead of normal DOM tree order.
        - Event's target and related-target are correctly adjusted so that
        we don't leak any node which is inaccessible from the event's
        current-target node. We enforce both upper and lower boundary
        encapsulation of Shadow DOM in event dispatching

        Here is an example of event dispatching. Suppose we have the following DOM tree, which
        includes some nested shadow hosts and insertion points
        A
        `--B-----[SR-B]
           |-C     `--G--------------[SR-G]
           | `-D      |-<H select=C>    |--J---------------[SR-J]
           `-E        `-<I select=E>    |  `-<K select=H>    `-<N select=K>
             `-F                        |
                                        `--L---------------[SR-L]
                                           `-<M select=I>    `-<O select=M>

          Notation: [SR-X]: Shadow Root
                    <X select=Y>: Insertion Point, called X, which selects Y.

        If a mouse moves from node '#F' to node '#D', the following
        'mouseover' events are dispatched in each ancestor node:

        [currentTarget] [target] [related-target]
          #D             #D       #F
          #C             #D       #F
          #H             #H       #I
          #K             #K       #M
          #N             #N       #M
          #SR-J          #N       #M
          #J             #K       #M
          #SR-G          #K       #M
          #G             #H       #I
          #SR-B          #H       #I
          #B             #D       #F
          #A             #D       #F

        Details are:
        - Insertion points, such as <content> or <shadow>, are resolved correctly
        in calculating event ancestors. That means if a node is distributed to
        an insertion point, the insertion point is now an ancestor of the node in
        bubbling (or capturing) events.
        - Both insertion points and shadow roots now can receive events. We can add
        event listeners to insertion points and shadow roots.
        - Dispatched event's target is now adjusted correctly using the re-targeting
        algorithm. The algorithm is now fully aware of insertion points.
        - Dispatched event's related-target can now differ in each tree scope of
        event ancestors. We choose the most appropriate related-target using the
        related target resolution algorithm for each node.

        Performance consideration:
        This patch can achieve the competitive performance. The results of
        ./Tools/Scripts/run-perf-tests PerformanceTests/DOM/Events.html for
        before/after this patch are:

        Before applying this patch:
            Running DOM/Events.html (1 of 1)
            RESULT DOM: Events= 270.310714286 ms
            median= 269.75 ms, stdev= 2.0042397663 ms, min= 267.357142857 ms, max= 276.5 ms

        After applying this patch:
            Running DOM/Events.html (1 of 1)
            RESULT DOM: Events= 268.108333333 ms
            median= 267.5 ms, stdev= 2.41883157195 ms, min= 263.625 ms, max= 273.142857143 ms

        I've also conducted a micro benchmark using both
        Shadow-Free-DOM-Tree and DOM-Tree-With-Shadow-Host.
        See https://bugs.webkit.org/show_bug.cgi?id=78586#c40 for the results.
        It seems that the new implementation has more capabilities, but
        doesn't sacrifice a performance of event dispatching in either cases.

        Test: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::parentIncludingInsertionPointAndShadowRoot):
        (WebCore):
        (WebCore::ComposedShadowTreeWalker::traverseParentIncludingInsertionPointAndShadowRoot):
        * dom/ComposedShadowTreeWalker.h:
        (ComposedShadowTreeWalker):
        * dom/EventContext.cpp:
        (WebCore::EventContext::EventContext):
        (WebCore::EventContext::handleLocalEvents):
        * dom/EventContext.h:
        (EventContext):
        (WebCore::EventContext::relatedTarget):
        (WebCore):
        (WebCore::EventContext::setRelatedTarget):
        * dom/EventDispatcher.cpp:
        (WebCore::EventRelatedTargetAdjuster::EventRelatedTargetAdjuster):
        (WebCore):
        (WebCore::EventRelatedTargetAdjuster::adjust):
        (WebCore::EventRelatedTargetAdjuster::findRelatedTarget):
        (WebCore::EventDispatcher::adjustRelatedTarget):
        (WebCore::EventDispatcher::ensureEventAncestors):
        (WebCore::EventDispatcher::dispatchEvent):
        (WebCore::EventDispatcher::determineDispatchBehavior):
        * dom/EventDispatcher.h:
        (WebCore):
        (EventRelatedTargetAdjuster):
        (EventDispatcher):
        * dom/MouseEvent.cpp:
        (WebCore::MouseEventDispatchMediator::dispatchEvent):
        * dom/MouseEvent.h:
        (WebCore::toMouseEvent):
        (WebCore):

2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>

        Moving caret up or down skips lines when there's a non-editable line
        https://bugs.webkit.org/show_bug.cgi?id=81490

        Reviewed by Eric Seidel.

        The bug was caused by previousRootInlineBoxCandidatePosition and nextRootInlineBoxCandidatePosition
        skipping leaf nodes that constitute a new line and belong to the same editable region because block elements
        that separate lines are not editable so it looked as if all editable lines belong to a single line as far as
        those two functions are concerned.

        Fixed the bug by using the first leaf node that belongs to the same editable region but does not belong in
        the same as the start node.

        This patch is based on a patch authored by Yi Shen (Nokia).

        Test: editing/selection/move-between-lines-of-different-editabilities.html

        * editing/visible_units.cpp:
        (WebCore::previousRootInlineBoxCandidatePosition):
        (WebCore::nextRootInlineBoxCandidatePosition):

2012-05-16  MORITA Hajime <morrita@google.com>

        Unreviewed attempt to fix Mac SL build.

        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:

2012-05-16  Levi Weintraub  <leviw@chromium.org>

        Use pixelSnappedLogicalHeight for TableSection layout
        https://bugs.webkit.org/show_bug.cgi?id=86665

        Reviewed by Eric Seidel.

        We do table layout using integers to ensure we follow the spec (see
        https://trac.webkit.org/wiki/LayoutUnit for details), but were previously
        flooring the logical height used in layoutRows. This caused us to mis-
        calculate the intrinsic padding and grow cells beyond their proper height.

        No new tests. Fully covered by existing tests with sub-pixel enabled.

        * rendering/RenderBox.h:
        (WebCore::RenderBox::pixelSnappedLogicalHeight): Added these convenience
        methods.
        (WebCore::RenderBox::pixelSnappedLogicalWidth):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):

2012-05-16  Tony Chang  <tony@chromium.org>

        rename display:-webkit-flexbox to display:-webkit-flex
        https://bugs.webkit.org/show_bug.cgi?id=86529

        Reviewed by Eric Seidel.

        Also renames -webkit-inline-flexbox to -webkit-inline-flex.

        No new tests. Covered by existing tests.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSValueKeywords.in: Update keyword values.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::createObject):
        * rendering/RenderObject.h:
        (RenderObject):
        * rendering/style/RenderStyleConstants.h: Rename const values.

2012-05-16  Greg Billock  <gbillock@google.com>

        IDL and implementation for Web Intents delivery
        https://bugs.webkit.org/show_bug.cgi?id=83634

        Reviewed by Adam Barth.

        The delivered intent has some extra fields and methods (extras,
        postResult, postFailure) from the invocation intent. It is implemented
        as a subclass. Responses from the service JS are passed to an embedder
        client object provided when the intent is delivered.
        See http://dvcs.w3.org/hg/web-intents/raw-file/tip/spec/Overview.html
        Test: webintents/web-intents-delivery.html

        * Modules/intents/DOMWindowIntents.cpp: Copied from Source/WebCore/Modules/intents/DOMWindowIntents.idl.
        (WebCore):
        (WebCore::DOMWindowIntents::DOMWindowIntents):
        (WebCore::DOMWindowIntents::~DOMWindowIntents):
        (WebCore::DOMWindowIntents::from):
        (WebCore::DOMWindowIntents::webkitIntent):
        (WebCore::DOMWindowIntents::deliver):
        * Modules/intents/DOMWindowIntents.h: Copied from Source/WebCore/Modules/intents/DOMWindowIntents.idl.
        (WebCore):
        (DOMWindowIntents):
        * Modules/intents/DOMWindowIntents.idl:
        * Modules/intents/DeliveredIntent.cpp: Copied from Source/WebCore/Modules/intents/Intent.h.
        (WebCore):
        (WebCore::DeliveredIntent::create):
        (WebCore::DeliveredIntent::DeliveredIntent):
        (WebCore::DeliveredIntent::ports):
        (WebCore::DeliveredIntent::getExtra):
        (WebCore::DeliveredIntent::postResult):
        (WebCore::DeliveredIntent::postFailure):
        * Modules/intents/DeliveredIntent.h: Copied from Source/WebCore/Modules/intents/Intent.h.
        (WebCore):
        (DeliveredIntent):
        (WebCore::DeliveredIntent::~DeliveredIntent):
        * Modules/intents/DeliveredIntent.idl: Copied from Source/WebCore/Modules/intents/Intent.h.
        * Modules/intents/Intent.h:
        (WebCore::Intent::~Intent):
        (Intent):
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * bindings/v8/custom/V8DeliveredIntentCustom.cpp: Copied from Source/WebCore/Modules/intents/Intent.h.
        (WebCore):
        (WebCore::V8DeliveredIntent::portsAccessorGetter):

2012-05-16  Kentaro Hara  <haraken@chromium.org>

        [V8][Refactoring] Replace throwError("message", XXXError)
        with throwError(XXXError, "message")
        https://bugs.webkit.org/show_bug.cgi?id=86579

        Reviewed by Adam Barth.

        This is one of a series of refactoring commented in
        https://bugs.webkit.org/show_bug.cgi?id=84074#c5

        Currently there are two equivalent throwError()s; i.e. throwError("message", XXXError)
        and throwError(XXXError, "message"). In this bug we replace
        throwError("message", XXXError) with throwError(XXXError, "message")
        (except for the case where XXXError == TypeError. This is because
        throwError("message", TypeError) will be replaced with throwTypeError("message")
        in a follow-up patch).

        No tests. No change in behavior.

        * bindings/v8/V8NPObject.cpp:
        (WebCore::npObjectInvokeImpl):
        (WebCore::npObjectGetProperty):
        (WebCore::npObjectSetProperty):
        (WebCore::npObjectPropertyEnumerator):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::handleMaxRecursionDepthExceeded):
        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::clearDataCallback):
        (WebCore::V8Clipboard::setDragImageCallback):
        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
        (WebCore::V8DOMFormData::appendCallback):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::constructorCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::V8XMLHttpRequest::constructorCallback):

2012-05-16  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to remaining toV8()
        https://bugs.webkit.org/show_bug.cgi?id=86570

        Reviewed by Nate Chapin.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to toV8(). I've landed a bunch of
        patches to pass Isolate to toV8(), and this would be the last
        patch for passing Isolate to toV8().

        No tests. No change in behavior.

        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
        (WebCore::getNamedItems):
        * bindings/v8/custom/V8IDBAnyCustom.cpp:
        (WebCore::toV8):

2012-05-16  James Robinson  <jamesr@chromium.org>

        GraphicsContext3D interface should not be aware of CanvasRenderingContext
        https://bugs.webkit.org/show_bug.cgi?id=86550

        Reviewed by Darin Adler.

        GraphicsContext3D is a WebCore/platform API construct. CanvasRenderingContext is a WebCore/html concept. Thus,
        the former shouldn't depend on the latter.  In turns out that all everyone ever wants from a
        CanvasRenderingContext in GraphicsContext3D is its underlying ImageBuffer, which is a WebCore/platform concept,
        so this just updates the APIs and implementations to use that instead.

        Refactor only, no new tests.

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::paintRenderingResultsToCanvas):
        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/cairo/DrawingBufferCairo.cpp:
        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
        * platform/graphics/clutter/DrawingBufferClutter.cpp:
        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
        (WebCore::GraphicsContext3D::paintCompositedResultsToCanvas):
        * platform/graphics/gpu/DrawingBuffer.h:
        * platform/graphics/gpu/qt/DrawingBufferQt.cpp:
        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
        (WebCore::GraphicsContext3D::paintCompositedResultsToCanvas):

2012-05-16  Joshua Bell  <jsbell@chromium.org>

        SerializedScriptValue: lazy initialization of static nullValue not threadsafe
        https://bugs.webkit.org/show_bug.cgi?id=70833

        Reviewed by Kentaro Hara.

        Remove unsafe lazy initialization of static |null| SSV. None of the callers
        appeared to be in performance-critical areas - most were preparing an event to
        be dispatched to script - so no per-call-site caching was added.

        No new tests - no functional changes.

        * bindings/js/SerializedScriptValue.cpp: Mint a new one each time.
        (WebCore::SerializedScriptValue::nullValue):
        * bindings/js/SerializedScriptValue.h: Return via PassRefPtr.
        * bindings/v8/SerializedScriptValue.cpp: Mint a new one each time.
        (WebCore::SerializedScriptValue::nullValue):
        * bindings/v8/SerializedScriptValue.h: Return via PassRefPtr.
        (SerializedScriptValue):
        * dom/Document.cpp:
        (WebCore::Document::statePopped): Change to PassRefPtr to maintain refcount.
        * dom/Document.h:
        (Document):

2012-05-16  James Robinson  <jamesr@chromium.org>

        CachedImage does not clear the ImageObserver pointer when dropping its Image ref
        https://bugs.webkit.org/show_bug.cgi?id=86689

        Reviewed by Eric Seidel.

        Image instances keep a weak pointer to their ImageObserver, which may be null. CachedImage is an ImageObserver
        and holds a RefPtr<Image> m_image. When CachedImage initializes its m_image to either an SVGImage or BitmapImage,
        it sets itself as that Image's ImageObserver. However, CachedImage never clears the ImageObserver pointer, even
        when dropping its reference to the Image. This means if other code holds a RefPtr<Image> there is no promise
        that calls on that Image will be valid. This patch clears the CachedImage::m_image's ImageObserver pointer
        whenever the CachedImage drops its reference. Image already has null checks for its m_imageObserver so this is
        always a safe operation.

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::~CachedImage):
        (WebCore::CachedImage::clear):

2012-05-16  Kentaro Hara  <haraken@chromium.org>

        [V8] Fix a broken copyright of V8SVGElementCustom.cpp
        https://bugs.webkit.org/show_bug.cgi?id=86569

        Reviewed by Nate Chapin.

        This patch just fixes a broken copyright of V8SVGElementCustom.cpp.

        Blame changeset: r54153

        No tests. No change in behavior.

        * bindings/v8/custom/V8SVGElementCustom.cpp:

2012-05-16  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to convertEventTargetToV8Object()
        https://bugs.webkit.org/show_bug.cgi?id=86566

        Reviewed by Nate Chapin.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to convertEventTargetToV8Object().
        I made the 'isolate' argument optional, since
        convertEventTargetToV8Object() can be called from the WebCore context.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (NativeToJSValue):
        * bindings/v8/V8DOMWrapper.cpp:
        (WebCore):
        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
        * bindings/v8/V8DOMWrapper.h:
        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
        (V8DOMWrapper):

2012-05-16  Peter Kasting  <pkasting@google.com>

        Correctly display malformed GIFs which specify bogus extension block
        sizes.
        https://bugs.webkit.org/show_bug.cgi?id=86531

        Reviewed by James Robinson.
        
        This was broken by r117333, which was an attempt to avoid memory errors
        on GIFs that were malformed in a similar way.  It turns out some GIFs
        in the wild (i.e. "our LayoutTests directory") relied on some of the
        effects of the old code.  This refixes in a way that doesn't break
        these.

        No new tests, covered by existing tests.

        * platform/image-decoders/gif/GIFImageReader.cpp:
        (GIFImageReader::read):

2012-05-16  Chris Rogers  <crogers@google.com>

        AudioParam must support fan-in (multiple audio connections)
        https://bugs.webkit.org/show_bug.cgi?id=83610

        Reviewed by Kenneth Russell.

        Test: webaudio/audioparam-summingjunction.html

        * Modules/webaudio/AudioParam.cpp:
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::calculateSampleAccurateValues):
        (WebCore::AudioParam::calculateAudioRateSignalValues):
        Sums intrinsic parameter value with all audio-rate connections.

        (WebCore::AudioParam::connect):
        (WebCore::AudioParam::disconnect):
        Support multiple connections.

        (WebCore::AudioParam::hasSampleAccurateValues):
        If we have one or more audio-rate connections.

        (WebCore::AudioParam::AudioParam):
        AudioParam now sub-classes AudioSummingJunction.

2012-05-16  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to createV8HTMLWrapper() and createV8SVGWrapper()
        https://bugs.webkit.org/show_bug.cgi?id=86558

        Reviewed by Nate Chapin.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to createV8HTMLWrapper() and createV8SVGWrapper().

        Basically 'isolate' has been implemented as the last argument
        but before 'forceNewObject' argument, because 'forceNewObject' is an optional
        argument and omitted in most cases. Due to the convention,
        this patch puts 'isolate' before 'forceNewObject'.

        No tests. No change in behavior.

        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGElementCustom.cpp:
        (WebCore::toV8):
        * dom/make_names.pl:
        (printWrapperFunctions):
        (printWrapperFactoryCppFile):
        (printWrapperFactoryHeaderFile):

2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>

        Move showStyle from CSSStyleDeclaration to StylePropertySet
        https://bugs.webkit.org/show_bug.cgi?id=86675

        Reviewed by Andreas Kling.

        Moved the function. Also deleted CSSStyleDeclaration.cpp since it's no longer needed.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSAllInOne.cpp:
        * css/CSSStyleDeclaration.cpp:
        (WebCore):
        * css/CSSStyleDeclaration.h:
        (CSSStyleDeclaration):
        * css/StylePropertySet.cpp:
        (WebCore):
        (WebCore::StylePropertySet::showStyle):
        * css/StylePropertySet.h:
        (StylePropertySet):

2012-05-16  Martin Robinson  <mrobinson@igalia.com>

        Fix the indexed database build for GTK+.

        * GNUmakefile.list.am: Add missing files to the build.
        * bindings/gobject/GNUmakefile.am: Be smarter about filtering out deactivating indexed database.
        * bindings/scripts/CodeGeneratorGObject.pm:
        (SkipAttribute): Always skip attributes that return indexed database types.

2012-05-16  Jon Lee  <jonlee@apple.com>

        Animated GIFs in page cache get updated
        https://bugs.webkit.org/show_bug.cgi?id=86668
        <rdar://problem/11395549>

        Reviewed by Brady Eidson.

        Test: fast/loader/image-in-page-cache.html

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::imageChanged): When we are notified by the CachedImage that the image has
        changed, we check to see if the document is in the page cache. If so, we should not be updating,
        so we bail out early.

2012-05-16  Tim Horton  <timothy_horton@apple.com>

        Crash if SVG gradient stop has display: none set
        https://bugs.webkit.org/show_bug.cgi?id=86686
        <rdar://problem/10751905>

        Reviewed by Dean Jackson.

        Create a renderer for SVGStopElement regardless of the "display" property.
        This matches the behavior of Opera and the SVG specification.

        Test: svg/custom/gradient-stop-display-none-crash.svg

        * svg/SVGStopElement.cpp:
        (WebCore::SVGStopElement::rendererIsNeeded):
        (WebCore):
        * svg/SVGStopElement.h:
        (SVGStopElement):

2012-05-16  Dana Jansens  <danakj@chromium.org>

        [chromium] Clear the m_private pointer when destroying WebFilterOperations to avoid assert in WebPrivateOwnPtr
        https://bugs.webkit.org/show_bug.cgi?id=86654

        Reviewed by James Robinson.

        * platform/chromium/support/WebFilterOperations.cpp:
        (WebKit::WebFilterOperations::reset):
        (WebKit::WebFilterOperations::destroy):
        (WebKit):

2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r92823): WebKit strips font-weight: normal from b element when copying
        https://bugs.webkit.org/show_bug.cgi?id=86663

        Reviewed by Tony Chang.

        The bug was caused by removeStyleFromRulesAndContext incorrectly stripping font-weight property
        even when the context had no font-weight property because of a property name mismatch in getPropertiesNotIn.

        Fixed the mismatch.

        Test: editing/pasteboard/paste-text-with-style-5.html

        * editing/EditingStyle.cpp:
        (WebCore::getPropertiesNotIn):

2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>

        Merge nextRootInlineBox with nextLinePosition
        https://bugs.webkit.org/show_bug.cgi?id=81593

        Reviewed by Enrica Casucci.

        Call previousRootInlineBox and nextRootInlineBox in previousLinePosition and nextLinePosition respectively
        to share the code. Moved out the nullity check of startBox and extracted the renderer's node from the former
        two, and added editableType to their argument lists to match the interface in both use cases.

        Also moved out the code to extract root inline box using RenderedPosition from those two functions and
        expanded in call sites since previousLinePosition and nextLinePosition need to return the candidate position
        even when the root inline box doesn't exist. To this end, renamed previousRootInlineBox and nextRootInlineBox
        to previousRootInlineBoxCandidatePosition and nextRootInlineBoxCandidatePosition respectively.

        In addition, got rid of one version of nextLeafWithSameEditability that adjusted node with respect to offset
        This variant did:

        Node* child = node->childNode(offset);
        node = child ? child->nextLeafNode() : node->lastDescendant()->nextLeafNode();

        instead of:

        node = node->nextLeafNode();

        at the beginning of the function. Observe that the former code is logically equivalent to:

        Node* child = node->childNode(offset);
        node = child ? child : node->lastDescendant();
        node = node->nextLeafNode();

        Thus, the first two lines of this logically equivalent code is added in nextLinePosition wherein we used to
        call the removed variant.

        This refactoring with no behavioral change would help us resolving the bug 81490.

        * editing/visible_units.cpp:
        (WebCore::previousRootInlineBoxCandidatePosition): Renamed from previousRootInlineBox.
        (WebCore::nextRootInlineBoxCandidatePosition): Renamed from nextRootInlineBox.
        (WebCore::logicallyPreviousBox): Checks the nullity of startBox's renderer and node. Also extracts the root
        inline box out of the position per the interface change.
        (WebCore::logicallyNextBox): Ditto.
        (WebCore::previousLinePosition): Calls previousRootInlineBoxCandidatePosition.
        (WebCore::nextLinePosition): Calls nextRootInlineBoxCandidatePosition.

2012-05-16  Noel Gordon  <noel.gordon@gmail.com>

        [chromium] Remove ImageDecoderCG.cpp from platform/image-decoders
        https://bugs.webkit.org/show_bug.cgi?id=86346

        Reviewed by Adam Barth.

        ImageDecoderCG.cpp was added for use in the Chromium port in r70846. Remove the
        implementation now that Chromium uses Skia on Mac OSX by default.

        No new tests. No change in behavior.
        
        * WebCore.gypi: Remove ImageDecoderCG.cpp from the gyp project.
        * platform/graphics/ImageSource.h: Revert the r70846 changes.
        * platform/image-decoders/ImageDecoder.cpp: Remove copyReferenceToBitmapData().
        (WebCore::ImageFrame::operator=): Return to using copyBitmapData() (as it was)
        given the removal of copyReferenceToBitmapData() above.
        * platform/image-decoders/ImageDecoder.h:
        (ImageFrame): Remove copyReferenceToBitmapData() declaration.
        * platform/image-decoders/cg/ImageDecoderCG.cpp: Removed, and it was the only
        decoder with a port-specific implementation of copyReferenceToBitmapData().

2012-05-16  Raymond Toy  <rtoy@google.com>

        Simplify AudioNode ref-counting by removing RefTypeDisabled
        https://bugs.webkit.org/show_bug.cgi?id=85681

        Reviewed by Chris Rogers.

        Existing tests should cover these changes.

        * Modules/webaudio/AudioNode.cpp: Remove RefTypeDiabled and m_disabledRefCount.
        (WebCore::AudioNode::AudioNode):
        (WebCore::AudioNode::~AudioNode):
        (WebCore::AudioNode::enableOutputsIfNecessary): New
        (WebCore::AudioNode::ref): 
        (WebCore::AudioNode::disableOutputsIfNecessary): New
        (WebCore::AudioNode::finishDeref):
        * Modules/webaudio/AudioNode.h: Remove RefTypeDisabled and m_disabledRefCount.
        * Modules/webaudio/AudioNodeInput.cpp: Removed uses of RefTypeDisbled.
        (WebCore::AudioNodeInput::disconnect):
        (WebCore::AudioNodeInput::disable):
        (WebCore::AudioNodeInput::enable):

2012-05-16  Ojan Vafai  <ojan@chromium.org>

        Fix perf regression from r116487
        https://bugs.webkit.org/show_bug.cgi?id=86680

        Reviewed by Ryosuke Niwa.

        http://trac.webkit.org/changeset/116487 caused a 6% regression on
        Dromaeo's dom-attr test. The issue is that we invalidated NodeList
        caches whenever an id/checked/type attribute changed.

        First, we don't need to invalidate on checked/type since that only
        affects the values return by NodeList items, not the list of items.
        Second, we only need to invalidate NodeList caches when an id attribute
        changes on a FormControlElement.

        Incidentally, we also don't need to invalidate caches for changes
        to attributes that don't have an ownerElement.

        No new tests. This is strictly a performance improvement.

        * dom/Attr.cpp:
        (WebCore::Attr::setValue):
        (WebCore::Attr::childrenChanged):
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged):
        * dom/Node.cpp:
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
        * dom/Node.h:
        (Node):

2012-04-22  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: inline-table-001 fails
        https://bugs.webkit.org/show_bug.cgi?id=84167

        Reviewed by Julien Chaffraix.

        Override lastLineBoxBaseline() in RenderTable so that it picks up the baseline
        of the text in the first row of the table. This allows inline tables to find the
        correct baseline to align to.

        Tests:
                css2.1/20110323/inline-table-001.htm
                css2.1/20110323/inline-table-002a.htm
                css2.1/20110323/inline-table-003.htm
                fast/css/empty-cell-baseline.html

        * rendering/RenderTable.cpp:
        (WebCore::getLineBoxBaseline):
        (WebCore):
        (WebCore::RenderTable::lastLineBoxBaseline):
        (WebCore::RenderTable::firstLineBoxBaseline):
        * rendering/RenderTable.h:
        (RenderTable):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::firstLineBoxBaseline): if a cell is empty it cannot provide a 
          baseline. Tested by fast/css/empty-cell-baseline.html

2012-05-16  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Rename valid/finished methods to isValid/isFinished to match coding standard
        https://bugs.webkit.org/show_bug.cgi?id=86655

        Reviewed by Tony Chang.

        No new tests - no functional changes.

        * Modules/indexeddb/IDBKey.h:
        (WebCore::IDBKey::isValid): valid() => isValid()
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::deleteFunction):
        (WebCore::IDBObjectStore::index):
        (WebCore::IDBObjectStore::transactionFinished):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::put):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::onSuccess):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::isFinished): finished() => isFinished()
        * Modules/indexeddb/IDBTransaction.h:
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):

2012-05-16  Jeffrey Pfau  <jpfau@apple.com>

        ImageLoader can still dispatch beforeload events for ImageDocuments
        https://bugs.webkit.org/show_bug.cgi?id=86658
        <rdar://problem/11465863>

        Reviewed by Brady Eidson.

        Prevent flags regarding sending beforeload events from being set on ImageDocuments.

        No new tests; testing framework doesn't allow for testing ImageDocuments with injected JavaScript.

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2012-05-16  Julien Chaffraix  <jchaffraix@webkit.org>

        layerX/layerY warning should be removed
        https://bugs.webkit.org/show_bug.cgi?id=86264

        Reviewed by James Robinson.

        Covered by: fast/dom/Window/window-xy-properties.html
                    fast/events/init-events.html
                    fast/events/mouse-relative-position.html
                    fast/events/mouseclick-target-and-positioning.html
                    fast/events/simulated-click-coords.html
                    jquery/event.html

        This change just removes the warning pending proper investigation.

        Longer explanation: The layerX/layerY warning was added prematurely
        as we didn't assess the web-compatibility potential breakage vs the
        maintenance cost. There is also not readily available replacement.

        * dom/MouseRelatedEvent.cpp:
        (WebCore::MouseRelatedEvent::layerX):
        (WebCore::MouseRelatedEvent::layerY):
        * dom/UIEvent.cpp:
        (WebCore::UIEvent::layerX):
        (WebCore::UIEvent::layerY):
        * dom/UIEvent.h:
        Removed warnDeprecatedLayerXYUsage and all the associated calls.

2012-05-16  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Use accessors for backing store / database id in store/index backends
        https://bugs.webkit.org/show_bug.cgi?id=86652

        Reviewed by Tony Chang.

        Hide the private members m_backingStore and m_databaseId of IDBObjectStoreBackendImpl
        and IDBIndexBackendImpl behind accessors. This is preparation for removing these
        members and only holding references to the IDBDatabaseBackendImpl: webkit.org/b/83074

        No new tests - no functional changes.

        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::openCursorInternal):
        (WebCore::IDBIndexBackendImpl::countInternal):
        (WebCore::IDBIndexBackendImpl::getInternal):
        (WebCore::IDBIndexBackendImpl::getByRangeInternal):
        (WebCore::IDBIndexBackendImpl::getKeyInternal):
        (WebCore::IDBIndexBackendImpl::getKeyByRangeInternal):
        (WebCore::IDBIndexBackendImpl::addingKeyAllowed):
        * Modules/indexeddb/IDBIndexBackendImpl.h:
        (WebCore::IDBIndexBackendImpl::backingStore): Added.
        (WebCore::IDBIndexBackendImpl::databaseId): Added.
        (IDBIndexBackendImpl):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::getByRangeInternal):
        (WebCore::IDBObjectStoreBackendImpl::getInternal):
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
        (WebCore::IDBObjectStoreBackendImpl::clearInternal):
        (WebCore):
        (WebCore::IDBObjectStoreBackendImpl::createIndex):
        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
        (WebCore::IDBObjectStoreBackendImpl::deleteIndexInternal):
        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
        (WebCore::IDBObjectStoreBackendImpl::countInternal):
        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
        (WebCore::IDBObjectStoreBackendImpl::genAutoIncrementKey):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (WebCore::IDBObjectStoreBackendImpl::backingStore): Added.
        (WebCore::IDBObjectStoreBackendImpl::databaseId): Added.
        (IDBObjectStoreBackendImpl):

2012-05-15  Peter Kasting  <pkasting@google.com>

        Malformed GIF can cause decoder to read off end of heap buffer
        https://bugs.webkit.org/show_bug.cgi?id=86531

        Reviewed by Adam Barth.

        Test: fast/images/read-past-end-of-buffer.html
        This test is only expected to catch problems if run under Address
        Sanitizer or a similar memory-checking utility.

        * platform/image-decoders/gif/GIFImageReader.cpp:
        (GIFImageReader::read):

2012-05-16  Varun Jain  <varunjain@google.com>

        [chromium] No modifier flags (shift/ctrl/alt) in drag&drop events on chromium linux
        https://bugs.webkit.org/show_bug.cgi?id=86236

        Reviewed by Tony Chang.

        ManualTests: ManualTests/chromium/modifiers-during-drag-and-drop.html

        * page/DragController.cpp:
        (WebCore::createMouseEvent):
        * platform/DragData.cpp:
        (WebCore):
        (WebCore::DragData::modifierKeyState):
        * platform/DragData.h:
        (DragData):
        * platform/chromium/ChromiumDataObject.cpp:
        (WebCore::ChromiumDataObject::ChromiumDataObject):
        * platform/chromium/ChromiumDataObject.h:
        (WebCore::ChromiumDataObject::modifierKeyState):
        (WebCore::ChromiumDataObject::setModifierKeyState):
        (ChromiumDataObject):
        * platform/chromium/DragDataChromium.cpp:
        (WebCore::DragData::modifierKeyState):
        (WebCore):

2012-05-16  Jer Noble  <jer.noble@apple.com>

        <video> elements with no video tracks report false for webkitSupportsFullscreen.
        https://bugs.webkit.org/show_bug.cgi?id=86650

        Reviewed by Eric Carlson.

        No new tests; updated media/media-fullscreen-inline.html.

        With the new Full Screen API, the restriction that only video elements with
        video tracks can enter full screen seems arbitrary. Some media types will
        occasionally determine they have video tracks long after loadedmetadata, which
        breaks websites who check for webkitSupportsFullscreen(). Relax the restriction
        on webkitSupportsFullscreen() for ports where the Full Screen API is enabled and
        supported so as to no longer require hasVideo().

        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::supportsFullscreen):

2012-05-16  Andreas Kling  <kling@webkit.org>

        Avoid reparsing the style attribute when cloning elements.
        <http://webkit.org/b/86574>

        Reviewed by Antti Koivisto.

        Refactor cloning of attributes a bit to dodge the styleAttr reparse previously
        caused by ElementAttributeData::setAttributes().

        Introduced Element::cloneDataFromElement() which takes care of cloning the
        ElementAttributeData as well as "non-attribute properties" (which is currently
        specific to HTMLInputElement.)

        Also includes some additional dodging of attribute vector traversal to find
        old/new 'id' and 'name' attributes.

        I'm seeing a ~10% improvement on PerformanceTests/DOM/CloneNodes locally.

        * dom/Document.cpp:
        (WebCore::Document::importNode):
        * dom/Element.cpp:
        (WebCore::Element::cloneElementWithoutChildren):
        (WebCore::Element::cloneAttributesFromElement):
        (WebCore::Element::cloneDataFromElement):
        * dom/Element.h:
        (WebCore::Element::copyNonAttributePropertiesFromElement):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::cloneDataFrom):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):
        * dom/Node.h:
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::styleAttributeChanged):
        (WebCore::StyledElement::parseAttribute):
        * dom/StyledElement.h:
        * editing/ReplaceNodeWithSpanCommand.cpp:
        (WebCore::swapInNodePreservingAttributesAndChildren):
        * html/HTMLElement.cpp:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::copyNonAttributePropertiesFromElement):
        * html/HTMLInputElement.h:
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::innerPatchNode):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setNodeName):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
        (WebCore::SVGUseElement::transferUseAttributesToReplacedElement):

2012-05-16  Brent Fulgham  <bfulgham@webkit.org>

        [WinCairo] Unreviewed build change after r115385.  Several Cairo
        image routines were modified to use new wrapper classes, but the
        relevant WinCairo sources were not updated to match.

        * WebCore.vcproj/WebCore.vcproj:
        * platform/graphics/win/ImageCairoWin.cpp:
        (WebCore::BitmapImage::create):
        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
        * platform/win/DragImageCairoWin.cpp:
        (WebCore::createDragImageFromImage):

2012-05-16  Tim Horton  <timothy_horton@apple.com>

        Scrollbar layers should respect accelerated drawing setting
        https://bugs.webkit.org/show_bug.cgi?id=86644
        <rdar://problem/11462038>

        Reviewed by Simon Fraser.

        When creating scrollbar layers, pass through the accelerated drawing setting.

        No new tests.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):

2012-05-16  Tim Horton  <timothy_horton@apple.com>

        FrameView::scrollContentsFastPath should use painted area to determine whether to drop out of the fast path
        https://bugs.webkit.org/show_bug.cgi?id=86651
        <rdar://problem/11459243>

        Reviewed by Simon Fraser.

        Previously, we decided to fall out of the fast scrolling path by the number of fixed-position elements
        on the page. This was less than ideal if a single fixed position element took up a significant portion
        of the page, or if there were many small, cheap-to-paint fixed elements.

        Instead, we should use the fast path if less than 50% of the page will be repainted by fixed-position
        elements, and otherwise fall back to the slow path.

        I've tested a few different thresholds with an internal test; 50% seems to work relatively well,
        but the ideal value is hard to determine and likely depends on hardware.

        No new tests, performance improvement with few large fixed-position objects or many small ones.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsFastPath):

2012-05-16  David Reveman  <reveman@chromium.org>

        [Chromium] Use ThrottledTextureUploader with threaded compositing.
        https://bugs.webkit.org/show_bug.cgi?id=85848

        Reviewed by Adrienne Walker.

        Switch to ThrottledUploader in CCThreadProxy.

        * platform/graphics/chromium/cc/CCThreadProxy.cpp:

2012-05-15  Emil A Eklund  <eae@chromium.org>

        Change ascents and descent back to ints for now
        https://bugs.webkit.org/show_bug.cgi?id=86518

        Reviewed by Eric Seidel.

        Change ascents and descent calculation back to integers for now as it
        looks like we'll need to support both the 1/60 and 1/1 implementations of
        FractionalLayoutUnit for the immediate future to ensure that text is
        rendered at the same offset and with the height regardless of the
        ENABLE_SUBPIXEL_LAYOUT flag.

        This ensures that most websites will look the same at 100% zoom
        regardless of the flag and also allows us to the same test expectations
        for the vast majority of layout tests.

        Eventually we want to move those back to FractionalLayoutUnits as that
        will result in more correct rendering.

        No new tests, no change in functionality.

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
        * rendering/RootInlineBox.cpp:
        (WebCore::setAscentAndDescent):
        (WebCore::RootInlineBox::ascentAndDescentForBox):
        * rendering/RootInlineBox.h:
        (RootInlineBox):

2012-05-16  Ken Buchanan  <kenrb@chromium.org>

        Crash due to first-letter not getting computed on RenderTableCell
        https://bugs.webkit.org/show_bug.cgi?id=86133

        Reviewed by Abhishek Arya.

        RenderTableCell overrides RenderBlock::layout() but doesn't call
        updateFirstLetter() in it. This is normally not a problem because
        updateFirstLetter() gets called during preferred logical width
        computation, but there exist rare occasions when layout of the table
        cell happens without preferred logical widths being dirty, in which
        case the first-letter update can be skipped.

        This patch adds a call to updateFirstLetter() to
        RenderTableCell::layout(). This ensures that the first-letter is up
        to date before commencing block layout.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::layout)

2012-05-16  Mikhail Naganov  <mnaganov@chromium.org>

        Avoid jumpscroll when entering new text in a multi-line editor.
        https://bugs.webkit.org/show_bug.cgi?id=82875

        Reviewed by Ryosuke Niwa.

        Scroll caret to the edge of the viewport in case if a line break or a paragraph
        separator is inserted at the end of a multi-line editor.  This avoids
        undesirable jumpscroll in cases when there is content under the editor.

        Tests: editing/input/scroll-to-edge-if-line-break-at-end-of-document-contenteditable.html
               editing/input/scroll-to-edge-if-line-break-at-end-of-document-textarea.html
               editing/input/scroll-to-edge-if-paragraph-separator-at-end-of-document-contenteditable.html

        * editing/Editor.cpp:
        (WebCore::Editor::insertLineBreak):
        (WebCore::Editor::insertParagraphSeparator):
        (WebCore::Editor::revealSelectionAfterEditingOperation):
        * editing/Editor.h:
        (Editor):

2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Pressing esc after requesting snippet creation should remove snippet.
        https://bugs.webkit.org/show_bug.cgi?id=86639

        Reviewed by Pavel Feldman.

        Added committed parameter to NavigatorView.rename() callback.

        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorView.prototype.rename.commitHandler):
        (WebInspector.NavigatorView.prototype.rename.cancelHandler):
        (WebInspector.NavigatorView.prototype.rename.afterEditing):
        * inspector/front-end/ScriptsNavigator.js:
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested.callback):
        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested):

2012-05-16  Abhishek Arya  <inferno@chromium.org>

        Missing RenderApplet cast check in HTMLAppletElement::renderWidgetForJSBindings.
        https://bugs.webkit.org/show_bug.cgi?id=86627

        Reviewed by Andreas Kling.

        Test: java/inline-applet-crash.html

        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):

2012-05-16  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: extract CompositeUISourceCodeProvider from DebuggerScriptMapping.
        https://bugs.webkit.org/show_bug.cgi?id=86634

        Reviewed by Vsevolod Vlasov.

        Extract refactoring.

        * inspector/front-end/DebuggerScriptMapping.js:
        (WebInspector.DebuggerScriptMapping):
        (WebInspector.DebuggerScriptMapping.prototype.uiSourceCodeProviders):
        (WebInspector.DebuggerScriptMapping.prototype._parsedScriptSource):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._loadUISourceCodes):
        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
        (WebInspector.CompositeUISourceCodeProvider):
        (WebInspector.CompositeUISourceCodeProvider.prototype._registerUISourceCodeProvider):
        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeAdded):
        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeReplaced):
        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeRemoved):
        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodes):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCodeProvider.prototype.uiSourceCodes):
        (WebInspector.UISourceCodeProvider.prototype.addEventListener):
        (WebInspector.UISourceCodeProvider.prototype.removeEventListener):

2012-05-16  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Double Clicking on "No watch expressions" should add an expression
        https://bugs.webkit.org/show_bug.cgi?id=86631

        Reviewed by Vsevolod Vlasov.

        A double-click listener for the section element adds a new watch expression if the correct element
        has been clicked.
        Drive-by: do not persist deleted (null) watch expressions.

        * inspector/front-end/WatchExpressionsSidebarPane.js:
        (WebInspector.WatchExpressionsSection.prototype._sectionDoubleClick):
        (WebInspector.WatchExpressionsSection.prototype.updateExpression):

2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Support script snippets saving.
        https://bugs.webkit.org/show_bug.cgi?id=86632

        Reviewed by Pavel Feldman.

        Added SnippetJavaScriptSource extending JavaScriptSource and overriding isEditable() and commitWorkingCopy() methods.
        ScriptSnippetModel now creates instances of this new class for snippets.
        Also maps in ScriptSnippetModel simplified.

        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.commitWorkingCopy):
        (WebInspector):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel):
        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype.deleteScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype.renameScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype.setScriptSnippetContent):
        (WebInspector.ScriptSnippetModel.prototype._uiSourceCodeList):
        (WebInspector.ScriptSnippetModel.prototype._releasedUISourceCodes):
        (WebInspector.SnippetJavaScriptSource):
        (WebInspector.SnippetJavaScriptSource.prototype.isEditable):
        (WebInspector.SnippetJavaScriptSource.prototype.commitWorkingCopy):
        (WebInspector.SnippetJavaScriptSource.prototype.get snippetId):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.set _fileRenamed):
        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested.callback):
        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested):

2012-05-16  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        [EFL] Memory leak in RenderThemeEfl
        https://bugs.webkit.org/show_bug.cgi?id=86609

        Reviewed by Martin Robinson.

        Fix a memory leak by freeing the cairo surface with
        cairo_surface_destroy.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::cacheThemePartFlush):

2012-05-16  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Speedup heap snapshot postprocessing
        https://bugs.webkit.org/show_bug.cgi?id=86635

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):

2012-05-16  Alexander Pavlov  <apavlov@chromium.org>

        Unreviewed, followup for r117273 that fixes the Web Inspector's Computed Style pane layout.

        * inspector/front-end/elementsPanel.css:
        (.styles-section.computed-style.expanded .properties > li):
        (.styles-section.computed-style.expanded .properties > li .webkit-css-property):

2012-05-16  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: [Extensions API] expose evaluateOptions in audit formatters
        https://bugs.webkit.org/show_bug.cgi?id=86617

        Reviewed by Pavel Feldman.

        Test: inspector/extensions/extensions-audits-content-script.html

        - apply extension-specific audit formatters earlier (in ExtensionAduitCategory, not along with the rest in AuditFormatters);
        - use ExtensionServer.evaluate() to handle evaluateOptions instead of PageAgent.evaluate();

        * inspector/front-end/AuditFormatters.js: Move node and object formatters to ExtensionAuditCategory.
        (WebInspector.partiallyApplyFormatters): Added a method to traverse formatters tree and apply formatters that are passed as input.
        * inspector/front-end/ExtensionAuditCategory.js:
        (WebInspector.ExtensionAuditCategory): Pass extensionOrigin.
        (WebInspector.ExtensionAuditCategoryResults.prototype._addNode): Apply extensions formatters before adding the result.
        (WebInspector.ExtensionAuditCategoryResults.prototype._addResult):
        (WebInspector.ExtensionAuditCategoryResults.prototype.evaluate): moved from AuditFormatters.
        (WebInspector.ExtensionAuditFormatters.object.onEvaluate):
        (WebInspector.ExtensionAuditFormatters.object):
        (WebInspector.ExtensionAuditFormatters.node.onNodeAvailable):
        (WebInspector.ExtensionAuditFormatters.node.onEvaluate):
        (WebInspector.ExtensionAuditFormatters.node):
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onAddAuditCategory): Plumb extensionOrigin through to audit category.

2012-05-16  Donald Carr  <donald.carr@nokia.com>

        Fixes the build with Qt 5 HEAD

        Reviewed by Csaba Osztrogonác.

        * WebCore.pri:
        * platform/graphics/texmap/TextureMapperGL.cpp:
        * plugins/qt/PluginViewQt.cpp:

2012-05-16  Rob Buis  <rbuis@rim.com>

        SVGSVGElement checkIntersection and checkEnclosure Mem corruption
        https://bugs.webkit.org/show_bug.cgi?id=67923

        Reviewed by Nikolas Zimmermann.

        Only call checkIntersection/checkEnclosure when we have a valid renderer.

        Test: svg/custom/intersection-list-null.svg

        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::checkIntersection):
        (WebCore::SVGSVGElement::checkEnclosure):

2012-05-16  Simon Hausmann  <simon.hausmann@nokia.com>

        Unreviewed, rolling out r110699.
        http://trac.webkit.org/changeset/110699
        https://bugs.webkit.org/show_bug.cgi?id=80982

        Not needed anymore and broke modal event loops

        * platform/qt/RunLoopQt.cpp:
        (WebCore::RunLoop::TimerObject::TimerObject):
        (WebCore::RunLoop::TimerObject::performWork):
        (RunLoop::TimerObject):

2012-05-16  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: split ScriptMapping into UISourceCodeProvider and SourceMapping.
        https://bugs.webkit.org/show_bug.cgi?id=86616

        Reviewed by Vsevolod Vlasov.

        This change simply splits the interface.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/CompilerScriptMapping.js:
        (WebInspector.CompilerScriptMapping.prototype.get uiSourceCodes):
        (WebInspector.CompilerScriptMapping.prototype.reset):
        * inspector/front-end/DebuggerModel.js:
        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding):
        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
        * inspector/front-end/DebuggerScriptMapping.js:
        (WebInspector.DebuggerScriptMapping):
        (WebInspector.DebuggerScriptMapping.prototype.uiSourceCodes):
        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeAdded):
        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeReplaced):
        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeRemoved):
        * inspector/front-end/FilteredItemSelectionDialog.js:
        (WebInspector.OpenScriptDialog):
        (WebInspector.OpenScriptDialog.install):
        (WebInspector.OpenScriptDialog._show):
        * inspector/front-end/PresentationConsoleMessageHelper.js:
        (WebInspector.PresentationConsoleMessageHelper):
        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleCleared):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.uiSourceCodes):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
        * inspector/front-end/Script.js:
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._uiSourceCodes):
        (WebInspector.SnippetScriptMapping.prototype.uiSourceCodes):
        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeAdded):
        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeRemoved):
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/ScriptsSearchScope.js:
        (WebInspector.ScriptsSearchScope):
        (WebInspector.ScriptsSearchScope.prototype._sortedUISourceCodes):
        * inspector/front-end/SourceMapping.js: Renamed from Source/WebCore/inspector/front-end/ScriptMapping.js.
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCodeProvider):
        (WebInspector.UISourceCodeProvider.prototype.uiSourceCodes):
        (WebInspector.UILocation):
        (WebInspector.UILocation.prototype.uiLocationToRawLocation):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Implement snippet creation/renaming in ScriptsNavigator.
        https://bugs.webkit.org/show_bug.cgi?id=82622

        Reviewed by Pavel Feldman.

        Implemented snippet creation and renaming.
        Added TitleChanged event to UISourceCode.

        * inspector/front-end/NavigatorOverlayController.js:
        (WebInspector.NavigatorOverlayController.prototype._containingElementFocused):
        (WebInspector.NavigatorOverlayController.prototype.isNavigatorPinned):
        (WebInspector.NavigatorOverlayController.prototype.isNavigatorHidden):
        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorView.prototype._uiSourceCodeTitleChanged):
        (WebInspector.NavigatorView.prototype._updateScriptTitle):
        (WebInspector.NavigatorView.prototype._addUISourceCodeListeners):
        (WebInspector.NavigatorView.prototype._removeUISourceCodeListeners):
        (WebInspector.NavigatorView.prototype._fileRenamed):
        (WebInspector.NavigatorScriptTreeElement.prototype.onattach):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.ScriptsNavigator):
        (WebInspector.ScriptsNavigator.prototype._snippetsNavigatorViewForUISourceCode):
        (WebInspector.ScriptsNavigator.prototype.addUISourceCode):
        (WebInspector.ScriptsNavigator.prototype.isScriptSourceAdded):
        (WebInspector.ScriptsNavigator.prototype.revealUISourceCode):
        (WebInspector.ScriptsNavigator.prototype.replaceUISourceCode):
        (WebInspector.ScriptsNavigator.prototype.rename):
        (WebInspector.ScriptsNavigator.prototype._fileRenamed):
        (WebInspector.ScriptsNavigator.prototype._snippetCreationRequested):
        (WebInspector.SnippetsNavigatorView.prototype._handleCreateSnippet):
        (WebInspector.SnippetsNavigatorView.prototype._snippetCreationRequested):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.set _hideDebuggerSidebar):
        (WebInspector.ScriptsPanel.prototype.set _fileRenamed):
        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested.callback):
        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested):
        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeTitleChanged):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.urlChanged):

2012-05-16  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: gradient properties are painful to inspect / author.
        https://bugs.webkit.org/show_bug.cgi?id=86379

        Reviewed by Pavel Feldman.

        The CSS styles layout has been changed to allow property values to wrap onto subsequent lines
        to let the users see the entire value text.

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.): Avoid line breaks between the color swatch and value.
        * inspector/front-end/elementsPanel.css:
        (.styles-section .properties li.not-parsed-ok img.exclamation-mark):
        (.styles-section .properties li):
        (.styles-section .properties li .webkit-css-property):
        (.styles-section.expanded .properties > li):
        (.styles-section .properties > li .webkit-css-property):
        (.styles-section .properties > li.child-editing):
        (.styles-section .properties > li.child-editing .webkit-css-property):
        (.styles-section .properties .enabled-button):

2012-05-16  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: rename ProfileView.js to CPUProfileView.js
        https://bugs.webkit.org/show_bug.cgi?id=86612

        Reviewed by Pavel Feldman.

        Renamed ProfileView.js to CPUProfileView.js to match the file content.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/CPUProfileView.js: Renamed from Source/WebCore/inspector/front-end/ProfileView.js.
        (WebInspector.CPUProfileView.profileCallback):
        (WebInspector.CPUProfileView.prototype.get statusBarItems):
        (WebInspector.CPUProfileView.prototype.get profile):
        (WebInspector.CPUProfileView.prototype.set profile):
        (WebInspector.CPUProfileView.prototype.get bottomUpProfileDataGridTree):
        (WebInspector.CPUProfileView.prototype.get topDownProfileDataGridTree):
        (WebInspector.CPUProfileView.prototype.get currentTree):
        (WebInspector.CPUProfileView.prototype.set currentTree):
        (WebInspector.CPUProfileView.prototype.willHide):
        (WebInspector.CPUProfileView.prototype.refresh):
        (WebInspector.CPUProfileView.prototype.refreshVisibleData):
        (WebInspector.CPUProfileView.prototype.refreshShowAsPercents):
        (WebInspector.CPUProfileView.prototype.searchCanceled):
        (WebInspector.CPUProfileView.prototype.performSearch.matchesQuery):
        (WebInspector.CPUProfileView.prototype.performSearch):
        (WebInspector.CPUProfileView.prototype.jumpToFirstSearchResult):
        (WebInspector.CPUProfileView.prototype.jumpToLastSearchResult):
        (WebInspector.CPUProfileView.prototype.jumpToNextSearchResult):
        (WebInspector.CPUProfileView.prototype.jumpToPreviousSearchResult):
        (WebInspector.CPUProfileView.prototype.showingFirstSearchResult):
        (WebInspector.CPUProfileView.prototype.showingLastSearchResult):
        (WebInspector.CPUProfileView.prototype._jumpToSearchResult):
        (WebInspector.CPUProfileView.prototype._changeView.set else):
        (WebInspector.CPUProfileView.prototype._focusClicked):
        (WebInspector.CPUProfileView.prototype._excludeClicked):
        (WebInspector.CPUProfileView.prototype._resetClicked):
        (WebInspector.CPUProfileView.prototype._dataGridNodeSelected):
        (WebInspector.CPUProfileView.prototype._dataGridNodeDeselected):
        (WebInspector.CPUProfileView.prototype._sortProfile):
        (WebInspector.CPUProfileView.prototype._assignParentsInProfile):
        (WebInspector.CPUProfileType):
        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
        (WebInspector.CPUProfileType.prototype.buttonClicked):
        (WebInspector.CPUProfileType.prototype.get treeItemTitle):
        (WebInspector.CPUProfileType.prototype.get description):
        (WebInspector.CPUProfileType.prototype.isRecordingProfile):
        (WebInspector.CPUProfileType.prototype.startRecordingProfile):
        (WebInspector.CPUProfileType.prototype.stopRecordingProfile):
        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
        (WebInspector.CPUProfileType.prototype.createView):
        (WebInspector.CPUProfileType.prototype.createTemporaryProfile):
        (WebInspector.CPUProfileType.prototype.createProfile):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype.performSearch.matchesByName):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-05-16  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        "border: collapse" + "display: none" rows in the tbody while having thead or tfoot doesn't render the opposite border
        https://bugs.webkit.org/show_bug.cgi?id=67877

        Reviewed by Antti Koivisto.

        Test: fast/css/table-collapsed-borders.html

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::computeCollapsedBeforeBorder):
        When getting the previous row group's after border, pass SkipEmptySections as the second param
        to the RenderTable::sectionAbove() call. Thus if the currSection is the top most section of the
        table passing SkipEmptySections to sectionAbove() would return null which should be the expected
        behavior.

        (WebCore::RenderTableCell::computeCollapsedAfterBorder):
        When getting the following row group's before border, pass SkipEmptySections as the second param
        to the RenderTable::sectionBelow() call. Thus if the currSection is the bottom most section of the
        table passing SkipEmptySections to sectionBelow() would return null which should be the expected
        behavior.

2012-05-16  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: follow up to r117267 - fixing typo and removing unnecessary dispatch.
        https://bugs.webkit.org/show_bug.cgi?id=86613

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):

2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Move edit/save script source logic to JavaScriptSource.
        https://bugs.webkit.org/show_bug.cgi?id=86604

        Reviewed by Pavel Feldman.

        Added working copy notion to UISourceCode.
        Moved DebuggerResourceBinding content edit calls to JavaScriptSource.
        Added WorkingCopyChanged event to UISourceCode.

        * inspector/front-end/CompilerScriptMapping.js:
        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding.prototype.canSetContent):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource):
        (WebInspector.JavaScriptSource.prototype.breakpointStorageId):
        (WebInspector.JavaScriptSource.prototype.isEditable):
        (WebInspector.JavaScriptSource.prototype.commitWorkingCopy):
        (WebInspector):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.wasShown):
        (WebInspector.JavaScriptSourceFrame.prototype.canEditSource):
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorView.prototype._uiSourceCodeWorkingCopyChanged):
        (WebInspector.NavigatorView.prototype._uiSourceCodeContentChanged):
        (WebInspector.NavigatorView.prototype._updateScriptTitle):
        (WebInspector.NavigatorView.prototype._removeUISourceCode):
        (WebInspector.NavigatorView.prototype._addUISourceCodeListeners):
        (WebInspector.NavigatorView.prototype._removeUISourceCodeListeners):
        (WebInspector.NavigatorView.prototype.reset):
        * inspector/front-end/RawSourceCode.js:
        (WebInspector.RawSourceCode.prototype._createUISourceCode):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer):
        (WebInspector.TabbedEditorContainer.prototype._titleForFile):
        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
        (WebInspector.TabbedEditorContainer.prototype._updateFileTitle.get if):
        (WebInspector.TabbedEditorContainer.prototype._updateFileTitle):
        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeWorkingCopyChanged):
        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeContentChanged):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.UISourceCode.prototype.contentChanged):
        (WebInspector.UISourceCode.prototype.isEditable):
        (WebInspector.UISourceCode.prototype.workingCopy):
        (WebInspector.UISourceCode.prototype.setWorkingCopy):
        (WebInspector.UISourceCode.prototype.isDirty):
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):

2012-05-16  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: get rid of UISourceCodeListChanged event.
        https://bugs.webkit.org/show_bug.cgi?id=86601

        Reviewed by Vsevolod Vlasov.

        There was unnecessary conversion between this event and UISourceCodeAdded/Removed/Replaced.

        * inspector/front-end/CompilerScriptMapping.js:
        (WebInspector.CompilerScriptMapping.prototype.reset):
        * inspector/front-end/DebuggerScriptMapping.js:
        (WebInspector.DebuggerScriptMapping):
        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeAdded):
        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeReplaced):
        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeRemoved):
        * inspector/front-end/NavigatorView.js:
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.addScript):
        (WebInspector.ResourceScriptMapping.prototype._handleUISourceCodeChanged):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
        (WebInspector.ResourceScriptMapping.prototype.reset):
        * inspector/front-end/ScriptMapping.js:
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
        (WebInspector.ScriptSnippetModel.prototype._reset):
        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeAdded):
        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeRemoved):
        * inspector/front-end/ScriptsNavigator.js:
        (WebInspector.ScriptsNavigator.prototype.replaceUISourceCode):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._uiSourceCodeReplaced):
        * inspector/front-end/TabbedEditorContainer.js:

2012-05-16  Keishi Hattori  <keishi@webkit.org>

        [chromium] Add WebKit API to access inner text value of input element
        https://bugs.webkit.org/show_bug.cgi?id=85353

        Reviewed by Kent Tamura.

        Test: fast/forms/editing-value.html

        We need this to implement the datalist UI for  <input type=email multiple>.
        HTMLInputElement.value gives you the sanitized value so the whitespace between values are trimmed.
        We need to append the selected suggestion to the end without modifying the rest of the text.

        * WebCore.exp.in: Added HTMLInputElement::setEditingValue
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setEditingValue):
        (WebCore):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * testing/Internals.cpp:
        (WebCore::Internals::setEditingValue):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-05-16  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] Cookies should be checked during parsing to improve performance.
        https://bugs.webkit.org/show_bug.cgi?id=85028

        Reviewed by George Staikos.

        We shouldn't waste time and memery on invalid cookies. It is better to drop them during parsing.
        We shouldn't check the default domain since it is set with host. So we only check domains which are parsed
        from response headers.

        No new tests. No functionality change.

        * platform/blackberry/CookieManager.cpp:
        (WebCore::CookieManager::setCookies):
        * platform/blackberry/CookieManager.h:
        * platform/blackberry/CookieParser.cpp:
        (WebCore::CookieParser::parseOneCookie):

2012-05-15  Pierre Rossi  <pierre.rossi@gmail.com>

        [Qt] Enable SVG Fonts by default
        https://bugs.webkit.org/show_bug.cgi?id=86463

        Reviewed by Nikolas Zimmermann.

        Another feature we can get for free after switching to using
        the font fast path with QRawFont.
        It will get disabled in features.prf if either SVG support is
        disabled or if we are not using QRawFont (e.g. for Qt 4).

        Covered by a series of tests that were skipped for the
        Qt port up until now.

        * platform/graphics/qt/FontPlatformData.h:
        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
        Initialize the platform data used as fallback in conjunction with SVG
        fonts so it will honor size, weight and oblique-ness.
        * rendering/svg/SVGTextMetricsBuilder.cpp: Avoid forcing the complex path.
        (WebCore::SVGTextMetricsBuilder::advance):
        (WebCore::SVGTextMetricsBuilder::advanceSimpleText):
        (WebCore::SVGTextMetricsBuilder::initializeMeasurementWithTextRenderer):
        * svg/SVGFontElement.cpp:
        (WebCore::SVGFontElement::ensureGlyphCache): avoid ambiguity with String(const QString&)

2012-05-16  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] WebTransformationMatrixTest.verifyDefaultConstructorCreatesIdentityMatrix is failing
        https://bugs.webkit.org/show_bug.cgi?id=86589

        Reviewed by Kent Tamura.

        Need to call m_private.reset(0) before destructing WebTransformationMatrix objects.

        No new tests. WebTransformationMatrixTest should pass on debug build.

        * platform/chromium/support/WebTransformationMatrix.cpp:
        (WebKit::WebTransformationMatrix::~WebTransformationMatrix):
        (WebKit):

2012-05-16  Shinya Kawanaka  <shinyak@chromium.org>

        ShadowRoot.selection should return the seleciton whose range is in a shadow tree.
        https://bugs.webkit.org/show_bug.cgi?id=82698

        Reviewed by Ryosuke Niwa.

        The selection object returned from shadowRoot.selection should be able to see
        the inner object of the shadowRoot.

        In the previous code, the node out of the shadow subtree was returned for
        anchorNode, focusNode, baseNode, and extentNode. This patch enables us to get
        the corresponding shadow ancestor in the specified TreeScope (m_treeScope).

        Tests: editing/shadow/selection-of-orphan-shadowroot.html
               editing/shadow/selection-of-shadowroot.html

        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::selection):
        * dom/ShadowRoot.h:
        (ShadowRoot):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::getSelection): When shadow DOM feature is not enabled, we want to use the same
        instance of DOMSelection among Document and ShadowRoot.
        * dom/TreeScopeAdjuster.cpp:
        (WebCore::TreeScopeAdjuster::TreeScopeAdjuster):
        (WebCore::TreeScopeAdjuster::ancestorInThisScope): Since node could be null, I've added a node check code.
        * dom/TreeScopeAdjuster.h:
        (TreeScopeAdjuster):
        (WebCore::TreeScopeAdjuster::treeScope):
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::anchorNode):
        (WebCore::DOMSelection::anchorOffset):
        (WebCore::DOMSelection::focusNode):
        (WebCore::DOMSelection::focusOffset):
        (WebCore::DOMSelection::baseNode):
        (WebCore::DOMSelection::baseOffset):
        (WebCore::DOMSelection::extentNode):
        (WebCore::DOMSelection::extentOffset):
        (WebCore::DOMSelection::shadowAdjustedNode): Gets the corresponding node in the m_treeScope from the Position.
        (WebCore):
        (WebCore::DOMSelection::shadowAdjustedOffset): Gets the corresponding node offset in the m_treeScope from the Position.
        * page/DOMSelection.h:
        (WebCore):
        (DOMSelection):

2012-05-16  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] xhr request to non existent file response is 0 and not 404.
        https://bugs.webkit.org/show_bug.cgi?id=86344

        Reviewed by George Staikos.

        NetworkJob receives 404 for a XMLHttpRequest which calls open("HEAD", "notExist.html", true).
        There are no data received because its method is HEAD.
        This case should not be treated as a failure.

        Add shouldNotifyClientFailed() to treat XMLHttpRequest as a special case.
        XMLHttpRequest will fail when status code is smaller than zero.

        If we use "GET" and receive 404 without body, NetworkJob won't go through failing code path, too.
        So add http/tests/xmlhttprequest/xmlhttprequest-check-get-readystate-for-404-without-body.html
        to check this case.

        Test: http/tests/xmlhttprequest/xmlhttprequest-check-head-readystate-for-404.html
              http/tests/xmlhttprequest/xmlhttprequest-check-get-readystate-for-404-without-body.html
        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::sendResponseIfNeeded):

2012-05-16  MORITA Hajime  <morrita@google.com>

        HasCustomWillOrDidRecalcStyleFlag and family should live in a bit.
        https://bugs.webkit.org/show_bug.cgi?id=86175

        Reviewed by Ryosuke Niwa.

        This change unifies following flags into one HasCustomCallbacksFlag.
        - HasCustomWillOrDidRecalcStyleFlag
        - HasCustomStyleForRendererFlag
        - IsFrameOwnerElementFlag

        By this change, some callbacks can be called even if there are no override.
        So all custom callbacks should just pass these invocations.

        No new tests. No behavior change.

        * dom/ContainerNodeAlgorithms.h:
        (WebCore::ChildFrameDisconnector::collectDescendant):
        * dom/Element.cpp:
        (WebCore::Element::styleForRenderer):
        (WebCore::Element::recalcStyle):
        (WebCore::Element::willRecalcStyle):
        (WebCore):
        (WebCore::Element::didRecalcStyle):
        (WebCore::Element::customStyleForRenderer):
        * dom/Element.h:
        (Element):
        * dom/Node.h:
        (WebCore::Node::isFrameOwnerElement):
        (WebCore::Node::hasCustomCallbacks):
        (WebCore::Node::setHasCustomCallbacks):
        * dom/Text.cpp:
        (WebCore::Text::recalcTextStyle):
        (WebCore::Text::willRecalcTextStyle):
        (WebCore):
        * dom/Text.h:
        (Text):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
        * html/HTMLFrameOwnerElement.cpp:
        (WebCore::HTMLFrameOwnerElement::disconnectContentFrame):
        * html/HTMLFrameOwnerElement.h:
        * html/HTMLFrameSetElement.cpp:
        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
        (WebCore::HTMLPlugInImageElement::documentWillSuspendForPageCache):
        (WebCore::HTMLPlugInImageElement::documentDidResumeFromPageCache):
        (WebCore::HTMLPlugInImageElement::customStyleForRenderer):
        * html/HTMLPlugInImageElement.h:
        (HTMLPlugInImageElement):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerElement::TextControlInnerElement):
        (WebCore::TextControlInnerElement::customStyleForRenderer):
        (WebCore::TextControlInnerTextElement::TextControlInnerTextElement):
        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
        * html/shadow/TextControlInnerElements.h:
        (TextControlInnerElement):
        (TextControlInnerTextElement):
        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::TextFieldDecorationElement::TextFieldDecorationElement):
        (WebCore::TextFieldDecorationElement::customStyleForRenderer):
        * html/shadow/TextFieldDecorationElement.h:
        (TextFieldDecorationElement):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::SVGElement):
        (WebCore::SVGElement::customStyleForRenderer):
        * svg/SVGElement.h:
        (SVGElement):
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGShadowText::SVGShadowText):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::SVGUseElement):

2012-05-16  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: exception when switching to heap profiler comparison view
        https://bugs.webkit.org/show_bug.cgi?id=86224

        Reviewed by Pavel Feldman.

        Make sure the messages are dispatched in the same order as they are sent in
        case a fake worker is used for heap snapshot processing.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.AsyncTaskQueue):
        (WebInspector.AsyncTaskQueue.prototype.addTask):
        (WebInspector.AsyncTaskQueue.prototype._onTimeout):
        (WebInspector.AsyncTaskQueue.prototype._scheduleTimer):
        (WebInspector.HeapSnapshotFakeWorker):
        (WebInspector.HeapSnapshotFakeWorker.prototype.postMessage):
        (WebInspector.HeapSnapshotFakeWorker.prototype._postMessageFromWorker):

2012-05-16  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>

        [EFL] PlatformKeyboardEvent: figures, letters and printscreen key handling
        https://bugs.webkit.org/show_bug.cgi?id=85503

        Reviewed by Gustavo Noronha Silva.

        * platform/efl/EflKeyboardUtilities.cpp:
        (WebCore::addCharactersToKeyMap): aux function
        (WebCore):
        (WebCore::createKeyMap): Figures and letters keys are added to the keyMap
        (WebCore::addCharactersToWinKeyMap): aux function
        (WebCore::createWindowsKeyMap): Capital letters keys are added to the windowsKeyMap. Corrected value for printscreen key.
        (WebCore::singleCharacterString): Return empty text for printscreen key.

2012-05-16  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: rename DebuggerPresentationModel to DebuggerScriptMapping, make it private to ScriptsPanel.
        https://bugs.webkit.org/show_bug.cgi?id=86594

        Reviewed by Vsevolod Vlasov.

        This change completes the elimination of the presentation model.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/AuditFormatters.js:
        (WebInspector.AuditFormatters.resourceLink):
        * inspector/front-end/DebuggerResourceBinding.js:
        (WebInspector.DebuggerResourceBinding):
        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
        * inspector/front-end/DebuggerScriptMapping.js: Renamed from Source/WebCore/inspector/front-end/DebuggerPresentationModel.js.
        (WebInspector.DebuggerScriptMapping):
        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeListChanged):
        * inspector/front-end/FilteredItemSelectionDialog.js:
        (WebInspector.OpenScriptDialog):
        (WebInspector.OpenScriptDialog.install):
        (WebInspector.OpenScriptDialog._show):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        * inspector/front-end/PresentationConsoleMessageHelper.js:
        (WebInspector.PresentationConsoleMessageHelper):
        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleCleared):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._loadUISourceCodes):
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
        * inspector/front-end/ScriptsSearchScope.js:
        (WebInspector.ScriptsSearchScope):
        (WebInspector.ScriptsSearchScope.prototype._sortedUISourceCodes):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCodeProject):
        (WebInspector.UISourceCodeProject.prototype.uiSourceCodes):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._createPanels):

2012-05-15  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: use separate fields for storing HeapSnapshotLoaderProxy and HeapSnapshotProxy
        https://bugs.webkit.org/show_bug.cgi?id=86488

        Reviewed by Pavel Feldman.

        Simplified heap profiler snapshot loading code. Introduced dedicated fields for
        snapshot loader proxy and for snapshot proxy.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotWorker):
        (WebInspector.HeapSnapshotLoaderProxy):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading.updateStaticData):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading.callLoadCallbacks):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.get loaded):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.startLoading):
        (WebInspector.HeapSnapshotLoaderProxy.prototype.pushJSONChunk):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.profileCallback):
        (WebInspector.HeapSnapshotView):
        (WebInspector.HeapSnapshotView.prototype.dispose):
        (WebInspector.HeapSnapshotView.prototype.get baseProfileWrapper):
        (WebInspector.HeapSnapshotView.prototype.wasShown.profileCallback1):
        (WebInspector.HeapSnapshotView.prototype._changeView):
        (WebInspector.HeapProfileHeader): split _proxy field into _loaderProxy and _snapshotProxy
        (WebInspector.HeapProfileHeader.prototype.snapshotProxy):
        (WebInspector.HeapProfileHeader.prototype.load):
        (WebInspector.HeapProfileHeader.prototype._setupWorker):
        (WebInspector.HeapProfileHeader.prototype.dispose):
        (WebInspector.HeapProfileHeader.prototype._saveStatusUpdate):
        (WebInspector.HeapProfileHeader.prototype.pushJSONChunk):
        (WebInspector.HeapProfileHeader.prototype.finishHeapSnapshot):
        (WebInspector.HeapProfileHeader.prototype.canSaveToFile):
        (WebInspector.HeapProfileHeader.prototype.loadFromFile.onLoad):
        (WebInspector.HeapProfileHeader.prototype.loadFromFile):

2012-05-16  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Use CSS columns feature for HelpScreen contents.
        https://bugs.webkit.org/show_bug.cgi?id=86367

        Reviewed by Yury Semikhatsky.

        Right-docked inspector should show shortcuts/settings in one column.
        Bottom-docked inspector should use horizontal space more effectively
        (more than 2 columns in shortcuts/settings).

        Please see attached screenshots.

        UI adjustments, no new tests.

        * inspector/front-end/SettingsScreen.js:
        (WebInspector.SettingsScreen): Turned table to div.
        (WebInspector.SettingsScreen.prototype._appendSection): Removed.
        * inspector/front-end/ShortcutsScreen.js:
        (WebInspector.ShortcutsScreen.prototype._buildTable): Removed "balancing" algorithm.
        (WebInspector.ShortcutsSection.prototype.renderSection): Turned table to div.
        (WebInspector.ShortcutsSection.prototype._renderHeader): Ditto.
        * inspector/front-end/helpScreen.css: Use CSS columns feature.
        (.help-container): Added columns container.
        (.help-block): Added "section".
        (.help-line): Added key shortcut line.
        (.help-key-cell): Added key shortcut cell.
        (.help-cell): Ditto
        (.help-section-title): Combined title classes
        (.help-content p): Adjusted spacing.

2012-05-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r117050.
        http://trac.webkit.org/changeset/117050
        https://bugs.webkit.org/show_bug.cgi?id=86587

        "Some heap profiler tests started timing out" (Requested by
        yurys on #webkit).

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotFakeWorker):
        (WebInspector.HeapSnapshotFakeWorker.prototype.postMessage):
        (WebInspector.HeapSnapshotFakeWorker.prototype._postMessageFromWorker):

2012-05-16  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r117206.
        http://trac.webkit.org/changeset/117206
        https://bugs.webkit.org/show_bug.cgi?id=86583

        breaks chromium browser_tests (Requested by bashi1 on
        #webkit).

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::continueAfterContentPolicy):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::create):

2012-05-16  Nikolas Zimmermann  <nzimmermann@rim.com>

        REGRESSION(r105057): Infinite loop inside SVGTextLayoutEngine::currentLogicalCharacterMetrics
        https://bugs.webkit.org/show_bug.cgi?id=83405

        Reviewed by Darin Adler.

        Dynamically adding tspans carrying position information in the x/y/dx/dy/rotate lists is broken.
        To avoid mistakes like this in future, simplify the calling code in RenderSVGInlineText and centralize
        the management of all caches (text positioning element cache / metrics map / layout attributes) in
        RenderSVGText. This avoids the hack in SVGRootInlineBox::computePerCharacterLayoutInformation() which
        called textRoot->rebuildLayoutAttributes(), which was used to fix previous security issues with this code.
        Instead correctly handle destruction of RenderSVGInlineText in RenderSVGText, keeping the m_layoutAttributes
        synchronized with the current state of the render tree. Fixes highcharts problems.

        Tests: svg/text/add-tspan-position-bug.html
               svg/text/highcharts-assertion.html
               svg/text/modify-tspan-position-bug.html

        * rendering/svg/RenderSVGBlock.h:
        (RenderSVGBlock):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::addChild):
        (WebCore::RenderSVGInline::removeChild):
        * rendering/svg/RenderSVGInline.h:
        (RenderSVGInline):
        * rendering/svg/RenderSVGInlineText.cpp:
        (WebCore::RenderSVGInlineText::setTextInternal):
        (WebCore::RenderSVGInlineText::styleDidChange):
        * rendering/svg/RenderSVGInlineText.h:
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::RenderSVGText):
        (WebCore::RenderSVGText::~RenderSVGText):
        (WebCore::collectLayoutAttributes):
        (WebCore::RenderSVGText::subtreeChildWasAdded):
        (WebCore::findPreviousAndNextAttributes):
        (WebCore::checkLayoutAttributesConsistency):
        (WebCore::RenderSVGText::willBeDestroyed):
        (WebCore::RenderSVGText::subtreeChildWillBeRemoved):
        (WebCore::RenderSVGText::subtreeChildWasRemoved):
        (WebCore::RenderSVGText::subtreeStyleDidChange):
        (WebCore::RenderSVGText::subtreeTextDidChange):
        (WebCore::updateFontInAllDescendants):
        (WebCore::RenderSVGText::layout):
        (WebCore::RenderSVGText::addChild):
        (WebCore::RenderSVGText::removeChild):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::layoutChildren):
        * rendering/svg/SVGRootInlineBox.cpp:
        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextRenderer):
        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForWholeTree):
        (WebCore::SVGTextLayoutAttributesBuilder::rebuildMetricsForTextRenderer):
        (WebCore::SVGTextLayoutAttributesBuilder::buildCharacterDataMap):
        * rendering/svg/SVGTextLayoutAttributesBuilder.h:
        (SVGTextLayoutAttributesBuilder):
        (WebCore::SVGTextLayoutAttributesBuilder::numberOfTextPositioningElements):
        * svg/SVGAElement.cpp:
        * svg/SVGAElement.h:
        (SVGAElement):
        * svg/SVGTextContentElement.cpp:
        * svg/SVGTextContentElement.h:
        (SVGTextContentElement):

2012-05-15  Abhishek Arya  <inferno@chromium.org>

        Crash in Document::nodeChildrenWillBeRemoved.
        https://bugs.webkit.org/show_bug.cgi?id=85247

        Reviewed by Hajime Morita.

        Reverse ordering of commands to ref ptr the children set
        first before calling nodeChildrenWillBeRemoved, since it
        can fire mutation events.

        Test: fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml

        * dom/ContainerNode.cpp:
        (WebCore::willRemoveChildren):

2012-05-15  Igor Oliveira  <igor.o@sisa.samsung.com>

        regression(111639): Issue with simultaneous CSS animations
        https://bugs.webkit.org/show_bug.cgi?id=85929

        Currently, previousTimeToNextService is just saving the previous CompositeAnimation::timeToNextService
        for AnimationControllerPrivate::updateAnimationTimerForRenderer, however CompositeAnimation::timeToNextService
        is also called and used by updateAnimationTimer. Make sure we save the existing timeToNextService from
        both places, updateAnimationTimerForRenderer and updateAnimationTimer.

        Reviewed by Dean Jackson.

        Test: animations/fill-mode-forwards.html

        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
        (WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer):
        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
        * page/animation/AnimationControllerPrivate.h:
        (AnimationControllerPrivate):

2012-05-15  Tien-Ren Chen  <trchen@chromium.org>

        [Chromium] CCTimer::isActive() is incorrect inside tick callback
        https://bugs.webkit.org/show_bug.cgi?id=86513

        This patch implements CCTimer::isActive() by clearing the task pointer
        when the timer fires.

        Reviewed by James Robinson.

        No new tests. Existing tests updated accordingly.

        * platform/graphics/chromium/cc/CCTimer.cpp:
        (WebCore::CCTimerTask::performTask):
        * rendering/RenderLayerBacking.cpp:

2012-05-15  Kentaro Hara  <haraken@chromium.org>

        Unreviewed. Rebaselined run-bindings-tests results.

        * bindings/scripts/test/JS/JSFloat64Array.cpp:
        (WebCore::JSFloat64Array::getOwnPropertySlot):
        (WebCore::JSFloat64Array::getOwnPropertyDescriptor):
        (WebCore::JSFloat64Array::put):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTarget::getOwnPropertySlot):
        (WebCore::JSTestEventTarget::getOwnPropertyDescriptor):

2012-05-15  Shinya Kawanaka  <shinyak@chromium.org>

        Rename Node::shadowTreeRootNode() to Node::shadowRoot()
        https://bugs.webkit.org/show_bug.cgi?id=86449

        Reviewed by Darin Adler.

        Since Node::shadowTreeRootNode() returns always a ShadowRoot now, shadowRoot() is
        mure suitable than shadowTreeRootNode().

        This patch changes the method name.

        No new tests, no change in behavior.

        * WebCore.order:
        * dom/Node.cpp:
        (WebCore::Node::rendererIsEditable):
        (WebCore::Node::shadowAncestorNode):
        (WebCore::Node::shadowRoot):
        * dom/Node.h:
        (Node):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        * dom/Range.cpp:
        (WebCore::Range::shadowRoot):
        * dom/Range.h:
        (Range):
        * editing/Editor.cpp:
        (WebCore::Editor::nextVisibleRange):
        (WebCore::Editor::countMatchesForText):
        * editing/TextIterator.cpp:
        (WebCore::TextIterator::handleReplacedElement):
        * editing/htmlediting.cpp:
        (WebCore::indexForVisiblePosition):
        * html/shadow/ContentSelectorQuery.cpp:
        (WebCore::ContentSelectorQuery::matches):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::HTMLContentElement::parseAttribute):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::detach):
        * page/EventHandler.cpp:
        (WebCore::instanceAssociatedWithShadowTreeElement):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::correspondingElement):
        (WebCore::collectInstancesForSVGElement):

2012-05-15  Nico Weber  <thakis@chromium.org>

        [chromium] Remove some unused gyp lines
        https://bugs.webkit.org/show_bug.cgi?id=86545

        Reviewed by Dirk Pranke.

        mac_framework_dirs adds directories to search for frameworks
        (similar to -I for includes), it doesn't add any frameworks.
        Having something that ends in .framewok in mac_framework_dirs
        doesn't make sense.

        No intended functionality change.

        * WebCore.gyp/WebCore.gyp:

2012-05-13  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] build a static list of mime-types
        https://bugs.webkit.org/show_bug.cgi?id=86331

        Reviewed by Martin Robinson.

        Don't bother parsing the gstreamer typefind factories and doing
        ugly hacks around this. Instead build a static list and let our
        ::supportsType() method return MediaPlayer::MayBeSupported or
        MediaPlayer::IsSupported for them. Playback will still fail if a
        demuxer or decoder is missing for one of these mime-types but we
        will handle that case more properly soon by fixing bug 34085 and
        bug 34318.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

2012-05-15  Greg Spencer  <gspencer@chromium.org>

        MHTML files should be loadable from all schemes considered local,
        not just file:

        https://bugs.webkit.org/show_bug.cgi?id=86540

        Reviewed by Adam Barth.

        Current tests should assure that loading is still allowed locally.

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::continueAfterContentPolicy):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::create):

2012-05-15  Fady Samuel  <fsamuel@chromium.org>

        [Chromium] Reset ScriptInstance in HTMLPlugInElement on WebPluginContainerImpl::setPlugin
        https://bugs.webkit.org/show_bug.cgi?id=86535

        Reviewed by Darin Fisher.
        
        When we swap out WebPluginImpls for the Browser Plugin, the HTMLPlugInElement continues
        to use a now invalid ScriptInstance, so we reset the ScriptInstance on WebPluginContainerImpl::setPlugin

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::resetInstance):
        (WebCore):
        * html/HTMLPlugInElement.h:
        (HTMLPlugInElement):

2012-05-15  Robert Hogan  <robert@webkit.org>

        Heap-use-after-free in WebCore::RenderBlock::layoutRunsAndFloats
        https://bugs.webkit.org/show_bug.cgi?id=86206

        Reviewed by Abhishek Arya.

        Revert https://trac.webkit.org/changeset/116438/. It caused three different regressions on 
        ClusterFuzz.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::updateFirstLetter):
        * rendering/RenderBlock.h:
        (RenderBlock):

2012-05-15  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86549
        Page Scale + Tiled Drawing: Twitter sign in page content disappears 
        after typing into name and enabling password field
        -and corresponding-
        <rdar://problem/11415352>

        Reviewed by Oliver Hunt.

        The enormous rect we used to use would overflow in CA and do nothing 
        when there was any scale > 1 on the context. Instead, just call 
        setNeedsDisplay on each tile.
        * platform/graphics/ca/mac/TileCache.mm:
        (WebCore::TileCache::setNeedsDisplay):

2012-05-15  Andreas Kling  <kling@webkit.org>

        Pass Attribute by const reference as much as possible.
        <http://webkit.org/b/86487>

        Reviewed by Darin Adler.

        Switch to passing around "const Attribute&" instead of "Attribute*" wherever possible.
        This helps enforce the constness and non-nullity of these arguments at compile time.

        Also renamed 'attr' to 'attribute' in the touched code. Attr and Attribute are two
        different classes, so having "Attribute attr" just looks wrong.

        * bindings/js/ScriptEventListener.cpp:
        (WebCore::createAttributeEventListener):
        * bindings/js/ScriptEventListener.h:
        * bindings/v8/ScriptEventListener.cpp:
        (WebCore::createAttributeEventListener):
        * bindings/v8/ScriptEventListener.h:
        * dom/Attr.cpp:
        (WebCore::Attr::setPrefix):
        (WebCore::Attr::setValue):
        (WebCore::Attr::childrenChanged):
        (WebCore::Attr::style):
        (WebCore::Attr::elementAttribute):
        * dom/Attr.h:
        * dom/Element.cpp:
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::attributeChanged):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::didAddAttribute):
        (WebCore::Element::didModifyAttribute):
        (WebCore::Element::didRemoveAttribute):
        * dom/Element.h:
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::setAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::attributeChanged):
        (WebCore::StyledElement::parseAttribute):
        (WebCore::StyledElement::updateAttributeStyle):
        * dom/StyledElement.h:
        (WebCore::StyledElement::collectStyleForAttribute):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::parseAttribute):
        * html/HTMLAnchorElement.h:
        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::parseAttribute):
        * html/HTMLAppletElement.h:
        * html/HTMLAreaElement.cpp:
        (WebCore::HTMLAreaElement::parseAttribute):
        * html/HTMLAreaElement.h:
        * html/HTMLBRElement.cpp:
        (WebCore::HTMLBRElement::collectStyleForAttribute):
        * html/HTMLBRElement.h:
        * html/HTMLBaseElement.cpp:
        (WebCore::HTMLBaseElement::parseAttribute):
        * html/HTMLBaseElement.h:
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::collectStyleForAttribute):
        (WebCore::HTMLBodyElement::parseAttribute):
        * html/HTMLBodyElement.h:
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::parseAttribute):
        * html/HTMLButtonElement.h:
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::parseAttribute):
        * html/HTMLCanvasElement.h:
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::parseAttribute):
        * html/HTMLDetailsElement.h:
        * html/HTMLDivElement.cpp:
        (WebCore::HTMLDivElement::collectStyleForAttribute):
        * html/HTMLDivElement.h:
        * html/HTMLElement.cpp:
        (WebCore::parseBorderWidthAttribute):
        (WebCore::HTMLElement::applyBorderAttributeToStyle):
        (WebCore::HTMLElement::mapLanguageAttributeToLocale):
        (WebCore::HTMLElement::collectStyleForAttribute):
        (WebCore::HTMLElement::parseAttribute):
        (WebCore::HTMLElement::applyAlignmentAttributeToStyle):
        (WebCore::HTMLElement::dirAttributeChanged):
        * html/HTMLElement.h:
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::collectStyleForAttribute):
        (WebCore::HTMLEmbedElement::parseAttribute):
        * html/HTMLEmbedElement.h:
        * html/HTMLFontElement.cpp:
        (WebCore::HTMLFontElement::collectStyleForAttribute):
        * html/HTMLFontElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::parseAttribute):
        * html/HTMLFormControlElement.h:
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::parseAttribute):
        * html/HTMLFormElement.h:
        * html/HTMLFrameElement.cpp:
        (WebCore::HTMLFrameElement::parseAttribute):
        * html/HTMLFrameElement.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::parseAttribute):
        * html/HTMLFrameElementBase.h:
        (HTMLFrameElementBase):
        * html/HTMLFrameSetElement.cpp:
        (WebCore::HTMLFrameSetElement::collectStyleForAttribute):
        (WebCore::HTMLFrameSetElement::parseAttribute):
        * html/HTMLFrameSetElement.h:
        * html/HTMLHRElement.cpp:
        (WebCore::HTMLHRElement::collectStyleForAttribute):
        * html/HTMLHRElement.h:
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
        (WebCore::HTMLIFrameElement::parseAttribute):
        * html/HTMLIFrameElement.h:
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::collectStyleForAttribute):
        (WebCore::HTMLImageElement::parseAttribute):
        * html/HTMLImageElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateType):
        (WebCore::HTMLInputElement::collectStyleForAttribute):
        (WebCore::HTMLInputElement::parseAttribute):
        (WebCore::HTMLInputElement::parseMaxLengthAttribute):
        * html/HTMLInputElement.h:
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::parseAttribute):
        * html/HTMLKeygenElement.h:
        * html/HTMLLIElement.cpp:
        (WebCore::HTMLLIElement::collectStyleForAttribute):
        (WebCore::HTMLLIElement::parseAttribute):
        * html/HTMLLIElement.h:
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::parseAttribute):
        * html/HTMLLinkElement.h:
        * html/HTMLMapElement.cpp:
        (WebCore::HTMLMapElement::parseAttribute):
        * html/HTMLMapElement.h:
        * html/HTMLMarqueeElement.cpp:
        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
        * html/HTMLMarqueeElement.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::parseAttribute):
        * html/HTMLMediaElement.h:
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::parseAttribute):
        * html/HTMLMetaElement.h:
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::parseAttribute):
        * html/HTMLMeterElement.h:
        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::collectStyleForAttribute):
        (WebCore::HTMLOListElement::parseAttribute):
        * html/HTMLOListElement.h:
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::collectStyleForAttribute):
        (WebCore::HTMLObjectElement::parseAttribute):
        * html/HTMLObjectElement.h:
        * html/HTMLOptGroupElement.cpp:
        (WebCore::HTMLOptGroupElement::parseAttribute):
        * html/HTMLOptGroupElement.h:
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::parseAttribute):
        * html/HTMLOptionElement.h:
        * html/HTMLOutputElement.cpp:
        (WebCore::HTMLOutputElement::parseAttribute):
        * html/HTMLOutputElement.h:
        * html/HTMLParagraphElement.cpp:
        (WebCore::HTMLParagraphElement::collectStyleForAttribute):
        * html/HTMLParagraphElement.h:
        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::collectStyleForAttribute):
        * html/HTMLPlugInElement.h:
        * html/HTMLPreElement.cpp:
        (WebCore::HTMLPreElement::collectStyleForAttribute):
        * html/HTMLPreElement.h:
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::parseAttribute):
        * html/HTMLProgressElement.h:
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::parseAttribute):
        * html/HTMLScriptElement.h:
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::parseAttribute):
        (WebCore::HTMLSelectElement::parseMultipleAttribute):
        * html/HTMLSelectElement.h:
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::parseAttribute):
        * html/HTMLStyleElement.h:
        * html/HTMLTableCaptionElement.cpp:
        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
        * html/HTMLTableCaptionElement.h:
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
        (WebCore::HTMLTableCellElement::parseAttribute):
        * html/HTMLTableCellElement.h:
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::collectStyleForAttribute):
        (WebCore::HTMLTableColElement::parseAttribute):
        * html/HTMLTableColElement.h:
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::collectStyleForAttribute):
        (WebCore::HTMLTableElement::parseAttribute):
        * html/HTMLTableElement.h:
        * html/HTMLTablePartElement.cpp:
        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
        * html/HTMLTablePartElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::collectStyleForAttribute):
        (WebCore::HTMLTextAreaElement::parseAttribute):
        * html/HTMLTextAreaElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::parseAttribute):
        * html/HTMLTextFormControlElement.h:
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::parseAttribute):
        * html/HTMLTrackElement.h:
        * html/HTMLUListElement.cpp:
        (WebCore::HTMLUListElement::collectStyleForAttribute):
        * html/HTMLUListElement.h:
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::collectStyleForAttribute):
        (WebCore::HTMLVideoElement::parseAttribute):
        * html/HTMLVideoElement.h:
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::HTMLContentElement::parseAttribute):
        * html/shadow/HTMLContentElement.h:
        * mathml/MathMLElement.cpp:
        (WebCore::MathMLElement::collectStyleForAttribute):
        * mathml/MathMLElement.h:
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::parseAttribute):
        * svg/SVGAElement.h:
        * svg/SVGAnimateMotionElement.cpp:
        (WebCore::SVGAnimateMotionElement::parseAttribute):
        * svg/SVGAnimateMotionElement.h:
        * svg/SVGAnimateTransformElement.cpp:
        (WebCore::SVGAnimateTransformElement::parseAttribute):
        * svg/SVGAnimateTransformElement.h:
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::parseAttribute):
        * svg/SVGAnimationElement.h:
        * svg/SVGCircleElement.cpp:
        (WebCore::SVGCircleElement::parseAttribute):
        * svg/SVGCircleElement.h:
        * svg/SVGClipPathElement.cpp:
        (WebCore::SVGClipPathElement::parseAttribute):
        * svg/SVGClipPathElement.h:
        * svg/SVGComponentTransferFunctionElement.cpp:
        (WebCore::SVGComponentTransferFunctionElement::parseAttribute):
        * svg/SVGComponentTransferFunctionElement.h:
        * svg/SVGCursorElement.cpp:
        (WebCore::SVGCursorElement::parseAttribute):
        * svg/SVGCursorElement.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::reportAttributeParsingError):
        (WebCore::SVGElement::parseAttribute):
        (WebCore::SVGElement::attributeChanged):
        * svg/SVGElement.h:
        * svg/SVGEllipseElement.cpp:
        (WebCore::SVGEllipseElement::parseAttribute):
        * svg/SVGEllipseElement.h:
        * svg/SVGExternalResourcesRequired.cpp:
        (WebCore::SVGExternalResourcesRequired::parseAttribute):
        * svg/SVGExternalResourcesRequired.h:
        (SVGExternalResourcesRequired):
        * svg/SVGFEBlendElement.cpp:
        (WebCore::SVGFEBlendElement::parseAttribute):
        * svg/SVGFEBlendElement.h:
        * svg/SVGFEColorMatrixElement.cpp:
        (WebCore::SVGFEColorMatrixElement::parseAttribute):
        * svg/SVGFEColorMatrixElement.h:
        * svg/SVGFEComponentTransferElement.cpp:
        (WebCore::SVGFEComponentTransferElement::parseAttribute):
        * svg/SVGFEComponentTransferElement.h:
        * svg/SVGFECompositeElement.cpp:
        (WebCore::SVGFECompositeElement::parseAttribute):
        * svg/SVGFECompositeElement.h:
        * svg/SVGFEConvolveMatrixElement.cpp:
        (WebCore::SVGFEConvolveMatrixElement::parseAttribute):
        * svg/SVGFEConvolveMatrixElement.h:
        * svg/SVGFEDiffuseLightingElement.cpp:
        (WebCore::SVGFEDiffuseLightingElement::parseAttribute):
        * svg/SVGFEDiffuseLightingElement.h:
        * svg/SVGFEDisplacementMapElement.cpp:
        (WebCore::SVGFEDisplacementMapElement::parseAttribute):
        * svg/SVGFEDisplacementMapElement.h:
        * svg/SVGFEDropShadowElement.cpp:
        (WebCore::SVGFEDropShadowElement::parseAttribute):
        * svg/SVGFEDropShadowElement.h:
        * svg/SVGFEGaussianBlurElement.cpp:
        (WebCore::SVGFEGaussianBlurElement::parseAttribute):
        * svg/SVGFEGaussianBlurElement.h:
        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::parseAttribute):
        * svg/SVGFEImageElement.h:
        * svg/SVGFELightElement.cpp:
        (WebCore::SVGFELightElement::parseAttribute):
        * svg/SVGFELightElement.h:
        * svg/SVGFEMergeNodeElement.cpp:
        (WebCore::SVGFEMergeNodeElement::parseAttribute):
        * svg/SVGFEMergeNodeElement.h:
        * svg/SVGFEMorphologyElement.cpp:
        (WebCore::SVGFEMorphologyElement::parseAttribute):
        * svg/SVGFEMorphologyElement.h:
        * svg/SVGFEOffsetElement.cpp:
        (WebCore::SVGFEOffsetElement::parseAttribute):
        * svg/SVGFEOffsetElement.h:
        * svg/SVGFESpecularLightingElement.cpp:
        (WebCore::SVGFESpecularLightingElement::parseAttribute):
        * svg/SVGFESpecularLightingElement.h:
        * svg/SVGFETileElement.cpp:
        (WebCore::SVGFETileElement::parseAttribute):
        * svg/SVGFETileElement.h:
        * svg/SVGFETurbulenceElement.cpp:
        (WebCore::SVGFETurbulenceElement::parseAttribute):
        * svg/SVGFETurbulenceElement.h:
        * svg/SVGFilterElement.cpp:
        (WebCore::SVGFilterElement::parseAttribute):
        * svg/SVGFilterElement.h:
        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
        (WebCore::SVGFilterPrimitiveStandardAttributes::parseAttribute):
        * svg/SVGFilterPrimitiveStandardAttributes.h:
        (SVGFilterPrimitiveStandardAttributes):
        * svg/SVGFitToViewBox.cpp:
        (WebCore::SVGFitToViewBox::parseAttribute):
        * svg/SVGFitToViewBox.h:
        (SVGFitToViewBox):
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::parseAttribute):
        * svg/SVGFontFaceElement.h:
        * svg/SVGFontFaceUriElement.cpp:
        (WebCore::SVGFontFaceUriElement::parseAttribute):
        * svg/SVGFontFaceUriElement.h:
        * svg/SVGForeignObjectElement.cpp:
        (WebCore::SVGForeignObjectElement::parseAttribute):
        * svg/SVGForeignObjectElement.h:
        * svg/SVGGElement.cpp:
        (WebCore::SVGGElement::parseAttribute):
        * svg/SVGGElement.h:
        * svg/SVGGlyphElement.cpp:
        (WebCore::SVGGlyphElement::parseAttribute):
        * svg/SVGGlyphElement.h:
        * svg/SVGGlyphRefElement.cpp:
        (WebCore::SVGGlyphRefElement::parseAttribute):
        * svg/SVGGlyphRefElement.h:
        * svg/SVGGradientElement.cpp:
        (WebCore::SVGGradientElement::parseAttribute):
        * svg/SVGGradientElement.h:
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::collectStyleForAttribute):
        (WebCore::SVGImageElement::parseAttribute):
        * svg/SVGImageElement.h:
        * svg/SVGImageLoader.cpp:
        (WebCore::SVGImageLoader::sourceURI):
        * svg/SVGLangSpace.cpp:
        (WebCore::SVGLangSpace::parseAttribute):
        * svg/SVGLangSpace.h:
        (SVGLangSpace):
        * svg/SVGLineElement.cpp:
        (WebCore::SVGLineElement::parseAttribute):
        * svg/SVGLineElement.h:
        * svg/SVGLinearGradientElement.cpp:
        (WebCore::SVGLinearGradientElement::parseAttribute):
        * svg/SVGLinearGradientElement.h:
        * svg/SVGMPathElement.cpp:
        (WebCore::SVGMPathElement::parseAttribute):
        * svg/SVGMPathElement.h:
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::parseAttribute):
        * svg/SVGMarkerElement.h:
        * svg/SVGMaskElement.cpp:
        (WebCore::SVGMaskElement::parseAttribute):
        * svg/SVGMaskElement.h:
        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::parseAttribute):
        * svg/SVGPathElement.h:
        * svg/SVGPatternElement.cpp:
        (WebCore::SVGPatternElement::parseAttribute):
        * svg/SVGPatternElement.h:
        * svg/SVGPolyElement.cpp:
        (WebCore::SVGPolyElement::parseAttribute):
        * svg/SVGPolyElement.h:
        * svg/SVGRadialGradientElement.cpp:
        (WebCore::SVGRadialGradientElement::parseAttribute):
        * svg/SVGRadialGradientElement.h:
        * svg/SVGRectElement.cpp:
        (WebCore::SVGRectElement::parseAttribute):
        * svg/SVGRectElement.h:
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::parseAttribute):
        * svg/SVGSVGElement.h:
        * svg/SVGScriptElement.cpp:
        (WebCore::SVGScriptElement::parseAttribute):
        * svg/SVGScriptElement.h:
        * svg/SVGStopElement.cpp:
        (WebCore::SVGStopElement::parseAttribute):
        * svg/SVGStopElement.h:
        * svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::parseAttribute):
        * svg/SVGStyleElement.h:
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::collectStyleForAttribute):
        (WebCore::SVGStyledElement::parseAttribute):
        * svg/SVGStyledElement.h:
        * svg/SVGStyledTransformableElement.cpp:
        (WebCore::SVGStyledTransformableElement::parseAttribute):
        * svg/SVGStyledTransformableElement.h:
        * svg/SVGSymbolElement.cpp:
        (WebCore::SVGSymbolElement::parseAttribute):
        * svg/SVGSymbolElement.h:
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::parseAttribute):
        * svg/SVGTRefElement.h:
        * svg/SVGTests.cpp:
        (WebCore::SVGTests::parseAttribute):
        * svg/SVGTests.h:
        (SVGTests):
        * svg/SVGTextContentElement.cpp:
        (WebCore::SVGTextContentElement::collectStyleForAttribute):
        (WebCore::SVGTextContentElement::parseAttribute):
        * svg/SVGTextContentElement.h:
        * svg/SVGTextElement.cpp:
        (WebCore::SVGTextElement::parseAttribute):
        * svg/SVGTextElement.h:
        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::parseAttribute):
        * svg/SVGTextPathElement.h:
        * svg/SVGTextPositioningElement.cpp:
        (WebCore::SVGTextPositioningElement::parseAttribute):
        * svg/SVGTextPositioningElement.h:
        * svg/SVGURIReference.cpp:
        (WebCore::SVGURIReference::parseAttribute):
        * svg/SVGURIReference.h:
        (SVGURIReference):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::parseAttribute):
        * svg/SVGUseElement.h:
        * svg/SVGViewElement.cpp:
        (WebCore::SVGViewElement::parseAttribute):
        * svg/SVGViewElement.h:
        * svg/SVGZoomAndPan.cpp:
        (WebCore::SVGZoomAndPan::parseAttribute):
        * svg/SVGZoomAndPan.h:
        (SVGZoomAndPan):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::parseAttribute):
        * svg/animation/SVGSMILElement.h:

2012-05-15  Kenneth Russell  <kbr@google.com>

        Assertion failure running Mozilla's WebGL performance regression tests
        https://bugs.webkit.org/show_bug.cgi?id=85942

        Reviewed by Stephen White.

        Fixed incorrect assumptions about source formats and buffer sizes
        when uploading to floating-point textures. Added code paths
        supporting the necessary conversions.

        Tests have been added to the WebGL conformance suite which cover
        these new code paths; they verify uploads of HTMLCanvasElement,
        HTMLImageElement, HTMLVideoElement, and ImageData to
        floating-point textures. However, because floating-point texture
        support is optional, and generally only supported on bots which
        run with real GPUs and not in virtual machines, it isn't feasible
        to incorporate these tests as layout tests.

        Ran the new WebGL conformance tests in Chromium on Linux; all
        pass.

        * platform/graphics/GraphicsContext3D.cpp:
        (WebCore::GraphicsContext3D::extractImageData):
        Properly compute size of destination buffer.

        (WebCore):
        Add pack/unpack routines for converting RGBA8/BGRA8 to floating point.

        (WebCore::doFloatingPointPacking):
        Support RGBA8 and BGRA8 source formats.

        (WebCore::isFloatingPointSource):
        Factored out logic for assertions.

        (WebCore::GraphicsContext3D::packPixels):
        Generalized assertions and logic.

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::getImageData):
        Properly compute size of destination buffer.

        * platform/graphics/cg/GraphicsContext3DCG.cpp:
        (WebCore::GraphicsContext3D::getImageData):
        Properly compute size of destination buffer.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
        (WebCore::GraphicsContext3D::getImageData):
        Properly compute size of destination buffer.

        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
        (WebCore::GraphicsContext3D::getImageData):
        Properly compute size of destination buffer.

2012-05-15  James Robinson  <jamesr@chromium.org>

        [chromium] Chromium port never sets USE(CG) so code behind it is dead
        https://bugs.webkit.org/show_bug.cgi?id=86537

        Reviewed by Adrienne Walker.

        Deletes code behind USE(CG) in chromium-specific code and removes unneeded USE(SKIA) guards.

        * platform/chromium/DragImageRef.h:
        (WebCore):
        * platform/chromium/MIMETypeRegistryChromium.cpp:
        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
        * platform/chromium/ScrollbarThemeChromiumMac.mm:
        (WebCore::ScrollbarThemeChromiumMac::paint):
        * platform/chromium/ThemeChromiumMac.mm:
        (WebCore::paintStepper):
        * platform/graphics/chromium/PlatformImage.cpp:
        (WebCore::PlatformImage::updateFromImage):

2012-05-15  Keyar Hood  <keyar@chromium.org>

        Skia does not respect a specified InterpolationQuality
        https://bugs.webkit.org/show_bug.cgi?id=86249

        Reviewed by Stephen White.

        The added functionality is not exposed to higher layers of webkit.
        Tests will be added that will exercise these changes when bug 82804 is 
        fixed.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawImage):
        (WebCore::GraphicsContext::drawImageBuffer):
        Code to have the useLowQualityScale cause the InterpolationQuality be
        be set to low for Chromium but remain as none for other platforms.
        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore::limitResamplingMode): Added
        (WebCore):
        (WebCore::paintSkBitmap):
        (WebCore::Image::drawPattern):
        We now limit the resampling choice based on what InterpolationQuality
        is set as. InterpolationNone restricts resampling to RESAMPLE_NONE,
        InterpolationLow and InterpolationMedium restricts resampling to
        RESAMPLE_LINEAR. InterpolationHigh and InterpolationDefault do not
        change the resampling.
        
        Furthermore, the choice on how to set the filter bitmap flag in
        paintSkBitmap was made to be consistent with that in
        Image::drawPattern.


2012-05-15  Jeffrey Pfau  <jpfau@apple.com>

        ImageDocuments erroneously trigger beforeload events for the main resource
        https://bugs.webkit.org/show_bug.cgi?id=86543
        <rdar://problem/11309013>

        Reviewed by Brady Eidson.

        No new tests; testing framework doesn't allow for testing ImageDocuments with injected JavaScript.

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2012-05-15  Dirk Pranke  <dpranke@chromium.org>

        [chromium] ScrollElasticityController.mm doesn't compile with the 10.6 SDK on mac
        https://bugs.webkit.org/show_bug.cgi?id=86544

        Reviewed by Anders Carlsson.

        This is a build fix for now until we can figure out what a
        better way to approach this is.

        * platform/mac/ScrollElasticityController.mm:
        (WebCore):

2012-05-15  Nate Chapin  <japhet@chromium.org>

        MainResourceLoader::load() always returns true, so make it return
        void and delete the related dead code.
        https://bugs.webkit.org/show_bug.cgi?id=86413

        Reviewed by Alexey Proskuryakov.

        No new tests, cleanup only.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource):
        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::load):
        * loader/MainResourceLoader.h:
        (MainResourceLoader):

2012-05-15  Ian Vollick  <vollick@chromium.org>

        [chromium] Ensure animations get ticked at least once when added.
        https://bugs.webkit.org/show_bug.cgi?id=86013

        Reviewed by James Robinson.

        Tested in
          CCLayerTreeHostTestTickAnimationWhileBackgrounded.runSingleThreaded
          CCLayerTreeHostTestAddAnimationWithTimingFunction.runSingleThreaded
          CCLayerTreeHostTestSynchronizeAnimationStartTimes.runSingleThreaded
          CCLayerTreeHostTestAnimationFinishedEvents.runSingleThreaded

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::didAddAnimation):
        (WebCore):
        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (CCSingleThreadProxyAnimationTimer):
        (WebCore::CCSingleThreadProxyAnimationTimer::create):
        (WebCore::CCSingleThreadProxyAnimationTimer::CCSingleThreadProxyAnimationTimer):
        (WebCore):
        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
        (WebCore::CCSingleThreadProxy::didAddAnimation):
        (WebCore::CCSingleThreadProxy::doComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-05-15  Alexandre Elias  <aelias@google.com>

        [chromium] Fix unsafe viewport tag dispatch
        https://bugs.webkit.org/show_bug.cgi?id=80554

        Reviewed by Adam Barth.

        In some uncommon situations (such as window.open() new tab on
        Android), dispatchViewportPropertiesDidChange may early-return without
        setting the page scale because the window size is not yet
        available from the embedder.  At that point, the previous behavior was
        to call it again in layoutUpdated(), but this is unsafe since it
        leaves a pending needsLayout.

        I moved the dispatch call into WebViewImpl::didChangeContentsSize and
        WebViewImpl::resize() instead -- these represent more explicitly the
        situations where the inputs to the viewport tag calculation change.  I
        removed the other dispatch call from setFrameRect as it's now
        redundant.

        Covered by FixedLayoutInitializeAtMinimumPageScale test introduced
        in http://webk.it/82949 (an assertion will fire there without
        this fix).

        * page/FrameView.cpp:
        (WebCore::FrameView::setFrameRect):

2012-05-15  Jer Noble  <jer.noble@apple.com>

        r117147 causes a null-deref crash in DOMImplementation::createDocument()
        https://bugs.webkit.org/show_bug.cgi?id=86532

        Reviewed by James Robinson.

        No new tests, but fixes many crashing tests.

        Protect against the possibility of being passed a NULL frame in
        DOMImplementation::createDocument().

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):

2012-05-15  Julien Chaffraix  <jchaffraix@webkit.org>

        Use posZOrderList() / negZOrderList() everywhere to avoid querying dirtied lists
        https://bugs.webkit.org/show_bug.cgi?id=86416

        Reviewed by Simon Fraser.

        Covered by existing tests that are not ASSERTing after this change.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::update3DTransformedDescendantStatus):
        Added a call to updateZOrderLists() to the previous sites as nothing guarantees
        that we have recomputed our z-order lists.

        (WebCore::RenderLayer::paintLayerContents):
        (WebCore::RenderLayer::hitTestLayer):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::needsContentsCompositingLayer):
        Converted those functions to use the safe getters.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::hasNegativeZOrderList):
        Newly added funtion to return if we have a negative z-order list.

2012-05-15  Abhishek Arya  <inferno@chromium.org>

        Crash due shadow tree parent confusion in SVG.
        https://bugs.webkit.org/show_bug.cgi?id=84248

        Reviewed by Nikolas Zimmermann.

        Test: svg/foreignObject/viewport-foreignobject-crash.html

        When we try to make a decision on whether we need an outer
        SVGRoot container, we detect if we are in shadow tree or not.
        We also need to make sure that our parentOrHostElement is also
        an svg element. 

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::isOutermostSVGSVGElement):

2012-05-15  Lauro Neto  <lauro.neto@openbossa.org>

        [File API] URL methods handling null arguments
        https://bugs.webkit.org/show_bug.cgi?id=69693

        Reviewed by Adam Barth.

        Per the latest editor's draft of the File API:
        http://dev.w3.org/2006/webapi/FileAPI/#dfn-createObjectURL

        Use null instead of undefined as return value when a
        null blob is given to URL.createObjectURL.

        Test: fast/files/url-null.html

        * html/DOMURL.idl:

2012-05-15  Jer Noble  <jer.noble@apple.com>

        Unreviewed build fix [Qt].

        Protect the definition of DOMImplementationSupportsTypeClient class with
        #if ENABLE(VIDEO) so as not to cause compilation errors on ports with
        VIDEO disabled.

        * dom/DOMImplementation.cpp:

2012-05-14  Jer Noble  <jer.noble@apple.com>

        Site-specific hack: Disclaim WebM as a supported type on Mac for YouTube.
        https://bugs.webkit.org/show_bug.cgi?id=86409

        Reviewed by Darin Adler.

        No new tests; site specific hack.

        Add a Mac-only site-specific hack which disclaims both video/webm and video/x-flv
        as supported types when the media element's document has a host of youtube.com.

        Add a new, pure-virtual prototype class for use by MediaPlayer::supportsType:
        * platform/graphics/MediaPlayer.h:
        (MediaPlayerSupportsTypeClient):
        (WebCore::MediaPlayerSupportsTypeClient::~MediaPlayerSupportsTypeClient):
        (WebCore::MediaPlayerSupportsTypeClient::mediaPlayerNeedsSiteSpecificHacks):
        (WebCore::MediaPlayerSupportsTypeClient::mediaPlayerDocumentHost):

        Use these new client calls to determine whether to apply the site-specific
        hack:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::supportsType):

        Add this prototype class as a superclass of HTMLMediaElement.  Pass in the
        HTMLMediaElement's this pointer when calling MediaPlayer::supportsType():
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::canPlayType):
        (WebCore::HTMLMediaElement::selectNextSourceChild):
        (WebCore::HTMLMediaElement::mediaPlayerNeedsSiteSpecificHacks):
        (WebCore::HTMLMediaElement::mediaPlayerDocumentHost):
        * html/HTMLMediaElement.h:

        As is HTMLMediaElement, a MediaPlayerSupportsTypeClient class is needed. Add a
        new class DOMImplementationSupportsTypeClient, an instance of which will be 
        passed to MediaPlayer::supportsType():
        * dom/DOMImplementation.cpp:
        (DOMImplementationSupportsTypeClient):
        (WebCore::DOMImplementationSupportsTypeClient::DOMImplementationSupportsTypeClient):
        (WebCore::DOMImplementation::createDocument):
        (WebCore::DOMImplementation::mediaPlayerNeedsSiteSpecificHacks):
        (WebCore::DOMImplementation::mediaPlayerDocumentHost):
        * dom/DOMImplementation.h:

2012-05-15  Anders Carlsson  <andersca@apple.com>

        Use unaccelerated scrolling deltas when rubber-banding
        https://bugs.webkit.org/show_bug.cgi?id=86503
        <rdar://problem/11378742>

        Reviewed by Sam Weinig.

        * WebCore.exp.in:
        * platform/PlatformWheelEvent.h:
        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
        (PlatformWheelEvent):
        (WebCore::PlatformWheelEvent::scrollCount):
        (WebCore::PlatformWheelEvent::unacceleratedScrollingDeltaX):
        (WebCore::PlatformWheelEvent::unacceleratedScrollingDeltaY):
        Add scroll count and unaccelerated scrolling deltas.

        * platform/mac/ScrollElasticityController.mm:
        (WebCore::elasticDeltaForTimeDelta):
        (WebCore::elasticDeltaForReboundDelta):
        (WebCore::reboundDeltaForElasticDelta):
        Call the new WKSI functions.

        (WebCore::ScrollElasticityController::handleWheelEvent):
        Use the unaccelerated scrolling deltas when needed.

        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        Add new WKSI functions.

2012-05-15  Terry Anderson  <tdanderson@chromium.org>

        [chromium] Compute the best target node on a GestureTap event
        https://bugs.webkit.org/show_bug.cgi?id=85101

        Reviewed by Adam Barth.

        Using the tests in the touchadjustment/ directory.

        * WebCore.gypi:
        Include TouchAdjustment.* files.
        * page/TouchAdjustment.cpp:
        (WebCore::TouchAdjustment::zoomableIntersectionQuotient):
        (WebCore::TouchAdjustment::findNodeWithLowestDistanceMetric):
        No longer using the INFINITY constant due to problems with compiling
        on chromium win.

2012-05-15  Chris Rogers  <crogers@google.com>

        Add AudioSummingJunction class to handle fan-in (abstracted from AudioNodeInput)
        https://bugs.webkit.org/show_bug.cgi?id=86396

        Reviewed by Kenneth Russell.

        No new tests.  Existing layout tests already extensively test summing.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        Add AudioSummingJunction files to makefiles.

        * Modules/webaudio/AudioContext.cpp:
        * Modules/webaudio/AudioContext.h:
        (WebCore::AudioContext::handlePreRenderTasks):
        (WebCore::AudioContext::handlePostRenderTasks):
        (WebCore::AudioContext::deleteMarkedNodes):
        (WebCore::AudioContext::markSummingJunctionDirty):
        (WebCore::AudioContext::removeMarkedSummingJunction):
        (WebCore::AudioContext::handleDirtyAudioSummingJunctions):
        Simple munge from AudioNodeInput -> AudioSummingJunction

        * Modules/webaudio/AudioNodeInput.cpp:
        * Modules/webaudio/AudioNodeInput.h:
        (WebCore::AudioNodeInput::AudioNodeInput):
        (WebCore::AudioNodeInput::didUpdate):
        Remove logic from AudioNodeInput which now is being moved to AudioSummingJunction.

        * Modules/webaudio/AudioSummingJunction.cpp: Added.
        * Modules/webaudio/AudioSummingJunction.h: Added.
        (WebCore::AudioSummingJunction::AudioSummingJunction):
        (WebCore::AudioSummingJunction::~AudioSummingJunction):
        (WebCore::AudioSummingJunction::changedOutputs):
        (WebCore::AudioSummingJunction::updateRenderingState):
        (WebCore::AudioSummingJunction::context):
        (WebCore::AudioSummingJunction::numberOfRenderingConnections):
        (WebCore::AudioSummingJunction::renderingOutput):
        (WebCore::AudioSummingJunction::isConnected):
        (WebCore::AudioSummingJunction::numberOfConnections):
        Add AudioSummingJunction which is an abstraction to manage/track the connections from AudioNodeOutputs
        representing the fan-in points for unity gain summing junctions.

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        Add AudioSummingJunction files to makefiles.

2012-05-15  Dan Bernstein  <mitz@apple.com>

        Ruby annotation is incorrectly identified as a paragraph boundary
        https://bugs.webkit.org/show_bug.cgi?id=86507

        Reviewed by Darin Adler.

        Test: editing/selection/paragraph-with-ruby.html

        * editing/htmlediting.cpp:
        (WebCore::isBlock): Changed to return false for ruby text.

2012-05-15  Philippe Normand  <pnormand@igalia.com>

        [GTK] Un-used GStreamer linker options
        https://bugs.webkit.org/show_bug.cgi?id=86407

        Reviewed by Martin Robinson.

        * GNUmakefile.am: Remove no-longer used webcore_libadd variable.

2012-05-15  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86506
        REGRESSION (tiled drawing): No scrollbar while page is loading
        -and corresponding
        <rdar://problem/11444589>

        Reviewed by Anders Carlsson.

        We have always had a mechanism in place to suppress painting overlay 
        scrollbars while the page is loading. However, that mechaism is 
        overriden if the page has been scrolled. It should be, anyway. It was 
        not being overriden when the scrolling was handled as a wheel event by 
        the scrolling tree. This patch takes advantage of the fact that 
        ScrollingTree::handleWheelEvent() already calls back to the main 
        thread for handleWheelEventPhase() and just patches 
        handleWheelEventPhase to mark m_haveScrolledSincePageLoad as true.
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::handleWheelEventPhase):

2012-05-15  Jessie Berlin  <jberlin@apple.com>

        WKContextSetCacheModel(contextref, kWKCacheModelDocumentViewer) doesn't prevent pages from
        going into the PageCache.
        https://bugs.webkit.org/show_bug.cgi?id=85891

        Reviewed by Brady Eidson.

        Do not claim that it is possible to cache a page when the page cache has a capacity of 0.

        Covered by the modified DOMWindowExtensionNoCache WK2 API test.

        * history/PageCache.cpp:
        (WebCore::PageCache::canCache):
        Check m_capacity.
        * history/PageCache.h:

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        canCache is no longer static on PageCache.

2012-05-15  James Robinson  <jamesr@chromium.org>

        Unreviewed, rolling out r116811.
        http://trac.webkit.org/changeset/116811
        https://bugs.webkit.org/show_bug.cgi?id=86257

        Introduced layering violation

        * WebCore.gypi:

2012-05-15  Darin Adler  <darin@apple.com>

        Font copy constructor unnecessarily recalculates transcoding
        https://bugs.webkit.org/show_bug.cgi?id=86490

        Reviewed by Dan Bernstein.

        * platform/graphics/Font.cpp:
        (WebCore::Font::Font): Copy m_needsTranscoding instead of recomputing it.

2012-05-15  Andreas Kling  <kling@webkit.org>

        Deep copy PluginModuleInfo before passing across thread boundary.
        <http://webkit.org/b/86491>
        <rdar://problem/11451178>

        Reviewed by Anders Carlsson.

        * plugins/PluginData.h:
        (MimeClassInfo):
        (WebCore::MimeClassInfo::isolatedCopy):
        (PluginInfo):
        (WebCore::PluginInfo::isolatedCopy):

2012-05-15  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116712.
        http://trac.webkit.org/changeset/116712
        https://bugs.webkit.org/show_bug.cgi?id=86484

        This patch is causing crashes in Chromium Canary builds
        (Requested by pilgrim_google__ on #webkit).

        * storage/StorageArea.h:
        (StorageArea):
        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::disabledByPrivateBrowsingInFrame):
        (WebCore::StorageAreaImpl::setItem):
        (WebCore::StorageAreaImpl::removeItem):
        (WebCore::StorageAreaImpl::clear):
        * storage/StorageAreaImpl.h:
        (StorageAreaImpl):

2012-05-15  Darin Adler  <darin@apple.com>

        Optimize save/restore with no drawing operations between them (shows up on some canvas benchmarks)
        https://bugs.webkit.org/show_bug.cgi?id=86448

        Reviewed by Simon Fraser.

        Since canvas programmers sometimes end up doing extra save/restore pairs with no actual drawing
        in between, optimize that case by not realizing saves until we have to. This is doubly important
        because saves are costly.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D): Initialize m_unrealizedSaveCount.
        (WebCore::CanvasRenderingContext2D::isAccelerated): Improve performance by calling the
        drawingContext function only once.
        (WebCore::CanvasRenderingContext2D::reset): Set m_unrealizedSaveCount to 0.
        (WebCore::CanvasRenderingContext2D::realizeSavesLoop): Added. Replaces the save function as the
        function that actually pushes context onto the state stack.
        (WebCore::CanvasRenderingContext2D::restore): Added code to do an early return if we can do the
        restore just by decrementing the unrealized save count.
        (WebCore::CanvasRenderingContext2D::setStrokeStyle): Added calls to realizeSaves and replaced
        calls to state with calls to modifiableState.
        (WebCore::CanvasRenderingContext2D::setFillStyle): Ditto.
        (WebCore::CanvasRenderingContext2D::setLineWidth): Ditto. Also added an early out for cases where
        the line width is not changing.
        (WebCore::CanvasRenderingContext2D::setLineCap): Ditto.
        (WebCore::CanvasRenderingContext2D::setLineJoin): Ditto.
        (WebCore::CanvasRenderingContext2D::setMiterLimit): Ditto.
        (WebCore::CanvasRenderingContext2D::setShadowOffsetX): Ditto.
        (WebCore::CanvasRenderingContext2D::setShadowOffsetY): Ditto.
        (WebCore::CanvasRenderingContext2D::setShadowBlur): Ditto.
        (WebCore::CanvasRenderingContext2D::setShadowColor): Ditto.
        (WebCore::CanvasRenderingContext2D::setWebkitLineDash): Ditto.
        (WebCore::CanvasRenderingContext2D::setWebkitLineDashOffset): Ditto.
        (WebCore::CanvasRenderingContext2D::setGlobalAlpha): Ditto.
        (WebCore::CanvasRenderingContext2D::setGlobalCompositeOperation): Ditto.
        (WebCore::CanvasRenderingContext2D::scale): Ditto.
        (WebCore::CanvasRenderingContext2D::rotate): Ditto.
        (WebCore::CanvasRenderingContext2D::translate): Ditto.
        (WebCore::CanvasRenderingContext2D::transform): Ditto.
        (WebCore::CanvasRenderingContext2D::setTransform): Ditto.
        (WebCore::CanvasRenderingContext2D::setStrokeColor): Ditto.
        (WebCore::CanvasRenderingContext2D::setFillColor): Ditto.
        (WebCore::CanvasRenderingContext2D::clip): Ditto.
        (WebCore::CanvasRenderingContext2D::clearRect): Changed implementation so it does not save
        the graphics context in the common case where shadows, global alpha, and global compositing
        operators do not interfer with the function's operation. This allowed us to get rid of the
        setAllAttributesToDefault function, which was used nowhere else.
        (WebCore::CanvasRenderingContext2D::setShadow): Added a new common bottleneck and made all
        the setShadow functions call it.
        (WebCore::CanvasRenderingContext2D::clearShadow): Changed to call the new setShadow.
        (WebCore::CanvasRenderingContext2D::setFont): Renamed tempDecl to the more friendly
        parsedStyle. Changed code structure so the CSS parser is deleted right after parsing is
        done. Used string concatenation instead of more expensive string append. Added calls to
        realizeSaves and modifiableState.
        (WebCore::CanvasRenderingContext2D::setTextAlign): Added calls to realizeSaves and replaced
        calls to state with calls to modifiableState. Also added an early out for cases where the
        alignment is not changing.
        (WebCore::CanvasRenderingContext2D::setTextBaseline): Ditto.

        * html/canvas/CanvasRenderingContext2D.h: Made save an inline function that bumps
        m_unrealizedSaveCount. Removed setAllAttributesToDefault. Added OVERRIDE for all the
        virtual function overrides, and made them all private. Moved m_path down with the other data
        members. Renamed the non-const state function to modifiableState. Added a realizeSaves
        function and the realizeSavesLoop for the unusual case where there is work to do.
        Added m_unrealizedSaveCount.

2012-05-15  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Setting onended on a LocalMediaStream triggers an assertion in V8
        https://bugs.webkit.org/show_bug.cgi?id=86459

        Reviewed by Adam Barth.

        LocalMediaStream inherits from MediaStream, but only MediaStream have the
        EventTarget idl attribute. Adding the attribute to LocalMediaStream as well fixes the issue.

        Test: fast/mediastream/LocalMediaStream-onended.html

        * Modules/mediastream/LocalMediaStream.idl:

2012-05-15  Terry Anderson  <tdanderson@chromium.org>

        [chromium] Remove unused code for tap target fuzzing
        https://bugs.webkit.org/show_bug.cgi?id=86252

        Reviewed by Adam Barth.

        No tests required since this is a cleanup of unused code.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleGestureTap):
        * page/EventHandler.h:
        (EventHandler):
        The touch adjustment code will be used to determine the best target
        for a GestureTap event instead of passing in a pre-targeted node.
        * platform/PlatformGestureEvent.h:
        (WebCore::PlatformGestureEvent::PlatformGestureEvent):
        (PlatformGestureEvent):
        A rectangular touch region is defined by the touch center and the
        delta values only, so gammaX and gammaY are not needed.

2012-05-15  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        [Qt] WebKit with Qt5 hangs on Mac
        https://bugs.webkit.org/show_bug.cgi?id=79785

        Reviewed by Tor Arne Vestbø.

        Delay the initialization of our QNetworkConfigurationManager used in
        NetworkStateNotifierPrivate. On Mac it was causing a race condition because it
        spawns a thread that triggers a static initializer in Qt, while in the main
        thread NetworkStateNotifier is being static initialized. On Mac the lock for
        static initializers is shared between all of them, causing a deadlock.

        The issue was also reported in http://openradar.appspot.com/11217150.

        * platform/network/qt/NetworkStateNotifierPrivate.h:
        (NetworkStateNotifierPrivate):
        (WebCore::NetworkStateNotifierPrivate::effectivelyOnline):
        * platform/network/qt/NetworkStateNotifierQt.cpp:
        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
        (WebCore::NetworkStateNotifierPrivate::setNetworkAccessAllowed):
        (WebCore::NetworkStateNotifierPrivate::setOnlineState):
        (WebCore::NetworkStateNotifierPrivate::initialize):
        (WebCore):
        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
        (WebCore::NetworkStateNotifier::updateState):
        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):

2012-05-15  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Factor HitTestPoint out of HitTestResult.
        https://bugs.webkit.org/show_bug.cgi?id=85965

        Reviewed by Simon Fraser.

        In preparation for handling transformations on area-based hit-testing, 
        we need to factor test-point and test-area out of HitTestResult so that
        it can be transformed independently.

        To maintain the current API as closely as possible HitTestResult now
        inherit from HitTestPoint, representing the original untransformed
        hitTestPoint.

        No change in functionality. No new tests. 

        * rendering/HitTestResult.cpp:
        (WebCore::HitTestPoint::HitTestPoint):
        (WebCore::HitTestPoint::~HitTestPoint):
        (WebCore::HitTestPoint::operator=):
        (WebCore::HitTestPoint::rectForPoint):
        (WebCore::HitTestResult::HitTestResult):
        (WebCore::HitTestResult::operator=):
        (WebCore::HitTestResult::isSelected):
        (WebCore::HitTestResult::spellingToolTip):
        (WebCore::HitTestResult::replacedString):
        * rendering/HitTestResult.h:
        (HitTestPoint):
        (WebCore::HitTestPoint::point):
        (WebCore::HitTestPoint::roundedPoint):
        (WebCore::HitTestPoint::setPoint):
        (WebCore::HitTestPoint::isRectBasedTest):
        (WebCore::HitTestPoint::topPadding):
        (WebCore::HitTestPoint::rightPadding):
        (WebCore::HitTestPoint::bottomPadding):
        (WebCore::HitTestPoint::leftPadding):
        (HitTestResult):
        (WebCore::HitTestResult::hitTestPoint):
        (WebCore::HitTestPoint::rectForPoint):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hitTestLayer):
        (WebCore::RenderLayer::hitTestList):

2012-05-15  Rob Buis  <rbuis@rim.com>

        Refactor SVG parts of Node::addEventListener/removeEventListener
        https://bugs.webkit.org/show_bug.cgi?id=86426

        Reviewed by Nikolas Zimmermann.

        Move SVG parts of Node::addEventListener/removeEventListener into svg/. Now we do not
        have to check in Node::addEventListener/removeEventListener if we are dealing with an SVG
        element. Make tryAddEventListener/tryRemoveEventListener protected methods on Node to be able to use
        it in SVGElement.

        No new tests, since no change in behavior, just refactoring.

        * dom/Node.cpp:
        (WebCore::tryAddEventListener):
        (WebCore::Node::addEventListener):
        (WebCore::tryRemoveEventListener):
        (WebCore::Node::removeEventListener):
        * svg/SVGElement.cpp:
        (WebCore::collectInstancesForSVGElement):
        (WebCore):
        (WebCore::SVGElement::addEventListener):
        (WebCore::SVGElement::removeEventListener):
        * svg/SVGElement.h:
        (SVGElement):

2012-05-15  Andreas Kling  <kling@webkit.org>

        RuleSet::addToRuleSet wastes a bit of Vector capacity.
        <http://webkit.org/b/86434>

        Reviewed by Antti Koivisto.

        Have makeRuleSet call shrinkToFit() on the vectors before returning them.
        This avoids wasting space for the rulesets constructed in collectFeatures().

        * css/StyleResolver.cpp:
        (WebCore::makeRuleSet):

2012-05-15  Darin Adler  <darin@apple.com>

        [CG] CGImageCreateWithImageInRect is too slow, but for now we still need to use it
        https://bugs.webkit.org/show_bug.cgi?id=86340

        Reviewed by Geoffrey Garen.

        This patch adds a subimage cache to defray the cost of CGImageCreateWithImageInRect.
        Later, we will restructure the code so it doesn't use that function, but at the
        moment there are CG issues blocking that change.

        * platform/graphics/cg/GraphicsContextCG.cpp:
        (SubimageCacheEntry): Added. An entry in the cache.
        (SubimageCacheEntryTraits): Added. Traits for the cache.
        (SubimageCacheHash): Added. Hash function for the cache.
        (SubimageCacheTimer): Added. Timer that clears the cache after a second
        of inactivity.
        (SubimageCacheWithTimer): Added. Cache and its timer.
        (WebCore::subimageCache): Added. Function returning the single global timer.
        (WebCore::SubimageCacheTimer::restart): Added. Start the timer.
        (WebCore::SubimageCacheTimer::fired): Added. Clear the cache when the timer fires.
        (SubimageRequest): Added. A key to look up in the cache.
        (SubimageCacheAdder): Added. Translator to add to the cache.
        (WebCore::subimage): Added. Puts an entry in the cache.
        (WebCore::GraphicsContext::drawNativeImage): Changed to call the subimage function.

2012-05-15  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: AdvancedSearchController is not stopped then view is hidden.
        https://bugs.webkit.org/show_bug.cgi?id=86466

        Reviewed by Vsevolod Vlasov.

        AdvancedSearchController overrides "wasHidden" method instead of "willHide".

        UI event-flow, not tested.

        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.SearchView.prototype.willHide): Renamed function.

2012-05-15  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        [Qt] http/tests/xmlhttprequest/xmlhttprequest-check-head-readystate-for-404.html times out
        https://bugs.webkit.org/show_bug.cgi?id=84016

        Reviewed by Simon Hausmann.

        Calling didFail abort the connection and doesn't activate the HEADERS_RECEIVED state.
        Since the goal of HEAD is to test then the request should be marked as finished
        also in cases of HTTP errors.
        This matches other ports behavior.

        * platform/network/qt/QNetworkReplyHandler.cpp:
        (WebCore::shouldIgnoreHttpError):

2012-05-15  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt][WK2] Fix scrolling in touch mode
        https://bugs.webkit.org/show_bug.cgi?id=75006

        Reviewed by Kenneth Rohde Christiansen.

        * page/FrameView.cpp:
        (WebCore::FrameView::setFixedVisibleContentRect):
            On changes to fixedVisibleContentRect update scroll-animators position, and
            recalculate page-step sizes in scrollbars.
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::scrollTo):
            Forward scrolling-request to the host window.
        (WebCore::ScrollView::updateScrollbars):
            Allow ScrollViews to have invisible scrollbars when scrolling is delegated.
        * platform/ScrollView.h:
        (ScrollView):

2012-05-15  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Refactor SnippetsModel: extract SnippetStorage, make SnippetScriptMapping delegate calls to ScriptSnippetModel and provide public interface on ScriptSnippetModel in terms of uiSourceCodes
        https://bugs.webkit.org/show_bug.cgi?id=86477

        Reviewed by Pavel Feldman.

        Extracted SnippetStorage to be reused for other snippet types.
        Made SnippetScriptMapping delegate all calls to ScriptSnippetModel and injected it in DebuggerPresentationModel.
        ScriptSnippetModel now provides public interface for ScriptsPanel in terms of uiSourceCodes.

        Tests: inspector/debugger/script-snippet-model.html
               inspector/snippet-storage.html

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModel):
        * inspector/front-end/ScriptSnippetModel.js: Added.
        (WebInspector.ScriptSnippetModel):
        (WebInspector.ScriptSnippetModel.prototype.get scriptMapping):
        (WebInspector.ScriptSnippetModel.prototype.createScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
        (WebInspector.ScriptSnippetModel.prototype._rawLocationToUILocation):
        (WebInspector.ScriptSnippetModel.prototype._uiLocationToRawLocation.get if):
        (WebInspector.ScriptSnippetModel.prototype._uiLocationToRawLocation):
        (WebInspector.ScriptSnippetModel.prototype._uiSourceCodeList):
        (WebInspector.ScriptSnippetModel.prototype._releasedUISourceCodes):
        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
        (WebInspector.ScriptSnippetModel.prototype._sourceURLForSnippet):
        (WebInspector.ScriptSnippetModel.prototype._snippetIdForSourceURL):
        (WebInspector.ScriptSnippetModel.prototype._snippetForSourceURL):
        (WebInspector.ScriptSnippetModel.prototype._reset):
        (WebInspector.SnippetScriptMapping):
        (WebInspector.SnippetScriptMapping.prototype.rawLocationToUILocation):
        (WebInspector.SnippetScriptMapping.prototype.uiLocationToRawLocation):
        (WebInspector.SnippetScriptMapping.prototype.uiSourceCodeList):
        (WebInspector.SnippetScriptMapping.prototype.snippetIdForSourceURL):
        (WebInspector.SnippetScriptMapping.prototype.addScript):
        (WebInspector.SnippetScriptMapping.prototype._uiSourceCodesAdded):
        (WebInspector.SnippetScriptMapping.prototype._uiSourceCodesRemoved):
        (WebInspector.SnippetScriptMapping.prototype.reset):
        (WebInspector.SnippetContentProvider):
        * inspector/front-end/SnippetStorage.js: Added.
        (WebInspector.SnippetStorage):
        (WebInspector.SnippetStorage.prototype.get namePrefix):
        (WebInspector.SnippetStorage.prototype._saveSettings):
        (WebInspector.SnippetStorage.prototype.set snippets):
        (WebInspector.SnippetStorage.prototype.snippetForId):
        (WebInspector.SnippetStorage.prototype.deleteSnippet):
        (WebInspector.SnippetStorage.prototype._snippetAdded):
        (WebInspector.SnippetStorage.prototype.reset.set this):
        (WebInspector.Snippet):
        (WebInspector.Snippet.fromObject):
        (WebInspector.Snippet.prototype.get id):
        (WebInspector.Snippet.prototype.get name):
        (WebInspector.Snippet.prototype.set name):
        (WebInspector.Snippet.prototype.get content):
        (WebInspector.Snippet.prototype.set content):
        (WebInspector.Snippet.prototype.serializeToObject):
        * inspector/front-end/SnippetsModel.js: Removed.
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:

2012-05-15  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: add show/hide debugger sidebar button.
        https://bugs.webkit.org/show_bug.cgi?id=86478

        Reviewed by Vsevolod Vlasov.

        As with the navigator, but with no overlay. See the screenshot.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/NavigatorOverlayController.js:
        (WebInspector.NavigatorOverlayController.prototype.set _pinNavigator):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
        (WebInspector.ScriptsPanel.prototype._debuggerResumed):
        (WebInspector.ScriptsPanel.prototype._showJavaScriptOutlineDialog):
        (WebInspector.ScriptsPanel.prototype._installDebuggerSidebarController.clickHandler):
        (WebInspector.ScriptsPanel.prototype._showDebuggerSidebar):
        (WebInspector.ScriptsPanel.prototype.set _hideDebuggerSidebar):
        * inspector/front-end/scriptsPanel.css:
        (#scripts-editor-container-tabbed-pane .tabbed-pane-header-contents):
        (button.status-bar-item.scripts-debugger-show-hide-button):
        (.status-bar-item.scripts-debugger-show-hide-button > .glyph):
        (.status-bar-item.scripts-debugger-show-hide-button.toggled-shown > .glyph):
        (.status-bar-item.scripts-debugger-show-hide-button.toggled-hidden > .glyph):

2012-05-15  Zoltan Herczeg  <zherczeg@webkit.org>

        NEONizing forceValidPreMultipliedPixels
        https://bugs.webkit.org/show_bug.cgi?id=86468

        Reviewed by Nikolas Zimmermann.

        Optimize forceValidPreMultipliedPixels with ARM-NEON intrinsics.

        Existing tests cover this feature.

        * platform/graphics/filters/FilterEffect.cpp:
        (WebCore::FilterEffect::forceValidPreMultipliedPixels):

2012-05-15  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: remove unnecessary setTimeout in HeapSnapshotGridNodes.js
        https://bugs.webkit.org/show_bug.cgi?id=86464

        Reviewed by Pavel Feldman.

        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.childrenRetrieved): Posting
        a message to worker is already asynchronous, no need to postpone the call via setTimeout.
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren):

2012-05-15  Florin Malita  <fmalita@chromium.org>

        Mask deformations when masked content is rotated
        https://bugs.webkit.org/show_bug.cgi?id=76527

        Reviewed by Nikolas Zimmermann.

        Test: svg/repaint/mask-clip-target-transform.svg

        RenderSVGResource::markForLayoutAndParentResourceInvalidation() needs to also
        invalidate parent mask and clip resources, not just filters.

        * rendering/svg/RenderSVGResource.cpp:
        (WebCore::removeFromCacheAndInvalidateDependencies):
        (WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation):

2012-05-15  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: merge show navigator with pin navigator buttons.
        https://bugs.webkit.org/show_bug.cgi?id=86469

        Reviewed by Vsevolod Vlasov.

        See screenshots attached to the bug.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/Images/navigatorPinButton.png: Removed.
        * inspector/front-end/Images/navigatorShowHideButton.png:
        * inspector/front-end/NavigatorOverlayController.js:
        (WebInspector.NavigatorOverlayController.prototype._toggleNavigator):
        (WebInspector.NavigatorOverlayController.prototype.set _pinNavigator):
        (WebInspector.NavigatorOverlayController.prototype.set showNavigatorOverlay):
        (WebInspector.NavigatorOverlayController.prototype.hideNavigatorOverlay):
        (WebInspector.NavigatorOverlayController.prototype._containingElementFocused):
        * inspector/front-end/SidebarOverlay.js:
        (WebInspector.SidebarOverlay):
        (WebInspector.SidebarOverlay.prototype.show):
        (WebInspector.SidebarOverlay.prototype.hide):
        * inspector/front-end/navigatorView.css:
        (.navigator-tabbed-pane .tabbed-pane-header-contents):
        * inspector/front-end/scriptsPanel.css:
        (.status-bar-item.scripts-navigator-show-hide-button > .glyph):
        (.status-bar-item.scripts-navigator-show-hide-button.toggled-shown > .glyph):
        (.status-bar-item.scripts-navigator-show-hide-button.toggled-overlay > .glyph):
        (button.status-bar-item.scripts-navigator-show-hide-button):
        (button.status-bar-item.scripts-navigator-show-hide-button.toggled-overlay):

2012-05-15  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: implement "Reveal in Dominators view" context menu action
        https://bugs.webkit.org/show_bug.cgi?id=86455

        Reviewed by Pavel Feldman.

        Implemented "Reveal in Dominators view" context menu action for objects
        in the console.

        Test: inspector/profiler/heap-snapshot-reveal-in-dominators-view.html

        * English.lproj/localizedStrings.js:
        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._nodeForSnapshotObjectId):
        (WebInspector.HeapSnapshot.prototype.nodeClassName):
        (WebInspector.HeapSnapshot.prototype.dominatorIdsForNode):
        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotDominatorsDataGrid):
        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.setDataSource):
        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.sortingChanged):
        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.highlightObjectByHeapSnapshotId.didGetDominators):
        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.highlightObjectByHeapSnapshotId.expandNextDominator):
        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.highlightObjectByHeapSnapshotId):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode.prototype.childForPosition):
        (WebInspector.HeapSnapshotGridNode.prototype.expandWithoutPopulate):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.childrenRetrieved):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren):
        (WebInspector.HeapSnapshotGridNode.prototype.sort):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId.didGetNodePosition):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId.didPopulateChildren):
        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotProxy.prototype.dominatorIdsForNode):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.revealInSummaryView):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.didReceiveHeapObjectId):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu):

2012-05-15  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: exception when switching to heap profiler comparison view
        https://bugs.webkit.org/show_bug.cgi?id=86224

        Reviewed by Pavel Feldman.

        Make sure the messages are dispatched in the same order as they are sent in
        case a fake worker is used for heap snapshot processing.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.TimerQueue):
        (WebInspector.TimerQueue.prototype.addTask):
        (WebInspector.TimerQueue.prototype._onTimeout):
        (WebInspector.TimerQueue.prototype._scheduleTimer):
        (WebInspector.HeapSnapshotFakeWorker):
        (WebInspector.HeapSnapshotFakeWorker.prototype.postMessage):
        (WebInspector.HeapSnapshotFakeWorker.prototype._postMessageFromWorker):

2012-05-15  Zoltan Herczeg  <zherczeg@webkit.org>

        The ARM NEON optimized filters does not compile on THUMB2
        https://bugs.webkit.org/show_bug.cgi?id=86457

        Reviewed by Csaba Osztrogonác.

        We should disable the compilation on Thumb2 until we fix the code.

        * platform/graphics/filters/FEComposite.cpp:
        (WebCore::FEComposite::platformArithmeticSoftware):
        * platform/graphics/filters/FEGaussianBlur.cpp:
        (WebCore::FEGaussianBlur::platformApplyWorker):
        (WebCore::FEGaussianBlur::platformApply):
        * platform/graphics/filters/FELighting.cpp:
        (WebCore::FELighting::platformApply):
        * platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp:
        * platform/graphics/filters/arm/FECompositeArithmeticNEON.h:
        * platform/graphics/filters/arm/FEGaussianBlurNEON.cpp:
        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
        * platform/graphics/filters/arm/FELightingNEON.cpp:
        * platform/graphics/filters/arm/FELightingNEON.h:

2012-05-15  MORITA Hajime  <morrita@google.com>

        Kill unnecessary RuntimeEnabledFeatures.h inclusion
        https://bugs.webkit.org/show_bug.cgi?id=86451

        Reviewed by Kentaro Hara.

        No new tests. No behavior change.

        * dom/Element.cpp:
        * dom/ElementShadow.cpp:
        * dom/TreeScope.cpp:

2012-05-14  Shinya Kawanaka  <shinyak@chromium.org> 

        document.execCommand('Indent') in the direct child of ShadowRoot causes a crash.
        https://bugs.webkit.org/show_bug.cgi?id=86341

        Reviewed by Ryosuke Niwa.

        When document.execCommand('Indent') is executed in the direct child of ShadowRoot,
        the scope variable of TextIterator becomes ShadowRoot. However, an element is assumed for it,
        so a crash happended.

        This patch enables TextIterator to have ShadowRoot as a scope variable.

        Test: editing/shadow/execcommand-indent-in-shadow.html

        * WebCore.exp.in:
        * editing/ApplyBlockElementCommand.cpp:
        (WebCore::ApplyBlockElementCommand::doApply):
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::doApply):
        * editing/TextIterator.cpp:
        (WebCore::TextIterator::rangeFromLocationAndLength):
        * editing/TextIterator.h:
        (TextIterator):
        * editing/htmlediting.cpp:
        (WebCore::indexForVisiblePosition):
        (WebCore::visiblePositionForIndex):
        * editing/htmlediting.h:
        (WebCore):

2012-05-14  Shinya Kawanaka  <shinyak@chromium.org>

        Node::shadowTreeRootNode() should return ShadowRoot instead of Node.
        https://bugs.webkit.org/show_bug.cgi?id=86428

        Reviewed by Hajime Morita.

        Since Node::shadowTreeRootNode() returns only ShadowRoot or 0 now, its return type should be ShadowRoot.
        This patch changes the return type and adds include directive to build.

        No new tests, no change in behavior.

        * dom/Node.cpp:
        (WebCore::Node::shadowAncestorNode):
        (WebCore::Node::shadowTreeRootNode):
        * dom/Node.h:
        (WebCore):
        (Node):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        * dom/Range.cpp:
        (WebCore::Range::shadowTreeRootNode):
        * dom/Range.h:
        (Range):
        * editing/Editor.cpp:
        * editing/TextIterator.cpp:
        * editing/htmlediting.cpp:
        * html/shadow/ContentSelectorQuery.cpp:
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::HTMLContentElement::parseAttribute):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::detach):
        * page/EventHandler.cpp:

2012-05-14  Luke Macpherson  <macpherson@chromium.org>

        Make StyleResolver::applyMatchedProperties and ::applyProperties use enum template parameter instead of bool.
        https://bugs.webkit.org/show_bug.cgi?id=86424

        Reviewed by Dimitri Glazkov.

        This patch changes from using a boolean template parameter for StyleResolver::applyMatchedProperties and
        StyleResolver::applyProperties functions. The motivation for this change is that it paves the way for
        CSS Variables to make the value tri-state, which is a requirement because variable definitions must occur
        before high priority CSS properties such that they can be referenced by the latter. This change affects
        only the type signatures of those functions, and not their behavior.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:

2012-05-14  MORITA Hajime  <morrita@google.com>

        [Refactoring] Get rid of ContentDistribution::Item
        https://bugs.webkit.org/show_bug.cgi?id=86350

        This change replaces the linked list on ContentDistribution with a Vector.
        We no longer link item class ContentDistribution::Item.
        This simplification also allows ContentDistribution to go.
        ContentDistribution is now just a typedef of Vector<RefPtr<Node> >.

        Reviewed by Dimitri Glazkov.

        No new tests. Covered by existing tests.

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseNode):
        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
        * dom/ElementShadow.cpp:
        * dom/ElementShadow.h:
        (ElementShadow):
        * dom/NodeRenderingContext.cpp:
        (WebCore::nextRendererOfInsertionPoint):
        (WebCore::previousRendererOfInsertionPoint):
        (WebCore::firstRendererOfInsertionPoint):
        (WebCore::lastRendererOfInsertionPoint):
        * html/shadow/ContentDistributor.cpp:
        (WebCore::ContentDistributor::distribute):
        (WebCore::ContentDistributor::clearDistribution):
        (WebCore::ContentDistributor::findInsertionPointFor):
        * html/shadow/ContentDistributor.h:
        (WebCore):
        (ContentDistributor):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::InsertionPoint):
        (WebCore::InsertionPoint::attachDistributedNode):
        (WebCore::InsertionPoint::assignShadowRoot):
        (WebCore::InsertionPoint::nextTo):
        (WebCore):
        (WebCore::InsertionPoint::previousTo):
        * html/shadow/InsertionPoint.h: Added a set of delegate method to m_distribution.
        (WebCore::InsertionPoint::hasDistribution):
        (WebCore::InsertionPoint::indexOf):
        (WebCore::InsertionPoint::size):
        (WebCore::InsertionPoint::at):
        (WebCore::InsertionPoint::first):
        (WebCore::InsertionPoint::last):
        (InsertionPoint):

2012-05-14  Tim Horton  <timothy_horton@apple.com>

        RenderLayer::repaintRectIncludingDescendants shouldn't include repaint rects of composited descendants
        https://bugs.webkit.org/show_bug.cgi?id=86429
        <rdar://problem/11445132>

        Reviewed by Simon Fraser.

        Change repaintRectIncludingDescendants to not include repaint rects for composited child layers,
        and rename the function to make it more clear that that's what it does now.

        No new tests, scrolling performance optimization.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsFastPath):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::repaintRectIncludingNonCompositingDescendants):
        * rendering/RenderLayer.h:
        (RenderLayer):

2012-05-14  Gavin Peters  <gavinp@chromium.org>

        Add Prerenderer, PrerenderHandle and a chromium interface for Prerendering.
        https://bugs.webkit.org/show_bug.cgi?id=85005

        Reviewed by Adam Barth.

        The prerender case isn't quite a resource load, and using resource loading to
        retrieve them has constrained the API, and unnecessarily complicated the loader.

        The new Prerenderer and PrerenderHandle let <link rel=prerender...> elements signal
        removal and unload to their platform.

        No new tests, as this interface requires a full platform to work, and doesn't affect layout.  Test
        it with your platform when implemented for it.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::Document::Document):
        * dom/Document.h:
        (WebCore):
        (Document):
        (WebCore::Document::prerenderer):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::removedFrom):
        * html/LinkRelAttribute.cpp:
        (WebCore::LinkRelAttribute::LinkRelAttribute):
        * html/LinkRelAttribute.h:
        (LinkRelAttribute):
        * loader/LinkLoader.cpp:
        (WebCore::LinkLoader::loadLink):
        (WebCore::LinkLoader::released):
        * loader/LinkLoader.h:
        (WebCore):
        (LinkLoader):
        * loader/Prerenderer.cpp: Added.
        (WebCore):
        (WebCore::Prerenderer::create):
        (WebCore::Prerenderer::Prerenderer):
        (WebCore::Prerenderer::~Prerenderer):
        (WebCore::Prerenderer::render):
        (WebCore::Prerenderer::stop):
        (WebCore::Prerenderer::suspend):
        (WebCore::Prerenderer::resume):
        (WebCore::Prerenderer::document):
        (WebCore::Prerenderer::client):
        * loader/Prerenderer.h: Copied from Source/Platform/chromium/public/WebPrerender.h.
        (WebCore):
        (Prerenderer):
        * loader/PrerendererClient.cpp: Copied from Source/WebCore/html/LinkRelAttribute.h.
        (WebCore):
        (WebCore::PrerendererClient::supplementName):
        (WebCore::PrerendererClient::from):
        (WebCore::providePrerendererClientTo):
        * loader/PrerendererClient.h: Copied from Source/WebCore/html/LinkRelAttribute.h.
        (WebCore):
        (PrerendererClient):
        (WebCore::PrerendererClient::~PrerendererClient):
        (WebCore::PrerendererClient::PrerendererClient):
        * loader/cache/CachedResource.cpp:
        (WebCore::defaultPriorityForResourceType):
        (WebCore::cachedResourceTypeToTargetType):
        (WebCore::CachedResource::load):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::ignoreForRequestCount):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::createResource):
        (WebCore::CachedResourceLoader::requestLinkResource):
        (WebCore::CachedResourceLoader::checkInsecureContent):
        (WebCore::CachedResourceLoader::canRequest):
        * platform/PrerenderHandle.h: Copied from Source/Platform/chromium/public/WebPrerender.h.
        (WebCore):
        (PrerenderHandle):
        * platform/chromium/Prerender.cpp: Added.
        (WebCore):
        (WebCore::Prerender::Prerender):
        (WebCore::Prerender::~Prerender):
        (WebCore::Prerender::setState):
        (WebCore::Prerender::add):
        (WebCore::Prerender::cancel):
        (WebCore::Prerender::abandon):
        (WebCore::Prerender::suspend):
        (WebCore::Prerender::resume):
        * platform/chromium/Prerender.h: Copied from Source/Platform/chromium/public/WebPrerender.h.
        (WebCore):
        (Prerender):
        (ExtraData):
        (WebCore::Prerender::ExtraData::~ExtraData):
        (WebCore::Prerender::url):
        (WebCore::Prerender::referrer):
        (WebCore::Prerender::referrerPolicy):
        (WebCore::Prerender::setExtraData):
        (WebCore::Prerender::extraData):
        * platform/chromium/PrerenderHandle.cpp: Copied from Source/Platform/chromium/public/WebPrerender.h.
        (WebCore):
        (WebCore::PrerenderHandle::create):
        (WebCore::PrerenderHandle::PrerenderHandle):
        (WebCore::PrerenderHandle::~PrerenderHandle):
        (WebCore::PrerenderHandle::prerender):
        (WebCore::PrerenderHandle::add):
        (WebCore::PrerenderHandle::cancel):
        (WebCore::PrerenderHandle::abandon):
        (WebCore::PrerenderHandle::suspend):
        (WebCore::PrerenderHandle::resume):
        (WebCore::PrerenderHandle::url):
        (WebCore::PrerenderHandle::referrer):
        (WebCore::PrerenderHandle::referrerPolicy):
        * platform/chromium/support/WebPrerender.cpp: Copied from Source/Platform/chromium/public/WebPrerender.h.
        (WebKit::WebPrerender::WebPrerender):
        (WebKit):
        (WebKit::WebPrerender::~WebPrerender):
        (WebKit::WebPrerender::url):
        (WebKit::WebPrerender::referrer):
        (WebKit::WebPrerender::referrerPolicy):
        (WebKit::WebPrerender::setExtraData):
        (WebKit::WebPrerender::extraData):
        * platform/network/blackberry/ResourceRequest.h:
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::platformTargetTypeForRequest):
        * platform/network/chromium/ResourceRequest.h:

2012-05-14  Luke Macpherson  <macpherson@chromium.org>

        Introduce ENABLE_CSS_VARIABLES compile flag.
        https://bugs.webkit.org/show_bug.cgi?id=86338

        Reviewed by Dimitri Glazkov.

        Add a configuration option for CSS Variables support, disabling it by default.

        No new tests. This patch only introduces an unused build flag.

        * Configurations/FeatureDefines.xcconfig:

2012-05-14  Eric Seidel  <eric@webkit.org>

        Styles are not recalculated when the seamless attribute is dynamically added/removed
        https://bugs.webkit.org/show_bug.cgi?id=86315

        Reviewed by Andreas Kling.

        Covered by fast/frames/seamless/seamless-css-cascade.html.

        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::isPresentationAttribute):
         - Make seamless a presentational attribute, which means style on the <iframe> will
           be forced to recalculate when it changes.  This is correct, but not observable
           until the layout changes are landed (as then the iframe should correctly revert to not
           being sized to fit its content if seamless is removed).
        (WebCore::HTMLIFrameElement::parseAttribute):
         - When the seamless attribute is added or remove, force the content document to recalc
           its style resolver, which will refresh the list of inherited stylesheets from the
           parent.  This doesn't need to happen synchronously.  When the layout changes land
           the content document will actually cause that recalc to redirect to the parent document
           in the seamless case anyway, but it's more correct to ask the content document directly.

2012-05-14  Alexandre Elias  <aelias@google.com>

        [chromium] Prevent KeyCodeConversionAndroid from breaking on next NDK roll
        https://bugs.webkit.org/show_bug.cgi?id=86415

        Reviewed by Adam Barth.

        The new enum values added in this file have been added in recent
        versions of the NDK, so this file will fail to compile with duplicate
        enum error when we roll NDK to r7c or higher.  A workaround is
        to move our enum values to the WebCore namespace.  When the NDK
        upgrade is complete, we can delete them.

        No new tests. (No-op change.)

        * platform/chromium/KeyCodeConversionAndroid.cpp:
        (WebCore):

2012-05-14  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86420
        ScrollbarPainter should support expansionTransitionProgress

        Reviewed by Sam Weinig.

        expansionTransitionProgress works the same as 
        uiStateTransitionProgress. This code just echoes that code, but for 
        expansion instead of uiState.
        * platform/mac/NSScrollerImpDetails.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (supportsExpansionTransitionProgress):
        (-[WebScrollbarPartAnimation setCurrentProgress:]):
        (-[WebScrollbarPainterDelegate cancelAnimations]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
        (-[WebScrollbarPainterDelegate invalidate]):

2012-05-14  Andy Estes  <aestes@apple.com>

        Fix RunLoopCF.cpp's copyright string.

        * platform/cf/RunLoopCF.cpp:

2012-05-14  Andy Estes  <aestes@apple.com>

        Move the parts of RunLoopMac.mm that aren't Mac-specific into RunLoopCF.cpp
        https://bugs.webkit.org/show_bug.cgi?id=86411

        Reviewed by Anders Carlsson.

        Most of RunLoopMac.mm was written in terms of CF API. Move these bits
        to a new file called RunLoopCF.cpp, leaving only the bits dealing with
        NSApplication.

        * WebCore.xcodeproj/project.pbxproj: Xcode decided to give
        VisitedLinks.* new UUIDs. I'll allow it.
        * platform/cf/RunLoopCF.cpp: Copied from Source/WebCore/platform/mac/RunLoopMac.mm.
        * platform/mac/RunLoopMac.mm:

2012-05-14  Erik Arvidsson  <arv@chromium.org>

        [V8] Add "stack" property to DOMException
        https://bugs.webkit.org/show_bug.cgi?id=85057

        Reviewed by Kentaro Hara.

        When we create a DOM exception we define a V8 accessor for the stack property. This
        accessor uses a new Error object to get the underlying stack string.

        Test: fast/dom/DOMException/stack-trace.html

        * bindings/v8/V8Proxy.cpp:
        (WebCore::DOMExceptionStackGetter):
        (WebCore):
        (WebCore::DOMExceptionStackSetter):
        (WebCore::V8Proxy::setDOMException):

2012-05-14  Michael Saboff  <msaboff@apple.com>

        Enh: Add the Ability to Disable / Enable JavaScript GC Timer
        https://bugs.webkit.org/show_bug.cgi?id=86382

        Reviewed by Darin Adler.

        Plumbing to set / clear JS GC activity timer enable flag.

        * WebCore.exp.in:
        * bindings/js/GCController.cpp:
        (WebCore::GCController::setJavaScriptGarbageCollectorTimerEnabled):
        * bindings/js/GCController.h:

2012-05-14  Nate Chapin  <japhet@chromium.org>

        [V8] Crash in npObjectGetProperty() in V8NPObject.cpp
        https://bugs.webkit.org/show_bug.cgi?id=86131

        Reviewed by Adam Barth.

        Tests: plugins/npruntime/delete-plugin-within-getProperty.html
               plugins/npruntime/delete-plugin-within-hasProperty-return-false.html
               plugins/npruntime/delete-plugin-within-hasProperty-return-true.html
               plugins/npruntime/delete-plugin-within-invoke.html
               plugins/npruntime/delete-plugin-within-setProperty.html

        * bindings/v8/NPV8Object.cpp:
        (_NPN_EvaluateHelper):
        * bindings/v8/V8NPObject.cpp: Check NPN_IsAlive in a bunch of places we're not currently.
        (WebCore::npObjectInvokeImpl):
        (WebCore::npObjectGetProperty):
        (WebCore::npObjectSetProperty):

2012-05-14  Brent Fulgham  <bfulgham@webkit.org>

        [WinCairo] Unreviewed build correction.

        * platform/win/DragImageCairoWin.cpp: Add missing include for
        new NativeImageCairo.h type.

2012-05-14  Takashi Sakamoto  <tasak@google.com>

        Crash in WebCore::RenderObject::repaint
        https://bugs.webkit.org/show_bug.cgi?id=86162

        Reviewed by Abhishek Arya.

        As RenderScrollbarPart has no parent renderer, we crash in
        WebCore::RenderBoxModelObject::paddingLeft when paddingLeft has
        percent value, e.g. 5%. However if we set the scrollbar's parent
        renderer to a renderer owning the scrollbar by using setParent method,
        RenderScrollbarPart::styleWillChange will invoke parent renderer's
        repaint. This causes crash in WebCore::RenderObject::repaint if the
        owning renderer is already destroyed.
        To fix the first crash without the second crash, modify
        RenderObject::containingBlock() to check isRenderScrollbarPart or not,
        if parent() is 0.
        If so, use scrollbar's owningRenderer from RenderScrollbarPart.

        Test: scrollbars/scrollbar-percent-padding-crash.html
              scrollbars/scrollbar-scrollbarparts-repaint-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containingBlock):
        Modifying containingBlock. If parent() is 0 and isRenderScrollbarPart()
        is true, use RenderScrollbarPart's m_scrollbar->owningRenderer()
        instead of parent().
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isRenderScrollbarPart):
        (RenderObject):
        Adding a new method, isRenderScrollbarPart.
        * rendering/RenderScrollbarPart.cpp:
        (WebCore::RenderScrollbarPart::rendererOwningScrollbar):
        (WebCore):
        Adding a new method, scrollbarOwningRenderer to obtain m_scrollar's
        owningRenderer.
        * rendering/RenderScrollbarPart.h:
        (RenderScrollbarPart):
        Removing "friend class RenderScrollbar".
        (WebCore::RenderScrollbarPart::isRenderScrollbarPart):
        (WebCore::toRenderScrollbarPart):
        (WebCore):
        Implementing isRenderScrollbarPart and toRenderScrollbarPart.

2012-05-14  Mike West  <mike@mikewest.org>

        Content Security Policy console errors include violated directive.
        https://bugs.webkit.org/show_bug.cgi?id=86323

        Reviewed by Adam Barth.

        Console errors generated when resources, inline script/style, or eval
        are blocked by Content Security Policy directives should include the
        text of the directive that's been violated. This gives developers more
        of the information they need to resolve the issue.

        Test: http/tests/security/contentSecurityPolicy/*

        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
        (WebCore::CSPDirectiveList::allowInlineScript):
        (WebCore::CSPDirectiveList::allowInlineStyle):
        (WebCore::CSPDirectiveList::allowEval):

2012-05-14  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in FrameView::windowClipRectForFrameOwner after r116371
        https://bugs.webkit.org/show_bug.cgi?id=86035

        Reviewed by David Hyatt.

        Added a NULL-check for |parentView| as nothing guarantees it to be
        non-NULL. Unfortunately no test as this is a crasher I couldn't
        reproduce on my machine and the user logs were not helpful.

        * page/FrameView.cpp:
        (WebCore::FrameView::windowClipRect):

2012-05-14  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86403
        ASSERTION FAILED: m_verticalScrollbarPainterDelegate on recent builds
        -and corresponding-
        <rdar://problem/11448841>

        Reviewed by Simon Fraser.

        http://trac.webkit.org/changeset/116476 accidentally started calling 
        these functions for custom scrollbars. This change replaces that 
        guard.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::destroyScrollbar):

2012-05-14  Simon Fraser  <simon.fraser@apple.com>

        Remove redundant pixel snapping in calculateCompositedBounds()
        https://bugs.webkit.org/show_bug.cgi?id=86400

        Reviewed by Sam Weinig.

        RenderLayer::calculateLayerBounds() returns a pixel-snapped rect,
        so we don't need to pixel-snap it again.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::calculateCompositedBounds):

2012-05-14  Simon Fraser  <simon.fraser@apple.com>

        Avoid logging related to setting shadow-related properties on a transform-only layer
        https://bugs.webkit.org/show_bug.cgi?id=86398

        Reviewed by Dan Bernstein.

        When making a CATransformLayer to support transform-style: preserve-3d, avoid trying
        to set filters on the transform layer. We should never have this combination,
        because filters force flattening to occur.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::ensureStructuralLayer):

2012-05-14  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116983.
        http://trac.webkit.org/changeset/116983
        https://bugs.webkit.org/show_bug.cgi?id=86397

        Does not compile on chromium-win (Requested by abarth on
        #webkit).

        * WebCore.gypi:
        * page/TouchAdjustment.cpp:

2012-05-14  Dan Bernstein  <mitz@apple.com>

        Pagination splits lines that could fit on a single page if it were not for their top leading
        https://bugs.webkit.org/show_bug.cgi?id=86388

        Reviewed by Darin Adler.

        Test: fast/multicol/split-in-top-margin.html

        When a line’s visible content fits on a page, but adding the top leading makes it taller than
        a page, instead of giving up and splitting the line in an arbitrary position, add a strut
        to push it downwards so that the split occurs in the top leading, and the visible content is
        fully contained on a single page.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::adjustLinePositionForPagination):

2012-05-14  Terry Anderson  <tdanderson@chromium.org>

        [chromium] Compute the best target node on a GestureTap event
        https://bugs.webkit.org/show_bug.cgi?id=85101

        Reviewed by Adam Barth.

        Using tests in the touchadjustment/ directory.

        * WebCore.gypi:
        Include TouchAdjustment.* files.
        * page/TouchAdjustment.cpp:
        Included math.h because of an 'Undeclared identifier: INFINITY' when
        this patch was landed before.

2012-05-14  Adrienne Walker  <enne@google.com>

        [chromium] Add compositor debug asserts for blocked main thread
        https://bugs.webkit.org/show_bug.cgi?id=86384

        Reviewed by James Robinson.

        Where we depend for thread-safety that the main thread is blocked,
        assert that this is actually the case.

        * platform/graphics/chromium/cc/CCProxy.cpp:
        (WebCore):
        (WebCore::CCProxy::isMainThreadBlocked):
        (WebCore::CCProxy::setMainThreadBlocked):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        (WebCore):
        (DebugScopedSetMainThreadBlocked):
        (WebCore::DebugScopedSetMainThreadBlocked::DebugScopedSetMainThreadBlocked):
        (WebCore::DebugScopedSetMainThreadBlocked::~DebugScopedSetMainThreadBlocked):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::doCommit):
        (WebCore::CCSingleThreadProxy::stop):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::stop):
        (WebCore::CCThreadProxy::beginFrame):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):

2012-05-14  Swapna P  <spottabathini@innominds.com>

        Reviewed by Eric Seidel.

        Bug: Cannot resize frames because frameborder=0
        https://bugs.webkit.org/show_bug.cgi?id=23750

        Removed check for frameborder, in order to allow resize of frames even in case of frameborder=0.

        Test: fast/frames/frames-with-frameborder-zero-can-be-resized.html

        * rendering/RenderFrameSet.cpp:
        (WebCore::RenderFrameSet::startResizing):
        (WebCore::RenderFrameSet::canResizeRow):
        (WebCore::RenderFrameSet::canResizeColumn):

2012-05-14  David Barton  <dbarton@mathscribe.com>

        Unify RenderMathMLSquareRoot.cpp and RenderMathMLRoot.cpp
        https://bugs.webkit.org/show_bug.cgi?id=86319

        Reviewed by Darin Adler.

        Most of RenderMathMLSquareRoot.cpp is duplicated in RenderMathMLRoot.cpp and can be
        eliminated. We also define RenderMathMLRoot::computePreferredLogicalWidths().

        Test: mathml/presentation/mroot-pref-width.html

        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::computePreferredLogicalWidths):
        (WebCore::RenderMathMLRoot::layout):
        (WebCore::RenderMathMLRoot::paint):
        * rendering/mathml/RenderMathMLRoot.h:
        * rendering/mathml/RenderMathMLSquareRoot.cpp:
        (WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot):
        (WebCore::RenderMathMLSquareRoot::addChild):
        * rendering/mathml/RenderMathMLSquareRoot.h:

2012-05-14  MORITA Hajime  <morrita@google.com>

        [Shadow DOM][Refactoring] HTMLContentSelector family should have better name
        https://bugs.webkit.org/show_bug.cgi?id=86064

        Reviewed by Dimitri Glazkov.

        This change renames classes around shadow content distribution.
        - Renamed HTMLContentSelector to ContentDistributor
        - Renamed HTMLContentSelectionList to ContentDistribution
        - Renamed HTMLContentSelection to ContentDistribution::Item
        - Inlined HTMLContentSelectionSet into ContentDistributor

        Associated rename and inlining are also happening for method names.

        No new tests. No behavior change.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseNode):
        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
        (WebCore::ComposedShadowTreeWalker::traverseParent):
        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::ElementShadow):
        (WebCore::ElementShadow::attach):
        (WebCore::ElementShadow::insertionPointFor):
        (WebCore::ElementShadow::distributionItemFor):
        (WebCore::ElementShadow::recalcStyle):
        (WebCore::ElementShadow::needsRedistributing):
        (WebCore::ElementShadow::hostChildrenChanged):
        (WebCore::ElementShadow::setNeedsRedistributing):
        * dom/ElementShadow.h:
        (WebCore):
        (ElementShadow):
        (WebCore::ElementShadow::distributor):
        (WebCore::ElementShadow::clearNeedsRedistributing):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        (WebCore::nextRendererOfInsertionPoint):
        (WebCore::previousRendererOfInsertionPoint):
        (WebCore::firstRendererOfInsertionPoint):
        (WebCore::lastRendererOfInsertionPoint):
        * dom/ShadowRoot.cpp:
        * dom/ShadowRoot.h:
        (WebCore):
        * html/shadow/ContentDistributor.cpp: Renamed from Source/WebCore/html/shadow/HTMLContentSelector.cpp.
        (WebCore):
        (WebCore::ContentDistribution::ContentDistribution):
        (WebCore::ContentDistribution::~ContentDistribution):
        (WebCore::ContentDistribution::find):
        (WebCore::ContentDistribution::clear):
        (WebCore::ContentDistribution::append):
        (WebCore::ContentDistributor::ContentDistributor):
        (WebCore::ContentDistributor::~ContentDistributor):
        (WebCore::ContentDistributor::distribute):
        (WebCore::ContentDistributor::clearDistribution):
        (WebCore::ContentDistributor::findFor):
        (WebCore::ContentDistributor::findInsertionPointFor):
        (WebCore::ContentDistributor::willDistribute):
        (WebCore::ContentDistributor::didDistribute):
        (WebCore::ContentDistributor::preparePoolFor):
        * html/shadow/ContentDistributor.h: Added.
        (WebCore):
        (ContentDistribution):
        (Item):
        (WebCore::ContentDistribution::Item::insertionPoint):
        (WebCore::ContentDistribution::Item::node):
        (WebCore::ContentDistribution::Item::next):
        (WebCore::ContentDistribution::Item::previous):
        (WebCore::ContentDistribution::Item::create):
        (WebCore::ContentDistribution::Item::Item):
        (WebCore::ContentDistribution::first):
        (WebCore::ContentDistribution::last):
        (WebCore::ContentDistribution::firstNode):
        (WebCore::ContentDistribution::lastNode):
        (WebCore::ContentDistribution::isEmpty):
        (ContentDistributor):
        (Translator):
        (WebCore::ContentDistributor::Translator::hash):
        (WebCore::ContentDistributor::Translator::equal):
        (WebCore::ContentDistributor::Hash::hash):
        (WebCore::ContentDistributor::Hash::equal):
        (Hash):
        (WebCore::ContentDistributor::inDistribution):
        (WebCore::ContentDistributor::poolIsReady):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::HTMLContentElement::parseAttribute):
        * html/shadow/HTMLContentSelector.h: Removed.
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::InsertionPoint):
        (WebCore::InsertionPoint::detach):
        (WebCore::InsertionPoint::distributeHostChildren):
        (WebCore::InsertionPoint::clearDistribution):
        (WebCore::InsertionPoint::attachDistributedNode):
        (WebCore::InsertionPoint::assignShadowRoot):
        (WebCore::InsertionPoint::clearAssignment):
        * html/shadow/InsertionPoint.h:
        (WebCore::InsertionPoint::distribution):
        (WebCore::InsertionPoint::hasDistribution):

2012-05-14  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116969.
        http://trac.webkit.org/changeset/116969
        https://bugs.webkit.org/show_bug.cgi?id=86386

        i accidentally the icondatabase (Requested by kling on
        #webkit).

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::synchronousIconForPageURL):
        (WebCore::IconDatabase::retainIconForPageURL):
        (WebCore::IconDatabase::releaseIconForPageURL):
        (WebCore::IconDatabase::retainedPageURLCount):
        (WebCore::IconDatabase::performURLImport):
        (WebCore::IconDatabase::syncThreadMainLoop):
        * loader/icon/IconDatabase.h:
        (IconDatabase):

2012-05-14  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Fix for wxMSW windows.h load order bug.
        
        * platform/graphics/wx/ImageBufferDataWx.h:

2012-05-14  Eric Carlson  <eric.carlson@apple.com>

        <video> won't load when URL ends with .php
        https://bugs.webkit.org/show_bug.cgi?id=86308

        Reviewed by Darin Adler.

        Test: http/tests/media/video-query-url.html

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::MediaPlayer): Initialize m_typeInferredFromExtension.
        (WebCore::MediaPlayer::load): Set m_typeInferredFromExtension appropriately.
        (WebCore::MediaPlayer::loadWithNextMediaEngine): If we don't find a media engine registered
            for a MIME type, and the type was inferred from the extension, give the first registered
            media engine a chance anwyay just as we do when there is no MIME type at all.
        * platform/graphics/MediaPlayer.h: Add m_typeInferredFromExtension.

2012-05-14  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: do not update $0-$4 console variables for the objects from loaded from file heap snapshot.
        https://bugs.webkit.org/show_bug.cgi?id=86371

        When the user selects an object in HeapSnapshot we are updating $0 variable in console API.
        But if the snapshot was loaded from file then we can't map object id for the selected obect
        from the snapshot to the live objects in the inspected page.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype._inspectedObjectChanged):
        (WebInspector.HeapSnapshotView.prototype._updateFilterOptions):
        (WebInspector.HeapProfileHeader):
        (WebInspector.HeapProfileHeader.prototype.canSaveToFile):
        (WebInspector.HeapProfileHeader.prototype.saveToFile):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileHeader):
        (WebInspector.ProfileHeader.prototype.loadFromFile):
        (WebInspector.ProfileHeader.prototype.fromFile):
        (WebInspector.ProfilesPanel.prototype._loadFromFile):

2012-05-14  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: [Extensions API] allow extensions to evaluate in the context of their content scripts
        https://bugs.webkit.org/show_bug.cgi?id=86361

        Reviewed by Yury Semikhatsky.

        Test: inspector/extensions/extensions-eval-content-script.html

        * inspector/front-end/ExtensionAPI.js: 
        (injectedExtensionAPI.ExtensionSidebarPaneImpl.prototype.setExpression): Added evaluateOptions optional parameter.
        (injectedExtensionAPI.InspectedWindow.prototype.eval):
        (injectedExtensionAPI.extractCallbackArgument): A helper to extract callback function from last argument.
        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionSidebarPane.prototype.setExpression): Added evaluateOptions optional parameter.
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onSetSidebarContent): Use ExtensionServer.evaluate() wrapper.
        (WebInspector.ExtensionServer.prototype._onEvaluateOnInspectedPage): Ditto.
        (WebInspector.ExtensionServer.prototype._normalizePath):
        (WebInspector.ExtensionServer.prototype.evaluate): A wrapper for PageAgent.evaluate() that handles evaluateOptions.
        * inspector/front-end/JavaScriptContextManager.js:
        (WebInspector.JavaScriptContextManager.prototype.contextByFrameAndSecurityOrigin): Expose interface to locate context id by frame and content script security origin.
        (WebInspector.FrameEvaluationContext.prototype._addExecutionContext): Maintain contexts sorted by name.
        (WebInspector.FrameEvaluationContext.prototype.isolatedContexts): ditto (skip sorting when returning contexts)
        (WebInspector.FrameEvaluationContext.prototype.contextBySecurityOrigin):
        * inspector/front-end/inspector.js: Hold/expose javaScriptContextManager.

2012-05-14  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: preserve tab index while widening / shrinking tabbed pane area.
        https://bugs.webkit.org/show_bug.cgi?id=86359

        Reviewed by Vsevolod Vlasov.

        After the drag'n'drop reorder, we should preserve tab index while widening /
        shrinking the tabbed pane area.

        * inspector/front-end/TabbedPane.js:
        (WebInspector.TabbedPane.prototype._innerCloseTab):
        (WebInspector.TabbedPane.prototype._showTabElement):
        (WebInspector.TabbedPane.prototype._hideTabElement):
        (WebInspector.TabbedPane.prototype._updateTabsDropDown):
        (WebInspector.TabbedPane.prototype.elementsToRestoreScrollPositionsFor):
        (WebInspector.TabbedPane.prototype._insertBefore):
        (WebInspector.TabbedPaneTab):
        (WebInspector.TabbedPaneTab.prototype._createTabElement):
        (WebInspector.TabbedPaneTab.prototype._tabDragging):

2012-05-14  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Request / response headers should be stored in name-value pairs array, not a map on front-end.
        https://bugs.webkit.org/show_bug.cgi?id=86357

        Reviewed by Pavel Feldman.

        Storing headers as name-value pairs array information more accurate and allows
        to treat Set-Cookie headers (which become not parseable when joined by comma) correctly.

        * inspector/front-end/AuditRules.js:
        (WebInspector.AuditRules.GzipRule.prototype._isCompressed):
        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeader):
        (WebInspector.AuditRules.CacheControlRule.prototype.hasResponseHeader):
        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeaderMatch):
        * inspector/front-end/HAREntry.js:
        (WebInspector.HAREntry.prototype._buildRequest):
        (WebInspector.HAREntry.prototype._buildResponse):
        * inspector/front-end/NetworkManager.js:
        (WebInspector.NetworkDispatcher.prototype._headersMapToHeadersArray):
        (WebInspector.NetworkDispatcher.prototype._updateNetworkRequestWithRequest):
        (WebInspector.NetworkDispatcher.prototype._updateNetworkRequestWithResponse):
        (WebInspector.NetworkDispatcher.prototype.webSocketWillSendHandshakeRequest):
        (WebInspector.NetworkDispatcher.prototype.webSocketHandshakeResponseReceived):
        * inspector/front-end/NetworkRequest.js:
        (WebInspector.NetworkRequest.prototype.get transferSize):
        (WebInspector.NetworkRequest.prototype.get requestHeaders):
        (WebInspector.NetworkRequest.prototype.get requestHeadersText):
        (WebInspector.NetworkRequest.prototype.get responseHeaders):
        (WebInspector.NetworkRequest.prototype.get responseHeadersText):
        (WebInspector.NetworkRequest.prototype._headerValue):
        * inspector/front-end/RequestHeadersView.js:
        (WebInspector.RequestHeadersView.prototype._refreshRequestHeaders):
        (WebInspector.RequestHeadersView.prototype._refreshResponseHeaders):
        (WebInspector.RequestHeadersView.prototype._refreshHeaders):
        * platform/chromium/support/WebHTTPLoadInfo.cpp:
        (WebKit::addHeader):

2012-05-14  Sriram Neelakandan  <sriram.neelakandan@gmail.com>

        [Gtk][DOM Bindings] Feature-protected interface usage in set/get property must be under condition guards
        https://bugs.webkit.org/show_bug.cgi?id=86060

        Reviewed by Martin Robinson.

        Property set/get functions generated was referencing WebCore::interface without any condition guard.
        This issue was triggered usually when an interface gets disabled; For instance; --disable-video, disables WebCore::HTMLMediaElement.
        Also updated the GObject binding reference tests

        No new tests - covered by existing bindings tests

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateProperties):
        * bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp:
        (webkit_dom_test_active_dom_object_get_property):
        * bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp:
        (webkit_dom_test_event_constructor_get_property):
        * bindings/scripts/test/GObject/WebKitDOMTestException.cpp:
        (webkit_dom_test_exception_get_property):
        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
        (webkit_dom_test_interface_set_property):
        (webkit_dom_test_interface_get_property):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_set_property):
        (webkit_dom_test_obj_get_property):
        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp:
        (webkit_dom_test_serialized_script_value_interface_get_property):

2012-05-14  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Styles] css properties copied into clipboard contain extra line breaks before color values
        https://bugs.webkit.org/show_bug.cgi?id=86372

        Reviewed by Vsevolod Vlasov.

        The "display: block" property found in the ".swatch-inner" CSS class was causing the issue
        (an additional \n was rendered in the plain text value).

        * inspector/front-end/inspector.css:
        (.swatch-inner):

2012-05-14  Pavel Feldman  <pfeldman@chromium.org>

        [Qt] REGRESSION (r116789): inspector/debugger/script-formatter-console.html fails
        https://bugs.webkit.org/show_bug.cgi?id=86336

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/ConsoleMessage.js:
        (WebInspector.ConsoleMessageImpl.prototype.location):

2012-05-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        TiledBackingStore: Prevent partial tile updates when they intersect the keep rect.
        https://bugs.webkit.org/show_bug.cgi?id=85488

        Reviewed by Kenneth Rohde Christiansen.

        Right now an invalidate can cause problems for tiles on the boundary of the keep
        rect. Intersecting the dirty rect causes only part of the tile to be updated,
        and the glitch becomes visible if the user scrolls this tile back into the viewport.

        * platform/graphics/TiledBackingStore.cpp:
        (WebCore::TiledBackingStore::invalidate):

2012-05-14  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Esc should revert the colorpicker-modifed color to the original
        https://bugs.webkit.org/show_bug.cgi?id=86349

        Reviewed by Vsevolod Vlasov.

        A boolean parameter has been added to the Spectrum's hide() method to denote the picker cancellation,
        which gets passed into the "Hidden" event listeners. StylesSidebarPane is made to remember the original property value
        when the picker is opened, and restore it if the color picker is cancelled.

        * inspector/front-end/Spectrum.js:
        (WebInspector.Spectrum):
        (WebInspector.Spectrum.prototype.toggle):
        (WebInspector.Spectrum.prototype.show):
        (WebInspector.Spectrum.prototype.hide):
        (WebInspector.Spectrum.prototype._onKeyDown):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylesSidebarPane.prototype.update):
        (WebInspector.StylesSidebarPane.prototype.willHide):
        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):

2012-05-14  Zeno Albisser  <zeno@webkit.org>

        [Qt] TextureMapperGL::drawTexture marked OVERRIDE but does not override any member function.
        https://bugs.webkit.org/show_bug.cgi?id=86347

        This bug was introduced by r116834.
        TextureMapperGL implements two drawTexture functions.
        The first one takes a BitmapTexture as an argument and does override TextureMapper::drawTexture().
        The second one takes a texture id as an argument and does not override any member function.

        * platform/graphics/texmap/TextureMapperGL.h:

2012-05-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: implement tabs reordering via drag'n'drop.
        https://bugs.webkit.org/show_bug.cgi?id=86294

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/TabbedPane.js:
        (WebInspector.TabbedPaneTab.prototype._createTabElement):
        (WebInspector.TabbedPaneTab.prototype._tabClicked):
        (WebInspector.TabbedPaneTab.prototype._tabMouseDown):
        (WebInspector.TabbedPaneTab.prototype._tabContextMenu):
        (WebInspector.TabbedPaneTab.prototype._tabMouseMove):
        (WebInspector.TabbedPaneTab.prototype._tabDragging):
        (WebInspector.TabbedPaneTab.prototype._endTabDragging):

2012-05-14  MORITA Hajime  <morrita@google.com>

        Should have Node::inDetach() for assertion purposes.
        https://bugs.webkit.org/show_bug.cgi?id=86157

        Reviewed by Darin Adler.

        Implemented Node::inDetach() and added an assertio in Document::setFocusedNode().
        This is a follow up of r116644 which removes inDetach() checking.

        No new tests. Just adding an asssertion.

        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        * dom/Node.cpp:
        (WebCore):
        (WebCore::Node::inDetach):
        (WebCore::Node::detach):
        * dom/Node.h:
        (Node):

2012-05-13  Noel Gordon  <noel.gordon@gmail.com>

        [chromium] Remove platform/image-decoders/xbm from WebCore.gyp
        https://bugs.webkit.org/show_bug.cgi?id=86333

        Reviewed by Adam Barth.

        No new tests. No change in behavior.

        * WebCore.gyp/WebCore.gyp: Remove reference to platform/image-decoders/xbm
        since that directory was removed from the repository long ago.

2012-05-13  Darin Adler  <darin@apple.com>

        [CG] Unneeded CFRetain/Release of CGImageRef in BitmapImage::draw
        https://bugs.webkit.org/show_bug.cgi?id=86332

        Reviewed by Dan Bernstein.

        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::BitmapImage::draw): Don't use RetainPtr since the result of
        the function is used before anything could call CFRelease on it.

2012-05-13  Darin Adler  <darin@apple.com>

        Listeners map uses raw pointers, but should use OwnPtr
        https://bugs.webkit.org/show_bug.cgi?id=86298

        Reviewed by Dan Bernstein.

        * bindings/js/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::~PageScriptDebugServer): Removed call
        to deleteAllValues since the destructor now takes care of this
        (WebCore::PageScriptDebugServer::addListener): Changed idiom of the add
        function call here to use adoptPtr.
        (WebCore::PageScriptDebugServer::removeListener): Added a now-needed
        call to get and removed a now-uneeeded call to delete.
        * bindings/js/PageScriptDebugServer.h: Changed the key type of
        PageListenersMap to OwnPtr.

        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::~ScriptDebugServer): Removed code to delete
        the values in m_pageListenersMap. This map was never used and so I have
        removed it.
        * bindings/js/ScriptDebugServer.h: Removed the type PageListenersMap
        and the unused data member, m_pageListenersMap.

2012-05-13  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move ValidityState methods implementation to another place
        https://bugs.webkit.org/show_bug.cgi?id=86058

        Reviewed by Kent Tamura.

        This patch changes ValidityState class for limiting scope of
        number/range input type related methods for introducing decimal
        arithmetic.

        Methods related to validation are moved from ValidateState to
        input, select and textarea elements with virtual method based
        dispatching via FormAssociateElement instead of tag name
        dispatching so far for code simplification.

        No new tests. This patch doesn't change behavior.

        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::customError): Added. Called from ValidateState. Returns custom error mssage in member variable.
        (WebCore::FormAssociatedElement::patternMismatch): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::rangeOverflow): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::rangeUnderflow): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::stepMismatch): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::tooLong): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::typeMismatch): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::valid): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::valueMissing): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::customValidationMessage): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::validationMessage): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::setCustomValidity): Added.  set custom error message.
        * html/FormAssociatedElement.h:
        (FormAssociatedElement): Added new instance value m_customValidationMessage.
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::validationMessage): Removed. Note: HTMLInputElement, HTMLSelectElement, and HTMLTextAreaElement implement this method.
        (WebCore::HTMLFormControlElement::setCustomValidity): Changed. Calls base class setCustomValidity.
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isValidValue): Call m_inputType methods instead of HTMLInputElement's.
        (WebCore::HTMLInputElement::tooLong): Call m_inputType methods instead of HTMLInputElement's.
        (WebCore):
        (WebCore::HTMLInputElement::typeMismatch): Move implementation to InputType.
        (WebCore::HTMLInputElement::valueMissing):  Move implementation to InputType.
        (WebCore::HTMLInputElement::patternMismatch): Move implementation to InputType.
        (WebCore::HTMLInputElement::rangeUnderflow): Move implementation to InputType.
        (WebCore::HTMLInputElement::rangeOverflow): Move implementation to InputType.
        (WebCore::HTMLInputElement::validationMessage): Move implementation to InputType.
        (WebCore::HTMLInputElement::stepMismatch): Move implementation to InputType.
        (WebCore::HTMLInputElement::isInRange): Call m_inputType methods instead of HTMLInputElement's.
        (WebCore::HTMLInputElement::isOutOfRange): Call m_inputType methods instead of HTMLInputElement's.
        * html/HTMLInputElement.h:
        (HTMLInputElement): Make tooLong method private.
        * html/HTMLObjectElement.h: Add "virtual" and "OVERRIDE".
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::validationMessage): Added. Implementation for HTMLSelectElement.
        (WebCore::HTMLSelectElement::valueMissing): Added. Implementation for HTMLSelectElement.
        * html/HTMLSelectElement.h:
        (HTMLSelectElement):  Added entries for newly added methods.
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::validationMessage): Added. Implementation for HTMLTextAreaElement.
        (WebCore::HTMLTextAreaElement::valueMissing): Added. Implementation for HTMLTextAreaElement.
        (WebCore::HTMLTextAreaElement::tooLong): Added. Implementation for HTMLTextAreaElement.
        * html/HTMLTextAreaElement.h:
        (HTMLTextAreaElement): Added entries for newly added methods. Change tooLong and valueMissing private.
        * html/InputType.cpp:
        (WebCore::InputType::stepMismatch): Change method signature.
        (WebCore::InputType::alignValueForStep):  Changed for calling InputClass instead of HTMLINputElement.
        (WebCore::InputType::stepUpFromRenderer):  Added. Moved from HTMLInputElement.
        (WebCore::InputType::validationMessage): Added.  Moved from HTMLInputElement.
        * html/InputType.h:
        (InputType): Added entries for newly added methods and update methods signature.
        * html/ValidityState.cpp: Move actual implementation to FormAssociatedElement and derived classes for localizing implementation change of elements and input types.
        (WebCore::ValidityState::validationMessage): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::valueMissing): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::typeMismatch): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::patternMismatch): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::tooLong): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::rangeUnderflow): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::rangeOverflow): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::stepMismatch): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::customError): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::valid):
        * html/ValidityState.h:
        (ValidityState): Remove custom validation message related things.

2012-05-13  Mike Lawther  <mikelawther@chromium.org>

        Heap-use-after-free in WTF::HashMap<int, WTF::RefPtr<WebCore::CalculationValue>, WTF::IntHash<unsigned int>, WTF::HashTrait
        https://bugs.webkit.org/show_bug.cgi?id=85195

        This bug was caused by Length not understanding that calc expressions shouldn't be 
        blended - a Length with a calc expression handle was created without incrementing
        the ref count of the expression. Length no longer attempts to blend calc expressions,
        http://webkit.org/b/86160 has been filed to track expression blending. Fixing this fixed
        the crash.

        Once this was fixed, the RenderStyle diff checker thought the style was changing,
        as Length didn't know how to compare calc expressions, resulting in an infinite
        loop of style recalcs. Expressions can now compare themselves.

        Reviewed by Darin Adler.

        Tests: css3/calc/transition-crash.html
               css3/calc/transition-crash2.html

        * platform/CalculationValue.h:
        (WebCore::CalcExpressionNode::CalcExpressionNode):
        (CalcExpressionNode):
        (WebCore::CalcExpressionNode::type):
        (CalculationValue):
        (WebCore::CalculationValue::operator==):
        (WebCore::CalcExpressionNumber::CalcExpressionNumber):
        (WebCore::CalcExpressionNumber::operator==):
        (CalcExpressionNumber):
        (WebCore::CalcExpressionLength::CalcExpressionLength):
        (WebCore::CalcExpressionLength::operator==):
        (CalcExpressionLength):
        (WebCore::CalcExpressionBinaryOperation::CalcExpressionBinaryOperation):
        (WebCore::CalcExpressionBinaryOperation::operator==):
        (CalcExpressionBinaryOperation):
        * platform/Length.cpp:
        (WebCore::Length::isCalculatedEqual):
        (WebCore):
        * platform/Length.h:
        (WebCore::Length::operator==):
        (Length):
        (WebCore::Length::blend):

2012-05-13  Darin Adler  <darin@apple.com>

        Roll out local changes accidentally landed in r116905.

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/cg/GraphicsContextCG.cpp:
        * platform/graphics/cg/ImageCG.cpp:

2012-05-13  Rob Buis  <rbuis@rim.com>

        Use emptyString instead of String("")
        https://bugs.webkit.org/show_bug.cgi?id=86305

        Reviewed by Darin Adler.

        Use emptyString() instead of String("") because it is better style and faster.

        No new tests. No change in behavior.

        * Modules/webdatabase/AbstractDatabase.cpp:
        (WebCore::AbstractDatabase::performOpenAndVerify):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::subprotocol):
        (WebCore::ThreadableWebSocketChannelClientWrapper::extensions):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setValueFromRenderer):
        * platform/SharedBufferChunkReader.cpp:
        (WebCore::SharedBufferChunkReader::nextChunkAsUTF8StringWithLatin1Fallback):
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::setProxyInfo):
        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::initializeLocalizedDateFormatText):
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::originalText):
        * storage/StorageNamespaceImpl.cpp:
        (WebCore::StorageNamespaceImpl::localStorageNamespace):
        * svg/SVGStringList.cpp:
        (WebCore::SVGStringList::reset):

2012-05-13  Darin Adler  <darin@apple.com>

        Image::initPlatformData is always an empty function so we can remove it
        https://bugs.webkit.org/show_bug.cgi?id=86297

        Reviewed by Dan Bernstein.

        * platform/graphics/BitmapImage.h: Removed declaration of initPlatformData.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.
        * platform/graphics/cairo/BitmapImageCairo.cpp:
        (WebCore::BitmapImage::BitmapImage): Ditto.
        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::BitmapImage::BitmapImage): Ditto.
        * platform/graphics/chromium/ImageChromiumMac.mm: Removed empty
        initPlatformData function.
        * platform/graphics/efl/ImageEfl.cpp: Ditto.
        * platform/graphics/gtk/ImageGtk.cpp:
        * platform/graphics/mac/ImageMac.mm:
        * platform/graphics/openvg/ImageOpenVG.cpp:
        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.
        Removed empty initPlatformData function.
        * platform/graphics/qt/ImageQt.cpp:
        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.
        Removed empty initPlatformData function.
        * platform/graphics/skia/ImageSkia.cpp: Removed empty initPlatformData function.
        * platform/graphics/win/ImageWin.cpp: Ditto.
        * platform/graphics/wx/ImageWx.cpp: Ditto.
        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.

2012-05-13  Darin Adler  <darin@apple.com>

        RenderView::selectionBounds and RenderView::setSelection use maps with raw pointers that should be OwnPtr
        https://bugs.webkit.org/show_bug.cgi?id=86300

        Reviewed by Eric Seidel.

        * rendering/RenderView.cpp:
        (WebCore::RenderView::selectionBounds): Changed SelectionMap type to use OwnPtr.
        Added code to do adoptPtr as needed and removed explicit delete code.
        (WebCore::RenderView::setSelection): Changed SelectedBlockMap type to use OwnPtr.
        Added code to do adoptPtr as needed and removed explicit delete code.

2012-05-13  Darin Adler  <darin@apple.com>

        FractionalLayoutUnit class has unneeded redundant uses of "inline" keyword
        https://bugs.webkit.org/show_bug.cgi?id=86301

        Reviewed by Andreas Kling.

        * platform/FractionalLayoutUnit.h: Removed uses of inline for functions
        defined inside a class definition. The C++ language defines that all such
        functions are treated as if specified with inline, and explicitly stating
        inline in addition does not add anything or change behavior.

2012-05-13  Darin Adler  <darin@apple.com>

        Dangling node to ID maps vector uses raw pointers, but should use OwnPtr
        https://bugs.webkit.org/show_bug.cgi?id=86299

        Reviewed by Pavel Feldman.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::releaseDanglingNodes): Removed now-unneeded call
        to deleteAllValues since the clear function now takes care of that.
        (WebCore::InspectorDOMAgent::pushNodePathToFrontend): Added code that uses
        adoptPtr and release as neeed to deal with a Vector<OwnPtr>.
        * inspector/InspectorDOMAgent.h: Changed m_danglingNodeToIdMaps to be
        Vector<OwnPtr> instead of a vector of raw pointers.

2012-05-13  Victor Carbune  <vcarbune@adobe.com>

        Volume slider needs to be displayed below the mute button
        https://bugs.webkit.org/show_bug.cgi?id=85990

        Reviewed by Dimitri Glazkov.

        Added back code for rendering offset, but used only when the volume slider
        needs to be displayed below the controls.

        Test: media/media-volume-slider-rendered-below.html

        * css/mediaControlsChromium.css:
        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
        Changed positioning of the slider to absolute, otherwise it is not possible to position it from the layout() method.
        * css/mediaControlsQuickTime.css:
        Added back the double mute-button and changed the z-index of the original button. When the slider is displayed
        the second mute button is actually there.
        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
        (audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button):
        Added copy.
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlPanelElement::makeTransparent): Disabled the possible of hiding controls. WebVTT rendering
        in the place of controls when these are visible is not possible with the current code.
        (RenderMediaVolumeSliderContainer):
        (WebCore):
        (WebCore::RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer):
        (WebCore::RenderMediaVolumeSliderContainer::layout):
        Checked if the absolute coordinates of the corner of the slider would be rendered outside the page. This part of the
        code is faulty if display:none is toggled on the controls.
        (WebCore::MediaControlVolumeSliderContainerElement::createRenderer):
        * html/shadow/MediaControlElements.h:
        (MediaControlVolumeSliderContainerElement):
        * html/shadow/MediaControlRootElement.cpp:
        (WebCore::MediaControlRootElement::create):

2012-05-13  Igor Oliveira  <igor.o@sisa.samsung.com>

        [Texmap] TextureMapperAnimations does not support keyframe with multiple animations
        https://bugs.webkit.org/show_bug.cgi?id=86303

        Qt and GTK, in WebKit1, use TextureMapper to store AC animations using
        TextureMapperAnimations::add(keyframeName, TextureMapperAnimation). And when a 
        CSS animation animates several CSS properties, TextureMapperAnimations::add is
        called more than once with the same keyframeName value. However, currently,
        TextureMapperAnimations can not store more than one animated property in the keyframe
        because it is using HashMap<String, TextureMapperAnimation>, and WebKit HashMap 
        does not support add the same key twice.

        Reviewed by Noam Rosenthal.

        * platform/graphics/texmap/TextureMapperAnimation.cpp:
        (WebCore::TextureMapperAnimations::hasActiveAnimationsOfType):
        (WebCore::TextureMapperAnimations::hasRunningAnimations):
        (WebCore::TextureMapperAnimations::add):
        (WebCore):
        (WebCore::TextureMapperAnimations::pause):
        (WebCore::TextureMapperAnimations::apply):
        * platform/graphics/texmap/TextureMapperAnimation.h:
        (TextureMapperAnimations): Use HashMap<String, Vector<TextureMapperAnimation> >,
        so we can support an keyframe with multiple animations.

2012-05-12  Abhishek Arya  <inferno@chromium.org>

        Crash in HTMLSelectElement::setOption
        https://bugs.webkit.org/show_bug.cgi?id=85420

        Reviewed by Eric Seidel
        
        RefPtr before option in HTMLSelectElement::setOption since it
        can get destroyed due to mutation events.

        Test: fast/dom/HTMLSelectElement/option-add-crash.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::setOption):

2012-05-12  Robin Dunn  <robin@alldunn.com>

        [wx] Restore text paste implementation.
        https://bugs.webkit.org/show_bug.cgi?id=86311

        Reviewed by Kevin Ollivier.

        * platform/wx/PasteboardWx.cpp:
        (WebCore::Pasteboard::plainText):

2012-05-12  Philip Rogers  <pdr@google.com>

        Cleanup before changing attributeName in SVG <animate>
        https://bugs.webkit.org/show_bug.cgi?id=86100

        Reviewed by Nikolas Zimmermann.

        Changing attributeName caused a crash because references were not removed from the old target.
        This change simply cleans up before changing attributeName in SVG animation elements.

        Test: svg/animations/dynamic-modify-attributename-crash.svg

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::svgAttributeChanged):

2012-05-12  Max Feil  <mfeil@rim.com>

        [BlackBerry] Allow the platform media player to determine the media element's paused/playing status
        https://bugs.webkit.org/show_bug.cgi?id=86235

        Reviewed by George Staikos.

        The platform media player needs to know when the HTMLMediaElement
        is not paused. This is to address problems when switching
        source element, which causes the destruction of the old
        MediaPlayerPrivate object and construction of a new one. The
        new one must resume playing ASAP if the old one was playing.

        Test: media/media-continues-playing-after-replace-source.html

        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::isElementPaused):
        (WebCore):
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        (MediaPlayerPrivate):

2012-05-12  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: heap profiler should allow revealing an element which is logged to the console
        https://bugs.webkit.org/show_bug.cgi?id=86204

        Reviewed by Pavel Feldman.

        JS objects in the console have context menu item that allows to reveal them in a heap snapshot view.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/ConsoleMessage.js:
        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
        * inspector/front-end/ContextMenu.js:
        (WebInspector.ContextMenu.prototype.isEmpty):
        * inspector/front-end/DataGrid.js:
        (WebInspector.DataGridNode.prototype._detach):
        (WebInspector.DataGridNode.prototype.wasDetached):
        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype.nodeClassName):
        (WebInspector.HeapSnapshotNodesProvider.prototype.nodePosition):
        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotSortableDataGrid):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.highlightObjectByHeapSnapshotId):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.highlightNode):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype.nodeWasDetached):
        (WebInspector.HeapSnapshotSortableDataGrid.prototype._clearCurrentHighlight):
        (WebInspector.HeapSnapshotViewportDataGrid):
        (WebInspector.HeapSnapshotViewportDataGrid.prototype.highlightNode):
        (WebInspector.HeapSnapshotViewportDataGrid.prototype._onScroll):
        (WebInspector.HeapSnapshotConstructorsDataGrid):
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.highlightObjectByHeapSnapshotId.didGetClassName):
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.highlightObjectByHeapSnapshotId):
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.setDataSource):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode.prototype.wasDetached):
        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId):
        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId.didPopulateChildren):
        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotProxy.prototype.nodeClassName):
        (WebInspector.HeapSnapshotProviderProxy.prototype.nodePosition):
        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertiesSection.ContextMenuProvider):
        (WebInspector.ObjectPropertiesSection.ContextMenuProvider.prototype.populateContextMenu):
        (WebInspector.ObjectPropertiesSection.addContextMenuProvider):
        (WebInspector.ObjectPropertiesSection.prototype.enableContextMenu):
        (WebInspector.ObjectPropertiesSection.prototype._contextMenuEventFired):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.showObject):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.revealInSummaryView):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.didReceiveHeapObjectId):
        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu):
        * inspector/front-end/profilesPanel.css:
        (.highlighted-row):
        (@-webkit-keyframes row_highlight):
        (to):

2012-05-12  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: move recording button state control out of addProfileHeader.
        https://bugs.webkit.org/show_bug.cgi?id=86293

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.buttonClicked):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotProfileType.prototype.buttonClicked):
        * inspector/front-end/ProfileView.js:
        (WebInspector.CPUProfileType.prototype.buttonClicked):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.buttonClicked):
        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):
        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot.done):
        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot):

2012-05-12  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: Turn HelpScreen to be View.
        https://bugs.webkit.org/show_bug.cgi?id=85711

        Reviewed by Yury Semikhatsky.

        Motivation: for further UI changes, HelpSceen needs to be View.
        It is planned to combine Settings Screen and Shortcuts Screen in one
        tabbed screen.
        Bonus: "helpScreen.css" will be lazy-loaded.
        Additional changes: move settingsScreen logic out of inspector.js

        UI change, no test required.

        * WebCore.gypi: Change "helpScreen.css" file group.
        * inspector/front-end/HelpScreen.js: 
        (WebInspector.HelpScreen): Turned to View subclass.
        (WebInspector.HelpScreen.prototype.showModal): Remove "onHide" param
        (WebInspector.HelpScreen.prototype.hide): Ditto.
        (WebInspector.HelpScreen.prototype._onKeyDown): Adopt View members.
        (WebInspector.HelpScreen.prototype._onBlur): Ditto.
        * inspector/front-end/SettingsScreen.js: Adopt new workflow.
        (WebInspector.SettingsScreen): Put onHide function to member
        (WebInspector.SettingsScreen.prototype.willHide): Invoke onHide
        (WebInspector.SettingsController): Mediator pattern - this class
        takes care of status bar button - settings screen relationship.
        (WebInspector.SettingsController.prototype.get statusBarItem):
        Getter fot representative element.
        (WebInspector.SettingsController.prototype._buttonClicked):
        Classifies user action.
        (WebInspector.SettingsController.prototype._onHideSettingsScreen):
        Cleanup after settings screen is hidden.
        (WebInspector.SettingsController.prototype._showSettingsScreen):
        Presents settings screen.
        (WebInspector.SettingsController.prototype._hideSettingsScreen):
        Hides settings screen.
        * inspector/front-end/ShortcutsScreen.js: Adopt new workflow.
        (WebInspector.ShortcutsScreen.prototype.wasShown): Lazy initialization.
        * inspector/front-end/WorkerManager.js: Adopt new workflow.
        (WebInspector.WorkerManager.prototype._disconnectedFromWorker): Ditto.
        (WebInspector.WorkerTerminatedScreen.prototype.willHide): Ditto.
        * inspector/front-end/helpScreen.css: Fix spacing.
        (.help-window-outer): Ditto.
        (body.compact .help-window-outer): Ditto.
        (body.compact .help-window-main): Ditto.
        (body.compact .help-window-caption): Ditto.
        (.help-content): Ditto.
        (body.compact .help-content): Ditto.
        (.help-content select): Ditto.
        * inspector/front-end/inspector.html: Ditto.
        * inspector/front-end/inspector.js: Ditto.
        (WebInspector._createGlobalStatusBarItems): Create SettingsController.
        (WebInspector.documentKeyDown): Adopt new workflow.

2012-05-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: add tab context menu
        https://bugs.webkit.org/show_bug.cgi?id=86292

        Reviewed by Yury Semikhatsky.

        This tab context menu will have "Close", "Close Others" and "Close All".

        * English.lproj/localizedStrings.js:
        * inspector/front-end/TabbedPane.js:
        (WebInspector.TabbedPane.prototype.closeOtherTabs):
        (WebInspector.TabbedPaneTab.prototype._createTabElement):
        (WebInspector.TabbedPaneTab.prototype._tabClicked):
        (WebInspector.TabbedPaneTab.prototype._tabContextMenu):
        (WebInspector.TabbedPaneTab.prototype._tabContextMenu.closeOthers):
        (WebInspector.TabbedPaneTab.prototype._tabContextMenu.closeAll):

2012-05-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: make call frame selector pane focusable, allow Up / Down to select current call frame.
        https://bugs.webkit.org/show_bug.cgi?id=86291

        Reviewed by Yury Semikhatsky.

        This change makes sidebar section focusable, introduces key listeners for Up and Down.

        * inspector/front-end/CallStackSidebarPane.js:
        (WebInspector.CallStackSidebarPane):
        (WebInspector.CallStackSidebarPane.prototype.setStatus):
        (WebInspector.CallStackSidebarPane.prototype._treeKeyDown):
        * inspector/front-end/UISourceCode.js:
        * inspector/front-end/scriptsPanel.css:
        (#scripts-debug-toolbar img):

2012-05-12  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: unreviewed one line fix.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotWorker):

2012-05-12  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: Load context menu item has to be shown for all Profiles panel.
        https://bugs.webkit.org/show_bug.cgi?id=86290

        Reviewed by Pavel Feldman.

        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._handleContextMenuEvent):

2012-05-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: shrink SourceFrame editing API to two methods (was 4).
        https://bugs.webkit.org/show_bug.cgi?id=86288

        Reviewed by Yury Semikhatsky.

        Used specific workflow in two SourceFrame implementations.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
        * inspector/front-end/ResourceView.js:
        (WebInspector.EditableResourceSourceFrame.prototype.commitEditing.callbackWrapper):
        (WebInspector.EditableResourceSourceFrame.prototype.commitEditing):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.commitEditing):
        (WebInspector.TextViewerDelegateForSourceFrame.prototype.commitEditing):

2012-05-11  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: allow showing arbitrary range of nodes in heap snapshot view
        https://bugs.webkit.org/show_bug.cgi?id=86230

        Reviewed by Pavel Feldman.

        Test: inspector/profiler/heap-snapshot-summary-show-ranges.html

        It was only possible to expand heap snapshot node children sequentially starting
        from the first child and then pressing either "Show next X items" or "Show all X items".
        This change makes it possible to show any range of children.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotFilteredOrderedIterator):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.serializeItemsRange):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.sortAll):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.sortAndRewind):
        (WebInspector.HeapSnapshotEdgesProvider.prototype.serializeItem):
        (WebInspector.HeapSnapshotNodesProvider.prototype.serializeItem):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode):
        (WebInspector.HeapSnapshotGridNode.prototype._populate.sorted):
        (WebInspector.HeapSnapshotGridNode.prototype._populate):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.serializeNextChunk):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.insertRetrievedChild):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.insertShowMoreButton):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.childrenRetrieved):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren):
        (WebInspector.HeapSnapshotGridNode.prototype._saveChildren):
        (WebInspector.HeapSnapshotGridNode.prototype.sort.afterSort):
        (WebInspector.HeapSnapshotGridNode.prototype.sort):
        (WebInspector.HeapSnapshotDiffNodesProvider):
        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.serializeItemsRange):
        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.serializeItemsRange.didReceiveDeletedItems):
        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.serializeItemsRange.didReceiveAddedItems):
        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.sortAndRewind):
        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotWorker):
        (WebInspector.HeapSnapshotProviderProxy.prototype.serializeItemsRange):
        * inspector/front-end/ShowMoreDataGridNode.js:
        (WebInspector.ShowMoreDataGridNode):
        (WebInspector.ShowMoreDataGridNode.prototype._showNextChunk):
        (WebInspector.ShowMoreDataGridNode.prototype._showAll):
        (WebInspector.ShowMoreDataGridNode.prototype._updateLabels):
        (WebInspector.ShowMoreDataGridNode.prototype.setStartPosition):
        (WebInspector.ShowMoreDataGridNode.prototype.setEndPosition):
        * inspector/front-end/utilities.js:

2012-05-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: remove UISourceCode.id since it is no longer used.
        https://bugs.webkit.org/show_bug.cgi?id=86286

        Reviewed by Vsevolod Vlasov.

        We are now using breakpointStorageId property for breakpoint persistence.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager):
        (WebInspector.BreakpointManager.prototype._debuggerReset):
        (WebInspector.BreakpointManager.prototype._uiLocationAdded.get if):
        (WebInspector.BreakpointManager.prototype._uiLocationAdded):
        (WebInspector.BreakpointManager.prototype._uiLocationRemoved.get if):
        (WebInspector.BreakpointManager.prototype._uiLocationRemoved):
        * inspector/front-end/CompilerScriptMapping.js:
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource):
        * inspector/front-end/RawSourceCode.js:
        (WebInspector.RawSourceCode):
        (WebInspector.RawSourceCode.prototype.rawLocationToUILocation):
        (WebInspector.RawSourceCode.prototype._createUISourceCode):
        (WebInspector.RawSourceCode.prototype._finishedLoading):
        * inspector/front-end/SnippetsModel.js:
        (WebInspector.SnippetsScriptMapping.prototype._snippetAdded):
        (WebInspector.SnippetsScriptMapping.prototype._createUISourceCodeForScript):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):

2012-05-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: merge MainScriptMapping into DebuggerPresentationModel; move other classes into their own files.
        https://bugs.webkit.org/show_bug.cgi?id=86285

        Reviewed by Yury Semikhatsky.

        The only purpose of the debugger presentation model now is to manage mappings. Merging main script mapping back into it.
        Other classes defined in that class are moved out into their own files.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModel):
        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
        * inspector/front-end/DebuggerResourceBinding.js: Added.
        (WebInspector.DebuggerResourceBinding):
        (WebInspector.DebuggerResourceBinding.canEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource):
        (WebInspector.DebuggerResourceBinding.prototype.canSetContent):
        (WebInspector.DebuggerResourceBinding.prototype.setContent):
        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
        (WebInspector.DebuggerResourceBinding.prototype._setContentWithInitialContent):
        * inspector/front-end/PresentationConsoleMessageHelper.js: Added.
        (WebInspector.PresentationConsoleMessageHelper):
        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleMessageAdded):
        (WebInspector.PresentationConsoleMessageHelper.prototype._addConsoleMessageToScript):
        (WebInspector.PresentationConsoleMessageHelper.prototype._addPendingConsoleMessage):
        (WebInspector.PresentationConsoleMessageHelper.prototype._parsedScriptSource):
        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleCleared):
        (WebInspector.PresentationConsoleMessageHelper.prototype._debuggerReset):
        (WebInspector.PresentationConsoleMessage):
        (WebInspector.PresentationConsoleMessage.prototype._updateLocation):
        (WebInspector.PresentationConsoleMessage.prototype.get lineNumber):
        (WebInspector.PresentationConsoleMessage.prototype.dispose):
        * inspector/front-end/ScriptMapping.js:
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:

2012-05-12  Mike West  <mkwst@chromium.org>

        Cleanup ContentSecurityPolicy naming conventions.
        https://bugs.webkit.org/show_bug.cgi?id=86282

        Reviewed by Adam Barth.

        Two tiny changes:
        
        1. `reportURI` and `reportURL` are both used within the CSP
           implementation. We should standardize on `reportURI` to match the
           spec.
        
        2. Renames `ContentSecurityPolicy::allowConnectFromSource` to
           `ContentSecurityPolicy::allowConnectToSource` for clarity.

        No new tests, as there's no user-visible change.

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::reportViolation):
        (WebCore::CSPDirectiveList::allowConnectToSource):
        (WebCore::CSPDirectiveList::parseReportURI):
        (WebCore::CSPDirectiveList::addDirective):
        (WebCore::ContentSecurityPolicy::allowConnectToSource):
        * page/ContentSecurityPolicy.h:
        * page/EventSource.cpp:
        (WebCore::EventSource::create):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open):

2012-05-11  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call isLinkVisited directly
        https://bugs.webkit.org/show_bug.cgi?id=85412

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * page/PageGroup.cpp:
        (WebCore::PageGroup::isLinkVisited):
        * platform/VisitedLinks.cpp: Added.
        (WebCore):
        (WebCore::VisitedLinks::isLinkVisited):
        * platform/VisitedLinks.h: Added.
        (WebCore):
        (VisitedLinks):
        * platform/chromium/PlatformSupport.h:
        * platform/chromium/VisitedLinksChromium.cpp: Added.
        (WebCore):
        (WebCore::VisitedLinks::isLinkVisited):

2012-05-11  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] Tiles are not created for large textures
        https://bugs.webkit.org/show_bug.cgi?id=86245

        Reviewed by Noam Rosenthal.

        No new tests. This will not produce any observable behavior changes,
        unless run on a machine with a small texture size limit.

        The maxTextureSize() method on TextureMapperGL was missing a "const"
        keyword, meaning that it was not properly overriding the version in
        the abstract base class (TextureMapper). This patch adds the const
        modifier and cleans up the list of override methods in the two 
        TextureMapper sublcasses, adding the OVERRIDE macro for compilers that
        support it and removing a couple unused methods.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        * platform/graphics/texmap/TextureMapperGL.h:
        (WebCore::TextureMapperGL::create):
        * platform/graphics/texmap/TextureMapperImageBuffer.h:
        (TextureMapperImageBuffer):

2012-05-11  Adrienne Walker  <enne@google.com>

        [chromium] Prevent deadlock on CCVideoLayerImpl destruction
        https://bugs.webkit.org/show_bug.cgi?id=86258

        Reviewed by James Robinson.

        ~CCVideoLayerImpl had a common deadlock issue where if it got
        destroyed before WebMediaPlayerClientImpl, it would take a lock,
        call WebMediaPlayerClientImpl::setVideoFrameProviderClient(0),
        which in turn would call CCVideoLayerImpl::stopUsingProvider(),
        which would try to take the same lock and would deadlock.

        CCVideoLayerImpl is only created and destroyed during tree
        synchronization in a commit or during synchronous compositor thread
        destruction. In either case, the main thread is blocked, and so no
        lock needs to be taken at all.

        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
        (WebCore::CCVideoLayerImpl::stopUsingProvider):

2012-05-11  Jeffrey Pfau  <jpfau@apple.com>

        REGRESSION (r114170): Scroll areas in nested frames improperly placed when tiled drawing is enabled
        https://bugs.webkit.org/show_bug.cgi?id=86239

        Reviewed by Anders Carlsson.

        Fixes a regression introduced in r114170 by recursively adding positions of parent frames to placement of nested frame scroll areas.

        Manual tests: ManualTests/scrollable-positioned-frame.html
                      ManualTests/scrollable-positioned-nested-frame.html

        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::computeNonFastScrollableRegion):
        (WebCore::ScrollingCoordinator::frameViewLayoutUpdated):

2012-05-11  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86278
        Composited layers should only run the overlay scrollbars painting pass 
        if necessary

        Reviewed by Dan Bernstein.

        It's not enough that the rootLayer has dirty scrollbars; we also have 
        to actually be doing the overlay scrollbars painting pass to skip the 
        early return.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintLayer):

2012-05-11  Anders Carlsson  <andersca@apple.com>

        Comcast website displays bottom of page when loaded
        https://bugs.webkit.org/show_bug.cgi?id=86277
        <rdar://problem/11426887>

        Reviewed by Beth Dakin.

        There were two bugs here. The first bug was that FrameView::setScrollPosition didn't end up calling into the scrolling coordinator
        to update the scroll position. The second bug was that ScrollingTreeNodeMac::setScrollPosition didn't constrain the scroll position
        to the edge of the page.

        * page/FrameView.cpp:
        (WebCore::FrameView::setScrollPosition):
        Call requestScrollPositionUpdate.

        * page/scrolling/ScrollingTree.cpp:
        * page/scrolling/ScrollingTree.h:
        Remove setMainFrameScrollPosition, it is not called by anyone.

        * page/scrolling/mac/ScrollingTreeNodeMac.h:
        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
        Clamp to the page size and call setScrollPositionWithoutContentEdgeConstraints.

        (WebCore::ScrollingTreeNodeMac::setScrollPositionWithoutContentEdgeConstraints):
        Update the scroll layer position and call back to the main thread.

        (WebCore::ScrollingTreeNodeMac::scrollBy):
        Call setScrollPosition.

        (WebCore::ScrollingTreeNodeMac::scrollByWithoutContentEdgeConstraints):
        Call setScrollPositionWithoutContentEdgeConstraints.

2012-05-11  Gavin Barraclough  <barraclough@apple.com>

        Introduce PropertyName class
        https://bugs.webkit.org/show_bug.cgi?id=86241

        Reviewed by Geoff Garen.

        Replace 'const Identifier&' arguments to functions accessing object properties with a new 'PropertyName' type.
        This change paves the way to allow for properties keyed by values that are not Identifiers.

        This change is largely a mechanical find & replace.
        It also changes JSFunction's constructor to take a UString& instead of an Identifier&
        (since in some cases we can no longer guarantee that we'lll have an Identifier), and
        unifies Identifier's methods to obtain array indices onto PropertyName.

        The new PropertyName class retains the ability to support .impl() and .ustring(), but
        in a future patch we may need to rework this, since not all PropertyNames should be
        equal based on their string representation.

        * WebCore.exp.in:
        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
        (WebCore::cssPropertyIDForJSCSSPropertyName):
        (WebCore::JSCSSStyleDeclaration::getOwnPropertySlotDelegate):
        (WebCore::JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate):
        (WebCore::JSCSSStyleDeclaration::putDelegate):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::findAtomicString):
        (WebCore::objectToStringFunctionGetter):
        * bindings/js/JSDOMBinding.h:
        (WebCore):
        (WebCore::propertyNameToString):
        (WebCore::propertyNameToAtomicString):
        * bindings/js/JSDOMMimeTypeArrayCustom.cpp:
        (WebCore::JSDOMMimeTypeArray::canGetItemsForName):
        (WebCore::JSDOMMimeTypeArray::nameGetter):
        * bindings/js/JSDOMPluginArrayCustom.cpp:
        (WebCore::JSDOMPluginArray::canGetItemsForName):
        (WebCore::JSDOMPluginArray::nameGetter):
        * bindings/js/JSDOMPluginCustom.cpp:
        (WebCore::JSDOMPlugin::canGetItemsForName):
        (WebCore::JSDOMPlugin::nameGetter):
        * bindings/js/JSDOMStringMapCustom.cpp:
        (WebCore::JSDOMStringMap::canGetItemsForName):
        (WebCore::JSDOMStringMap::nameGetter):
        (WebCore::JSDOMStringMap::deleteProperty):
        (WebCore::JSDOMStringMap::putDelegate):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::nonCachingStaticFunctionGetter):
        (WebCore::childFrameGetter):
        (WebCore::namedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
        (WebCore::JSDOMWindow::put):
        (WebCore::JSDOMWindow::deleteProperty):
        (WebCore::JSDOMWindow::defineOwnProperty):
        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::getOwnPropertySlot):
        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
        (WebCore::JSDOMWindowShell::put):
        (WebCore::JSDOMWindowShell::putDirectVirtual):
        (WebCore::JSDOMWindowShell::defineOwnProperty):
        (WebCore::JSDOMWindowShell::deleteProperty):
        * bindings/js/JSDOMWindowShell.h:
        (JSDOMWindowShell):
        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        (WebCore::getNamedItems):
        (WebCore::callHTMLAllCollection):
        (WebCore::JSHTMLAllCollection::canGetItemsForName):
        (WebCore::JSHTMLAllCollection::nameGetter):
        (WebCore::JSHTMLAllCollection::item):
        * bindings/js/JSHTMLAppletElementCustom.cpp:
        (WebCore::JSHTMLAppletElement::getOwnPropertySlotDelegate):
        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
        (WebCore::JSHTMLAppletElement::putDelegate):
        * bindings/js/JSHTMLCollectionCustom.cpp:
        (WebCore::getNamedItems):
        (WebCore::JSHTMLCollection::canGetItemsForName):
        (WebCore::JSHTMLCollection::nameGetter):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::canGetItemsForName):
        (WebCore::JSHTMLDocument::nameGetter):
        * bindings/js/JSHTMLEmbedElementCustom.cpp:
        (WebCore::JSHTMLEmbedElement::getOwnPropertySlotDelegate):
        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
        (WebCore::JSHTMLEmbedElement::putDelegate):
        * bindings/js/JSHTMLFormElementCustom.cpp:
        (WebCore::JSHTMLFormElement::canGetItemsForName):
        (WebCore::JSHTMLFormElement::nameGetter):
        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
        (WebCore::JSHTMLFrameSetElement::canGetItemsForName):
        (WebCore::JSHTMLFrameSetElement::nameGetter):
        * bindings/js/JSHTMLObjectElementCustom.cpp:
        (WebCore::JSHTMLObjectElement::getOwnPropertySlotDelegate):
        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
        (WebCore::JSHTMLObjectElement::putDelegate):
        * bindings/js/JSHistoryCustom.cpp:
        (WebCore::nonCachingStaticBackFunctionGetter):
        (WebCore::nonCachingStaticForwardFunctionGetter):
        (WebCore::nonCachingStaticGoFunctionGetter):
        (WebCore::JSHistory::getOwnPropertySlotDelegate):
        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
        (WebCore::JSHistory::putDelegate):
        (WebCore::JSHistory::deleteProperty):
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::nonCachingStaticReplaceFunctionGetter):
        (WebCore::nonCachingStaticReloadFunctionGetter):
        (WebCore::nonCachingStaticAssignFunctionGetter):
        (WebCore::JSLocation::getOwnPropertySlotDelegate):
        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
        (WebCore::JSLocation::putDelegate):
        (WebCore::JSLocation::deleteProperty):
        (WebCore::JSLocation::defineOwnProperty):
        (WebCore::JSLocationPrototype::putDelegate):
        (WebCore::JSLocationPrototype::defineOwnProperty):
        * bindings/js/JSNamedNodeMapCustom.cpp:
        (WebCore::JSNamedNodeMap::canGetItemsForName):
        (WebCore::JSNamedNodeMap::nameGetter):
        * bindings/js/JSNodeListCustom.cpp:
        (WebCore::JSNodeList::canGetItemsForName):
        (WebCore::JSNodeList::nameGetter):
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::runtimeObjectPropertyGetter):
        (WebCore::runtimeObjectCustomGetOwnPropertySlot):
        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
        (WebCore::runtimeObjectCustomPut):
        * bindings/js/JSPluginElementFunctions.h:
        (WebCore):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::canGetItemsForName):
        (WebCore::JSStorage::nameGetter):
        (WebCore::JSStorage::deleteProperty):
        (WebCore::JSStorage::putDelegate):
        * bindings/js/JSStyleSheetListCustom.cpp:
        (WebCore::JSStyleSheetList::canGetItemsForName):
        (WebCore::JSStyleSheetList::nameGetter):
        * bindings/js/JSWorkerContextCustom.cpp:
        (WebCore::JSWorkerContext::getOwnPropertySlotDelegate):
        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertySlotBody):
        (GenerateGetOwnPropertyDescriptorBody):
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateConstructorDeclaration):
        (GenerateConstructorDefinition):
        * bridge/c/c_class.cpp:
        (JSC::Bindings::CClass::methodsNamed):
        (JSC::Bindings::CClass::fieldNamed):
        * bridge/c/c_class.h:
        (CClass):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CRuntimeMethod::create):
        (JSC::Bindings::CRuntimeMethod::finishCreation):
        (JSC::Bindings::CInstance::getMethod):
        * bridge/c/c_instance.h:
        (CInstance):
        * bridge/jni/jsc/JavaClassJSC.cpp:
        (JavaClass::methodsNamed):
        (JavaClass::fieldNamed):
        * bridge/jni/jsc/JavaClassJSC.h:
        (JavaClass):
        * bridge/jni/jsc/JavaInstanceJSC.cpp:
        (JavaRuntimeMethod::create):
        (JavaRuntimeMethod::finishCreation):
        * bridge/jni/jsc/JavaInstanceJSC.h:
        (JavaInstance):
        * bridge/jsc/BridgeJSC.h:
        (Class):
        (JSC::Bindings::Class::fallbackObject):
        (JSC::Bindings::Instance::setValueOfUndefinedField):
        (Instance):
        (JSC::Bindings::Instance::getOwnPropertySlot):
        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
        (JSC::Bindings::Instance::put):
        * bridge/objc/objc_class.h:
        (ObjcClass):
        * bridge/objc/objc_class.mm:
        (JSC::Bindings::ObjcClass::methodsNamed):
        (JSC::Bindings::ObjcClass::fieldNamed):
        (JSC::Bindings::ObjcClass::fallbackObject):
        * bridge/objc/objc_instance.h:
        (ObjcInstance):
        * bridge/objc/objc_instance.mm:
        (ObjCRuntimeMethod::create):
        (ObjCRuntimeMethod::finishCreation):
        (ObjcInstance::setValueOfUndefinedField):
        (ObjcInstance::getValueOfUndefinedField):
        * bridge/objc/objc_runtime.h:
        (JSC::Bindings::ObjcFallbackObjectImp::create):
        (JSC::Bindings::ObjcFallbackObjectImp::propertyName):
        (ObjcFallbackObjectImp):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertySlot):
        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
        (JSC::Bindings::ObjcFallbackObjectImp::put):
        (JSC::Bindings::callObjCFallbackObject):
        (JSC::Bindings::ObjcFallbackObjectImp::deleteProperty):
        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::lengthGetter):
        (JSC::RuntimeArray::getOwnPropertySlot):
        (JSC::RuntimeArray::getOwnPropertyDescriptor):
        (JSC::RuntimeArray::put):
        (JSC::RuntimeArray::deleteProperty):
        * bridge/runtime_array.h:
        (RuntimeArray):
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::finishCreation):
        (JSC::RuntimeMethod::lengthGetter):
        (JSC::RuntimeMethod::getOwnPropertySlot):
        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
        * bridge/runtime_method.h:
        (JSC::RuntimeMethod::create):
        (RuntimeMethod):
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
        (JSC::Bindings::RuntimeObject::fieldGetter):
        (JSC::Bindings::RuntimeObject::methodGetter):
        (JSC::Bindings::RuntimeObject::getOwnPropertySlot):
        (JSC::Bindings::RuntimeObject::getOwnPropertyDescriptor):
        (JSC::Bindings::RuntimeObject::put):
        (JSC::Bindings::RuntimeObject::deleteProperty):
        * bridge/runtime_object.h:
        (RuntimeObject):

2012-05-11  David Barton  <dbarton@mathscribe.com>

        use after free in WebCore::RenderObject::document
        https://bugs.webkit.org/show_bug.cgi?id=84891

        Reviewed by Julien Chaffraix.

        Change RenderMathMLFenced::addChild() to use the beforeChild parameter. When beforeChild
        is 0, insert child renderers before the closing fence, which might not be the same as
        this->lastChild(), e.g. possibly due to anonymous blocks or generated content.

        Tests: mathml/presentation/mfenced-add-child1-expected.html
               mathml/presentation/mfenced-add-child1.html
               mathml/presentation/mfenced-add-child2-expected.html
               mathml/presentation/mfenced-add-child2.html

        * rendering/mathml/RenderMathMLFenced.cpp:
        (WebCore::RenderMathMLFenced::RenderMathMLFenced):
        (WebCore::RenderMathMLFenced::makeFences):
        (WebCore::RenderMathMLFenced::addChild):
        * rendering/mathml/RenderMathMLFenced.h:
        (RenderMathMLFenced):

2012-05-11  Anders Carlsson  <andersca@apple.com>

        Can't scroll on webpage after following links from Blogger
        https://bugs.webkit.org/show_bug.cgi?id=86274
        <rdar://problem/11431352>

        Reviewed by Beth Dakin.

        When committing a new scroll layer, make sure to reset the scroll position.

        * page/scrolling/ScrollingTree.cpp:
        (WebCore::ScrollingTree::commitNewTreeState):

2012-05-11  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] Support drawing debug borders
        https://bugs.webkit.org/show_bug.cgi?id=86237

        Reviewed by Noam Rosenthal.

        No new tests. This is the implementation of an interactive debugging
        feature.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayer::create): Moved this to the top of the file to
        reduce contention for the coveted last spot in the file. This also
        follows the pattern used in many WebCore files of having the factories
        at the top.
        (WebCore::GraphicsLayerTextureMapper::setDebugBorder): Added this
        plumbing.
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h: Added
        plumbing.
        * platform/graphics/texmap/TextureMapper.h: Ditto.
        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
        (WebCore::TextureMapperTiledBackingStore::TextureMapperTiledBackingStore):
        Initialize the new member.
        (WebCore::TextureMapperTiledBackingStore::paintToTextureMapper): When
        debug borders are enabled call the new drawBorder method on the TM.
        (WebCore::TextureMapperTiledBackingStore::setDebugBorder): Added this
        plumbing.
        * platform/graphics/texmap/TextureMapperBackingStore.h: Added plumbing
        and members to store debug border states. This is necessary because of
        the when painting there is no handle on the GraphicsLayers.
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawRect): Factored out the common bits of
        drawTexture and drawBorder into this helper.
        (WebCore::TextureMapperGL::drawBorder): Added this method, which works
        very similarly to drawTexture, but uses a different shader program and
        must also set the line width and color.
        (WebCore::TextureMapperGL::drawTexture): Factored out the bits that
        are shared with drawRect.
        * platform/graphics/texmap/TextureMapperGL.h:
        (TextureMapperGL): Added the new method declarations.
        * platform/graphics/texmap/TextureMapperImageBuffer.h:
        (WebCore::TextureMapperImageBuffer::drawBorder): Added an empty
        implementation. Later we can add an implementation for the ImageBuffer
        TM.
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::updateBackingStore): When updating the
        backing store send the debug border information through.
        (WebCore::TextureMapperLayer::syncCompositingStateSelf): When updating
        the layer state, also update the debug indicators. This is required to
        initialize the debug border values for the layer.
        (WebCore::TextureMapperLayer::setDebugBorder): Added this plumbing.
        * platform/graphics/texmap/TextureMapperLayer.h: Ditto.
        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Added a
        solid color shader that doesn't care about texture coordinates or
        opacity values.
        (WebCore::TextureMapperShaderManager::solidColorProgram): Added. This
        is a shorter getter for the solid color program that doesn't require
        casting from the caller.
        (WebCore::TextureMapperShaderManager::getShaderProgram): Added support
        for the solid color program.
        (WebCore::TextureMapperShaderProgramSolidColor::create): Added.
        (WebCore::TextureMapperShaderProgramSolidColor::TextureMapperShaderProgramSolidColor):
        Ditto.
        (WebCore::TextureMapperShaderProgramSolidColor::vertexShaderSource):
        Ditto.
        (WebCore::TextureMapperShaderProgramSolidColor::fragmentShaderSource):
        Ditto.
        * platform/graphics/texmap/TextureMapperShaderManager.h:
        (TextureMapperShaderProgramSolidColor): Added.
        (WebCore::TextureMapperShaderProgramSolidColor::colorVariable): Added.

2012-05-10  Timothy Hatcher  <timothy@apple.com>

        Instrument timer function calls so they show up in the Web Inspector Timeline.

        https://webkit.org/b/86173

        Reviewed by Pavel Feldman.

        Test: inspector/timeline/timeline-timer.html

        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext): Wrap the call with JSMainThreadExecState::instrumentFunctionCall
        and InspectorInstrumentation::didCallFunction.

2012-05-11  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Let libwebkit.dylib link in Debug/components build
        https://bugs.webkit.org/show_bug.cgi?id=86244

        Reviewed by James Robinson.

        In static builds, this was not needed because the targets depending on
        'webkit' already link in QuartzCore. In Release components builds, it wasn't
        needed because they are built with -dead_strip, which stripped the referencing
        code.

        * WebCore.gyp/WebCore.gyp:

2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116802.
        http://trac.webkit.org/changeset/116802
        https://bugs.webkit.org/show_bug.cgi?id=86260

        This patch causes compiling error to chromium builds
        (Requested by jianli_ on #webkit).

        * WebCore.gypi:

2012-05-11  Ryosuke Niwa  <rniwa@webkit.org>

        Regression fix after r116798.

        We need to return true for the html element in the design mode
        in which case parentNode() is editable and is not a body element.

        * dom/Node.cpp:
        (WebCore::Node::isRootEditableElement):

2012-05-11  James Robinson  <jamesr@chromium.org>

        [chromium] Move implementation of WebCore::GraphicsContext3D and related from WebKit/chromium/src to WebCore/platform/chromium/support
        https://bugs.webkit.org/show_bug.cgi?id=86257

        Reviewed by Adam Barth.

        The WebCore platform interfaces GraphicsContext3D and Extensions3DChromium are implemented in chromium on top of
        the Platform interface WebGraphicsContext3D. This moves the implementation support code from WebKit/chromium/src
        to WebCore/platform/chromium/support, which avoids having code in WebKit/ implementing WebCore interfaces and
        allows code in WebCore/platform to use this support code directly where appropriate.

        Refactor only, no new functionality or tests.

        * WebCore.gypi:
        * platform/chromium/support/Extensions3DChromium.cpp: Renamed from Source/WebKit/chromium/src/Extensions3DChromium.cpp.
        (WebCore):
        (WebCore::Extensions3DChromium::Extensions3DChromium):
        (WebCore::Extensions3DChromium::~Extensions3DChromium):
        (WebCore::Extensions3DChromium::supports):
        (WebCore::Extensions3DChromium::ensureEnabled):
        (WebCore::Extensions3DChromium::isEnabled):
        (WebCore::Extensions3DChromium::getGraphicsResetStatusARB):
        (WebCore::Extensions3DChromium::blitFramebuffer):
        (WebCore::Extensions3DChromium::renderbufferStorageMultisample):
        (WebCore::Extensions3DChromium::postSubBufferCHROMIUM):
        (WebCore::Extensions3DChromium::mapBufferSubDataCHROMIUM):
        (WebCore::Extensions3DChromium::unmapBufferSubDataCHROMIUM):
        (WebCore::Extensions3DChromium::mapTexSubImage2DCHROMIUM):
        (WebCore::Extensions3DChromium::unmapTexSubImage2DCHROMIUM):
        (WebCore::Extensions3DChromium::setVisibilityCHROMIUM):
        (WebCore::Extensions3DChromium::discardFramebufferEXT):
        (WebCore::Extensions3DChromium::ensureFramebufferCHROMIUM):
        (WebCore::Extensions3DChromium::setGpuMemoryAllocationChangedCallbackCHROMIUM):
        (WebCore::Extensions3DChromium::createVertexArrayOES):
        (WebCore::Extensions3DChromium::deleteVertexArrayOES):
        (WebCore::Extensions3DChromium::isVertexArrayOES):
        (WebCore::Extensions3DChromium::bindVertexArrayOES):
        (WebCore::Extensions3DChromium::getTranslatedShaderSourceANGLE):
        (WebCore::Extensions3DChromium::setSwapBuffersCompleteCallbackCHROMIUM):
        (WebCore::Extensions3DChromium::rateLimitOffscreenContextCHROMIUM):
        (WebCore::Extensions3DChromium::paintFramebufferToCanvas):
        (WebCore::Extensions3DChromium::texImageIOSurface2DCHROMIUM):
        (WebCore::Extensions3DChromium::texStorage2DEXT):
        (WebCore::Extensions3DChromium::createQueryEXT):
        (WebCore::Extensions3DChromium::deleteQueryEXT):
        (WebCore::Extensions3DChromium::isQueryEXT):
        (WebCore::Extensions3DChromium::beginQueryEXT):
        (WebCore::Extensions3DChromium::endQueryEXT):
        (WebCore::Extensions3DChromium::getQueryivEXT):
        (WebCore::Extensions3DChromium::getQueryObjectuivEXT):
        * platform/chromium/support/GraphicsContext3DChromium.cpp: Renamed from Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp.
        (WebCore):
        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
        (WebCore::GraphicsContext3DPrivate::extractWebGraphicsContext3D):
        (WebCore::GraphicsContext3DPrivate::platformGraphicsContext3D):
        (WebCore::GraphicsContext3DPrivate::platformTexture):
        (GrMemoryAllocationChangedCallback):
        (WebCore::GrMemoryAllocationChangedCallback::GrMemoryAllocationChangedCallback):
        (WebCore::GrMemoryAllocationChangedCallback::onGpuMemoryAllocationChanged):
        (WebCore::GraphicsContext3DPrivate::grContext):
        (WebCore::GraphicsContext3DPrivate::prepareTexture):
        (WebCore::GraphicsContext3DPrivate::markContextChanged):
        (WebCore::GraphicsContext3DPrivate::markLayerComposited):
        (WebCore::GraphicsContext3DPrivate::layerComposited):
        (WebCore::GraphicsContext3DPrivate::paintFramebufferToCanvas):
        (WebCore::GraphicsContext3DPrivate::paintRenderingResultsToCanvas):
        (WebCore::GraphicsContext3DPrivate::paintCompositedResultsToCanvas):
        (WebCore::GraphicsContext3DPrivate::paintRenderingResultsToImageData):
        (WebCore::GraphicsContext3DPrivate::reshape):
        (WebCore::GraphicsContext3DPrivate::getInternalFramebufferSize):
        (WebCore::GraphicsContext3DPrivate::isContextLost):
        (WebCore::GraphicsContext3DPrivate::isGLES2Compliant):
        (WebCore::GraphicsContext3DPrivate::bindAttribLocation):
        (WebCore::GraphicsContext3DPrivate::bufferData):
        (WebCore::GraphicsContext3DPrivate::bufferSubData):
        (WebCore::GraphicsContext3DPrivate::getActiveAttrib):
        (WebCore::GraphicsContext3DPrivate::getActiveUniform):
        (WebCore::GraphicsContext3DPrivate::getAttribLocation):
        (WebCore::GraphicsContext3DPrivate::getContextAttributes):
        (WebCore::GraphicsContext3DPrivate::getProgramInfoLog):
        (WebCore::GraphicsContext3DPrivate::getShaderInfoLog):
        (WebCore::GraphicsContext3DPrivate::getShaderSource):
        (WebCore::GraphicsContext3DPrivate::getString):
        (WebCore::GraphicsContext3DPrivate::getUniformLocation):
        (WebCore::GraphicsContext3DPrivate::shaderSource):
        (WebCore::GraphicsContext3DPrivate::texImage2D):
        (WebCore::GraphicsContext3DPrivate::texSubImage2D):
        (WebCore::GraphicsContext3DPrivate::uniform1fv):
        (WebCore::GraphicsContext3DPrivate::uniform1iv):
        (WebCore::GraphicsContext3DPrivate::uniform2fv):
        (WebCore::GraphicsContext3DPrivate::uniform2iv):
        (WebCore::GraphicsContext3DPrivate::uniform3fv):
        (WebCore::GraphicsContext3DPrivate::uniform3iv):
        (WebCore::GraphicsContext3DPrivate::uniform4fv):
        (WebCore::GraphicsContext3DPrivate::uniform4iv):
        (WebCore::GraphicsContext3DPrivate::uniformMatrix2fv):
        (WebCore::GraphicsContext3DPrivate::uniformMatrix3fv):
        (WebCore::GraphicsContext3DPrivate::uniformMatrix4fv):
        (WebCore::GraphicsContext3DPrivate::getExtensions):
        (WebCore::GraphicsContext3DPrivate::isResourceSafe):
        (WebCore::GraphicsContext3DPrivate::initializeExtensions):
        (WebCore::GraphicsContext3DPrivate::supportsExtension):
        (WebCore::GraphicsContext3DPrivate::ensureExtensionEnabled):
        (WebCore::GraphicsContext3DPrivate::isExtensionEnabled):
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        (WebCore::GraphicsContext3D::~GraphicsContext3D):
        (WebCore::GraphicsContext3D::create):
        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
        (WebCore::GraphicsContext3D::platformTexture):
        (WebCore::GraphicsContext3D::grContext):
        (WebCore::GraphicsContext3D::prepareTexture):
        (WebCore::GraphicsContext3D::getInternalFramebufferSize):
        (WebCore::GraphicsContext3D::isResourceSafe):
        (WebCore::GraphicsContext3D::platformLayer):
        (WebCore::GraphicsContext3D::layerComposited):
        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
        (GraphicsContextLostCallbackAdapter):
        (WebCore::GraphicsContextLostCallbackAdapter::~GraphicsContextLostCallbackAdapter):
        (WebCore::GraphicsContextLostCallbackAdapter::GraphicsContextLostCallbackAdapter):
        (WebCore::GraphicsContextLostCallbackAdapter::onContextLost):
        (WebCore::GraphicsContextLostCallbackAdapter::create):
        (WebCore::GraphicsContext3DPrivate::setContextLostCallback):
        (GraphicsErrorMessageCallbackAdapter):
        (WebCore::GraphicsErrorMessageCallbackAdapter::~GraphicsErrorMessageCallbackAdapter):
        (WebCore::GraphicsErrorMessageCallbackAdapter::GraphicsErrorMessageCallbackAdapter):
        (WebCore::GraphicsErrorMessageCallbackAdapter::onErrorMessage):
        (WebCore::GraphicsErrorMessageCallbackAdapter::create):
        (WebCore::GraphicsContext3DPrivate::setErrorMessageCallback):
        (WebCore::GraphicsContext3D::isGLES2Compliant):
        (GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::~GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::onSwapBuffersComplete):
        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::create):
        (WebCore::GraphicsContext3DPrivate::setSwapBuffersCompleteCallbackCHROMIUM):
        (GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::~GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::onMemoryAllocationChanged):
        (WebCore::GraphicsContext3DPrivate::setGpuMemoryAllocationChangedCallbackCHROMIUM):
        * platform/chromium/support/GraphicsContext3DPrivate.h: Renamed from Source/WebKit/chromium/src/GraphicsContext3DPrivate.h.
        (WebKit):
        (WebCore):
        (GraphicsContext3DPrivate):

2012-05-11  Keyar Hood  <keyar@chromium.org>

        ImageSkia.cpp does not conform to style guidelines
        https://bugs.webkit.org/show_bug.cgi?id=86219

        Reviewed by Stephen White.

        No tests as this is purely style changees.

        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore::TransformDimensions):
        (WebCore::BitmapImage::draw):
        (WebCore::BitmapImageSingleFrameSkia::draw):

2012-05-11  Tim Horton  <timothy_horton@apple.com>

        Unreviewed Chromium build fix after http://trac.webkit.org/changeset/116799.

        * rendering/RenderLayerBacking.cpp:

2012-05-11  Terry Anderson  <tdanderson@chromium.org>

        [chromium] Compute the best target node on a GestureTap event
        https://bugs.webkit.org/show_bug.cgi?id=85101

        Reviewed by Adam Barth.

        Will be using the tests in the touchadjustment/ directory.

        * WebCore.gypi:
        Include TouchAdjustment.* files.

2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116498.
        http://trac.webkit.org/changeset/116498
        https://bugs.webkit.org/show_bug.cgi?id=86251

        Causes crashes in major sites and security issues (Requested
        by schenney on #webkit).

        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::addChild):
        * rendering/svg/RenderSVGInlineText.cpp:
        (WebCore::RenderSVGInlineText::willBeDestroyed):
        (WebCore::RenderSVGInlineText::setTextInternal):
        (WebCore::RenderSVGInlineText::styleDidChange):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::recursiveUpdateLayoutAttributes):
        (WebCore::RenderSVGText::layoutAttributesChanged):
        (WebCore::RenderSVGText::layoutAttributesWillBeDestroyed):
        (WebCore::RenderSVGText::invalidateTextPositioningElements):
        (WebCore::recursiveUpdateScaledFont):
        (WebCore::RenderSVGText::layout):
        (WebCore::RenderSVGText::addChild):
        (WebCore::recursiveCollectLayoutAttributes):
        (WebCore::RenderSVGText::rebuildLayoutAttributes):
        (WebCore):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):
        (WebCore::RenderSVGText::layoutAttributes):
        * rendering/svg/SVGRootInlineBox.cpp:
        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributes):

2012-05-11  Tim Horton  <timothy_horton@apple.com>

        FrameView->m_lastPaintTime is not updated in the tiled drawing case
        https://bugs.webkit.org/show_bug.cgi?id=86246
        <rdar://problem/11248475>

        Reviewed by Simon Fraser.

        Update FrameView's m_lastPaintTime from RenderLayerBacking::paintContents
        if the RenderLayerBacking is backing a tiled drawing layer.

        In the future we might want to consider updating m_lastPaintTime when any
        compositing layer is painted into, but this change gets us on par with the
        non-tiled-drawing case as it stands now.

        No new tests.

        * page/FrameView.h:
        (WebCore::FrameView::setLastPaintTime):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::paintContents):

2012-05-11  Shezan Baig  <shezbaig.wk@gmail.com>

        Add helper function for node()->rootEditableElement() == node()
        https://bugs.webkit.org/show_bug.cgi?id=86217

        Reviewed by Ryosuke Niwa.

        Added Node::isRootEditableElement and updated existing code that did
        (node->rootEditableElement() == node) to use isRootEditableElement
        instead.

        No new tests. No change in behavior.

        * dom/Node.cpp:
        (WebCore::Node::isRootEditableElement):
        (WebCore):
        * dom/Node.h:
        (Node):
        Added new helper function.

        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        * dom/Element.cpp:
        (WebCore::Element::updateFocusAppearance):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::removeNode):
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        * page/FocusController.cpp:
        (WebCore::FocusController::setFocusedNode):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::hasLineIfEmpty):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::addOverflowFromInlineChildren):
        Updates to existing code to use the new helper function.

2012-05-11  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Create WebTransformationMatrix interface for chromium platform
        https://bugs.webkit.org/show_bug.cgi?id=86049

        Reviewed by James Robinson.

        This patch creates a WebTransformationMatrix interface. It will
        remain unused at the moment, until (a) unit tests are created
        and (b) when we are ready to make a brief transition of all other
        chromium code to use it.

        * WebCore.gypi:
        * platform/chromium/support/WebTransformationMatrix.cpp: Added.
        (WebKit):
        (WebKit::WebTransformationMatrix::WebTransformationMatrix):
        (WebKit::WebTransformationMatrix::operator=):
        (WebKit::WebTransformationMatrix::operator==):
        (WebKit::WebTransformationMatrix::operator*):
        (WebKit::WebTransformationMatrix::inverse):
        (WebKit::WebTransformationMatrix::to2dTransform):
        (WebKit::WebTransformationMatrix::multiply):
        (WebKit::WebTransformationMatrix::makeIdentity):
        (WebKit::WebTransformationMatrix::translate):
        (WebKit::WebTransformationMatrix::translate3d):
        (WebKit::WebTransformationMatrix::translateRight3d):
        (WebKit::WebTransformationMatrix::scale):
        (WebKit::WebTransformationMatrix::scaleNonUniform):
        (WebKit::WebTransformationMatrix::scale3d):
        (WebKit::WebTransformationMatrix::rotate):
        (WebKit::WebTransformationMatrix::rotate3d):
        (WebKit::WebTransformationMatrix::skewX):
        (WebKit::WebTransformationMatrix::skewY):
        (WebKit::WebTransformationMatrix::applyPerspective):
        (WebKit::WebTransformationMatrix::blend):
        (WebKit::WebTransformationMatrix::hasPerspective):
        (WebKit::WebTransformationMatrix::isInvertible):
        (WebKit::WebTransformationMatrix::isBackFaceVisible):
        (WebKit::WebTransformationMatrix::isIdentity):
        (WebKit::WebTransformationMatrix::isIdentityOrTranslation):
        (WebKit::WebTransformationMatrix::isIntegerTranslation):
        (WebKit::WebTransformationMatrix::m11):
        (WebKit::WebTransformationMatrix::setM11):
        (WebKit::WebTransformationMatrix::m12):
        (WebKit::WebTransformationMatrix::setM12):
        (WebKit::WebTransformationMatrix::m13):
        (WebKit::WebTransformationMatrix::setM13):
        (WebKit::WebTransformationMatrix::m14):
        (WebKit::WebTransformationMatrix::setM14):
        (WebKit::WebTransformationMatrix::m21):
        (WebKit::WebTransformationMatrix::setM21):
        (WebKit::WebTransformationMatrix::m22):
        (WebKit::WebTransformationMatrix::setM22):
        (WebKit::WebTransformationMatrix::m23):
        (WebKit::WebTransformationMatrix::setM23):
        (WebKit::WebTransformationMatrix::m24):
        (WebKit::WebTransformationMatrix::setM24):
        (WebKit::WebTransformationMatrix::m31):
        (WebKit::WebTransformationMatrix::setM31):
        (WebKit::WebTransformationMatrix::m32):
        (WebKit::WebTransformationMatrix::setM32):
        (WebKit::WebTransformationMatrix::m33):
        (WebKit::WebTransformationMatrix::setM33):
        (WebKit::WebTransformationMatrix::m34):
        (WebKit::WebTransformationMatrix::setM34):
        (WebKit::WebTransformationMatrix::m41):
        (WebKit::WebTransformationMatrix::setM41):
        (WebKit::WebTransformationMatrix::m42):
        (WebKit::WebTransformationMatrix::setM42):
        (WebKit::WebTransformationMatrix::m43):
        (WebKit::WebTransformationMatrix::setM43):
        (WebKit::WebTransformationMatrix::m44):
        (WebKit::WebTransformationMatrix::setM44):
        (WebKit::WebTransformationMatrix::a):
        (WebKit::WebTransformationMatrix::setA):
        (WebKit::WebTransformationMatrix::b):
        (WebKit::WebTransformationMatrix::setB):
        (WebKit::WebTransformationMatrix::c):
        (WebKit::WebTransformationMatrix::setC):
        (WebKit::WebTransformationMatrix::d):
        (WebKit::WebTransformationMatrix::setD):
        (WebKit::WebTransformationMatrix::e):
        (WebKit::WebTransformationMatrix::setE):
        (WebKit::WebTransformationMatrix::f):
        (WebKit::WebTransformationMatrix::setF):
        (WebKit::WebTransformationMatrix::toWebCoreTransform):
        (WebKit::WebTransformationMatrix::mapRect):
        (WebKit::WebTransformationMatrix::mapPoint):
        (WebKit::WebTransformationMatrix::mapQuad):
        (WebKit::WebTransformationMatrix::projectPoint):

2012-05-11  Alexandru Chiculita  <achicu@adobe.com>

        [CSS Shaders] Make CSS Shaders render to texture framebuffers
        https://bugs.webkit.org/show_bug.cgi?id=85113

        Reviewed by Dean Jackson.

        Added the required members to store the framebuffer, the texture and the depth buffer. Also removed the m_drawingBuffer
        because context->readPixels doesn't require one anymore.

        ReadPixels is not flipping the result, so I've also removed the flipping projection matrix that was specific only to Chromium.

        Added a test to check that colors are not switched and the resulting image is not mirrored.

        Test: css3/filters/custom/effect-color-check.html

        * platform/graphics/filters/FECustomFilter.cpp:
        (WebCore::FECustomFilter::FECustomFilter):
        (WebCore::FECustomFilter::~FECustomFilter):
        (WebCore):
        (WebCore::FECustomFilter::deleteRenderBuffers):
        (WebCore::FECustomFilter::platformApplySoftware):
        (WebCore::FECustomFilter::initializeContext):
        (WebCore::FECustomFilter::resizeContext):
        (WebCore::FECustomFilter::bindProgramAndBuffers):
        * platform/graphics/filters/FECustomFilter.h:
        (FECustomFilter):

2012-05-11  Anders Carlsson  <andersca@apple.com>

        REGRESSION(r116687): [Chromium] plugins/embed-attributes-style.html shows a garbled string
        https://bugs.webkit.org/show_bug.cgi?id=86170

        Reviewed by Andreas Kling.

        The string we are passing to the TextRun constructor needs to stay alive for longer so revert back to the old
        behavior where we store it as a member variable.

        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::unavailablePluginReplacementText):
        (WebCore):
        (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReason):
        (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
        * rendering/RenderEmbeddedObject.h:
        (RenderEmbeddedObject):

2012-05-11  Simon Fraser  <simon.fraser@apple.com>

        CVDisplayLink keeps running after a single requestAnimationFrame
        https://bugs.webkit.org/show_bug.cgi?id=86174
        
        Reviewed by Sam Weinig.
        
        A DisplayRefreshMonitor would keep its CVDisplayLink alive for as long
        as it had clients, and the client is the ScriptedAnimationController, which
        lives on the document. So a single requestAnimationFrame call would kick
        off a CVDisplayLink which lived until the document was destroyed.
        
        Fix by having the DisplayRefreshMonitor kill itself if the CVDisplayLink
        fires for 10 times with no scheduled callbacks (to avoid creation/deletion
        thrash on pages that call requestAnimationFrames with short setTimeouts,
        as some do).
        
        Use a HashMap in DisplayRefreshMonitorManager for the set of DisplayRefreshMonitor,
        with the displayID as the key (using UnsignedWithZeroKeyHashTraits<uint64_t> since
        we want to allow for 0 to be a valid displayID).
        
        Use a HashSet in DisplayRefreshMonitor for the client set, so that we don't have to
        worry about adding clients twice.
        
        Also fix a possible crash when the only client of a DisplayRefreshMonitor
        was removed from inside the callback by making DisplayRefreshMonitor ref-counted,
        with a protector.

        Test: fast/animation/request-animation-frame-detach-element2.html

        * platform/graphics/DisplayRefreshMonitor.cpp:
        (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor): Initialize m_unscheduledFireCount
        (WebCore::DisplayRefreshMonitor::handleDisplayRefreshedNotificationOnMainThread): Renamed
        from refreshDisplayOnMainThread, since it doesn't just refresh the display.
        (WebCore::DisplayRefreshMonitor::addClient): No longer inline.
        (WebCore::DisplayRefreshMonitor::removeClient): No longer inline.
        (WebCore::DisplayRefreshMonitor::displayDidRefresh): Keep track of m_unscheduledFireCount,
        which we used to kill this monitor if it has been idle for a while.
        Use a RefPtr<DisplayRefreshMonitor> to prevent deletion while running the callback.
        Copy the clients to a vector to protect against mutating the set while enumerating it.
        Notify the DisplayRefreshMonitorManager when we're done, so that it can decide
        to delete inactive monitors.
        
        (WebCore::DisplayRefreshMonitorManager::ensureMonitorForClient): find or allocate
        a DisplayRefreshMonitor for a given client.
        (WebCore::DisplayRefreshMonitorManager::registerClient): Simplified by use of HashMap.
        (WebCore::DisplayRefreshMonitorManager::unregisterClient): Ditto.
        (WebCore::DisplayRefreshMonitorManager::scheduleAnimation): Ditto. Uses
        ensureMonitorForClient() since an earlier inactive monitor may have been removed.
        (WebCore::DisplayRefreshMonitorManager::displayDidRefresh): Remove inactive
        monitors.
        * platform/graphics/DisplayRefreshMonitor.h: Make DisplayRefreshMonitor
        ref-counted, to make it easier to avoid deletion while it's on the stack.
        (WebCore::DisplayRefreshMonitor::create):
        (DisplayRefreshMonitor):
        (WebCore::DisplayRefreshMonitor::shouldBeTerminated):
        (DisplayRefreshMonitorManager):
        * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp: Attempt to
        keep things building.
        (WebCore::DisplayRefreshMonitor::~DisplayRefreshMonitor):
        (WebCore::DisplayRefreshMonitor::displayLinkFired):
        to give the manager a chance to kill this monitor.
        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
        (WebCore::DisplayRefreshMonitor::~DisplayRefreshMonitor):
        (WebCore::DisplayRefreshMonitor::displayLinkFired): Don't bail early
        if not scheduled; we want to call handleDisplayRefreshedNotificationOnMainThread(),

2012-05-11  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: move canEditScriptSource and setScriptSource from DebuggerPresentationModel into ResourceBinding
        https://bugs.webkit.org/show_bug.cgi?id=86234

        Reviewed by Vsevolod Vlasov.

        Simple move refactoring.

        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModel):
        (WebInspector.DebuggerResourceBinding):
        (WebInspector.DebuggerResourceBinding.canEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
        (WebInspector.DebuggerResourceBinding.setScriptSource):
        (WebInspector.DebuggerResourceBinding.prototype.canSetContent):
        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
        (WebInspector.DebuggerResourceBinding.prototype._setContentWithInitialContent):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.canEditSource):
        (WebInspector.JavaScriptSourceFrame.prototype.editContent):

2012-05-11  Julien Chaffraix  <jchaffraix@webkit.org>

        Remove RenderLayer::m_scrollOverflow
        https://bugs.webkit.org/show_bug.cgi?id=86226

        Reviewed by Simon Fraser.

        No expected change in behavior.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::computeScrollDimensions):
        Added 2 local variables to compute the left / top scrollable overflows.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::scrolledContentOffset):
        Returned m_scrollOffset directly as this is what the old code was doing by adding
        m_scrollOrigin then adding m_scrollOverflow (which was set to -m_scrollOrigin in
        computeScrollDimensions).

        (RenderLayer::m_scrollOffset): Improved the comment about what m_scrollOffset is.

2012-05-11  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: extract PresentationConsoleMessageHelper from DebuggerPresentationModel.
        https://bugs.webkit.org/show_bug.cgi?id=86229

        Reviewed by Vsevolod Vlasov.

        This change also starts tracking messages along with the live location changes.

        Tested with script-formatter-console.html.

        * inspector/front-end/BreakpointManager.js:
        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModel):
        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
        (WebInspector.PresentationConsoleMessageHelper):
        (WebInspector.PresentationConsoleMessageHelper.prototype._addPendingConsoleMessage):
        (WebInspector.PresentationConsoleMessageHelper.prototype._parsedScriptSource):
        (WebInspector.PresentationConsoleMessageHelper.prototype._debuggerReset):
        (WebInspector.PresentationConsoleMessage):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.populateLineGutterContextMenu):
        (WebInspector.JavaScriptSourceFrame.prototype._consoleMessageAdded):
        (WebInspector.JavaScriptSourceFrame.prototype._setBreakpoint):

2012-05-11  Emil A Eklund  <eae@chromium.org>

        Simplify FloatingObject by removing unnecessary convenience methods.
        https://bugs.webkit.org/show_bug.cgi?id=86163

        Reviewed by Eric Seidel.

        Simplify the pixel snapping in FloatingObject by getting rid of a bunch
        of convenience methods.

        No new tests, no change in functionality.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addOverhangingFloats):
        (WebCore::RenderBlock::addIntrudingFloats):
        (WebCore::RenderBlock::FloatingObjects::intervalForFloatingObject):
        (WebCore::::string):
        * rendering/RenderBlock.h:
        (FloatingObject):
        (WebCore::RenderBlock::pixelSnappedLogicalTopForFloat):
        (WebCore::RenderBlock::pixelSnappedLogicalBottomForFloat):
        (WebCore::RenderBlock::pixelSnappedLogicalLeftForFloat):
        (WebCore::RenderBlock::pixelSnappedLogicalRightForFloat):

2012-05-11  Ian Vollick  <vollick@chromium.org>

        [chromium] Ensure that animations continue to run when transform-style is changed
        https://bugs.webkit.org/show_bug.cgi?id=83283

        Make sure that we transfer animations when changing layers due to a transform-style change.
        Unit tested in GraphicsLayerChromiumTest.updateLayerPreserves3DWithAnimations

        Reviewed by James Robinson.

        Test: animations/change-transform-style-during-animation.html

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setLayerAnimationController):
        (WebCore::LayerChromium::releaseLayerAnimationController):
        (WebCore):
        (WebCore::LayerChromium::notifyAnimationStarted):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::CCLayerAnimationController):
        (WebCore::CCLayerAnimationController::pushAnimationUpdatesTo):
        (WebCore::CCLayerAnimationController::notifyAnimationStarted):
        (WebCore::CCLayerAnimationController::setClient):
        (WebCore):
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
        (CCLayerAnimationController):
        (WebCore::CCLayerAnimationController::setForceSync):

2012-05-11  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Fix a reference counting issue in UserMediaRequest
        https://bugs.webkit.org/show_bug.cgi?id=86210

        Reviewed by Abhishek Arya.

        When contextDestroyed() is called on UserMediaRequest it does a callback to the
        page client. If the receiving code clears their stored copy the UserMediaRequest
        object is destroyed in the middle of the call.

        Currently only testable manually against chrome, preferably with asan turned on.
        I have added a manual test that verifies the fix, but I have started work
        to make DumpRenderTree able to test this and many other things. The first patch is here:
        https://bugs.webkit.org/show_bug.cgi?id=86215

        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::contextDestroyed):

2012-05-11  Min Qin  <qinmin@google.com>

        split MediaPlayer::enterFullscreen into 2 seperate functions
        https://bugs.webkit.org/show_bug.cgi?id=86052

        Reviewed by Adam Barth.

        It is confusing that enterFullscreen returns a boolean while exitFullscreen does
        not do the same. And ios does not need the return value.
        So remove the return value on enterFullscreen and make a seperate canEnterFullscreen()
        function for android.
        No tests as there are no behavior change, just refactoring.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::enterFullscreen):
        (WebCore):
        (WebCore::MediaPlayer::canEnterFullscreen):
        * platform/graphics/MediaPlayer.h:
        (MediaPlayer):
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::enterFullscreen):
        (MediaPlayerPrivateInterface):
        (WebCore::MediaPlayerPrivateInterface::canEnterFullscreen):

2012-05-11  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: move breakpoint manager from debuggerPresentationModel to WebInspector.
        https://bugs.webkit.org/show_bug.cgi?id=86220

        Reviewed by Yury Semikhatsky.

        Now that breakpoint manager does not depend on the source mapping instance from the
        debugger presentation model, it can be moved out.

        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModel):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource):
        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent.didFormatContent):
        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent):
        (WebInspector.JavaScriptSource.prototype.setFormatted):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        * inspector/front-end/ScriptsPanel.js:
        * inspector/front-end/inspector.js:

2012-05-11  David Reveman  <reveman@chromium.org>

        [Chromium] Move instantiation of texture uploader to LayerRendererChromium.
        https://bugs.webkit.org/show_bug.cgi?id=85893

        Reviewed by Adrienne Walker.

        Move instantiation of texture uploader to LayerRendererChromium and
        allow CCProxy to decide between a throttled or unthrottled uploader
        using a flag passed to the LayerRendererChromium constructor.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::create):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
        (WebCore::CCSingleThreadProxy::recreateContext):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
        (WebCore::CCThreadProxy::recreateContextOnImplThread):

2012-05-10  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: pass source mapping into UISourceCode's constructor; move formatting outside mapping.
        https://bugs.webkit.org/show_bug.cgi?id=86099

        Reviewed by Vsevolod Vlasov.

        This changes moves formatting out of the source mapping machinery.
        As a result, it removes most of the DebuggerPresentation's mapping-related code as well
        as most of the raw source code's code.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager):
        (WebInspector.BreakpointManager.prototype.restoreBreakpoints):
        (WebInspector.BreakpointManager.Breakpoint):
        * inspector/front-end/CallStackSidebarPane.js:
        (WebInspector.CallStackSidebarPane.prototype.setStatus):
        * inspector/front-end/CompilerScriptMapping.js:
        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModel):
        (WebInspector.DebuggerPresentationModel.prototype._callFrameSelected):
        (WebInspector.DebuggerPresentationModel.prototype._handleUISourceCodeListChanged):
        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource):
        (WebInspector.JavaScriptSource.prototype.fireContentAvailable):
        (WebInspector.JavaScriptSource.prototype.setFormatted.if):
        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent.didFormatContent):
        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent):
        (WebInspector.JavaScriptSource.prototype.setFormatted):
        (WebInspector.JavaScriptSource.prototype.togglingFormatter):
        (WebInspector.JavaScriptSource.prototype.uiLocationToRawLocation):
        (WebInspector.JavaScriptSource.prototype.overrideLocation):
        (WebInspector.JavaScriptSource.prototype.breakpointStorageId):
        (WebInspector):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype._onContentChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointRemoved):
        * inspector/front-end/RawSourceCode.js:
        (WebInspector.RawSourceCode):
        (WebInspector.RawSourceCode.prototype.addScript):
        (WebInspector.RawSourceCode.prototype.rawLocationToUILocation):
        (WebInspector.RawSourceCode.prototype._createUISourceCode):
        (WebInspector.RawSourceCode.prototype.uiLocationToRawLocation):
        (WebInspector.RawSourceCode.prototype.uiSourceCode):
        (WebInspector.RawSourceCode.prototype._finishedLoading):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping):
        (WebInspector.ResourceScriptMapping.prototype.addScript):
        (WebInspector.ResourceScriptMapping.prototype._handleUISourceCodeChanged):
        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeChanged):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.rawLocationToUILocation):
        * inspector/front-end/ScriptFormatter.js:
        (WebInspector.ScriptFormatter.prototype._didFormatContent):
        (WebInspector.FormatterSourceMapping):
        (WebInspector.FormatterSourceMapping.prototype.originalToFormatted):
        (WebInspector.FormatterSourceMapping.prototype.formattedToOriginal):
        (WebInspector.IdentityFormatterSourceMapping):
        (WebInspector.IdentityFormatterSourceMapping.prototype.originalToFormatted):
        (WebInspector.IdentityFormatterSourceMapping.prototype.formattedToOriginal):
        (WebInspector.FormatterSourceMappingImpl):
        (WebInspector.FormatterSourceMappingImpl.prototype.originalToFormatted):
        (WebInspector.FormatterSourceMappingImpl.prototype.formattedToOriginal):
        * inspector/front-end/ScriptMapping.js:
        (WebInspector.MainScriptMapping):
        (WebInspector.MainScriptMapping.prototype._handleUISourceCodeListChanged):
        (WebInspector.MainScriptMapping.prototype.reset):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._handleUISourceCodeAdded):
        (WebInspector.ScriptsPanel.prototype.showFunctionDefinition):
        (WebInspector.ScriptsPanel.prototype._showFile):
        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
        * inspector/front-end/ScriptsSearchScope.js:
        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
        * inspector/front-end/SnippetsModel.js:
        (WebInspector.SnippetsScriptMapping.prototype._snippetAdded):
        (WebInspector.SnippetsScriptMapping.prototype._createUISourceCodeForScript):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.UISourceCode.prototype.requestContent):
        (WebInspector.UISourceCode.prototype.mimeType):
        (WebInspector.UISourceCode.prototype.content):
        (WebInspector.UISourceCode.prototype.fireContentAvailable):
        (WebInspector.UISourceCode.prototype.contentLoaded):
        (WebInspector.UISourceCode.prototype.uiLocationToRawLocation):

2012-05-11  Dominik Röttsches  <dominik.rottsches@intel.com>

        [EFL][DRT] Input Attribute Placeholder RefTests failing
        https://bugs.webkit.org/show_bug.cgi?id=85603

        Unreviewed, build fix for EFL.

        * platform/efl/RenderThemeEfl.cpp:

2012-05-11  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Remove support of combined nodes and edges serialization schema.
        https://bugs.webkit.org/show_bug.cgi?id=86209

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.get _nodes):
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesStart):
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesEnd):
        (WebInspector.HeapSnapshot):
        (WebInspector.HeapSnapshot.prototype._init):
        (WebInspector.HeapSnapshot.prototype._buildRetainers):
        (WebInspector.HeapSnapshot.prototype._bfs):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._calculateClassesRetainedSize):
        (WebInspector.HeapSnapshot.prototype._buildDominatedNodes):
        * inspector/front-end/HeapSnapshotLoader.js:
        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):

2012-05-11  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add Profiler.getHeapObjectId command
        https://bugs.webkit.org/show_bug.cgi?id=86211

        Reviewed by Pavel Feldman.

        Added Profiler.getHeapObjectId command to the protocol which allows to convert remote
        object id to heap snapshot object id.

        * bindings/js/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::getHeapObjectId):
        (WebCore):
        * bindings/js/ScriptProfiler.h:
        (WebCore):
        (ScriptProfiler):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::getHeapObjectId):
        (WebCore):
        * bindings/v8/ScriptProfiler.h:
        (WebCore):
        (ScriptProfiler):
        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::findObjectById):
        (WebCore):
        * inspector/InjectedScript.h:
        (InjectedScript):
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/Inspector.json:
        * inspector/InspectorProfilerAgent.cpp:
        (WebCore::InspectorProfilerAgent::getHeapObjectId):
        (WebCore):
        * inspector/InspectorProfilerAgent.h:
        (InspectorProfilerAgent):

2012-05-11  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Qt support for new layout types.
        https://bugs.webkit.org/show_bug.cgi?id=85607

        Reviewed by Simon Hausmann.

        Adds similar Qt support to FractionalLayout classes as Qt has for
        FloatSomething and IntSomething classes. This means Qt code can stay
        unchanged from after the redefinition of Layout classes.

        No new functionality. No new tests.

        * Target.pri:
        * platform/FractionalLayoutUnit.h:
        (WebCore::operator<<):
        (WebCore::operator>>):
        * platform/graphics/FractionalLayoutPoint.h:
        (FractionalLayoutPoint):
        * platform/graphics/FractionalLayoutRect.h:
        (FractionalLayoutRect):
        * platform/graphics/FractionalLayoutSize.h:
        (FractionalLayoutSize):
        * platform/graphics/qt/FractionalLayoutPointQt.cpp: Added.
        (WebCore::FractionalLayoutPoint::FractionalLayoutPoint):
        (WebCore::FractionalLayoutPoint::operator QPointF):
        * platform/graphics/qt/FractionalLayoutRectQt.cpp: Added.
        (WebCore::FractionalLayoutRect::FractionalLayoutRect):
        (WebCore::FractionalLayoutRect::operator QRectF):
        * platform/graphics/qt/FractionalLayoutSizeQt.cpp: Added.
        (WebCore::FractionalLayoutSize::FractionalLayoutSize):
        (WebCore::FractionalLayoutSize::operator QSizeF):

2012-05-11  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Internals::touchPositionAdjustedToBestClickableNode adjust twice for scroll-offset
        https://bugs.webkit.org/show_bug.cgi?id=86205

        Reviewed by Simon Hausmann.

        Remove the redundant conversion from document to window coords.

        Test: touchadjustment/scroll-offset.html

        * testing/Internals.cpp:
        (WebCore::Internals::touchPositionAdjustedToBestClickableNode):
        (WebCore::Internals::bestZoomableAreaForTouchPoint):

2012-05-11  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: load heap snapshot implementation.
        https://bugs.webkit.org/show_bug.cgi?id=86097

        The idea is to have a hidden file selector control.
        When the user select a context menu item or click a button
        we redirect this user-action to file selector.
        As result we see the standard file selector dialog.
        When the user selects a file we load it's chunks and push the chunks to the worker.
        The loaded snapshot can be completely unrelated to the current page.
        Thats why we have to skip range selection options in Summary tab.

        Reviewed by Yury Semikhatsky.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype._updateFilterOptions): we have to skip the profiles loaded from file because there is no guaranty t
        (WebInspector.HeapSnapshotProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
        (WebInspector.HeapSnapshotProfileType.prototype.createProfile): cosmetic changes.
        (WebInspector.HeapProfileHeader):
        (WebInspector.HeapProfileHeader.prototype._setupWorker): a common part was extracted from load method and reused in loadFromFile.
        (WebInspector.HeapProfileHeader.prototype._saveStatusUpdate): cosmetic changes.
        (WebInspector.HeapProfileHeader.prototype.finishHeapSnapshot):
        (WebInspector.HeapProfileHeader.prototype.canSaveToFile): cosmetic rename for better consistency with 'load' part.
        (WebInspector.HeapProfileHeader.prototype.saveToFile): cosmetic rename for better consistency with 'load' part.
        (WebInspector.HeapProfileHeader.prototype.canLoadFromFile): cosmetic rename for better consistency with 'load' part.
        (WebInspector.HeapProfileHeader.prototype.loadFromFile): chunk based file loader.
        (WebInspector.HeapProfileHeader.prototype.loadFromFile.loadNextChunk):
        (WebInspector.HeapProfileHeader.prototype.loadFromFile.onLoad):
        * inspector/front-end/ProfileView.js:
        (WebInspector.CPUProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
        (WebInspector.ProfileHeader.prototype.canSaveToFile): cosmetic rename for better consistency with 'load' part.
        (WebInspector.ProfileHeader.prototype.saveToFile): cosmetic rename for better consistency with 'load' part.
        (WebInspector.ProfileHeader.prototype.canLoadFromFile): default implementation for 'load' part.
        (WebInspector.ProfileHeader.prototype.loadFromFile): default implementation for 'load' part.
        (WebInspector.ProfilesPanel.prototype._createFileSelectorElement):
        (WebInspector.ProfilesPanel.prototype._loadFromFile):
        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):

2012-05-11  Dominik Röttsches  <dominik.rottsches@intel.com>

        [EFL][DRT] Input Attribute Placeholder RefTests failing
        https://bugs.webkit.org/show_bug.cgi?id=85603

        Reviewed by Hajime Morita.

        Refrain from overriding style coloring by theme coloring.
        RenderThemeEfl was always overriding colors and whitespace
        handling leading to failures in reftests that verify placeholder styling
        which expect the user agent stylesheet to be applied correctly
        without any color overrides. Also, leave whitespace handling untouched.

        No new tests, covered by existing tests. See also
        the LayoutTests/ChangeLog in this commit for the required
        rebaselining.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::createEdje):
        (WebCore::RenderThemeEfl::applyEdjeColors):
        (WebCore::RenderThemeEfl::RenderThemeEfl):
        (WebCore::RenderThemeEfl::adjustButtonStyle):
        (WebCore::RenderThemeEfl::adjustMenuListStyle):
        (WebCore::RenderThemeEfl::adjustTextFieldStyle):
        (WebCore::RenderThemeEfl::adjustSearchFieldStyle):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):

2012-05-11  Christophe Dumez  <christophe.dumez@intel.com>

        Web Intents code only supports V8
        https://bugs.webkit.org/show_bug.cgi?id=85954

        Reviewed by Adam Barth.

        Add necessary abstraction for js Dictionary and ScriptValue so that
        the Web Intents code in WebCore compiles with JSC, not just V8.

        This required changes in the JSC bindings generator to pass
        callback arguments of type SerializedScriptValue as raw pointers
        instead of RefPtr. This matches the change made to the V8 bindings
        generator in r104531.

        * CMakeLists.txt:
        * Modules/intents/Intent.cpp:
        * Modules/intents/Intent.h:
        * bindings/js/Dictionary.cpp:
        (WebCore::Dictionary::Dictionary):
        (WebCore):
        (WebCore::Dictionary::getOwnPropertiesAsStringHashMap):
        * bindings/js/Dictionary.h:
        (Dictionary):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        (WebCore):
        * bindings/js/JSDictionary.h:
        (WebCore):
        (WebCore::JSDictionary::initializerObject):
        * bindings/js/ScriptValue.cpp:
        (WebCore::ScriptValue::serialize):
        (WebCore):
        * bindings/js/ScriptValue.h:
        (ScriptValue):
        * bindings/scripts/CodeGeneratorJS.pm:
        (AddIncludesForType):
        (GenerateCallbackHeader):
        (GenerateCallbackImplementation):
        (GetNativeTypeForCallbacks):

2012-05-11  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Can't type spaces in "Override User Agent" field
        https://bugs.webkit.org/show_bug.cgi?id=86202

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HelpScreen.js:
        (WebInspector.HelpScreen.prototype.isClosingKey):
        (WebInspector.HelpScreen.prototype._onKeyDown):
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.SettingsScreen.prototype.isClosingKey):

2012-05-11  Dominik Röttsches  <dominik.rottsches@intel.com>

        [EFL][DRT] Input Attribute Placeholder RefTests failing
        https://bugs.webkit.org/show_bug.cgi?id=85603

        Reviewed by Hajime Morita.

        Refrain from overriding style coloring by theme coloring.
        RenderThemeEfl was always overriding colors and whitespace
        handling leading to failures in reftests that verify placeholder styling
        which expect the user agent stylesheet to be applied correctly
        without any color overrides. Also, leave whitespace handling untouched.

        No new tests, covered by existing tests. See also
        the LayoutTests/ChangeLog in this commit for the required
        rebaselining.

        * platform/efl/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::createEdje):
        (WebCore::RenderThemeEfl::applyEdjeColors):
        (WebCore::RenderThemeEfl::RenderThemeEfl):
        (WebCore::RenderThemeEfl::adjustButtonStyle):
        (WebCore::RenderThemeEfl::adjustMenuListStyle):
        (WebCore::RenderThemeEfl::adjustTextFieldStyle):
        (WebCore::RenderThemeEfl::adjustSearchFieldStyle):
        * platform/efl/RenderThemeEfl.h:
        (RenderThemeEfl):

2012-05-11  Gustavo Noronha Silva  <gns@gnome.org>

        REGRESSION(r116205): [GTK]: build no longer supports thin archives
        https://bugs.webkit.org/show_bug.cgi?id=86207

        * GNUmakefile.am: go back to not linking libWebCoreModules into
        libWebCore; when linking 2 convenience libraries libtools tries to
        extract the object files from one of them to add to the other, breaking
        thin archive builds

2012-05-11  Keishi Hattori  <keishi@webkit.org>

        Sanitization algorithm for input type=email should strip whitespaces
        https://bugs.webkit.org/show_bug.cgi?id=86177

        Reviewed by Kent Tamura.

        No new tests. Covered by: fast/forms/ValidityState-typeMismatch-email.html

        The spec says that the value sanitization algorithm should
        > Strip line breaks from the value, then strip leading and trailing whitespace from the value.

        * html/EmailInputType.cpp:
        (WebCore::EmailInputType::sanitizeValue):

2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116752.
        http://trac.webkit.org/changeset/116752
        https://bugs.webkit.org/show_bug.cgi?id=86201

        Build failure on Chromium-mac (Requested by tkent on #webkit).

        * html/FormAssociatedElement.cpp:
        * html/FormAssociatedElement.h:
        (FormAssociatedElement):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::setCustomValidity):
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isValidValue):
        (WebCore::HTMLInputElement::typeMismatch):
        (WebCore::HTMLInputElement::valueMissing):
        (WebCore::HTMLInputElement::patternMismatch):
        (WebCore::HTMLInputElement::rangeUnderflow):
        (WebCore::HTMLInputElement::rangeOverflow):
        (WebCore::HTMLInputElement::minimum):
        (WebCore::HTMLInputElement::maximum):
        (WebCore::HTMLInputElement::stepMismatch):
        (WebCore::HTMLInputElement::minimumString):
        (WebCore::HTMLInputElement::maximumString):
        (WebCore):
        (WebCore::HTMLInputElement::stepBaseString):
        (WebCore::HTMLInputElement::stepString):
        (WebCore::HTMLInputElement::typeMismatchText):
        (WebCore::HTMLInputElement::valueMissingText):
        (WebCore::HTMLInputElement::isInRange):
        (WebCore::HTMLInputElement::isOutOfRange):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/HTMLObjectElement.h:
        (WebCore::HTMLObjectElement::setCustomValidity):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::valueMissing):
        * html/HTMLSelectElement.h:
        (HTMLSelectElement):
        * html/HTMLTextAreaElement.cpp:
        * html/HTMLTextAreaElement.h:
        (WebCore::HTMLTextAreaElement::valueMissing):
        (HTMLTextAreaElement):
        * html/InputType.cpp:
        (WebCore::InputType::alignValueForStep):
        (WebCore::InputType::stepUpFromRenderer):
        * html/InputType.h:
        (InputType):
        * html/ValidityState.cpp:
        (WebCore::ValidityState::validationMessage):
        (WebCore):
        (WebCore::ValidityState::setCustomErrorMessage):
        (WebCore::ValidityState::valueMissing):
        (WebCore::ValidityState::typeMismatch):
        (WebCore::ValidityState::patternMismatch):
        (WebCore::ValidityState::tooLong):
        (WebCore::ValidityState::rangeUnderflow):
        (WebCore::ValidityState::rangeOverflow):
        (WebCore::ValidityState::stepMismatch):
        (WebCore::ValidityState::customError):
        (WebCore::ValidityState::valid):
        * html/ValidityState.h:
        (ValidityState):

2012-05-11  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Search box doesn't allow CSS selectors anymore
        https://bugs.webkit.org/show_bug.cgi?id=86196

        Reviewed by Pavel Feldman.

        Refactoring in http://trac.webkit.org/changeset/99983 inadvertently removed the selector matching during
        node search in the InspectorDOMAgent. This change re-introduces the Document::querySelectorAll() evaluation
        for the user query.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::performSearch):

2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116527.
        http://trac.webkit.org/changeset/116527
        https://bugs.webkit.org/show_bug.cgi?id=86199

        Causing crashes on ClusterFuzz (Requested by inferno-sec on
        #webkit).

        * rendering/RenderScrollbar.cpp:
        (WebCore::RenderScrollbar::updateScrollbarPart):
        * rendering/RenderScrollbarPart.h:

2012-05-11  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move ValidityState methods implementation to another place
        https://bugs.webkit.org/show_bug.cgi?id=86058

        Reviewed by Kent Tamura.

        This patch changes ValidityState class for limiting scope of
        number/range input type related methods for introducing decimal
        arithmetic.

        Methods related to validation are moved from ValidateState to
        input, select and textarea elements with virtual method based
        dispatching via FormAssociateElement instead of tag name
        dispatching so far for code simplification.

        No new tests. This patch doesn't change behavior.

        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::customError): Added. Called from ValidateState. Returns custom error mssage in member variable.
        (WebCore::FormAssociatedElement::patternMismatch): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::rangeOverflow): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::rangeUnderflow): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::stepMismatch): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::tooLong): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::typeMismatch): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::valid): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::valueMissing): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::customValidationMessage): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::validationMessage): Added.  Called from ValidateState. This is default implementation.
        (WebCore::FormAssociatedElement::setCustomValidity): Added.  set custom error message.
        * html/FormAssociatedElement.h:
        (FormAssociatedElement): Added new instance value m_customValidationMessage.
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::setCustomValidity): Changed. Calls base class setCustomValidity.
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isValidValue): Call m_inputType methods instead of HTMLInputElement's.
        (WebCore::HTMLInputElement::tooLong): Call m_inputType methods instead of HTMLInputElement's.
        (WebCore):
        (WebCore::HTMLInputElement::typeMismatch): Move implementation to InputType.
        (WebCore::HTMLInputElement::valueMissing):  Move implementation to InputType.
        (WebCore::HTMLInputElement::patternMismatch): Move implementation to InputType.
        (WebCore::HTMLInputElement::rangeUnderflow): Move implementation to InputType.
        (WebCore::HTMLInputElement::rangeOverflow): Move implementation to InputType.
        (WebCore::HTMLInputElement::validationMessage): Move implementation to InputType.
        (WebCore::HTMLInputElement::stepMismatch): Move implementation to InputType.
        (WebCore::HTMLInputElement::isInRange): Call m_inputType methods instead of HTMLInputElement's.
        (WebCore::HTMLInputElement::isOutOfRange): Call m_inputType methods instead of HTMLInputElement's.
        * html/HTMLInputElement.h:
        (HTMLInputElement): Make tooLong method private.
        * html/HTMLObjectElement.h: Add "virtual" and "OVERRIDE".
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::validationMessage): Added. Implementation for HTMLSelectElement.
        (WebCore::HTMLSelectElement::valueMissing): Added. Implementation for HTMLSelectElement.
        * html/HTMLSelectElement.h:
        (HTMLSelectElement):  Added entries for newly added methods.
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::validationMessage): Added. Implementation for HTMLTextAreaElement.
        (WebCore::HTMLTextAreaElement::valueMissing): Added. Implementation for HTMLTextAreaElement.
        (WebCore::HTMLTextAreaElement::tooLong): Added. Implementation for HTMLTextAreaElement.
        * html/HTMLTextAreaElement.h:
        (HTMLTextAreaElement): Added entries for newly added methods. Change tooLong and valueMissing private.
        * html/InputType.cpp:
        (WebCore::InputType::stepMismatch): Change method signature.
        (WebCore::InputType::alignValueForStep):  Changed for calling InputClass instead of HTMLINputElement.
        (WebCore::InputType::stepUpFromRenderer):  Added. Moved from HTMLInputElement.
        (WebCore::InputType::validationMessage): Added.  Moved from HTMLInputElement.
        * html/InputType.h:
        (InputType): Added entries for newly added methods and update methods signature.
        * html/ValidityState.cpp: Move actual implementation to FormAssociatedElement and derived classes for localizing implementation change of elements and input types.
        (WebCore::ValidityState::validationMessage): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::valueMissing): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::typeMismatch): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::patternMismatch): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::tooLong): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::rangeUnderflow): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::rangeOverflow): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::stepMismatch): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::customError): Changed to call FormAssociatedElement's method.
        (WebCore::ValidityState::valid):
        * html/ValidityState.h:
        (ValidityState): Remove custom validation message related things.

2012-05-11  Kent Tamura  <tkent@chromium.org>

        Fix a build error without SVG, introduced by tab-size support.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):

2012-05-11  Shinya Kawanaka  <shinyak@chromium.org>

        [Refactoring] Move Selection from DOMWindow to TreeScope.
        https://bugs.webkit.org/show_bug.cgi?id=82699

        Reviewed by Ryosuke Niwa.

        Since ShadowRoot will also manage its own version of DOMSelection, we would like to
        share the code among Document and DOMSelection. This patch moves DOMSelection from DOMWindow to TreeScope
        so that ShadowRoot can also use it.

        No new tests, should covered by existing tests.

        * dom/Document.cpp:
        (WebCore::Document::updateFocusAppearanceTimerFired):
        * dom/Document.h:
        (Document):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::selection):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::~TreeScope):
        (WebCore::TreeScope::getSelection):
        (WebCore):
        * dom/TreeScope.h:
        (WebCore):
        (TreeScope):
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::DOMSelection):
        (WebCore::DOMSelection::clearTreeScope):
        (WebCore):
        * page/DOMSelection.h:
        (WebCore):
        (WebCore::DOMSelection::create):
        (DOMSelection):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::~DOMWindow):
        (WebCore::DOMWindow::clearDOMWindowProperties):
        (WebCore::DOMWindow::getSelection):
        * page/DOMWindow.h:
        (DOMWindow):

2012-05-04  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: console should allow JS execution in the context of an isolated world
        https://bugs.webkit.org/show_bug.cgi?id=85612

        Reviewed by Pavel Feldman.

        Added an option to select not only a frame but also isolated world in which
        to perform evaluation of the code typed into the console.

        Each execution context can be identified using it injected script id. We call it
        execution context id in the protocol. Runtime agent is extended with an event that
        is sent when new ExecutionContext is created. The event tracking can be enabled/disabled
        using setReportExecutionContextCreation command.

        * bindings/js/ScriptController.cpp:
        (WebCore):
        (WebCore::isolatedWorldToSecurityOriginMap):
        * bindings/js/ScriptController.h:
        (ScriptController):
        * bindings/js/ScriptState.cpp:
        (WebCore::isolatedWorldScriptState):
        (WebCore):
        * bindings/js/ScriptState.h:
        (WebCore):
        * bindings/v8/ScriptController.cpp:
        (WebCore):
        (WebCore::ScriptController::isolatedWorldToSecurityOriginMap):
        * bindings/v8/ScriptController.h:
        (ScriptController):
        * bindings/v8/ScriptState.cpp:
        (WebCore::isolatedWorldScriptState):
        (WebCore):
        * bindings/v8/ScriptState.h:
        (WebCore):
        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::setSecurityOrigin):
        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::setIsolatedWorldSecurityOrigin):
        (WebCore::V8Proxy::isolatedWorldContext):
        (WebCore):
        (WebCore::V8Proxy::isolatedWorldToSecurityOriginMap):
        * bindings/v8/V8Proxy.h:
        (V8Proxy):
        * inspector/CodeGeneratorInspector.py:
        (DomainNameFixes):
        * inspector/Inspector.json:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didCreateIsolatedContextImpl):
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::didCreateIsolatedContext):
        * inspector/InspectorRuntimeAgent.cpp:
        (WebCore::InspectorRuntimeAgent::evaluate):
        * inspector/InspectorRuntimeAgent.h:
        (InspectorRuntimeAgent):
        * inspector/InstrumentingAgents.h:
        (WebCore):
        (WebCore::InstrumentingAgents::InstrumentingAgents):
        (WebCore::InstrumentingAgents::pageRuntimeAgent):
        (WebCore::InstrumentingAgents::setPageRuntimeAgent):
        (InstrumentingAgents):
        * inspector/PageRuntimeAgent.cpp:
        (PageRuntimeAgentState):
        (WebCore):
        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
        (WebCore::PageRuntimeAgent::setFrontend):
        (WebCore::PageRuntimeAgent::clearFrontend):
        (WebCore::PageRuntimeAgent::restore):
        (WebCore::PageRuntimeAgent::setReportExecutionContextCreation):
        (WebCore::PageRuntimeAgent::didCreateExecutionContext):
        (WebCore::PageRuntimeAgent::getScriptStateForEval):
        * inspector/PageRuntimeAgent.h:
        (WebCore):
        (PageRuntimeAgent):
        * inspector/WorkerRuntimeAgent.cpp:
        (WebCore::WorkerRuntimeAgent::setReportExecutionContextCreation):
        (WebCore::WorkerRuntimeAgent::getScriptStateForEval):
        * inspector/WorkerRuntimeAgent.h:
        (WorkerRuntimeAgent):
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.get statusBarItems):
        (WebInspector.ConsoleView.prototype.addContext):
        (WebInspector.ConsoleView.prototype.removeContext):
        (WebInspector.ConsoleView.prototype._updateIsolatedWorldSelector):
        (WebInspector.ConsoleView.prototype._contextUpdated):
        (WebInspector.ConsoleView.prototype._addedExecutionContext):
        (WebInspector.ConsoleView.prototype._currentEvaluationContextId):
        (WebInspector.ConsoleView.prototype._currentEvaluationContext):
        (WebInspector.ConsoleView.prototype._currentIsolatedWorldId):
        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
        * inspector/front-end/ExtensionPanel.js:
        (WebInspector.ExtensionSidebarPane.prototype.setExpression):
        * inspector/front-end/ExtensionServer.js:
        (WebInspector.ExtensionServer.prototype._onEvaluateOnInspectedPage):
        * inspector/front-end/JavaScriptContextManager.js:
        (WebInspector.JavaScriptContextManager):
        (WebInspector.JavaScriptContextManager.prototype._didLoadCachedResources):
        (WebInspector.JavaScriptContextManager.prototype.isolatedContextCreated):
        (WebInspector.RuntimeDispatcher):
        (WebInspector.RuntimeDispatcher.prototype.isolatedContextCreated):
        (WebInspector.ExecutionContext):
        (WebInspector.ExecutionContext.comparator):
        (WebInspector.FrameEvaluationContext):
        (WebInspector.FrameEvaluationContext.prototype._frameNavigated):
        (WebInspector.FrameEvaluationContext.prototype._addExecutionContext):
        (WebInspector.FrameEvaluationContext.prototype._ensureMainWorldContextAdded):
        (WebInspector.FrameEvaluationContext.prototype.isolatedContexts):

2012-05-11  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: use div, not span as a parent element for ElementsTreeOutline in Audits panel
        https://bugs.webkit.org/show_bug.cgi?id=86188

        Reviewed by Yury Semikhatsky.

        We need to use <div>, not <span> as a container for ElementsTreeOutline, as latter accesses its parent offsetWidth
        within _treeElementFromEvent(), which returns 0 for inline elements.

        * inspector/front-end/AuditFormatters.js:
        (WebInspector.AuditFormatters.node.onNodeAvailable):
        (WebInspector.AuditFormatters.node):

2012-05-11  Antti Koivisto  <antti@apple.com>

        Inline Node::traverseNextNode
        https://bugs.webkit.org/show_bug.cgi?id=85844

        Reviewed by Ryosuke Niwa.
        
        Inline traverseNextNode and traverseNextSibling to reduce entry/exit overhead and allow better code generation
        for many hot loops.

        In this version only the firstChild()/nextSibling() tests are inlined and the ancestor traversal is not.
        
        Performance bots will tell if this was worthwhile.

        * dom/ContainerNode.h:
        (WebCore::Node::traverseNextNode):
        (WebCore):
        (WebCore::Node::traverseNextSibling):
        * dom/Node.cpp:
        (WebCore::Node::traverseNextAncestorSibling):
        * dom/Node.h:
        (Node):
        * bindings/v8/RetainedDOMInfo.cpp:

2012-05-07  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: get rid of InspectorAgent::emitCommitLoadIfNeeded method
        https://bugs.webkit.org/show_bug.cgi?id=85708

        Reviewed by Pavel Feldman.

        Instead of calling emitCommitLoadIfNeeded after all agents are restored
        required actions are performed directly in the restore() methods.

        * inspector/InspectorAgent.cpp:
        * inspector/InspectorAgent.h:
        (WebCore::InspectorAgent::didCommitLoadFired):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::restoreInspectorStateFromCookie):
        * inspector/InspectorDatabaseAgent.cpp:
        (WebCore::InspectorDatabaseAgent::restore):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::create):
        (WebCore::InspectorPageAgent::InspectorPageAgent):
        (WebCore::InspectorPageAgent::restore):
        * inspector/InspectorPageAgent.h:
        (WebCore):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::restore):

2012-05-10  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: [Extensions API] add audit formatters for remote objects and DOM elements
        https://bugs.webkit.org/show_bug.cgi?id=86108

        Reviewed by Pavel Feldman.

       - added two new formatters to AuditResults object of webInspector.audits API;

        * inspector/front-end/AuditFormatters.js:
        (WebInspector.AuditFormatters.resourceLink):
        (WebInspector.AuditFormatters.object.onEvaluate):
        (WebInspector.AuditFormatters.object): format as a remote object property list;
        (WebInspector.AuditFormatters.node.onNodeAvailable):
        (WebInspector.AuditFormatters.node.onEvaluate):
        (WebInspector.AuditFormatters.node): format as a DOM elements sub-tree;
        (WebInspector.AuditFormatters.Utilities.evaluate): common expression evaluation logic for both new formatters;
        * inspector/front-end/ExtensionAPI.js:
        (injectedExtensionAPI.AuditResultImpl):
        * inspector/front-end/auditsPanel.css:
        (.audit-result-tree ol.outline-disclosure):
        (.audit-result-tree .section .header):
        (.audit-result-tree .section .header::before):

2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116727.
        http://trac.webkit.org/changeset/116727
        https://bugs.webkit.org/show_bug.cgi?id=86181

        Build error on Chromium-Android (Requested by tkent on
        #webkit).

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::enterFullscreen):
        (WebCore):
        * platform/graphics/MediaPlayer.h:
        (MediaPlayer):
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::enterFullscreen):
        (MediaPlayerPrivateInterface):

2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116731.
        http://trac.webkit.org/changeset/116731
        https://bugs.webkit.org/show_bug.cgi?id=86178

        Build failure on Chromium-mac (Requested by tkent on #webkit).

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::create):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::create):
        (WebCore::UnthrottledTextureUploader::~UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::isBusy):
        (WebCore::UnthrottledTextureUploader::beginUploads):
        (WebCore::UnthrottledTextureUploader::endUploads):
        (WebCore::UnthrottledTextureUploader::uploadTexture):
        (WebCore::UnthrottledTextureUploader::UnthrottledTextureUploader):
        (WebCore):
        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
        (WebCore::CCSingleThreadProxy::recreateContext):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore):
        (UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::create):
        (WebCore::UnthrottledTextureUploader::~UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::isBusy):
        (WebCore::UnthrottledTextureUploader::beginUploads):
        (WebCore::UnthrottledTextureUploader::endUploads):
        (WebCore::UnthrottledTextureUploader::uploadTexture):
        (WebCore::UnthrottledTextureUploader::UnthrottledTextureUploader):
        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
        (WebCore::CCThreadProxy::recreateContextOnImplThread):

2012-05-10  David Reveman  <reveman@chromium.org>

        [Chromium] Move instantiation of texture uploader to LayerRendererChromium.
        https://bugs.webkit.org/show_bug.cgi?id=85893

        Reviewed by Adrienne Walker.

        Move instantiation of texture uploader to LayerRendererChromium and
        allow CCProxy to decide between a throttled or unthrottled uploader
        using a flag passed to the LayerRendererChromium constructor.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::create):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
        (WebCore::CCSingleThreadProxy::recreateContext):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
        (WebCore::CCThreadProxy::recreateContextOnImplThread):

2012-05-10  MORITA Hajime  <morrita@google.com>

        ElementShadow should minimize the usage of "ShadowRoot" name
        https://bugs.webkit.org/show_bug.cgi?id=85970

        Reviewed by Dimitri Glazkov.

        This change cleans two out dated assumptions which brought in at
        early stage of Shadow DOM implementation.

        - Removed Element::hasShadowRoot(): shadow existence can be checked by Element::shadow().
        - Made ElementShadow::removeAllShadowRoots() private: we no longer allow ShadowRoot removal.
          It can only happens at the ElementShadow destruction.

        Most of changes in element implementations are basically simple
        replacement from hasShadowRoot() to shadow().

        No new tests. Covered by existing tests.

        * WebCore.exp.in:
        * dom/ContainerNodeAlgorithms.h:
        (WebCore::ChildFrameDisconnector::collectDescendant):
        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseChild):
        * dom/Document.cpp:
        (WebCore::Document::buildAccessKeyMap):
        * dom/Element.cpp:
        (WebCore::Element::recalcStyle):
        (WebCore::Element::ensureShadowRoot):
        (WebCore::Element::childrenChanged):
        * dom/Element.h:
        (Element):
        (WebCore::isShadowHost):
        (WebCore):
        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::~ElementShadow):
        (WebCore::ElementShadow::removeAllShadowRoots):
        * dom/ElementShadow.h:
        (ElementShadow):
        (WebCore::ElementShadow::host):
        * dom/EventDispatcher.cpp:
        * dom/Node.cpp:
        (WebCore::oldestShadowRootFor):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::create):
        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::createShadowSubtree):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::createShadowSubtree):
        (WebCore::FileInputType::multipleAttributeChanged):
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::createShadowSubtree):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::createShadowSubtree):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
        (WebCore::HTMLKeygenElement::shadowSelect):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::hasMediaControls):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::createShadowSubtree):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::createShadowSubtree):
        * html/HTMLSummaryElement.cpp:
        (WebCore::HTMLSummaryElement::createShadowSubtree):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::createShadowSubtree):
        * html/InputType.cpp:
        (WebCore::InputType::destroyShadowSubtree):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::handleMouseDownEvent):
        (WebCore::RangeInputType::createShadowSubtree):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::createShadowSubtree):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::trackLimiterElementOf):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::unbind):
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        * page/FocusController.cpp:
        (WebCore):
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::uploadButton):
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::updateReferencedText):
        (WebCore::SVGTRefElement::detachTarget):
        * testing/Internals.cpp:
        (WebCore::Internals::ensureShadowRoot):
        (WebCore::Internals::youngestShadowRoot):
        (WebCore::Internals::oldestShadowRoot):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-05-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Move resumeAnimations to use Internals interface
        https://bugs.webkit.org/show_bug.cgi?id=86063

        Reviewed by Alexey Proskuryakov.

        Add resumeAnimations functions, because it is able to work in the
        cross-port way through the Internals interface.

        No new tests, since we are improving here the infra-structure for testing
        a specific method.

        * testing/Internals.cpp:
        (WebCore::Internals::resumeAnimations):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-05-10  Min Qin  <qinmin@google.com>

        split MediaPlayer::enterFullscreen into 2 seperate functions
        https://bugs.webkit.org/show_bug.cgi?id=86052

        Reviewed by Benjamin Poulain.

        It is confusing that enterFullscreen returns a boolean while exitFullscreen does
        not do the same. And ios does not need the return value.
        So remove the return value on enterFullscreen and make a seperate canEnterFullscreen()
        function for android.
        No tests as there are no behavior change, just refactoring.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::enterFullscreen):
        (WebCore):
        (WebCore::MediaPlayer::canEnterFullscreen):
        * platform/graphics/MediaPlayer.h:
        (MediaPlayer):
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::enterFullscreen):
        (MediaPlayerPrivateInterface):
        (WebCore::MediaPlayerPrivateInterface::canEnterFullscreen):

2012-05-10  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116715.
        http://trac.webkit.org/changeset/116715
        https://bugs.webkit.org/show_bug.cgi?id=86172

        Broke http/tests/security/cross-frame-access-selection.html
        (Requested by tkent on #webkit).

        * dom/Document.cpp:
        (WebCore):
        (WebCore::Document::getSelection):
        * dom/Document.h:
        (Document):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::selection):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::~TreeScope):
        * dom/TreeScope.h:
        (WebCore):
        (TreeScope):
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::DOMSelection):
        * page/DOMSelection.h:
        (WebCore):
        (WebCore::DOMSelection::create):
        (DOMSelection):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::~DOMWindow):
        (WebCore::DOMWindow::clearDOMWindowProperties):
        (WebCore::DOMWindow::getSelection):
        * page/DOMWindow.h:
        (DOMWindow):

2012-05-10  Hajime Morrita  <morrita@google.com>

        WebKit should support tab-size.
        https://bugs.webkit.org/show_bug.cgi?id=52994

        - Added boilerplate for "tab-size" CSS property.
        - Added RenderStye::tabSize() as a RareInheritedData.
        - Replaced TextRun::m_allowTabs into TextRun::m_tabSize.

        Reviewed by Simon Fraser.

        Tests: fast/css/tab-size-expected.html
               fast/css/tab-size.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSStyleSelector.cpp:
        (WebCore::CSSStyleSelector::applyProperty):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawTextInternal):
        * platform/chromium/PopupListBox.cpp:
        (WebCore::PopupListBox::paintRow):
        * platform/graphics/Font.h:
        (WebCore::Font::tabWidth):
        * platform/graphics/TextRun.h:
        (WebCore::TextRun::TextRun):
        (WebCore::TextRun::allowTabs):
        (WebCore::TextRun::tabSize):
        (WebCore::TextRun::setTabSize):
        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::advance):
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::adjustGlyphsAndAdvances):
        * platform/win/PopupMenuWin.cpp:
        (WebCore::PopupMenuWin::paint):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::constructTextRun):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::constructTextRun):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::textWidth):
        (WebCore::tryHyphenating):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::widthFromCache):
        (WebCore::RenderText::computePreferredLogicalWidths):
        (WebCore::RenderText::width):
        * rendering/RenderText.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff):
        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyleBitfields::tabSize):
        (WebCore::RenderStyleBitfields::collapsedTabSize):
        (WebCore::RenderStyleBitfields::setTabSize):
        (WebCore::RenderStyleBitfields::initialTabSize):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
        (WebCore::StyleRareInheritedData::operator==):
        * rendering/style/StyleRareInheritedData.h:
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::constructTextRun):
        * rendering/svg/SVGTextMetrics.cpp:
        (WebCore::constructTextRun):

2012-05-10  Antoine Labour  <piman@chromium.org>

        Sync with impl thread when removing references to external textures
        https://bugs.webkit.org/show_bug.cgi?id=86054

        We want to ensure the client side is safe to release textures, so we
        sync with the impl thread when:
        - we change the texture (and we had one)
        - the layer is removed from the tree (and we had a texture)
        - the layer is destroyed (and we had a texture)

        Reviewed by James Robinson.

        Test: TextureLayerChromiumTest.

        * platform/graphics/chromium/TextureLayerChromium.cpp:
        (WebCore::TextureLayerChromium::~TextureLayerChromium):
        (WebCore::TextureLayerChromium::setTextureId):
        (WebCore::TextureLayerChromium::setLayerTreeHost):
        (WebCore):
        * platform/graphics/chromium/TextureLayerChromium.h:
        (TextureLayerChromium):

2012-05-10  Kent Tamura  <tkent@chromium.org>

        [Chromium] attempt to build fix for Chromium-mac.
        r116697 introduced an override of a system function. It's intentional
        and WebCoreTextFieldCell should be in the whitelist.

        * WebCore.gyp/WebCore.gyp:

2012-05-10  Anders Carlsson  <andersca@apple.com>

        PDF files won't scroll in Safari when using Adobe plug-in
        https://bugs.webkit.org/show_bug.cgi?id=86167
        <rdar://problem/11389719>

        Reviewed by Sam Weinig.

        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::computeNonFastScrollableRegion):
        Loop over the frame view children looking for plug-in views that want wheel events
        and add them to the non-fast scrollable region. Ideally, the plug-ins should be added
        to the set of scrollable areas, but PluginView in WebKit2 is not a ScrollableArea yet.

        * plugins/PluginViewBase.h:
        (PluginViewBase):
        (WebCore::PluginViewBase::wantsWheelEvents):

2012-05-10  Alexey Proskuryakov  <ap@apple.com>

        Crash in 3rd party WebKit apps that disable cache at a wrong time
        https://bugs.webkit.org/show_bug.cgi?id=86027
        <rdar://problem/10615880>

        Reviewed by Antti Koivisto.

        Added an API test.

        The fix is to use CachedResourceHandle throughout MemoryCache, which will certainly
        keep the resource alive. Also removed earlier fixes.

        * css/CSSImageSetValue.cpp: (WebCore::CSSImageSetValue::cachedImageSet):
        * css/CSSImageValue.cpp: (WebCore::CSSImageValue::cachedImage):
        * css/WebKitCSSShaderValue.cpp: (WebCore::WebKitCSSShaderValue::cachedShader):
        * history/PageCache.cpp: (WebCore::PageCache::releaseAutoreleasedPagesNow):
        * loader/ImageLoader.cpp: (WebCore::ImageLoader::updateFromElement):
        * loader/TextTrackLoader.cpp: (WebCore::TextTrackLoader::load):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestImage):
        (WebCore::CachedResourceLoader::requestFont):
        (WebCore::CachedResourceLoader::requestTextTrack):
        (WebCore::CachedResourceLoader::requestShader):
        (WebCore::CachedResourceLoader::requestCSSStyleSheet):
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
        (WebCore::CachedResourceLoader::requestScript):
        (WebCore::CachedResourceLoader::requestXSLStyleSheet):
        (WebCore::CachedResourceLoader::requestSVGDocument):
        (WebCore::CachedResourceLoader::requestLinkResource):
        (WebCore::CachedResourceLoader::requestRawResource):
        (WebCore::CachedResourceLoader::requestResource):
        (WebCore::CachedResourceLoader::revalidateResource):
        (WebCore::CachedResourceLoader::loadResource):
        (WebCore::CachedResourceLoader::requestPreload):
        * loader/cache/CachedResourceLoader.h: (CachedResourceLoader):
        * loader/cache/MemoryCache.h: (WebCore::MemoryCache::setPruneEnabled):

        * loader/cache/CachedResourceHandle.h:
        (WebCore::CachedResourceHandle::CachedResourceHandle):
        (WebCore::CachedResourceHandle::operator=):
        Teach CachedResourceHandle how to make CachedResourceHandle<CachedResource> from
        a handle to subclass.

2012-05-10  Tien-Ren Chen  <trchen@chromium.org>

        Eliminate duplicated code for culled line box in RenderInline
        https://bugs.webkit.org/show_bug.cgi?id=85725

        This patch extracts the common part of culledInlineBoundingBox() /
        culledInlineAbsoluteRects() / culledInlineAbsoluteQuads() to become a
        template function generateCulledLineBoxRects(). The template function
        accepts a new parameter, GeneratorContext functor, which will be
        invoked everytime a new line box rect has been generated. The generated
        rect will be in local coordinate. The functor will be responsible for
        appropriate transformation, then appending to vector or union with
        existing bounding box.

        Reviewed by Eric Seidel.

        No new tests. No change in behavior.

        * rendering/RenderInline.cpp:
        (WebCore):
        (WebCore::RenderInline::generateLineBoxRects):
        (WebCore::RenderInline::generateCulledLineBoxRects):
        (WebCore::RenderInline::absoluteRects):
        (WebCore::RenderInline::absoluteQuads):
        (WebCore::RenderInline::linesBoundingBox):
        (WebCore::RenderInline::culledInlineVisualOverflowBoundingBox):
        (WebCore::RenderInline::addFocusRingRects):
        * rendering/RenderInline.h:
        (RenderInline):

2012-05-10  Abhishek Arya  <inferno@chromium.org>

        Crash in swapInNodePreservingAttributesAndChildren.
        https://bugs.webkit.org/show_bug.cgi?id=85197
 
        Reviewed by Ryosuke Niwa.
 
        Keep the children in a ref vector before adding them to newNode.
        They can get destroyed due to mutation events.

        No new tests because we don't have a reduction.

        * editing/ReplaceNodeWithSpanCommand.cpp:
        (WebCore::swapInNodePreservingAttributesAndChildren):

2012-05-10  Shinya Kawanaka  <shinyak@chromium.org>

        [Refactoring] Move Selection from DOMWindow to TreeScope.
        https://bugs.webkit.org/show_bug.cgi?id=82699

        Reviewed by Ryosuke Niwa.

        Since ShadowRoot will also manage its own version of DOMSelection, we would like to
        share the code among Document and DOMSelection. This patch moves DOMSelection from DOMWindow to TreeScope
        so that ShadowRoot can also use it.

        No new tests, should covered by existing tests.

        * dom/Document.cpp:
        (WebCore::Document::updateFocusAppearanceTimerFired):
        * dom/Document.h:
        (Document):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::selection):
        * do/mTreeScope.cpp:
        (WebCore::TreeScope::~TreeScope):
        (WebCore::TreeScope::getSelection):
        (WebCore):
        * dom/TreeScope.h:
        (WebCore):
        (TreeScope):
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::DOMSelection):
        (WebCore::DOMSelection::clearTreeScope):
        (WebCore):
        * page/DOMSelection.h:
        (WebCore):
        (WebCore::DOMSelection::create):
        (DOMSelection):
        (WebCore::DOMSelection::frame):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::~DOMWindow):
        (WebCore::DOMWindow::clearDOMWindowProperties):
        (WebCore::DOMWindow::getSelection):
        * page/DOMWindow.h:
        (DOMWindow):

2012-05-10  Kent Tamura  <tkent@chromium.org>

        Unreviewed, rolling out r116594.
        http://trac.webkit.org/changeset/116594
        https://bugs.webkit.org/show_bug.cgi?id=86013

        r116594 might have made some composition tests flaky.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
        (WebCore::CCSingleThreadProxy::doComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-05-10  Michael Nordman  <michaeln@google.com>

        [chromium] DomStorage events handling needs TLC (2)
        https://bugs.webkit.org/show_bug.cgi?id=85221
        Alter the StorageArea virtual interface such that the mutators no longer
        return old values. This is to allow implementations of the interface to operate
        more asynchronously.

        Reviewed by Adam Barth.

        No new tests. Existing tests cover this.

        * storage/StorageArea.h: Alter the interface so the mutators no longer return previous values
        * storage/StorageAreaImpl.cpp:
        (WebCore::StorageAreaImpl::disabledByPrivateBrowsingInFrame):  removed an unneeded PLATFORM(CHROMIUM) guard
        (WebCore::StorageAreaImpl::setItem): no longer return the old value
        (WebCore::StorageAreaImpl::removeItem): no longer return the old value
        (WebCore::StorageAreaImpl::clear): no longer return whether something was cleared
        * storage/StorageAreaImpl.h: match StorageArea's virtual interface

2012-05-10  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86158
        Overlay scrollbars without layers never paint in overflow regions in 
        tiled drawing mode
        -and corresponding-
        <rdar://problem/11289546>

        Reviewed by Darin Adler.

        RenderLayers paint scrollbars that do not have their own layers by 
        running a second pass through the layer tree after the layer tree has 
        painted. This ensures that the scrollbars always paint on top of 
        content. However, this mechanism was relying on 
        FrameView::paintContents() as a choke-point for all painting to 
        trigger the second painting pass. That is not a reasonable choke-point 
        in tiled drawing, so this patch adds similar code to 
        RenderLayerBacking.

        Only opt into the second painting pass for scrollbars that do not have 
        their own layers.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintOverflowControls):
        
        A layer that paints into its backing cannot return early here if it 
        has overlay scrollbars to paint.
        (WebCore::RenderLayer::paintLayer):
        
        This replicates code in FrameView::paintContents(). After painting the 
        owning layer, do a second pass if there are overlay scrollbars to 
        paint.
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::paintIntoLayer):

2012-05-10  Anders Carlsson  <andersca@apple.com>

        Well, at least fixing the GTK+ build is something!

        * platform/gtk/LocalizedStringsGtk.cpp:
        (WebCore::insecurePluginVersionText):
        (WebCore):

2012-05-10  Anders Carlsson  <andersca@apple.com>

        Add insecurePluginVersionText stubs.

        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
        (WebCore::insecurePluginVersionText):
        (WebCore):
        * platform/efl/LocalizedStringsEfl.cpp:
        (WebCore::insecurePluginVersionText):
        (WebCore):
        * platform/qt/LocalizedStringsQt.cpp:
        (WebCore::insecurePluginVersionText):
        (WebCore):

2012-05-10  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116677.
        http://trac.webkit.org/changeset/116677
        https://bugs.webkit.org/show_bug.cgi?id=86159

        This patch causes linker error to some mac bots (Requested by
        jianli_ on #webkit).

        * WebCore.exp.in:
        * dom/ContainerNode.h:
        * dom/Node.cpp:
        (WebCore::Node::traverseNextNode):
        (WebCore::Node::traverseNextSibling):
        * dom/Node.h:
        (Node):

2012-05-10  Abhishek Arya  <inferno@chromium.org>

        Crash in FontCache::releaseFontData due to infinite float size.
        https://bugs.webkit.org/show_bug.cgi?id=86110

        Reviewed by Andreas Kling.

        New callers always forget to clamp the font size, which overflows
        to infinity on multiplication. It is best to clamp it at the end
        to avoid getting greater than std::numeric_limits<float>::max().

        Test: fast/css/large-font-size-crash.html

        * platform/graphics/FontDescription.h:
        (WebCore::FontDescription::setComputedSize):
        (WebCore::FontDescription::setSpecifiedSize):

2012-05-10  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=82131
        [Mac] REGRESSION (r110480): Text field that specifies background-color 
        (or is auto-filled) gets un-themed border
        -and corresponding-
        <rdar://problem/11115221>

        Reviewed by Maciej Stachowiak.

        This change rolls out r110480 which is what caused styled text fields 
        to get the un-themed border, and it does a bunch of work to make sure 
        we get the pretty, new version of the NSTextField art whenever 
        possible. We do this differently for post-Lion OS's since there is now 
        a way to opt into it all the time. Lion and SnowLeopard can only use 
        the new art in HiDPI mode when the background color of the text field 
        is just white.

        RenderThemeMac::textField() takes a boolean paramter used to determine 
        if the new gradient will be used.
        * rendering/RenderThemeMac.h:
        (RenderThemeMac):
        
        This is the post-Lion workaround. This code has no effect on Lion and 
        SnowLeopard. This allows up to opt into a version of [NSTextField drawWithFrame:] that will only draw the frame of the text field; without this, it will draw the frame and the background, which creates a number of problems with styled text fields and text fields in HiDPI. There is a less comprehesive workaround for Lion and SnowLeopard in place in RenderThemeMac::textField().
        * rendering/RenderThemeMac.mm:
        (-[WebCoreTextFieldCell _coreUIDrawOptionsWithFrame:inView:includeFocus:]):
        
        This is the roll-out of r110480.
        (WebCore::RenderThemeMac::isControlStyled):
        
        See the comments for a full explanation, but this is mostly code for 
        Lion and SnowLeopard to determine if we can opt into the new artwork.
        (WebCore::RenderThemeMac::paintTextField):
        (WebCore::RenderThemeMac::textField):

2012-05-10  Anders Carlsson  <andersca@apple.com>

        WebKit1: Add a way to blacklist specific plug-ins/plug-in versions
        https://bugs.webkit.org/show_bug.cgi?id=86150
        <rdar://problem/9551196>

        Reviewed by Sam Weinig.

        * English.lproj/Localizable.strings:
        Update.

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::loadPlugin):
        It is possible that the client has already set the unavailability reason so don't try to set it twice.

        * platform/LocalizedStrings.cpp:
        (WebCore::insecurePluginVersionText):
        * platform/LocalizedStrings.h:
        Add insecure plug-in version text.

        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::unavailablePluginReplacementText):
        * rendering/RenderEmbeddedObject.h:
        Add InsecurePluginVersion unavailability reason.

2012-05-10  Eric Seidel  <eric@webkit.org>

        Make IFRAME_SEAMLESS child documents inherit styles from their parent iframe element
        https://bugs.webkit.org/show_bug.cgi?id=85940

        Reviewed by Ojan Vafai.

        The HTML5 <iframe seamless> spec says:
        In a CSS-supporting user agent: the user agent must, for the purpose of CSS property
        inheritance only, treat the root element of the active document of the iframe
        element's nested browsing context as being a child of the iframe element.
        (Thus inherited properties on the root element of the document in the
        iframe will inherit the computed values of those properties on the iframe
        element instead of taking their initial values.)

        Initially I implemented this support to the letter of the spec. However, doing so I learned
        that WebKit has a RenderStyle for the Document Node, not just the root element of the document.
        In this RenderStyle on the Document, we add a bunch of per-document styles from settings
        including designMode.

        This change makes StyleResolver::styleForDocument inherit style from the parent iframe's
        style, before applying any of these per-document styles.  This may or may not be correct
        depending on what behavior we want for rtl-ordering, page-zoom, locale, design mode, etc.
        For now, we continue to treat the iframe's document as independent in these regards, and
        the settings on that document override those inherited from the iframe.

        Also, intially when making this work, I added redirects in recalcStyle and scheduleStyleRecalc
        from the child document to the parent document in the case of seamless (since the parent
        document effectively manages the style resolve and layout of the child in seamless mode).
        However, I was not able to find a test which depended on this code change, so in this final patch
        I have removed both of these modifications and replaced them with FIXMEs.  Based on discussions
        with Ojan and James Robinson, I believe both of those changes may eventually be wanted.

        This change basically does 3 things:
        1.  Makes StyleResolver::styleForDocument inherit from the parent iframe.
        2.  Makes any recalcStyle calls on the iframe propogate down into the child document (HTMLIFrameElement::didRecalcStyle).
        3.  Makes Document::recalcStyle aware of the fact that the Document's style *can* change
            for reasons other than recalcStyle(Force).

        I'm open to more testing suggestions, if reviewers have settings on the Document's style
        that you want to make sure we inherit from the parent iframe, or don't inherit, etc.
        I view this as a complete solution to this aspect of the current <iframe seamless> spec,
        but likely not the last code we will write for this aspect of the seamless feature. :)

        Tested by fast/frames/seamlesss/seamless-css-cascade.html and seamless-designMode.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * dom/Document.cpp:
        (WebCore::Document::scheduleStyleRecalc):
        (WebCore::Document::recalcStyle):
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
        (WebCore::HTMLIFrameElement::didRecalcStyle):
        (WebCore):
        * html/HTMLIFrameElement.h:
        (HTMLIFrameElement):

2012-05-10  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in computedCSSPadding* functions due to RenderImage::imageDimensionsChanged called during attachment
        https://bugs.webkit.org/show_bug.cgi?id=85912

        Reviewed by Eric Seidel.

        Tests: fast/images/link-body-content-imageDimensionChanged-crash.html
               fast/images/script-counter-imageDimensionChanged-crash.html

        The bug comes from CSS generated images that could end up calling imageDimensionsChanged during attachment. As the
        rest of the code (e.g. computedCSSPadding*) would assumes that we are already inserted in the tree, we would crash.

        The solution is to bail out in this case as newly inserted RenderObject will trigger layout later on and properly
        handle what we would be doing as part of imageDimensionChanged (the only exception being updating our intrinsic
        size which should be done as part of imageDimensionsChanged).

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::imageDimensionsChanged):

2012-05-10  Adam Barth  <abarth@webkit.org>

        ASSERT in BidiResolver<Iterator, Run>::commitExplicitEmbedding makes running debug builds annoying
        https://bugs.webkit.org/show_bug.cgi?id=86140

        Reviewed by Eric Seidel.

        The correct fix here is to resolve
        https://bugs.webkit.org/show_bug.cgi?id=76574, but in the mean time,
        this ASSERT is annoying.

        * platform/text/BidiResolver.h:
        (WebCore::::commitExplicitEmbedding):

2012-05-10  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call addTraceEvent and getTraceCategoryEnabledFlag directly
        https://bugs.webkit.org/show_bug.cgi?id=85399

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/EventTracer.cpp: Added.
        (WebCore):
        (WebCore::EventTracer::getTraceCategoryEnabledFlag):
        (WebCore::EventTracer::addTraceEvent):
        * platform/EventTracer.h: Added.
        (WebCore):
        (EventTracer):
        * platform/chromium/EventTracerChromium.cpp: Added.
        (WebCore):
        (WebCore::EventTracer::getTraceCategoryEnabledFlag):
        (WebCore::EventTracer::addTraceEvent):
        * platform/chromium/PlatformSupport.h:
        * platform/chromium/TraceEvent.h:

2012-05-10  Adam Barth  <abarth@webkit.org>

        ScrollView::fixedVisibleContentRect should be public
        https://bugs.webkit.org/show_bug.cgi?id=86147

        Reviewed by Eric Seidel.

        Some code in the WebKit layer of OS(ANDROID) uses this function. That
        could will be upstreamed in a later patch. For now, this patch just
        makes this function public so that we remove the diff to this file.

        * platform/ScrollView.h:
        (WebCore::ScrollView::fixedVisibleContentRect):
        (WebCore::ScrollView::delegatesScrollingDidChange):

2012-05-10  Anders Carlsson  <andersca@apple.com>

        Rename the missing plug-in indicator to the unavailable plug-in indicator
        https://bugs.webkit.org/show_bug.cgi?id=86136

        Reviewed by Sam Weinig.

        Since the indicator is shown for more than just missing plug-ins, generalize it and use a plug-in unavailability
        reason enum to make it easier to extend. Also, pass the unavailability reason to the ChromeClient member functions.

        * WebCore.exp.in:
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::updateWidget):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::updateWidget):
        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::defaultEventHandler):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::updateWidgetIfNecessary):
        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::loadPlugin):
        * page/ChromeClient.h:
        (WebCore::ChromeClient::shouldUnavailablePluginMessageBeButton):
        (WebCore::ChromeClient::unavailablePluginButtonClicked):
        * page/FrameView.cpp:
        (WebCore::FrameView::updateWidget):
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject):
        (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReason):
        (WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):
        (WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsPressed):
        (WebCore::RenderEmbeddedObject::paint):
        (WebCore::RenderEmbeddedObject::paintReplaced):
        (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
        (WebCore::RenderEmbeddedObject::unavailablePluginReplacementText):
        (WebCore):
        (WebCore::RenderEmbeddedObject::isInUnavailablePluginIndicator):
        (WebCore::shouldUnavailablePluginMessageBeButton):
        (WebCore::RenderEmbeddedObject::handleUnavailablePluginIndicatorEvent):
        (WebCore::RenderEmbeddedObject::getCursor):
        * rendering/RenderEmbeddedObject.h:
        (RenderEmbeddedObject):

2012-05-10  Brady Eidson  <beidson@apple.com>

        <rdar://problem/10972577> and https://bugs.webkit.org/show_bug.cgi?id=80170
        Contents of noscript elements turned into strings in WebArchives

        Reviewed by Andy Estes.

        There's a much deeper question about how innerHTML of <noscript> is expected to work in 
        both a scripting and non-scripting environment that we should pursue separately.

        But for webarchives, we can solve this by filtering out the <noscript> elements completely 
        if scripting is enabled.

        Test: webarchive/ignore-noscript-if-scripting-enabled.html

        * WebCore.exp.in:

        Add arguments to createMarkup and MarkupAccumulator methods to pass a Vector of QualifiedNames
        that should be filtered from the resulting markup:
        * editing/MarkupAccumulator.cpp:
        (WebCore::MarkupAccumulator::serializeNodes):
        (WebCore::MarkupAccumulator::serializeNodesWithNamespaces):
        * editing/MarkupAccumulator.h:
        * editing/markup.cpp:
        (WebCore::createMarkup):
        * editing/markup.h:

        If scripting is enabled, add the noscriptTag to the tag names to filter:
        * loader/archive/cf/LegacyWebArchive.cpp:
        (WebCore::LegacyWebArchive::create):

2012-05-10  Abhishek Arya  <inferno@chromium.org>

        Crash due to floats not removed from first-letter element.
        https://bugs.webkit.org/show_bug.cgi?id=86019

        Reviewed by Julien Chaffraix.

        Move clearing logic of a floating/positioned object from removeChild
        to removeChildNode. There are lot of places which use removeChildNode
        directly and hence the object is not removed from the floating or
        positioned objects list.

        Test: fast/block/float/float-not-removed-from-first-letter.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::removeChild):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):

2012-05-10  Andreas Kling  <kling@webkit.org>

        Remove empty ElementAttributeData destructor.
        <http://webkit.org/b/86126>

        Reviewed by Antti Koivisto.

        * dom/ElementAttributeData.cpp:
        * dom/ElementAttributeData.h:

2012-05-10  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: heap snapshot comparison view is broken
        https://bugs.webkit.org/show_bug.cgi?id=86102

        Reviewed by Pavel Feldman.

        Pass HeapSnapshotProxy instead of undefined to the profile load callback. Added
        compiler annotations to avoid such errors in the future.

        * inspector/front-end/HeapSnapshotView.js:

2012-05-10  Zan Dobersek  <zandobersek@gmail.com>

        [GTK] ENABLE_IFRAME_SEAMLESS support
        https://bugs.webkit.org/show_bug.cgi?id=85843

        Reviewed by Eric Seidel.

        Export the ENABLE_IFRAME_SEAMLESS feature define when the feature is
        enabled.

        No new tests - all the related tests should now be passing.

        * GNUmakefile.am:

2012-05-10  Antti Koivisto  <antti@apple.com>

        Inline Node::traverseNextNode
        https://bugs.webkit.org/show_bug.cgi?id=85844

        Reviewed by Ryosuke Niwa.
        
        Inline traverseNextNode and traverseNextSibling to reduce entry/exit overhead and allow better code generation
        for many hot loops.

        In this version only the firstChild()/nextSibling() tests are inlined and the ancestor traversal is not.
        
        Performance bots will tell if this was worthwhile.

        * dom/ContainerNode.h:
        (WebCore::Node::traverseNextNode):
        (WebCore):
        (WebCore::Node::traverseNextSibling):
        * dom/Node.cpp:
        (WebCore::Node::traverseNextAncestorSibling):
        * dom/Node.h:
        (Node):

2012-05-10  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Fix MediaHints parsing
        https://bugs.webkit.org/show_bug.cgi?id=86098

        Reviewed by Adam Barth.

        Not currently testable. Working on a series of patches that will fix that.

        * Modules/mediastream/PeerConnection00.cpp:
        (WebCore::PeerConnection00::createMediaHints):

2012-05-10  Tommy Widenflycht  <tommyw@google.com>

        [chromium] MediaStream API: Fix the ExtraData functionality in WebMediaStreamDescriptor
        https://bugs.webkit.org/show_bug.cgi?id=86087

        Reviewed by Adam Barth.

        Not easy to test but I have added code that excercises this to WebUserMediaClientMock (in DumpRenderTree).

        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
        (WebKit::WebMediaStreamDescriptor::setExtraData):

2012-05-10  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: search title is shown beside the search field (not under) in the vertical mode.
        https://bugs.webkit.org/show_bug.cgi?id=86120

        Reviewed by Yury Semikhatsky.

        This change makes search title render as placeholder at all times.
        It also adjusts the size of the search field when navigation arrows appear.

        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController):
        (WebInspector.SearchController.prototype.updateSearchLabel):
        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
        (WebInspector.SearchController.prototype._createSearchNavigationButton):
        * inspector/front-end/inspector.css:
        (#toolbar-search-item):
        (.with-navigation-buttons #search):
        (.toolbar-search-navigation-label):
        (.with-navigation-buttons .toolbar-search-navigation-label):
        * inspector/front-end/inspector.html:

2012-05-10  Varun Jain  <varunjain@google.com>

        [chromium] Trigger context menu for long press gesture
        https://bugs.webkit.org/show_bug.cgi?id=85919

        Reviewed by Adam Barth.

        Test: fast/events/touch/gesture/context-menu-on-long-press.html

        * page/EventHandler.cpp:
        (WebCore):
        (WebCore::EventHandler::sendContextMenuEventForGesture):
        * page/EventHandler.h:
        (EventHandler):

2012-05-10  Abhishek Arya  <inferno@chromium.org>

        Crash in ApplyStyleCommand::joinChildTextNodes.
        https://bugs.webkit.org/show_bug.cgi?id=85939

        Reviewed by Ryosuke Niwa.

        Test: editing/style/apply-style-join-child-text-nodes-crash.html

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): add conditions
        to bail out if our start and end position nodes are removed due to 
        mutation events in joinChildTextNodes.
        (WebCore::ApplyStyleCommand::applyInlineStyle): this executes after
        applyRelativeFontStyleChange in ApplyStyleCommand::doApply. So, need
        to bail out if our start and end position nodes are removed due to
        mutation events.
        (WebCore::ApplyStyleCommand::joinChildTextNodes): hold all the children
        in a ref vector to prevent them from getting destroyed due to mutation events.

2012-05-10  Erik Arvidsson  <arv@chromium.org>

        Unreviewed, rebaselined run-bindings-tests results.

        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
        (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionAddEventListener):
        (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
        * bindings/scripts/test/V8/V8TestException.cpp:
        (WebCore::V8TestException::wrapSlow):
        * bindings/scripts/test/V8/V8TestException.h:
        (WebCore::V8TestException::wrap):

2012-05-10  Abhishek Arya  <inferno@chromium.org>

        Crash in InsertParagraphSeparatorCommand::doApply.
        https://bugs.webkit.org/show_bug.cgi?id=84995

        Reviewed by Ryosuke Niwa.

        Test: editing/inserting/insert-paragraph-seperator-crash.html

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::mergeParagraphs): no need of static cast, since
        type of enclosingBlock returned is already Element*.
        * editing/IndentOutdentCommand.cpp:
        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): no need of static cast, since
        type of enclosingBlock returned is already Element*.
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply): RefPtr startBlock to guard against
        mutation events.
        * editing/htmlediting.cpp:
        (WebCore::enclosingBlock): make sure type of enclosingNode is an element before doing
        the static cast. This was already failing in a couple of layout tests. Also, isBlock
        check already exists in the function call to enclosingNodeOfType, so don't need it
        again on enclosingNode's renderer.
        * editing/htmlediting.h: 
        (WebCore):

2012-05-10  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        TouchAdjustment doesn't correct for scroll-offsets.
        https://bugs.webkit.org/show_bug.cgi?id=86083

        Reviewed by Kenneth Rohde Christiansen.

        Already tested by: touchadjustment/scroll-delegation

        * page/EventHandler.cpp:
        (WebCore::EventHandler::bestClickableNodeForTouchPoint):
        (WebCore::EventHandler::bestZoomableAreaForTouchPoint):
        * page/TouchAdjustment.cpp:
        (WebCore::TouchAdjustment::findNodeWithLowestDistanceMetric):
        * testing/Internals.cpp:
        (WebCore::Internals::bestZoomableAreaForTouchPoint):

2012-05-10  Konrad Piascik  <kpiascik@rim.com>

        Fix typo in filename
        https://bugs.webkit.org/show_bug.cgi?id=86095

        Reviewed by Andreas Kling.

        * UseJSC.cmake:

2012-05-10  Stephen Chenney  <schenney@chromium.org>

        SVG Filters allow invalid elements as children
        https://bugs.webkit.org/show_bug.cgi?id=83979

        Reviewed by Nikolas Zimmermann.

        According to the SVG spec, there are numerous restrictions on the
        content of nodes (that is, their children). Specific to this problem,
        SVGFilter elements may only contain SVGFilterPrimitive elements, and
        those may only contain animation related elements. This patch enforces
        the restriction on filters in the render tree, thus preventing us from
        having (for instance) content that is inside a filter yet filtered by
        the filter.

        Manual test: ManualTests/bugzilla-83979.svg

        * svg/SVGFilterElement.cpp:
        (WebCore::SVGFilterElement::childShouldCreateRenderer): Added to only allow renderers for fe* children
        (WebCore):
        * svg/SVGFilterElement.h:
        (SVGFilterElement):
        * svg/SVGFilterPrimitiveStandardAttributes.h: Do not allow any children at all for fe* elements.
        (SVGFilterPrimitiveStandardAttributes):

2012-05-10  Joe Thomas  <joethomas@motorola.com>

        [CSS3 Backgrounds and Borders] Add background-size to the background shorthand
        https://bugs.webkit.org/show_bug.cgi?id=27577

        Reviewed by Alexis Menard.

        Added CSSPropertyBackgroundSize to the background shorthand propery. Added the logic for parsing background-size.
        bakground-size appears after background-position followed by a '/'.
        The specification related to this change is http://www.w3.org/TR/css3-background/#the-background

        Tests: fast/backgrounds/background-shorthand-with-backgroundSize-style.html
               fast/backgrounds/size/backgroundSize-in-background-shorthand.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        (WebCore::CSSComputedStyleDeclaration::getBackgroundShorthandValue):
        (WebCore):
        * css/CSSComputedStyleDeclaration.h:
        (CSSComputedStyleDeclaration):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFillShorthand):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getLayeredShorthandValue):
        * css/StylePropertyShorthand.cpp:
        (WebCore):
        (WebCore::backgroundShorthand):

2012-05-10  MORITA Hajime <morrita@google.com>

        Node::InDetachFlag could be removed.
        https://bugs.webkit.org/show_bug.cgi?id=85963

        Reviewed by Antti Koivisto.

        Removed Node::inDetach() since it can never true
        on the only call site setFocusedNode().

        No new test. Covered by existing tests.

        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        * dom/Node.cpp:
        (WebCore::Node::detach):
        * dom/Node.h:
        (WebCore):
        (Node):

2012-05-10  Keishi Hattori  <keishi@webkit.org>

        Crash in HTMLFormControlElement::m_fieldSetAncestor
        https://bugs.webkit.org/show_bug.cgi?id=86070

        Reviewed by Kent Tamura.

        No new tests.

        The previous patch r115990 didn't completely resolve the crash (Bug 85453)
        We don't have a reproducible test case, so we are reverting to the old code for setting m_fieldSetAncestor.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
        (WebCore::HTMLFormControlElement::updateFieldSetAndLegendAncestor):
        (WebCore::HTMLFormControlElement::insertedInto): Set m_dataListAncestorState to Unknown because ancestor has changed. Call setNeedsWillValidateCheck because style might need to be updated.
        (WebCore::HTMLFormControlElement::removedFrom):
        (WebCore::HTMLFormControlElement::disabled):
        (WebCore::HTMLFormControlElement::recalcWillValidate):
        (WebCore::HTMLFormControlElement::willValidate):
        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement): Added m_dataListAncestorState.

2012-05-10  Sam D  <dsam2912@gmail.com>

        Web Inspector: rename InspectorBackendStub.js to InspectorBackendCommands.js
        https://bugs.webkit.org/show_bug.cgi?id=72306

        Changed name for InspectorBackendStub.js to
        InspectorBackendCommands.js

        Reviewed by Yury Semikhatsky.

        No new tests required. File name is changed.

        * DerivedSources.pri:
        * GNUmakefile.am:
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.vcproj/copyWebCoreResourceFiles.cmd:
        * WebCore.xcodeproj/project.pbxproj:
        * gyp/copy-inspector-resources.sh:
        * inspector/CodeGeneratorInspector.py:
        * inspector/front-end/InspectorBackendCommands.qrc: Added.
        * inspector/front-end/InspectorBackendStub.qrc: Removed.
        * inspector/front-end/inspector.html:

2012-05-10  Alexis Menard  <alexis.menard@openbossa.org>

        [Qt] Avoid string conversions to construct a QUrl when using Qt5.
        https://bugs.webkit.org/show_bug.cgi?id=86006

        Reviewed by Kenneth Rohde Christiansen.

        In Qt5, the QUrl constructor can handle the string directly, even in UTF-16 because the
        constructor QUrl(QString) has been fixed. Unfortunately we still need to use the old
        code path when building with Qt4.

        No new tests : it's a performance improvement which should be covered by tests.

        * platform/qt/KURLQt.cpp:
        (WebCore::KURL::operator QUrl):

2012-05-10  Noel Gordon  <noel.gordon@gmail.com>

        [chromium] REGRESSION(r107389) Visible line artifacts on some JPEG images
        https://bugs.webkit.org/show_bug.cgi?id=85772

        Reviewed by Kent Tamura.

        On some JPEG images, vertical and horizontal lines artifacts might appear in image
        regions with very high frequency color variation when using DCT_IFAST decodes. Use
        DCT_IFAST on small screen devices only (Chromium Android).

        No new tests. Covered by existing tests.

        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (dctMethod): Permit DCT_IFAST decoding for Chromium Android only.

2012-05-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        [Qt] Implement fit-to-width behaviour
        https://bugs.webkit.org/show_bug.cgi?id=86085

        Reviewed by Simon Hausmann.

        Add a method to get the minimum scale factor that contains the content
        without showing any chrome background.

        * dom/ViewportArguments.cpp:
        (WebCore::computeMinimumScaleFactorForContentContained):
        (WebCore):
        * dom/ViewportArguments.h:
        (WebCore):

2012-05-10  MORITA Hajime  <morrita@google.com>

        Remove support for Node::willRemove()
        https://bugs.webkit.org/show_bug.cgi?id=55209

        Reviewed by Ryosuke Niwa.

        This change de-virtualizes Node::willRemove(), gains
        5% speedup on Dromaeo dom-modify.

        Originally there were 5 willRemove() overrides:
        - Element
        - HTMLStyleElement
        - HTMLSourceElement
        - HTMLTrackElement
        - HTMLFrameOwnerElement

        For first 4 items, this change moves their implementations to
        Node::removedFrom() overrides.

        Then HTMLFrameOwnerElement is the only class which needs the
        notification.  Because it emits the "unload" event, it needs some
        notification _before_ its removal. To handle that, this change
        introduces ChildFrameDisconnector which collects
        corresponding decendant elements and disconnect their content frame.

        Even though this approach doesn't kill pre-removal tree traversal
        completely, it's a bit more efficient due to the de-virtualization.

        No new tests. Covered by existing test.

        * dom/ContainerNode.cpp:
        (WebCore::willRemoveChild): Replaced willRemove() call with ChildFrameDisconnector.
        (WebCore::willRemoveChildren): Ditto.
        (WebCore::ContainerNode::disconnectDescendantFrames): Added. Used from FrameLoader to replace Document::willRemove() call.
        (WebCore):
        * dom/ContainerNode.h:
        (ContainerNode):
        * dom/ContainerNodeAlgorithms.cpp:
        (WebCore::ChildFrameDisconnector::collectDescendant):
        (WebCore):
        (WebCore::ChildFrameDisconnector::Target::disconnect):
        * dom/ContainerNodeAlgorithms.h:
        (ChildFrameDisconnector):
        (Target):
        (WebCore::ChildFrameDisconnector::Target::Target):
        (WebCore::ChildFrameDisconnector::Target::isValid):
        (WebCore):
        (WebCore::ChildFrameDisconnector::ChildFrameDisconnector):
        (WebCore::ChildFrameDisconnector::collectDescendant):
        (WebCore::ChildFrameDisconnector::disconnect):
        * dom/Element.cpp:
        (WebCore::Element::removedFrom):
        * dom/Element.h:
        * dom/ElementShadow.cpp:
        * dom/ElementShadow.h:
        (ElementShadow):
        * dom/Node.cpp:
        * dom/Node.h: Added IsFrameOwnerElement flag to de-virtualize IsFrameOwnerElement().
        (WebCore::Node::isFrameOwnerElement): De-virtualized.
        (Node):
        * html/HTMLElement.h:
        (HTMLElement):
        (WebCore::HTMLElement::HTMLElement):
        * html/HTMLFrameOwnerElement.cpp:
        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
        (WebCore::HTMLFrameOwnerElement::disconnectContentFrame): Extracted from original willRemove().
        * html/HTMLFrameOwnerElement.h:
        (HTMLFrameOwnerElement):
        (WebCore::toFrameOwnerElement):
        (WebCore):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::sourceWasRemoved): Renamed from sourceWillBeRemoved(), dealing with the timing change.
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):
        (WebCore::isMediaElement):
        (WebCore):
        (WebCore::toMediaElement):
        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::removedFrom): Moved some code from willRemove().
        * html/HTMLSourceElement.h:
        (HTMLSourceElement):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::removedFrom):
        (WebCore):
        * html/HTMLStyleElement.h:
        (HTMLStyleElement):
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::removedFrom): Moved some code from willRemove().
        * html/HTMLTrackElement.h:
        (HTMLTrackElement):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear):

2012-05-10  Kinuko Yasuda  <kinuko@chromium.org>

        Change the return type of Entry.toURL() back to String from KURL
        https://bugs.webkit.org/show_bug.cgi?id=85858

        Reviewed by Ryosuke Niwa.

        I once changed it from String to KURL in r116273 but it turned out that
        it involves implicit conversion and may incur extra overhead.
        This partly reverts r116273 while keeping some internal functions
        returning KURL as it's what we initially create as and is more
        convenient to operate on.

        No new tests; no functional or visible changes.

        * Modules/filesystem/EntryBase.cpp:
        (WebCore::EntryBase::toURL):
        * Modules/filesystem/EntryBase.h:
        (EntryBase):

2012-05-10  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Autocomplete for CSS property values in the Styles pane behaving incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=85784

        Reviewed by Vsevolod Vlasov.

        Before executing the number increment/decrement within CSS property value, the current word is checked
        for being a valid suggestion for the current property, and if it is, the numeric change is skipped
        in favor of the suggested property value switch by a suggest box.

        * inspector/front-end/StylesSidebarPane.js:

2012-05-10  Abhishek Arya  <inferno@chromium.org>

        Make DOMCharacterDataModified a scoped event (similar to r73690).
        https://bugs.webkit.org/show_bug.cgi?id=85920

        Reviewed by Ryosuke Niwa.

        DOMCharacterDataModified was missing in the list of already scoped
        DOM mutation events like DOMSubtreeModified, DOMNodeInserted, etc.
        It helps to delay event dispatches until the completion of each call
        of EditCommand::doApply. This has been useful in the past and helped to 
        prevent unexpected DOM tree mutations while the editing command is executing.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::dispatchModifiedEvent):

2012-05-10  Alexandre Elias  <aelias@google.com>

        Default to null value for HistoryItem::m_pageScaleFactor
        https://bugs.webkit.org/show_bug.cgi?id=84385

        Reviewed by Adam Barth.

        Previously, HistoryItem::m_pageScaleFactor defaulted to a value
        of 1, making it impossible to determine whether this value was never
        set, or intentionally set to 1.  This patch introduces a default value
        of 0 and makes restoreScrollPositionAndViewState not touch the page
        scale factor if this value is still present at time of reload.

        This is a no-op change for common navigation scenarios.  The
        motivation for this change is the corner case of syncing history items
        from a desktop browser to a mobile device.  In that case, we need a
        way to specify that the history item does not contain a
        pageScaleFactor so that the mobile device does not display the page
        overly zoomed in.

        No new tests.

        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::HistoryItem):
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::restoreScrollPositionAndViewState):

2012-05-10  Csaba Osztrogonác  <ossy@webkit.org>

        Use suitable viewport values when a Mobile DTD is used.
        https://bugs.webkit.org/show_bug.cgi?id=85425

        Unreviewed debug buildfix after r116571.

        * dom/Document.cpp:
        (WebCore::Document::setDocType):

2012-05-10  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms] Move step related methods to InputType class from HTMLInputElement class
        https://bugs.webkit.org/show_bug.cgi?id=85978

        Reviewed by Kent Tamura.

        This patch is part of re-factoring of HTMLInputElement.cpp for numeric input type.
        In this patch, we move implementation of getAllowedValueStep and stepUp/stepUpFromRenderer
        to InputType class because of these are for DateTime/Number/Range.

        Following patches will change implementation of getAllowedValueStep to use StepRange and
        remove step related methods, defaultStep, stepScaleFactor, and so on.

        No new tests. This patch should not change behavior.

        * html/HTMLInputElement.cpp:
        (WebCore):
        (WebCore::HTMLInputElement::getAllowedValueStep):
        (WebCore::HTMLInputElement::stepUp):
        (WebCore::HTMLInputElement::stepDown):
        (WebCore::HTMLInputElement::stepUpFromRenderer):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore::InputType::applyStep):
        (WebCore):
        (WebCore::InputType::alignValueForStep):
        (WebCore::InputType::getAllowedValueStep):
        (WebCore::InputType::getAllowedValueStepWithDecimalPlaces):
        (WebCore::InputType::stepUp):
        (WebCore::InputType::stepUpFromRenderer):
        * html/InputType.h:
        (InputType):

2012-05-09  Kent Tamura  <tkent@chromium.org>

        Calendar Picker: Fix a crash by changing input type.
        https://bugs.webkit.org/show_bug.cgi?id=86007

        Reviewed by Hajime Morita.

        Manual test: forms/calendar-picker-crash-by-type-change.html

        * html/shadow/CalendarPickerElement.cpp:
        (WebCore::CalendarPickerElement::~CalendarPickerElement):
        Added. Make sure the popup is closed.
        * html/shadow/CalendarPickerElement.h:
        (CalendarPickerElement): Add declaration of the destructor.

2012-05-09  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Move suspendAnimations to use Internals interface.
        https://bugs.webkit.org/show_bug.cgi?id=85986

        Reviewed by Ryosuke Niwa.

        Add suspendAnimations functions, because it is able to work in the
        cross-port way through the Internals interface.

        No new tests, since we are improving here the infra-structure for testing
        a specific method.

        * testing/Internals.cpp:
        (WebCore::Internals::suspendAnimations):
        (WebCore):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-05-09  Charlie Reis  <creis@chromium.org>

        Add dispatchMessageEventWithOriginCheck to DOMWindow
        https://bugs.webkit.org/show_bug.cgi?id=85815

        Reviewed by Adam Barth.

        Useful for ports that support cross-process postMessage.
        No new tests, since covered by existing postMessage tests.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::postMessageTimerFired):
        (WebCore):
        (WebCore::DOMWindow::dispatchMessageEventWithOriginCheck):
        * page/DOMWindow.h:
        (WebCore):
        (DOMWindow):

2012-05-09  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] Cookie parsing issue. If the cookie value provided was (") then the browser creates a session cookie instead.
        https://bugs.webkit.org/show_bug.cgi?id=85775

        Reviewed by Rob Buis.

        Make CookieParser::parseOneCookie handle (cookiename="cookievalue;expires=xxxx) correctly.
        This cookie's value is "cookievalue not "cookievalue;expires=xxxx.

        Test: http/tests/cookies/single-quoted-value.html

        * platform/blackberry/CookieParser.cpp:
        (WebCore::CookieParser::parseOneCookie):

2012-05-09  Raymond Liu  <raymond.liu@intel.com>

        Add multi-channels support for CopyWithGainFrom in AudioBus
        https://bugs.webkit.org/show_bug.cgi?id=80675

        Reviewed by Chris Rogers.

        * platform/audio/AudioBus.cpp:
        (WebCore):
        (WebCore::AudioBus::AudioBus):
        (WebCore::AudioBus::copyWithGainFrom):
        * platform/audio/AudioBus.h:
        (AudioBus):

2012-05-09  Jessie Berlin  <jberlin@apple.com>

        Crash using the new WKBundleDOMWindowExtensions APIs.
        https://bugs.webkit.org/show_bug.cgi?id=85888

        Reviewed by Brady Eidson.

        WKBundlePageWillDestroyGlobalObjectForDOMWindowExtensionCallback was only being invoked when
        the WKPage was destroyed, and then only for the child frames. In addition, the
        DOMWindowExtension was holding onto a destroyed DOMWindow and attempting to unregister from
        when the WK2 wrapper object was attempting to destroy the DOMWindowExtension.

        The underlying issue here was that the DOMWindowProperties were getting disconnectFrame
        and willDetachPage called on them at the wrong times.

        Rename DOMWindowProperty::disconnectFrame and reconnectFrame to disconnectFrameForPageCache
        and reconnectFrameFromPageCache for clarity.

        Only invoke DOMWindowProperty::disconnectFrameForPageCache when the frame is going into the
        page cache.

        In the cases where the DOMWindow is getting destroyed, the frame is being destroyed, or the
        DOMWindow is getting cleared because the frame is being navigated, invoke
        DOMWindowProperty::willDestroyGlobalObjectInFrame instead of disconnectFrame.

        Invoke DOMWindowProperty::willDetachGlobalObjectFromFrame when a document is being detached
        because the frame has been detached (e.g. fast/storage/storage-detached-iframe.html) and
        won't be immediately destroyed.

        Invoke DOMWindowProperty::willDestroyGlobalObjectInCachedFrame when a cached frame is
        being destroyed.

        New WK2 API Test: DOMWindowExtensionNoCache.

        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::disconnectFrameForPageCache):
        Updated for disconnectFrame rename.
        (WebCore::DOMWindowIndexedDatabase::reconnectFrameFromPageCache):
        Updated for reconnectFrame rename.
        (WebCore::DOMWindowIndexedDatabase::willDestroyGlobalObjectInCachedFrame):
        Get rid of the suspended IDBFactory.
        (WebCore::DOMWindowIndexedDatabase::willDestroyGlobalObjectInFrame):
        Get rid of the IDBFactory.
        (WebCore::DOMWindowIndexedDatabase::willDetachGlobalObjectFromFrame):
        Ditto.
        * Modules/indexeddb/DOMWindowIndexedDatabase.h:

        * dom/Document.cpp:
        (WebCore::Document::prepareForDestruction):
        Tell the DOMWindow before detaching the Document.
        * dom/Document.h:

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::destroy):
        Tell the DOMWindow.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear):
        Use Document::prepareForDestruction so that the DOMWindow is told about the main frame
        navigation before detaching the Document.

        * loader/appcache/DOMApplicationCache.cpp:
        (WebCore::DOMApplicationCache::disconnectFrameForPageCache):
        Updated for the disconnectFrame rename.
        (WebCore::DOMApplicationCache::reconnectFrameFromPageCache):
        Updated for the reconnectFrame rename.
        (WebCore::DOMApplicationCache::willDestroyGlobalObjectInFrame):
        Cover the cases formerly covered by disconnectFrame (which was sometimes being called when
        called when the frame was destroyed).
        * loader/appcache/DOMApplicationCache.h:

        * notifications/DOMWindowNotifications.cpp:
        (WebCore::DOMWindowNotifications::disconnectFrameForPageCache):
        Updated for the disconnectFrame rename.
        (WebCore::DOMWindowNotifications::reconnectFrameFromPageCache):
        Updated for the reconnectFrame rename.
        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInCachedFrame):
        Get rid of the suspended notification center.
        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInFrame):
        Get rid of the notification center.
        (WebCore::DOMWindowNotifications::willDetachGlobalObjectFromFrame):
        Do not allow use of the notification center by detached frames.
        * notifications/DOMWindowNotifications.h:

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::clearDOMWindowProperties):
        Do not call disconnectDOMWindowProperties. It is now the responsibility of the callers to
        tell the DOMWindowProperties the correct cause of being cleared.
        (WebCore::DOMWindow::~DOMWindow):
        Make sure the DOMWindowProperties still know that the DOMWindow is going away.
        (WebCore::DOMWindow::frameDestroyed):
        Invoke willDestroyGlobalObjectInFrame on the DOMWindowProperties.
        (WebCore::DOMWindow::willDetachPage):
        It is no longer necessary to tell the DOMWindowProperties anything here.
        (WebCore::DOMWindow::willDestroyCachedFrame):
        Tell the DOMWindowProperties.
        (WebCore::DOMWindow::willDestroyDocumentInFrame):
        Ditto.
        (WebCore::DOMWindow::willDetachDocumentFromFrame):
        Ditto.
        (WebCore::DOMWindow::clear):
        Ditto.
        (WebCore::DOMWindow::disconnectDOMWindowProperties):
        Updated for the disconnectFrame rename.
        (WebCore::DOMWindow::reconnectDOMWindowProperties):
        Ditto.
        * page/DOMWindow.h:

        * page/DOMWindowExtension.cpp:
        (WebCore::DOMWindowExtension::DOMWindowExtension):
        Move the responsibility for tracking the disconnected DOMWindow to DOMWindowProperty, since
        DOMWindowProperty will need it to unregister the property when a cached frame is destroyed.
        (WebCore::DOMWindowExtension::disconnectFrameForPageCache):
        Remove the code to check for disconnectFrame being called twice - it is now only called when
        a frame goes into the page cache.
        Let the DOMWindowProperty keep track of the disconnected DOMWindow.
        (WebCore::DOMWindowExtension::reconnectFrameFromPageCache):
        Let the DOMWindowProperty keep track of the disconnected DOMWindow.
        (WebCore::DOMWindowExtension::willDestroyGlobalObjectInCachedFrame):
        Dispatch the willDestroyGlobalObjectForDOMWindowExtension callback.
        (WebCore::DOMWindowExtension::willDestroyGlobalObjectInFrame):
        Ditto, but only if the callback hasn't already been sent because the frame has been detached.
        (WebCore::DOMWindowExtension::willDetachGlobalObjectFromFrame):
        Send the callback because nothing interesting can be done in the frame once it has been
        detached.
        * page/DOMWindowExtension.h:

        * page/DOMWindowProperty.cpp:
        (WebCore::DOMWindowProperty::DOMWindowProperty):
        Keep track of the disconnected DOMWindow so it can be used to unregister the property when a
        cached frame is destroyed.
        (WebCore::DOMWindowProperty::~DOMWindowProperty):
        Also unregister the property when a DOMWindowProperty for a cached frame is destroyed.
        (WebCore::DOMWindowProperty::disconnectFrameForPageCache):
        Keep track of the disconnected DOMWindow.
        (WebCore::DOMWindowProperty::reconnectFrameFromPageCache):
        Ditto.
        (WebCore::DOMWindowProperty::willDestroyGlobalObjectInCachedFrame):
        Unregister the property from the disconnected DOMWindow.
        (WebCore::DOMWindowProperty::willDestroyGlobalObjectInFrame):
        Unregister the property from the DOMWindow and stop keeping track of the frame.
        (WebCore::DOMWindowProperty::willDetachGlobalObjectFromFrame):
        Do not set m_frame to 0 because detached frames still have access to the DOMWindow, even if
        they can't do anything meaningful with it.
        * page/DOMWindowProperty.h:

        * page/Frame.cpp:
        (WebCore::Frame::setView):
        Tell the DOMWindow that the Document is being detached so it can tell the
        DOMWindowProperties.

        * page/PointerLock.cpp:
        (WebCore::PointerLock::disconnectFrameForPageCache):
        Updated for disconnectFrame rename.
        (WebCore::PointerLock::willDestroyGlobalObjectInFrame):
        Cover the cases formerly covered by disconnectFrame (which was sometimes being called when
        called when the frame was destroyed).
        * page/PointerLock.h:

2012-05-09  Ian Vollick  <vollick@chromium.org>

        [chromium] Ensure animations get ticked at least once when added.
        https://bugs.webkit.org/show_bug.cgi?id=86013

        Reviewed by James Robinson.

        Tested in
          CCLayerTreeHostTestTickAnimationWhileBackgrounded.runSingleThreaded
          CCLayerTreeHostTestAddAnimationWithTimingFunction.runSingleThreaded
          CCLayerTreeHostTestSynchronizeAnimationStartTimes.runSingleThreaded
          CCLayerTreeHostTestAnimationFinishedEvents.runSingleThreaded

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::addAnimation):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::didAddAnimation):
        (WebCore):
        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (CCSingleThreadProxyAnimationTimer):
        (WebCore::CCSingleThreadProxyAnimationTimer::create):
        (WebCore::CCSingleThreadProxyAnimationTimer::CCSingleThreadProxyAnimationTimer):
        (WebCore):
        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
        (WebCore::CCSingleThreadProxy::didAddAnimation):
        (WebCore::CCSingleThreadProxy::doComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCThreadProxy.h:

2012-05-09  Adam Barth  <abarth@webkit.org>

        Implement HTML Media Capture
        https://bugs.webkit.org/show_bug.cgi?id=85958

        Reviewed by Eric Seidel.

        This patch begins the implementation of
        http://www.w3.org/TR/html-media-capture/ by adding the capture
        attribute to HTMLInputElement.

        Test: fast/forms/file/file-input-capture.html

        * html/FileInputType.cpp:
        (WebCore::FileInputType::handleDOMActivateEvent):
        * html/HTMLAttributeNames.in:
        * html/HTMLInputElement.cpp:
        (WebCore):
        (WebCore::HTMLInputElement::capture):
        (WebCore::HTMLInputElement::setCapture):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/HTMLInputElement.idl:
        * platform/FileChooser.h:
        (FileChooserSettings):

2012-05-09  Charles Wei  <charles.wei@torchmobile.com.cn>

        [BlackBerry]  Refactor data scheme support
        https://bugs.webkit.org/show_bug.cgi?id=85938

        Reviewed by Rob Buis.

        We will create a DataStream in our platform repository,
        so that can be wrapped up by NetworkJob for webkit rendering,
        and by DownloadStream for downloading.

        Refactor, no new tests.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::NetworkJob):
        (WebCore::NetworkJob::initialize):
        (WebCore::NetworkJob::cancelJob):
        (WebCore::NetworkJob::sendResponseIfNeeded):
        * platform/network/blackberry/NetworkJob.h:
        (NetworkJob):
        * platform/network/blackberry/NetworkManager.cpp:
        (WebCore::NetworkManager::startJob):

2012-05-09  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't draw when canDraw() is false
        https://bugs.webkit.org/show_bug.cgi?id=85829

        Reviewed by Adrienne Walker.

        This is based on the work of Daniel Sievers in bug
        https://bugs.webkit.org/show_bug.cgi?id=82680. When canDraw() is false,
        we should not call drawLayers() or prepareToDraw() in both Single- and
        Multi-Threaded mode.

        drawLayers() is crashing in single threaded mode, and this attempts to
        prevent it from being called with invalid state. While making it behave
        properly in single-threaded mode, it seems appropriate to unrevert the
        parts of 82680 that made threaded mode behave similarly appropriately.

        A single-threaded test is not included since LTHTests is unable to run
        in single-threaded mode at this time (pending work from Ian Vollick). So
        we test in threaded mode only with a note to include a single thread
        version.

        Tests: CCLayerTreeHostTestCanDrawBlocksDrawing.runMultiThread

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        (WebCore::CCLayerTreeHostImpl::drawLayers):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::doComposite):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):

2012-05-09  Martin Robinson  <mrobinson@igalia.com>

        [Cairo] GLContextGLX releases the context with an uninitialized display
        https://bugs.webkit.org/show_bug.cgi?id=86039

        Reviewed by Philippe Normand.

        No new tests. This does not change behavior on most machines, but has
        the potential to prevent a pretty nasty crash on others.

        Use the shared display to release GLX contexts instead of the uninitialized
        m_display member.

        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore::GLContextGLX::~GLContextGLX): Release the display with the shared
        display.
        * platform/graphics/glx/GLContextGLX.h:
        (GLContextGLX): Remove the m_display member.

2012-05-09  Tony Gentilcore  <tonyg@chromium.org>

        Subresources loaded after a reload completes shouldn't be revalidated.
        https://bugs.webkit.org/show_bug.cgi?id=84614

        Based on patch by Darin Fisher.

        Reviewed by Darin Fisher.

        Tests: http/tests/cache/loaded-from-cache-after-reload-within-iframe.html
               http/tests/cache/loaded-from-cache-after-reload.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): Reset m_loadType after the load completes.

2012-05-09  Erik Arvidsson  <arv@chromium.org>

        [V8] Fix issue where V8BindingPerContextData could keep the context object alive
        https://bugs.webkit.org/show_bug.cgi?id=86036

        Reviewed by Kentaro Hara.

        This is a partial revert of http://trac.webkit.org/changeset/114320/. This keeps
        the layout tests that were introduced since it turns out that
        http://trac.webkit.org/changeset/114989 fixes the tests too.

        Covered by: http/tests/security/isolatedWorld/context-destroy.html

        * bindings/v8/V8IsolatedContext.cpp:
        (WebCore::V8IsolatedContext::destroy):

2012-05-09  Anders Carlsson  <andersca@apple.com>

        Speed up some parts of TileCache drawing
        https://bugs.webkit.org/show_bug.cgi?id=86033
        <rdar://problem/10919373>

        Reviewed by Sam Weinig.

        * platform/graphics/ca/mac/TileCache.mm:
        (WebCore::TileCache::tileCoverageRect):
        If we can't have scrollbars, there's not much need to extend the tile coverage rect outside of the visible rect, since it's
        unlikely that we'll do any form of scrolling here.

        (WebCore::TileCache::revalidateTiles):
        Don't update the tile layer frame if it's big enough to contain the tile size. Also, if there are no new tiles created,
        don't call platformCALayerDidCreateTiles since that will trigger an extra layer flush.

2012-05-09  Alexandre Elias  <aelias@google.com>

        setPageScaleFactor should setScrollPosition if scale is unchanged
        https://bugs.webkit.org/show_bug.cgi?id=84400

        Reviewed by Adam Barth.

        Previously, setPageScaleFactor forgot about its "origin" argument if
        the page scale factor is unchanged.  This has proven undesirable in
        practice because, for example, a single pinch gesture may zoom in and
        back out to the original page scale factor, but at a different scroll
        offset.

        New test case added to scale-and-scroll-body-expected.txt

        * page/Page.cpp:
        (WebCore::Page::setPageScaleFactor):

2012-05-09  Hugo Parente Lima  <hugo.lima@openbossa.org>

        Use suitable viewport values on XHTML-MP pages.
        https://bugs.webkit.org/show_bug.cgi?id=85425

        Reviewed by Kenneth Rohde Christiansen.

        Tests: fast/viewport/viewport-legacy-xhtmlmp-misplaced-doctype.html
               fast/viewport/viewport-legacy-xhtmlmp-ordering.html
               fast/viewport/viewport-legacy-xhtmlmp.html

        Use device-width and device-height as viewport size on
        XHTML-MP pages if the use feature LEGACY_VIEWPORT_ADAPTION
        is set according as the non normative section of
        http://www.w3.org/TR/css-device-adapt/

        * dom/Document.cpp:
        (WebCore::Document::setDocType):

2012-05-09  Beth Dakin  <bdakin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=86025
        RTL and vertical text documents do no scroll properly with the new 
        tiled scrolling model
        -and corresponding-
        <rdar://problem/11077589>

        Reviewed by Dan Bernstein.
        
        Most of the fix here is just to teach the scrolling tree about the 
        scroll origin.
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::frameViewLayoutUpdated):
        (WebCore::ScrollingCoordinator::setScrollParameters):
        * page/scrolling/ScrollingCoordinator.h:
        (ScrollParameters):
        * page/scrolling/ScrollingTreeNode.cpp:
        (WebCore::ScrollingTreeNode::update):
        * page/scrolling/ScrollingTreeNode.h:
        (WebCore::ScrollingTreeNode::scrollOrigin):
        (ScrollingTreeNode):
        * page/scrolling/ScrollingTreeState.cpp:
        (WebCore::ScrollingTreeState::setScrollOrigin):
        (WebCore):
        * page/scrolling/ScrollingTreeState.h:
        (WebCore::ScrollingTreeState::scrollOrigin):
        (ScrollingTreeState):
        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
        (WebCore::ScrollingTreeNodeMac::scrollPosition):
        (WebCore::ScrollingTreeNodeMac::setScrollLayerPosition):
        (WebCore::ScrollingTreeNodeMac::minimumScrollPosition):
        (WebCore::ScrollingTreeNodeMac::maximumScrollPosition):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::frameViewDidScroll):

        Teaching the scrolling tree about the scroll origin revealed this pre-
        existing bug. layoutOverflowRect() is not the right rect to use since 
        it is not writing-mode savvy. unscaledDocumentRect() is the right rect 
        for the view's bounds.
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateCompositedBounds):

2012-05-09  Rob Buis  <rwlbuis@webkit.org>

        Cleanup SVGElement.cpp
        https://bugs.webkit.org/show_bug.cgi?id=86004

        Reviewed by Eric Seidel.

        Remove unneeded includes. We do not need to check attr in SVGElement::attributeChanged,
        lower layers assume it is non-null and we do not call attributeChanged in SVG.

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::attributeChanged):
        (WebCore::SVGElement::isAnimatableAttribute):

2012-05-09  Jochen Eisinger  <jochen@chromium.org>

        When creating a new page during a navigation, prime the initial document with the correct referrer policy
        https://bugs.webkit.org/show_bug.cgi?id=86001

        Reviewed by Adam Barth.

        Test: http/tests/security/referrer-policy-redirect-link.html

        * dom/Document.h:
        (WebCore::Document::setReferrerPolicy):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy):

2012-05-09  Alec Flett  <alecflett@chromium.org>

        IndexedDB: call abort handler when there are problems committing
        https://bugs.webkit.org/show_bug.cgi?id=85841

        Reviewed by Ojan Vafai.

        No new tests. Every existing test that calls commit() is testing
        the success side of this, and this only throws when there are
        LevelDB errors, which is exactly what we're trying to diagnose
        with this patch.

        * Modules/indexeddb/IDBBackingStore.h:
        (Transaction):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
        (WebCore::IDBLevelDBBackingStore::Transaction::commit):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (Transaction):
        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
        (WebCore::IDBTransactionBackendImpl::commit):

2012-05-09  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Remove PlatformSupport::loadPlatformImageResource, call loadResource directly
        https://bugs.webkit.org/show_bug.cgi?id=84417

        Reviewed by Adam Barth.

        Part of a refactoring series. See tracking bug 82948.

        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/graphics/chromium/ImageChromium.cpp:
        (WebCore::Image::loadPlatformResource):
        * platform/graphics/chromium/ImageChromiumMac.mm: Removed.

2012-05-09  Rob Buis  <rbuis@rim.com>

        Remove some isSVGFoo methods
        https://bugs.webkit.org/show_bug.cgi?id=86009

        Reviewed by Eric Seidel.

        These are not used at the moment and were probably just copy and pasted from
        isSVGFoo methods in RenderObject.h.

        * rendering/RenderObject.h:
        * rendering/svg/RenderSVGEllipse.h:
        (RenderSVGEllipse):
        * rendering/svg/RenderSVGRect.h:
        (RenderSVGRect):
        * rendering/svg/RenderSVGShape.h:

2012-05-09  Ian Vollick  <vollick@chromium.org>

        [chromium] Add impl-thread support for fill-mode and direction css animation properties
        https://bugs.webkit.org/show_bug.cgi?id=77662

        Reviewed by James Robinson.

        Adds support for accelerating css animations with -webkit-animation-fill-mode,
        and -webkit-animation-direction properties.

        Tested in:
          CCActiveAnimationTest.TrimTimeAlternating
          CCLayerAnimationControllerTest.createReversedAnimation
          CCLayerAnimationControllerTest.createAlternatingAnimation
          CCLayerAnimationControllerTest.createReversedAlternatingAnimation

        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
        (WebCore::CCActiveAnimation::CCActiveAnimation):
        (WebCore::CCActiveAnimation::trimTimeToCurrentIteration):
        (WebCore::CCActiveAnimation::cloneForImplThread):
        * platform/graphics/chromium/cc/CCActiveAnimation.h:
        (CCActiveAnimation):
        (WebCore::CCActiveAnimation::alternatesDirection):
        (WebCore::CCActiveAnimation::setAlternatesDirection):
        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:

2012-05-09  Ken Buchanan  <kenrb@chromium.org>

        Crash from removal of a line break object
        https://bugs.webkit.org/show_bug.cgi?id=85997

        Reviewed by David Hyatt.

        Regression from r115343. That replaced a call to setNeedsLayout()
        with a separate call that used a different bit during linebox
        invalidation after renderer child removal. There are special cases
        where layout isn't marked on parent nodes just from the removal, so
        line dirtying needs to explicitly mark ancestors for layout.

        * rendering/RenderObject.h:
        (WebCore::RenderObject::setAncestorLineBoxDirty):

2012-05-09  Levi Weintraub  <leviw@chromium.org>

        Fix performance regression for floats caused by LayoutUnit change
        https://bugs.webkit.org/show_bug.cgi?id=85834

        Reviewed by Ojan Vafai.

        Refactoring FractionalLayout types to alleviate performance issues. Explicitly
        inlining constructor and operator functions in FractionalLayoutUnit, as well as
        pixelSnappedIntSize and pixelSnappedIntRect (particularly hot code paths). Also
        further simplifying round and ceil functions when sub-pixel layout is not enabled.

        pixelSnappedIntSize was the only function defined in FractionalLayoutSize.cpp,
        so it is removed.

        No new tests. No change in functionality.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/FractionalLayoutUnit.h:
        (WebCore::FractionalLayoutUnit::FractionalLayoutUnit):
        (FractionalLayoutUnit):
        (WebCore::FractionalLayoutUnit::toInt):
        (WebCore::FractionalLayoutUnit::toFloat):
        (WebCore::FractionalLayoutUnit::toDouble):
        (WebCore::FractionalLayoutUnit::toUnsigned):
        (WebCore::FractionalLayoutUnit::operator int):
        (WebCore::FractionalLayoutUnit::operator unsigned):
        (WebCore::FractionalLayoutUnit::operator float):
        (WebCore::FractionalLayoutUnit::operator double):
        (WebCore::FractionalLayoutUnit::operator bool):
        (WebCore::FractionalLayoutUnit::ceil):
        (WebCore::FractionalLayoutUnit::round):
        * platform/graphics/FractionalLayoutRect.cpp:
        (WebCore):
        * platform/graphics/FractionalLayoutRect.h:
        (WebCore::FractionalLayoutRect::pixelSnappedSize):
        (WebCore::pixelSnappedIntRect):
        (WebCore):
        * platform/graphics/FractionalLayoutSize.cpp: Removed.
        * platform/graphics/FractionalLayoutSize.h:
        (WebCore):
        * rendering/LayoutTypes.h:
        (WebCore::pixelSnappedIntSize):
        (WebCore):

2012-05-09  Abhishek Arya  <inferno@chromium.org>

        Crash in ReplaceSelectionCommand::performTrivialReplace
        https://bugs.webkit.org/show_bug.cgi?id=85943

        Reviewed by Ryosuke Niwa.

        RefPtr nodeAfterInsertionPos to guard against mutation events.

        Test: editing/inserting/insert-html-crash.html

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::performTrivialReplace):

2012-05-03  Shawn Singh  <shawnsingh@chromium.org>

        Hit testing is incorrect in some cases with perspective transforms
        https://bugs.webkit.org/show_bug.cgi?id=79136

        Reviewed by Simon Fraser.

        Tests: transforms/3d/hit-testing/coplanar-with-camera.html
               transforms/3d/hit-testing/perspective-clipped.html

        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::TransformationMatrix::projectPoint): Fix a
        divide-by-zero error so that values do not become Inf or Nan. Also
        fix an overflow error by using a large, but not-too-large constant
        to represent infinity.

        (WebCore::TransformationMatrix::projectQuad): Fix an error where
        incorrect quads were being returned. Incorrect quads can occur
        when projectPoint clamped==true after returning.

2012-05-09  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        Simplify CSSParser::parseSimpleLengthValue()
        https://bugs.webkit.org/show_bug.cgi?id=85910

        Reviewed by Alexis Menard.

        Various small improvements to this function, mainly:
        - Move the check if the property ID accepts a simple length as early as possible;
        - Remove the check for the characters{8,16} pointers since they'll be valid (we ASSERT that);
        - Use a template to avoid duplicate code for 8 and 16 bit characters.

        * css/CSSParser.cpp:
        (WebCore):
        (WebCore::parseSimpleLength):
        (WebCore::parseSimpleLengthValue):

2012-05-09  Ami Fischman  <fischman@chromium.org>

        [chromium] Support multiple buffered time ranges
        https://bugs.webkit.org/show_bug.cgi?id=85926

        Reviewed by Eric Carlson.

        Preserve existing rendering of a single rect even in the presence of multiple buffered regions.

        No new tests as this change has no functional effects.

        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaSlider):

2012-05-09  Dana Jansens  <danakj@chromium.org>

        Early-out and avoid any copying when possible for Region operations
        https://bugs.webkit.org/show_bug.cgi?id=85260

        Reviewed by Anders Carlsson.

        For an empty region, any intersection or subtraction will not modify
        the region, so we can simply return instead of creating a new Shape
        and replacing the current empty Shape.

        When a region is united with a region it contains, the orignal
        containing region is the result. So, if A.unite(B) and A.contains(B)
        then A does not need to change at all and we can return without making
        a copy of A's shape. When A is a rect, we can do this test even more
        simply.

        We also remove redundant checks from trySimpleOperation() methods, where
        the test is already done in the Region calling site.

        This change improves the performance of the Region overlap testing for
        composited layers, and allows us to avoid unnecessary copies of the
        Region during unite. With a layout test (attached to bug #81087), that
        creates a Region from the union of 225 composited layers, as well as
        600 overlapping layers above them, this change decreases the running
        time of the test by 3.2% by avoiding a copy of the entire Region for
        each insertion that does not change the resulting Region.

        Unit tests: RegionTest.unite

        * platform/graphics/Region.cpp:
        (WebCore::Region::Shape::UnionOperation::trySimpleOperation):
        (WebCore::Region::Shape::IntersectOperation::trySimpleOperation):
        (WebCore::Region::Shape::SubtractOperation::trySimpleOperation):
        (WebCore::Region::intersect):
        (WebCore::Region::unite):
        (WebCore::Region::subtract):
        * platform/graphics/Region.h:
        (WebCore::Region::isRect):
        (WebCore::Region::Shape::isRect):

2012-05-09  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: SessionDescription::addCandidate should not crash for malformed input
        https://bugs.webkit.org/show_bug.cgi?id=85988

        Reviewed by Adam Barth.

        Sending null would crash the browser. Added safeguards in both the bindings and the native code.

        Test: fast/mediastream/SessionDescription.html

        * Modules/mediastream/SessionDescription.cpp:
        (WebCore::SessionDescription::addCandidate):
        * Modules/mediastream/SessionDescription.h:
        (SessionDescription):
        * Modules/mediastream/SessionDescription.idl:

2012-05-09  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Adding the possibility of port specific information in MediaStreamDescriptor
        https://bugs.webkit.org/show_bug.cgi?id=85794

        Reviewed by Adam Barth.

        To facilitate for ports I have added an ExtraData field that can be used for whatever purpose is needed.

        No behavioral changes.

        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
        (ExtraDataContainer):
        (WebKit::ExtraDataContainer::ExtraDataContainer):
        (WebKit::ExtraDataContainer::extraData):
        (WebKit):
        (WebKit::WebMediaStreamDescriptor::extraData):
        (WebKit::WebMediaStreamDescriptor::setExtraData):
        * platform/mediastream/MediaStreamDescriptor.h:
        (ExtraData):
        (WebCore::MediaStreamDescriptor::ExtraData::~ExtraData):
        (MediaStreamDescriptor):
        (WebCore::MediaStreamDescriptor::extraData):
        (WebCore::MediaStreamDescriptor::setExtraData):

2012-05-09  Takashi Sakamoto  <tasak@google.com>

        Crash in WebCore::RenderBoxModelObject::paddingLeft
        https://bugs.webkit.org/show_bug.cgi?id=83889

        Reviewed by Abhishek Arya.

        RenderScrollbar creates RenderScrollbarPart without any parent
        renderers. However, if the scrollbar has percent padding styles,
        non-null parent renderer is required. So after creating/destroying
        RenderScrollbarPart instances, set owningRenderer(creating)/0
        (destroying) as its parent renderer.

        Test: scrollbars/scrollbar-percent-padding-crash.html
              scrollbars/scrollbar-percent-padding-crash-expected.txt

        * rendering/RenderScrollbar.cpp:
        (WebCore::RenderScrollbar::updateScrollbarPart):
        Added setParent after creating/destroying RenderScrollbarPart.
        * rendering/RenderScrollbarPart.cpp:
        Made RenderScollbar friend, because setParent is protected and
        RenderScrollbar is not inherited from class RenderObject.

2012-05-09  Takashi Sakamoto  <tasak@google.com>

        ShadowRoot needs applyAuthorStyles
        https://bugs.webkit.org/show_bug.cgi?id=78472

        Reviewed by Hajime Morita.

        Implemented applyAuthorStyles attribute defined in the following spec:
        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#shadow-root-attributes
        Since applyAuthorSheets attribute has been already implemented,
        renamed all applyAuthorSheets to applyAuthorStyles and
        added applyAuthorStyles to ShadowRoot.idl.
        Currently, changing dynamically applyAuthorStyles doesn't work. I will fix this isse in bugs:84215: https://bugs.webkit.org/show_bug.cgi?id=84251

        Test: fast/dom/shadow/shadow-root-applyAuthorStyles.html
              fast/dom/shadow/shadow-root-applyAuthorStyles-expected.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::ShadowRoot):
        (WebCore::ShadowRoot::applyAuthorStyles):
        (WebCore::ShadowRoot::setApplyAuthorStyles):
        * dom/ShadowRoot.h:
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::applyAuthorStyles):
        * dom/TreeScope.h:
        (TreeScope):
        Changed all applyAuthorSheets to applyAuthorSytles.
        (ShadowRoot):
        * dom/ShadowRoot.idl:
        Added a new attribute, boolean applyAuthorStyles.

2012-05-09  Yoshifumi Inoue  <yosin@chromium.org>

        [Chromium][Forms] HTMLOptionsCollection doesn't have indexed properties on property enumeration
        https://bugs.webkit.org/show_bug.cgi?id=85937

        Reviewed by Kentaro Hara.

        This patch adds numeric indices to properties in enumeration to HTMLOptionsCollection V8 binding
        to changes Objects.keys in ECMAScript5 and for-in statement behavior for compatibility with
        Firefox 12, IE9, Opera 11, and Safari 5.

        Test: fast/forms/select/options-indexed-properties.html

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementationIndexer): Set $hasEnumerator true for interface HTMLOptionsCollection

2012-05-09  Shinya Kawanaka  <shinyak@chromium.org>

        Position should be able to have ShadowRoot as a container.
        https://bugs.webkit.org/show_bug.cgi?id=82021

        Reviewed by Ryosuke Niwa.

        Since Position could not take a shadow root as a container node, pointing the direct children
        of a shadow root was difficult.

        This patch makes it enabled, and fixes a lot of crashes caused by that limitation.
        Also, we confirm that ShadowRoot is not exposed to JavaScript layer.

        Currently this change is only enabled if shadow dom flag is enabled, since we cannot
        prove this change does not destroy the existing behavior. However, this change is really required
        to fix other editing bugs in Shadow DOM. A bunch of patches and tests will be added to
        fix other editing bugs and they will check this patch does not break editing.
        We will also add a fuzzer to check the stability of editing in Shadow DOM later, and it will
        also help to confirm the patch will not break the editing.

        Tests: editing/shadow/doubleclick-on-meter-in-shadow-crash.html
               editing/shadow/rightclick-on-meter-in-shadow-crash.html
               editing/shadow/shadow-selection-not-exported.html

        * dom/Position.cpp:
        (WebCore::Position::Position):
        (WebCore::Position::containerNode):
        (WebCore::Position::parentAnchoredEquivalent):
        (WebCore::Position::previous):
        (WebCore::Position::next):
        (WebCore::Position::atStartOfTree):
        (WebCore::Position::atEndOfTree):
        (WebCore::Position::findParent):
        * dom/Position.h:
        (WebCore):
        (WebCore::positionInParentBeforeNode):
        (WebCore::positionInParentAfterNode):

2012-05-09  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Build fix when using libpng version != 1.2
        https://bugs.webkit.org/show_bug.cgi?id=85614

        Reviewed by Eric Seidel.

        Don't enforce the version of libpng when passing the option to the linker.

        No new tests, no intended functionality change.

        * WebCore.pri:

2012-05-09  Oli Lan  <olilan@chromium.org>

        Add identifying methods for date/time input types.

        This patch adds methods isDateField(), isDateTimeField(), isDateTimeLocalField(),
        isMonthField(), isTimeField() and isWeekField() to InputType and the appropriate
        HTMLInputElement classes, to allow date/time input types to be identified.

        The new methods match the existing methods for types such as email, search and number.

        https://bugs.webkit.org/show_bug.cgi?id=78746

        Reviewed by Kent Tamura.

        A new test WebViewTest.TextInputType has been added in WebKit/chromium/tests that calls
        through to these methods via WebViewImpl.textInputType().

        * html/DateInputType.cpp:
        (WebCore::DateInputType::isDateField):
        (WebCore):
        * html/DateInputType.h:
        (DateInputType):
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::isDateTimeField):
        (WebCore):
        * html/DateTimeInputType.h:
        (DateTimeInputType):
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::isDateTimeLocalField):
        (WebCore):
        * html/DateTimeLocalInputType.h:
        (DateTimeLocalInputType):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isDateField):
        (WebCore):
        (WebCore::HTMLInputElement::isDateTimeField):
        (WebCore::HTMLInputElement::isDateTimeLocalField):
        (WebCore::HTMLInputElement::isMonthField):
        (WebCore::HTMLInputElement::isTimeField):
        (WebCore::HTMLInputElement::isWeekField):
        * html/HTMLInputElement.h:
        (HTMLInputElement):
        * html/InputType.cpp:
        (WebCore::InputType::isDateField):
        (WebCore):
        (WebCore::InputType::isDateTimeField):
        (WebCore::InputType::isDateTimeLocalField):
        (WebCore::InputType::isMonthField):
        (WebCore::InputType::isTimeField):
        (WebCore::InputType::isWeekField):
        * html/InputType.h:
        (InputType):
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::isMonthField):
        (WebCore):
        * html/MonthInputType.h:
        (MonthInputType):
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::isTimeField):
        (WebCore):
        * html/TimeInputType.h:
        (TimeInputType):
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::isWeekField):
        (WebCore):
        * html/WeekInputType.h:
        (WeekInputType):

2012-05-09  Nikolas Zimmermann  <nzimmermann@rim.com>

        REGRESSION(r105057): Infinite loop inside SVGTextLayoutEngine::currentLogicalCharacterMetrics
        https://bugs.webkit.org/show_bug.cgi?id=83405

        Reviewed by Darin Adler.

        Dynamically adding tspans carrying position information in the x/y/dx/dy/rotate lists is broken.
        To avoid mistakes like this in future, simplify the calling code in RenderSVGInlineText and centralize
        the managment of all caches (text positioning element cache / metrics map / layout attributes) in
        RenderSVGText. This avoids the hack in SVGRootInlineBox::computePerCharacterLayoutInformation() which
        called textRoot->rebuildLayoutAttributes(), which was used to fix previous security issues with this code.
        Instead correctly handle destruction of RenderSVGInlineText in RenderSVGText, keeping the m_layoutAttributes
        synchronized with the current state of the render tree. Fixes highcharts problems.

        Tests: svg/text/add-tspan-position-bug.html
               svg/text/modify-tspan-position-bug.html

        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::addChild):
        * rendering/svg/RenderSVGInlineText.cpp:
        (WebCore::RenderSVGInlineText::willBeDestroyed):
        (WebCore::RenderSVGInlineText::setTextInternal):
        (WebCore::RenderSVGInlineText::styleDidChange):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::recursiveUpdateMetrics):
        (WebCore::RenderSVGText::subtreeChildAdded):
        (WebCore::RenderSVGText::subtreeChildWillBeDestroyed):
        (WebCore::recursiveCollectLayoutAttributes):
        (WebCore::checkLayoutAttributesConsistency):
        (WebCore::RenderSVGText::subtreeChildWasDestroyed):
        (WebCore::RenderSVGText::subtreeStyleChanged):
        (WebCore::RenderSVGText::subtreeTextChanged):
        (WebCore::RenderSVGText::layout):
        (WebCore::RenderSVGText::addChild):
        (WebCore::RenderSVGText::rebuildAllLayoutAttributes):
        (WebCore::RenderSVGText::rebuildLayoutAttributes):
        * rendering/svg/RenderSVGText.h:
        (WebCore::RenderSVGText::layoutAttributes):
        * rendering/svg/SVGRootInlineBox.cpp:
        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributes):

2012-05-08  Dongwoo Im  <dw.im@samsung.com>

        NavigatorRegisterProtocolHandler can call ChromeClient directly.
        https://bugs.webkit.org/show_bug.cgi?id=85944

        Reviewed by Adam Barth.

        Covered by fast/dom/register-protocol-handler.html

        * page/Chrome.cpp: Remove registerProtocolHandler function.
        * page/Chrome.h: Remove registerProtocolHandler prototype.
        (Chrome):
        * page/NavigatorRegisterProtocolHandler.cpp: Call ChromeClient::registerProtocolHandler directly.
        (WebCore::NavigatorRegisterProtocolHandler::registerProtocolHandler):

2012-05-08  Mario Sanchez Prada  <msanchez@igalia.com>

        Coding style issues present in RenderFrameSet.cpp
        https://bugs.webkit.org/show_bug.cgi?id=85955

        Reviewed by Eric Seidel.

        Just fixed those coding style issues.

        * rendering/RenderFrameSet.cpp:
        (WebCore::RenderFrameSet::GridAxis::resize):
        (WebCore::RenderFrameSet::layOutAxis):
        (WebCore::RenderFrameSet::continueResizing):

2012-05-08  Jon Lee  <jonlee@apple.com>

        Unreviewed build fix.

        * platform/mac/WebCoreSystemInterface.h:

2012-05-08  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] Auth credentials set in private mode are reused in public mode.
        https://bugs.webkit.org/show_bug.cgi?id=84697

        Reviewed by Rob Buis.

        Add setPrivateMode function for CredentialStorage.

        Now, we only save credentials in memory and CredentialBackingStore isn't enabled.
        When we set private mode from on to off, we clear all these temporary credentials.

        We have to change Private Browsing to test, so have to write a manual test case.
        Test: ManualTests/blackberry/http-auth-private-mode-changed.html

        * network/CredentialStorage.cpp:
        (WebCore::CredentialStorage::setPrivateMode):
        (WebCore):
        * platform/network/CredentialStorage.h:
        (CredentialStorage):

2012-05-08  Rakesh KN  <rakesh.kn@motorola.com>

        RadioNodeList support in HTMLFormElement::elements
        https://bugs.webkit.org/show_bug.cgi?id=81854

        Reviewed by Ryosuke Niwa.

        Implement RadioNodeList support spec'ed at
        http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#radionodelist

        Test: fast/forms/form-collection-radio-node-list.html

        * CMakeLists.txt:
        Added entries for new files.
        * DerivedSources.cpp: Ditto.
        * DerivedSources.make: Ditto.
        * DerivedSources.pri: Ditto.
        * GNUmakefile.list.am: Ditto.
        * Target.pri: Ditto.
        * WebCore.gypi: Ditto.
        * WebCore.vcproj/WebCore.vcproj: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSHTMLCollectionCustom.cpp:
        (WebCore::getNamedItems):
        Modified to create RadioNodeList object when FormControlCollection has more than
        one element of same name/id.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        Added code to include Node.h and JSNode.h in JSRadioNodeElement.cpp.
        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
        (WebCore::getNamedItems):
        Modified to create RadioNodeList object when FormControlCollection has more than
        one element of same name/id.
        * dom/Node.cpp:
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
        Invalidate lists even for change in id, type, checked attributes.
        (WebCore::NodeListsNodeData::invalidateCachesThatDependOnAttributes):
        Invalidate radioNodeList cache.
        (WebCore::NodeListsNodeData::isEmpty):
        Changes for radioNodeList.
        (WebCore::Node::radioNodeList):
        Creates if needed a RadioNodeList and adds it to the cache.
        (WebCore::Node::removeCachedRadioNodeList):
        Removes a cached radioNodeList.
        * dom/Node.h: Ditto
        * dom/NodeRareData.h:
        (WebCore):
        (NodeListsNodeData):
        Added radioNodeList list.
        * html/CollectionType.h:
        Added new FormControls type.
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::shouldIncludeChildren):
        (WebCore::HTMLCollection::isAcceptableElement):
        Handle FormControls collection type.
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        Contruct collection of FormControls type.
        * html/RadioNodeList.cpp: Added.
        (WebCore):
        (WebCore::RadioNodeList::RadioNodeList):
        (WebCore::RadioNodeList::~RadioNodeList):
        (WebCore::toRadioButtonInputElement):
        (WebCore::RadioNodeList::value):
        (WebCore::RadioNodeList::setValue):
        (WebCore::RadioNodeList::nodeMatches):
        * html/RadioNodeList.h: Added.
        (WebCore):
        (RadioNodeList):
        (WebCore::RadioNodeList::create):
        RadioNodeList implementation.
        * html/RadioNodeList.idl: Added.
        Idl for generating RadioNodeList JS/V8 bindings.

2012-05-08  Benjamin Poulain  <bpoulain@apple.com>

        [JSC] Regression: addEventListener() and removeEventListener() raise an exception on missing args
        https://bugs.webkit.org/show_bug.cgi?id=85928

        Reviewed by Geoffrey Garen.

        The functions addEventListener() and removeEventListener() raise an exception if there are missin arguments.
        This behavior breaks existing content.

        This patch change the code generator of JavaScript core to have an exception for addEventListener() and removeEventListener().
        For those function, we do not raise an exception on missin argument.

        This patch does not modify the V8 code generator because such exceptions are already in place there.

        Tests: fast/dom/Window/window-legacy-event-listener.html
               fast/dom/XMLHttpRequest-legacy-event-listener.html
               fast/dom/node-legacy-event-listener.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-05-08  Chris Rogers  <crogers@google.com>

        AudioParam should directly be given context in create() method
        https://bugs.webkit.org/show_bug.cgi?id=85905

        Reviewed by James Robinson.

        No new tests.  This is a low-level re-factoring and is covered by existing tests.

        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
        * Modules/webaudio/AudioGain.h:
        (WebCore::AudioGain::create):
        (WebCore::AudioGain::AudioGain):
        * Modules/webaudio/AudioGainNode.cpp:
        (WebCore::AudioGainNode::AudioGainNode):
        * Modules/webaudio/AudioPannerNode.cpp:
        (WebCore::AudioPannerNode::AudioPannerNode):
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::create):
        (AudioParam):
        (WebCore::AudioParam::AudioParam):
        * Modules/webaudio/BiquadFilterNode.cpp:
        (WebCore::BiquadFilterNode::BiquadFilterNode):
        * Modules/webaudio/BiquadProcessor.cpp:
        (WebCore::BiquadProcessor::BiquadProcessor):
        * Modules/webaudio/BiquadProcessor.h:
        * Modules/webaudio/DelayNode.cpp:
        (WebCore::DelayNode::DelayNode):
        * Modules/webaudio/DelayProcessor.cpp:
        (WebCore::DelayProcessor::DelayProcessor):
        * Modules/webaudio/DelayProcessor.h:
        (DelayProcessor):
        * Modules/webaudio/DynamicsCompressorNode.cpp:
        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
        * Modules/webaudio/Oscillator.cpp:
        (WebCore::Oscillator::Oscillator):

2012-05-08  Dana Jansens  <danakj@chromium.org>

        [chromium] Show borders for partial-draw-culled quads to visualize culling behaviour
        https://bugs.webkit.org/show_bug.cgi?id=85414

        Reviewed by Adrienne Walker.

        The borders are brown, and are only shown when the quad's visible rect
        is non-empty and is different from the quad's original rect.

        Adds a flag to CCQuadCuller constructor, to enable showing debug borders
        around what it leaves after culling (when it culls anything in a quad
        at all).

        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore::CCDrawQuad::isDebugQuad):
        (WebCore::CCDrawQuad::sharedQuadState):
        (CCDrawQuad):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        (WebCore):
        (WebCore::CCQuadCuller::CCQuadCuller):
        (WebCore::appendQuadInternal):
        (WebCore::CCQuadCuller::append):
        (WebCore::CCQuadCuller::appendSurface):
        (WebCore::CCQuadCuller::appendReplica):
        * platform/graphics/chromium/cc/CCQuadCuller.h:
        (CCQuadCuller):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsForLayer):
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):

2012-05-08  Julien Chaffraix  <jchaffraix@webkit.org>

        Move RenderLayers z-index lists dirtying to post style change
        https://bugs.webkit.org/show_bug.cgi?id=85437

        Reviewed by Darin Adler.

        No expected change in behavior.

        This change moves the z-order lists to RenderLayer::styleChanged. As part of this
        change, also added proper handling of stacking context transition. This enabled
        us to tighten more of the dirtyZOrderLists / clearZOrderLists code.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::styleWillChange):
        Removed this code, moved to updateStackingContextsAfterStyleChange.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        Only stacking contexts start with dirty z-order lists.

        (WebCore::RenderLayer::dirtyZOrderLists):
        Added an ASSERT.

        (WebCore::RenderLayer::updateStackingContextsAfterStyleChange):
        Refactored the code to handle the transition between stacking context status.

        (WebCore::RenderLayer::styleChanged):
        Added a call to updateStackingContextsAfterStyleChange.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::isStackingContext):
        Added a call to the next function.

        (WebCore::RenderLayer::layerWithStyleIsStackingContext):
        Factored the isStackingContext logic here so that we can reuse it inside
        updateStackingContextsAfterStyleChange.

        (WebCore::RenderLayer::clearZOrderLists):
        Added an ASSERT.

2012-05-08  Abhishek Arya  <inferno@chromium.org>

        Crash due to owning renderer not removed from custom scrollbar.
        https://bugs.webkit.org/show_bug.cgi?id=80610

        Reviewed by Eric Seidel.

        Test: scrollbars/scrollbar-owning-renderer-crash.html

        Changed RenderScrollbar to keep pointer to owning node, instead of the
        renderer. Renderer can get destroyed without informing the scrollbar, causing
        crashes later. Remove code from r94107 since it is not needed anymore and saves
        times when RenderBox is getting destroyed.

        * page/FrameView.cpp:
        (WebCore::FrameView::createScrollbar): pass renderer's node.
        * page/FrameView.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::willBeDestroyed): no longer need this. came originally from r94107.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::createScrollbar): pass renderer's node.
        (WebCore::RenderLayer::destroyScrollbar): no longer need to clear owning renderer.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::createScrollbar): pass renderer's node.
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::createScrollbar): pass renderer's node.
        * rendering/RenderScrollbar.cpp:
        (WebCore::RenderScrollbar::createCustomScrollbar): Store owner node instead of renderer.
        (WebCore::RenderScrollbar::RenderScrollbar): Store owner node instead of renderer.
        (WebCore::RenderScrollbar::owningRenderer): calculate owning renderer from owner node.
        * rendering/RenderScrollbar.h:
        (RenderScrollbar):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::createScrollbar): pass renderer's node.

2012-05-08  Jon Lee  <jonlee@apple.com>

        Safari warns that it needs to resend the form in an iFrame when going back
        https://bugs.webkit.org/show_bug.cgi?id=82658
        <rdar://problem/11292558>

        Reviewed by Darin Adler.

        Test: http/tests/loading/post-in-iframe-with-back-navigation.html

        * WebCore.exp.in: Add _wkCFURLRequestAllowAllPostCaching.
        * platform/mac/WebCoreSystemInterface.h: Add wkCFURLRequestAllowAllPostCaching.
        * platform/mac/WebCoreSystemInterface.mm: Add wkCFURLRequestAllowAllPostCaching.
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doUpdatePlatformRequest): Set the bit to cache all POST responses.
        * platform/network/mac/ResourceRequestMac.mm:
        (WebCore::ResourceRequest::doUpdatePlatformRequest): Set the bit to cache all POST responses.

2012-05-08  Dana Jansens  <danakj@chromium.org>

        [chromium] Reflections with masks should not occlude
        https://bugs.webkit.org/show_bug.cgi?id=85927

        Reviewed by James Robinson.

        When a surface does not have a mask, we make both it and its reflection
        occlude the things below them. However, if the reflection has a mask
        applied to it, then we should not consider it as occluding.

        Adds replicaHasMask() to the render surface classes so we can test if
        the mask is present.

        Unit Tests: CCOcclusionTrackerTestReplicaWithMask

        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
        (WebCore::RenderSurfaceChromium::hasMask):
        This is unusued right now, but will allow us to remove a FIXME from
        CCOcclusionTracker::finishedTargetRenderSurface().
        (WebCore):
        (WebCore::RenderSurfaceChromium::replicaHasMask):
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (RenderSurfaceChromium):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::leaveToTargetRenderSurface):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::hasMask):
        This is unusued right now, but will allow us to remove a FIXME from
        CCOcclusionTracker::finishedTargetRenderSurface().
        (WebCore):
        (WebCore::CCRenderSurface::replicaHasMask):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-05-08  Eric Seidel  <eric@webkit.org>

        Add stylesheet inheritance support to IFRAME_SEAMLESS
        https://bugs.webkit.org/show_bug.cgi?id=85914

        Reviewed by Ojan Vafai.

        This work is already guarded by IFRAME_SEAMLESS, as
        Document::shouldDisplaySeamlesslyWithParent always returns false
        when IFRAME_SEAMLESS is off.

        This makes the child document use all author stylesheets from all parent documents,
        per the seamless spec:
        http://www.whatwg.org/specs/web-apps/current-work/#attr-iframe-seamless

        This support is slightly inefficient as every time a sheet is added
        to a parent document, the child document must do a full style selector recalc.
        Normally author sheet additions have a fast-path which avoids the full selector recalc,
        but such is not possible in the seamless case as we're inserting the parents sheets
        earlier in the child's cascade (instead of just appending them to the end of the list).

        The test covers both the static inheritance as well as addition of a stylesheet
        to the parent and testing that it caused a recalc of the child.

        Covered by fast/frames/seamless/seamless-css-cascade.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::StyleResolver::addStylesheetsFromSeamlessParents):
        (WebCore):
        * css/StyleResolver.h:
        (StyleResolver):
        * dom/Document.cpp:
        (WebCore::Document::seamlessParentUpdatedStylesheets):
        (WebCore):
        (WebCore::Document::notifySeamlessChildDocumentsOfStylesheetUpdate):
        (WebCore::Document::updateActiveStylesheets):
        * dom/Document.h:
        (Document):

2012-05-08  Raphael Kubo da Costa  <rakuco@webkit.org>

        [CMake] FindGStreamer: Fix the build with static WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=85930

        Reviewed by Daniel Bates.

        No new tests, build fix.

        Building WebCore statically was failing because files in
        WebCore/platform/gstreamer when ENABLE_VIDEO was set required
        gstreamer-base, which was not being linked to after r116453.

        Fix that by looking for gstreamer-base, requiring and linking
        against it if GStreamer is used.

        * PlatformEfl.cmake: Link to GSTREAMER_LIBRARIES and
        GSTREAMER_BASE_LIBRARIES, and include GSTREAMER_INCLUDE_DIRS and
        GSTREAMER_BASE_INCLUDE_DIRS.

2012-05-08  Raymond Toy  <rtoy@google.com>

        JavaScriptAudioNode should not ASSERT if number of input channels is 0
        https://bugs.webkit.org/show_bug.cgi?id=85818

        Reviewed by Eric Seidel.

        Test: webaudio/javascriptaudionode-zero-input-channels.html

        * Modules/webaudio/JavaScriptAudioNode.cpp:
        (WebCore::JavaScriptAudioNode::process): Update buffersAreGood.
        (WebCore::JavaScriptAudioNode::fireProcessEvent): Remove ASSERT.

2012-05-08  Dana Jansens  <danakj@chromium.org>

        Region reads past end of spans
        https://bugs.webkit.org/show_bug.cgi?id=85909

        Reviewed by Anders Carlsson.

        Region currently checks aSpan == aSpanEnd as the indicator that
        we passed all the spans. When aSpan < aSpanEnd, it uses aSpan+1
        to find the height of the span.

        If aSpan == aSpanEnd - 1, then aSpan+1 == aSpanEnd. This does not
        represent a valid span, since aSpanEnd is past the end of the
        array, not the last element in the array. The loop should terminate
        in this case.

        Checking aSegment != aSegmentEnd is acceptable in the inner loop since
        it increments by two each time (segments come in pairs, while spans
        come in singles).

        Test: RegionTest.ReadPastFullSpanVectorInIntersectsTest

        * platform/graphics/Region.cpp:
        (WebCore::Region::Shape::compareShapes):

2012-05-08  Philip Rogers  <pdr@google.com>

        Prevent crash in animated lists
        https://bugs.webkit.org/show_bug.cgi?id=85382

        Reviewed by Nikolas Zimmermann.

        Animated lists blindly assign the last list value to m_toAtEndOfDurationType
        in SVGAnimationElement::startedActiveInterval. If the last list value's length
        is larger or smaller than the animated "to" length, we crash.

        This change prevents accessing values off the end of toAtEndOfDuration by adding
        a check for this case. It may seem inefficient to perform this check on every
        animation update but the "to" value can change (in cardinality) while animating.

        I checked each of the other animation types (e.g., SVGAnimatedAngle,
        SVGAnimatedBoolean, etc.) and was only able to hit this style of crash
        in the three types modified in this change:
        SVGAnimatedLengthList, SVGAnimatedNumberList, and SVGAnimatedPointList.

        Tests: svg/animations/animate-linear-discrete-additive-b-expected.svg
               svg/animations/animate-linear-discrete-additive-b.svg
               svg/animations/animate-linear-discrete-additive-c-expected.svg
               svg/animations/animate-linear-discrete-additive-c.svg
               svg/animations/animate-linear-discrete-additive-expected.svg
               svg/animations/animate-linear-discrete-additive.svg
               svg/animations/animate-list-crash.svg

        * svg/SVGAnimatedLengthList.cpp:
        (WebCore::SVGAnimatedLengthListAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedNumberList.cpp:
        (WebCore::SVGAnimatedNumberListAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedPointList.cpp:
        (WebCore::SVGAnimatedPointListAnimator::calculateAnimatedValue):

2012-05-08  Rafael Weinstein  <rafaelw@chromium.org>

        HTMLElementStack::hasOnlyHTMLElementsInScope is no longer called
        https://bugs.webkit.org/show_bug.cgi?id=85908

        Reviewed by Eric Seidel.

        This patch just removes the dead code.

        No tests needed. Cleanup only.

        * html/parser/HTMLElementStack.cpp:
        * html/parser/HTMLElementStack.h:
        (HTMLElementStack):

2012-05-08  W. James MacLean  <wjmaclean@chromium.org>

        [chromium] Create LinkHighlightLayerChromium class to provide link-highlight preview animations for GraphicsLayerChromium.
        https://bugs.webkit.org/show_bug.cgi?id=85084

        Reviewed by James Robinson.

        Unit test provided.

        Creates a layer delegate class to provide link highlight animations for link-preview feature.
        These are added to a GraphicsLayerChromium via provided methods. Moves dispensing of animation
        ids into a separate class.

        * WebCore.gypi:
        * platform/graphics/chromium/AnimationIdVendor.cpp: Added.
        (WebCore):
        (WebCore::AnimationIdVendor::getNextAnimationId):
        (WebCore::AnimationIdVendor::getNextGroupId):
        * platform/graphics/chromium/AnimationIdVendor.h: Added.
        (WebCore):
        (AnimationIdVendor):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::willBeDestroyed):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::addLinkHighlight):
        (WebCore):
        (WebCore::GraphicsLayerChromium::didFinishLinkHighlight):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::mapAnimationNameToId):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore):
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LinkHighlight.cpp: Added.
        (WebCore):
        (WebCore::LinkHighlight::create):
        (WebCore::LinkHighlight::LinkHighlight):
        (WebCore::LinkHighlight::~LinkHighlight):
        (WebCore::LinkHighlight::contentLayer):
        (WebCore::LinkHighlight::paintContents):
        (WebCore::LinkHighlight::notifyAnimationStarted):
        (WebCore::LinkHighlight::notifyAnimationFinished):
        * platform/graphics/chromium/LinkHighlight.h: Added.
        (WebCore):
        (LinkHighlight):

2012-05-08  Raphael Kubo da Costa  <rakuco@webkit.org>

        [CMake] Rewrite FindGStreamer.cmake.
        https://bugs.webkit.org/show_bug.cgi?id=85857

        Reviewed by Daniel Bates.

        No new tests, build system change.

        We are currently kind of duplicating the same
        FindGStreamer-Foo.cmake file whenever a new GStreamer plugin needs
        to be found. Besides this approach not scaling very well, it
        relies on pkg-config for version checking, uses the LibFindMacros
        package that we should deprecate and all the find files could be
        merged into one, with users using the COMPONENTS feature of the
        FIND_PACKAGE() call to find the desired plugins.

        FindGStreamer.cmake has then been rewritten to take all that into
        account:
        - The LibFindMacros.cmake package is not used anymore.
        - Version check is performed in the CMake file itself by parsing
        the gstversion.h header.
        - All GStreamer plugins are searched and the COMPONENTS keyword
        used in the FIND_PACKAGE() call is used to check which plugins are
        required.
        - The plugins-base and base GStreamer plugins are not searched, as
        they were not used anywhere in the build system.

        * PlatformEfl.cmake: Update GStreamer-related variable names.

2012-05-08  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>

        [EFL] Handling of numeric-pad keys in EFL's PlatformKeyboardEvent
        https://bugs.webkit.org/show_bug.cgi?id=85479

        Reviewed by Gustavo Noronha Silva.

        EFL's PlatformKeyboardEvent::isKeypad() now returns meaningful value.
        Added numeric-pad keys to the Key Map and Windows Key Map.

        No new tests.

        * platform/efl/EflKeyboardUtilities.cpp:
        (WebCore::createKeyMap):
        (WebCore::createWindowsKeyMap):
        * platform/efl/PlatformKeyboardEventEfl.cpp:
        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):

2012-05-04  Nikolas Zimmermann  <nzimmermann@rim.com>

        Tie lifetime of SVGAnimateElement::m_animatedType to the duration of the animation
        https://bugs.webkit.org/show_bug.cgi?id=85627

        Reviewed by Antti Koivisto.

        Example:
        <rect width="10" height="100">
            <animate attributeName="width" from="10" to="100" begin="2s" dur="4s" fill="remove"/>
        </rect>

        At t=0s the <animate> element receives its first interval: begin=2s, end=6s.
        At this point we've created the 'OwnPtr<SVGAnimatedType> m_animatedType' in
        SVGAnimateElement, which holds the current animated value of the target type.
        In this example it contains a SVGLength with '10' as value at t=0s.

        Calling "rect.width.animVal.value" will return the value currently contained in the
        m_animatedType from the SVGAnimateElement, even though the animation didn't begin
        yet. This is fine, as the animVal equals to the baseVal, as long as no animation is
        running.

        At t=6s you'd expect that the whole 'animVal' object is destructed again, as it's no
        longer needed, as animVal will be equal to baseVal again, but the current code keeps
        the animVal alive, and just resets it to the baseVal. The animVals will be destructed
        once the animate element leaves the tree.

        CSS animations suffer from the same problem, we never remove the animated SMIL properties
        but we only reset them to the base value. This makes integration with CSS Animations and
        CSS Transitions harder, so this needs to be changed.

        This patch starts tracking the start/end of an animation chain properly, to destruct
        the animation effect for non-frozen animations at the end of their duration. This has to
        work properly together with seeking (SVGSVGElement.setCurrentTime), as our testing relies
        on the ability to drive the SMIL timeline from script.

        Tests: svg/animations/list-wrapper-assertion-expected.svg
               svg/animations/list-wrapper-assertion.svg

        * svg/SVGAnimateElement.cpp:
        (WebCore::SVGAnimateElement::resetAnimatedType):
        (WebCore::applyCSSPropertyToTarget):
        (WebCore::removeCSSPropertyFromTarget):
        (WebCore::applyCSSPropertyToTargetAndInstances):
        (WebCore::removeCSSPropertyFromTargetAndInstances):
        (WebCore::notifyTargetAboutAnimValChange):
        (WebCore::notifyTargetAndInstancesAboutAnimValChange):
        (WebCore::SVGAnimateElement::clearAnimatedType):
        (WebCore::SVGAnimateElement::applyResultsToTarget):
        (WebCore::SVGAnimateElement::targetElementWillChange):
        * svg/SVGAnimateElement.h:
        (SVGAnimateElement):
        * svg/SVGAnimateMotionElement.cpp:
        (WebCore::SVGAnimateMotionElement::resetAnimatedType):
        (WebCore::SVGAnimateMotionElement::clearAnimatedType):
        * svg/SVGAnimateMotionElement.h:
        (SVGAnimateMotionElement):
        * svg/SVGAnimationElement.cpp:
        * svg/SVGAnimationElement.h:
        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::updateAnimations):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::reset):
        (WebCore::SVGSMILElement::targetElementWillChange):
        (WebCore::SVGSMILElement::determineActiveState):
        (WebCore::SVGSMILElement::progress):
        * svg/animation/SVGSMILElement.h:
        (SVGSMILElement):
        * svg/properties/SVGAnimatedListPropertyTearOff.h:
            Remove svgAttributeChanged() calls from animationEnded/animValDidChange.
            Callers are now required to notify the target about changes. There are cases
            where we want to call animValDidChange without invoking svgAttributeChanged().
            That is supported now.
        (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
        * svg/properties/SVGAnimatedProperty.h: Ditto.
        (WebCore::SVGAnimatedProperty::commitChange): Add safety guard.
        * svg/properties/SVGAnimatedPropertyTearOff.h: Ditto.
        (WebCore::SVGAnimatedPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedPropertyTearOff::animValDidChange):
        * svg/properties/SVGAnimatedStaticPropertyTearOff.h: Ditto.
        (WebCore::SVGAnimatedStaticPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedStaticPropertyTearOff::animValDidChange):

2012-05-08  Ryuan Choi  <ryuan.choi@samsung.com>

        [EFL][DRT]Do not create ScrollbarEfl when mockScrollbar is enabled.
        https://bugs.webkit.org/show_bug.cgi?id=81315

        Reviewed by Chang Shu.

        ScrollbarEfl creates custom scrollbars as separated layer and they are
        not related to ScrollbarTheme.
        So, DRT/Efl creates custom scrollbars on webview which paints mockScrollbar.

        This patch prevents creating custom scrollbars when mockScrollbar is enabled.

        Because DRT/Efl only renders the webview now, expected results are same
        until Bug 79853 is landed.

        * platform/efl/ScrollbarEfl.cpp:
        (Scrollbar::createNativeScrollbar):

2012-05-08  Timothy Hatcher  <timothy@apple.com>

        Fix the SOFT_LINK_STAGED_FRAMEWORK_OPTIONAL macro so it passes the full path to dlopen.

        dyld only considers libraries in the versioned framework path if their install name
        matches the library that it is attempting to load. The path we were passing to
        dlopen lacked the Versions/A component of the path so dyld did not recognize that
        we wanted it to use the staged version if it is newer.

        <rdar://problem/11406517>

        Reviewed by Mark Rowe.

        * platform/mac/SoftLinking.h: Have SOFT_LINK_STAGED_FRAMEWORK_OPTIONAL take the
        framework version as an argument and use it when constructing the path to dlopen.

2012-05-08  Rafael Brandao  <rafael.lobo@openbossa.org>

        Build fix for Qt Snowleopard Release
        https://bugs.webkit.org/show_bug.cgi?id=85895

        Reviewed by Alexis Menard.

        The enum value JSUint8ClampedArray conflicted with the JSUint8ClampedArray class.
        I've added the 'Type' suffix to the enum value to make their names different.

        No new tests needed.

        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::valueRealType):
        (JSC::Bindings::convertValueToQVariant):

2012-05-08  Shezan Baig  <shezbaig.wk@gmail.com>

        offsetLeft broken within CSS3 columns
        https://bugs.webkit.org/show_bug.cgi?id=34875

        Reviewed by Julien Chaffraix.

        Reimplement offsetLeft and offsetTop in terms of a new method called
        'offsetTopLeft'. The new method starts from a reference point (the
        top-left coordinate of a box or inline) and adjusts this reference
        point for columns as we traverse each parent. Note that the reference
        point needs to be adjusted in both dimensions, even though offsetLeft
        and offsetTop return only one of them.

        A new method called 'offsetForColumns' was added to RenderObject. This
        method is similar to adjustForColumns, except that it returns the
        offset instead of modifying a reference. This method is necessary to
        simplify the implementation of offsetTopLeft.

        Tests: fast/block/positioning/offsetLeft-offsetTop-multicolumn-expected.txt
               fast/block/positioning/offsetLeft-offsetTop-multicolumn.html

        * rendering/RenderBox.h:
        (RenderBox):
        Override offsetLeft and offsetTop.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::offsetLeft):
        Implemented in terms of RenderBoxModelObject::offsetTopLeft, using
        topLeftLocation as startPoint.
        (WebCore::RenderBox::offsetTop):
        Implemented in terms of RenderBoxModelObject::offsetTopLeft, using
        topLeftLocation as startPoint.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::offsetTopLeft):
        New method to compute offsetLeft and offsetTop simultaneously, and
        adjusting for columns at each parent.
        (WebCore::RenderBoxModelObject::offsetLeft):
        Reimplemented in terms of offsetTopLeft.
        (WebCore::RenderBoxModelObject::offsetTop):
        Reimplemented in terms of offsetTopLeft.
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):
        Declare new offsetTopLeft method.
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetLeft):
        Reimplemented in terms of RenderBoxModelObject::offsetTopLeft.
        (WebCore::RenderInline::offsetTop):
        Reimplemented in terms of RenderBoxModelObject::offsetTopLeft.
        * rendering/RenderObject.h:
        (RenderObject):
        (WebCore::RenderObject::offsetForColumns):
        New helper method to simplify implementation of offsetTopLeft.

2012-03-31  Robert Hogan  <robert@webkit.org>

        CSS 2.1 failure: first-letter-nested-004.htm fails
        https://bugs.webkit.org/show_bug.cgi?id=72987

        Reviewed by Eric Seidel.

        When styling first-letter check each sibling and drill into its inlines until we find either (i) a text node 
        that is not all whitespace, or (ii) a line break.

        This makes our rendering of the following tests compatible with FF and Opera. Our current behaviour is also conformant
        since the spec allows UAs to style just one element:
            css2.1/20110323/first-letter-quote-002.htm
            css2.1/20110323/first-letter-quote-003.htm
            css2.1/20110323/first-letter-quote-004.htm
            css2.1/20110323/first-letter-quote-005.htm

        This fixes the following two tests. We now drill into the descendants of an element styled with :first-letter looking
        for text to style:
            css2.1/20110323/first-letter-nested-004.htm
            css2.1/20110323/first-letter-nested-006.htm

        This patch changes our rendering of first-letter-dynamic-001.htm as we now render adjacent quotes in the second line as 
        green. This is consistent with the spec, which allows this behaviour but does not require it. It's the 'right' behaviour
        since it is consistent with the rendering of such quotes in a single element with :first-letter style.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::findLastObjectWithFirstLetterText): Iterate through the child's siblings looking for the last
          object to be styled :first-letter.
        (WebCore::RenderBlock::findLastObjectAfterFirstLetterPunctuation): Style any leading punctuation as first-letter, drill
          down into the child's descendants looking for text if necessary.
        (WebCore::RenderBlock::updateFirstLetter): Refactor to drill into sibling's children looking for inlines
         that should be styled as first-letter.
        (WebCore::RenderBlock::addFirstLetter): Split out from updateFirstLetter so that it can be used when a
         descendant node inside a sibling is found in findLastObjectWithFirstLetterText() needs to be styled as first-letter.
        * rendering/RenderBlock.h:

2012-05-08  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116402.
        http://trac.webkit.org/changeset/116402
        https://bugs.webkit.org/show_bug.cgi?id=85898

        Caused a 3% regression on Chromium's bloat-http test on Linux
        (Requested by ojan_gardening on #webkit).

        * WebCore.exp.in:
        * bindings/v8/RetainedDOMInfo.cpp:
        * dom/ContainerNode.h:
        * dom/Node.cpp:
        (WebCore::Node::traverseNextNode):
        (WebCore):
        (WebCore::Node::traverseNextSibling):
        * dom/Node.h:
        (Node):

2012-05-08  Hironori Bono  <hbono@chromium.org>

        [Chromium] Fix the position of an RTL resizer
        https://bugs.webkit.org/show_bug.cgi?id=80640

        Reviewed by Tony Chang.

        When rendering an RTL resizer, my r110073 renders it at the same position as the
        one used for rendering a LTR resizer. Unfortunately, this code renders the RTL
        resizer image at an incorrect position on Mac and Linux. This change uses the
        correct formula to calculate the position of an RTL resizer.

        Test: platform/chromium/scrollbars/rtl-resizer-position.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::drawPlatformResizerImage):

2012-05-08  Andreas Kling  <kling@webkit.org>

        Element: isURLAttribute() should take a const Attribute&.
        <http://webkit.org/b/85890>

        Reviewed by Anders Carlsson.

        Change isURLAttribute(Attribute*) to isURLAttribute(const Attribute&) to enforce
        the fact that the Attribute can't be null, and shouldn't be mutated, at compile-time.
        Also sprinkle OVERRIDE while we're at it.

        * dom/Element.cpp:
        (WebCore::Element::getURLAttribute):
        (WebCore::Element::getNonEmptyURLAttribute):
        * dom/Element.h:
        (WebCore::Element::isURLAttribute):
        * editing/MarkupAccumulator.cpp:
        (WebCore::MarkupAccumulator::appendQuotedURLAttributeValue):
        (WebCore::MarkupAccumulator::appendAttribute):
        * editing/markup.cpp:
        (WebCore::completeURLs):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::isURLAttribute):
        * html/HTMLAnchorElement.h:
        * html/HTMLBaseElement.cpp:
        (WebCore::HTMLBaseElement::isURLAttribute):
        * html/HTMLBaseElement.h:
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::isURLAttribute):
        * html/HTMLBodyElement.h:
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::isURLAttribute):
        * html/HTMLButtonElement.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::isURLAttribute):
        * html/HTMLElement.h:
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::isURLAttribute):
        * html/HTMLEmbedElement.h:
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::isURLAttribute):
        * html/HTMLFormElement.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::isURLAttribute):
        * html/HTMLFrameElementBase.h:
        (HTMLFrameElementBase):
        * html/HTMLHtmlElement.cpp:
        (WebCore::HTMLHtmlElement::isURLAttribute):
        * html/HTMLHtmlElement.h:
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::isURLAttribute):
        * html/HTMLImageElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isURLAttribute):
        * html/HTMLInputElement.h:
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::isURLAttribute):
        * html/HTMLLinkElement.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::isURLAttribute):
        * html/HTMLMediaElement.h:
        * html/HTMLModElement.cpp:
        (WebCore::HTMLModElement::isURLAttribute):
        * html/HTMLModElement.h:
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::isURLAttribute):
        * html/HTMLObjectElement.h:
        * html/HTMLParamElement.cpp:
        (WebCore::HTMLParamElement::isURLAttribute):
        * html/HTMLParamElement.h:
        * html/HTMLQuoteElement.cpp:
        (WebCore::HTMLQuoteElement::isURLAttribute):
        * html/HTMLQuoteElement.h:
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::isURLAttribute):
        * html/HTMLScriptElement.h:
        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::isURLAttribute):
        * html/HTMLSourceElement.h:
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::isURLAttribute):
        * html/HTMLTableCellElement.h:
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::isURLAttribute):
        * html/HTMLTableElement.h:
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::isURLAttribute):
        * html/HTMLTrackElement.h:
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::isURLAttribute):
        * html/HTMLVideoElement.h:
        * svg/SVGScriptElement.cpp:
        (WebCore::SVGScriptElement::isURLAttribute):
        * svg/SVGScriptElement.h:

2012-05-08  Stephen Chenney  <schenney@chromium.org>

        Shrink ElementAttributeData by factoring out Attr object count.
        https://bugs.webkit.org/show_bug.cgi?id=85825

        Unreviewed build fix.

        * dom/ElementAttributeData.cpp:
        (WebCore::attrListForElement): Was returning false instead of 0 for a pointer value. Now returns 0.

2012-05-08  Andreas Kling  <kling@webkit.org>

        Element: Merge idAttributeChanged() into attributeChanged().
        <http://webkit.org/b/85885>

        Reviewed by Antti Koivisto.

        No new tests, code churn only.

        * dom/Element.h:
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged): There's no need for this to be a standalone function anymore.

2012-05-08  Andreas Kling  <kling@webkit.org>

        Shrink ElementAttributeData by factoring out Attr object count.
        <http://webkit.org/b/85825>

        Reviewed by Antti Koivisto.

        Stop tracking the number of Attr objects that point to a given Element on the
        Element itself and manage this by having a global hashmap of Element => AttrList,
        where AttrList is a vector of (pointers to) the associated Attr objects.

        This shrinks ElementAttributeData by one integer, effectively reducing memory
        consumption by ~530kB when viewing the full HTML5 spec at <http://whatwg.org/c>.

        * dom/ElementAttributeData.h:
        (ElementAttributeData):

            Remove m_attrCount...

        * dom/Node.h:
        (WebCore::Node::hasAttrList):
        (WebCore::Node::setHasAttrList):
        (WebCore::Node::clearHasAttrList):

            ...replacing it with a Node flag that tells us whether there's an Attr
            object map for this Node (only applies to Elements.)

        * dom/ElementAttributeData.cpp:
        (WebCore::attrListMap):
        (WebCore::attrListForElement):
        (WebCore::ensureAttrListForElement):
        (WebCore::removeAttrListForElement):
        (WebCore::ElementAttributeData::attrIfExists):
        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):
        (WebCore::ElementAttributeData::detachAttributesFromElement):

            Map Element => per-Element AttrList in a global hash.

2012-05-08  Chris Guan  <chris.guan@torchmobile.com.cn>

        [Blackberry] remove m_isRequestedByPlugin in ResourceRequest
        https://bugs.webkit.org/show_bug.cgi?id=84559

        Reviewed by Antonio Gomes.

        ResourceRequest is a network level abstraction, and it should
        not know anything about web concepts such as plug-ins, and Blackberry
        does not need m_isRequestedByPlugin any longer, So clean up all related
        code.

        Tested on a website of http://edition.cnn.com, a new window should be
        opened only when user has a singe tap gesture on a plugin element.

        * platform/network/blackberry/ResourceRequest.h:
        (WebCore::ResourceRequest::ResourceRequest):
        (ResourceRequest):
        (CrossThreadResourceRequestData):
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::ResourceRequest::doPlatformCopyData):
        (WebCore::ResourceRequest::doPlatformAdopt):

2012-05-03  Alexander Pavlov  <apavlov@chromium.org>

        Extra line-breaks added when copying from source.
        https://bugs.webkit.org/show_bug.cgi?id=85282

        Reviewed by Ryosuke Niwa.

        The code used to replace any \n by \r\n, even the one that had a preceding \r, resulting in \r\r\n.
        This change introduces a check for the preceding \r when replacing \n's.

        Test: platform/win/editing/pasteboard/pasting-crlf-isnt-translated-to-crcrlf-win.html

        * platform/chromium/ClipboardUtilitiesChromium.cpp:
        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
        * platform/win/ClipboardUtilitiesWin.cpp:
        (WebCore::replaceNewlinesWithWindowsStyleNewlines):

2012-05-08  Adam Barth  <abarth@webkit.org>

        OS(ANDROID) JNI AttachCurrentThread take JNIEnv** as a parameter, not void**
        https://bugs.webkit.org/show_bug.cgi?id=85869

        Reviewed by Eric Seidel.

        According to
        http://docs.oracle.com/javase/1.5.0/docs/guide/jni/spec/invocation.html,
        AttachCurrentThread takes a JNIEnv** rather than a void**.  Apparently,
        most implementations actually take a void**.  The OS(ANDROID)
        implementation, however, actually takes an JNIEnv**.  This patch
        introduces a typedef to give each implementation what it desires.

        * bridge/jni/JNIUtility.cpp:
        (JSC::Bindings::getJNIEnv):

2012-05-08  Balazs Kelemen  <kbalazs@webkit.org>

        [Qt] X11 plugins need to be reworked for Qt5+WK1
        https://bugs.webkit.org/show_bug.cgi?id=80691

        Reviewed by Simon Hausmann.

        Implement basic windowless plugin support with Qt5.
        The solution is the same that has been chosen for
        WebKit2. We get the content drawed by the plugin
        from the X server as an image, create a QImage
        from it and paint it to the window surface with QPainter.
        Performance is sufficient for basic video playback.

        No new tests, covered by existing plugin tests.

        * Target.pri:
        * WebCore.pri:
        * platform/qt/QWebPageClient.h:
        (QWebPageClient):
        * plugins/PluginView.h:
        (PluginView):
        * plugins/qt/PluginPackageQt.cpp:
        (WebCore::PluginPackage::isPluginBlacklisted):
        Blacklist plugins that are incompatible with Qt5.
        The only one I know about currently is skypebuttons
        but the list can be extended in the future.
        (WebCore):
        (WebCore::PluginPackage::load):
        * plugins/qt/PluginViewQt.cpp:
        (X11Environment):
        (WebCore):
        (WebCore::x11Display):
        (WebCore::x11Screen):
        (WebCore::rootWindowID):
        (WebCore::displayDepth):
        (WebCore::syncX):
        (WebCore::PluginView::platformPageClient): Added a safe
        convenience getter for the QWebpageClient.
        (WebCore::PluginView::updatePluginWidget):
        (WebCore::PluginView::setFocus):
        (WebCore::setupGraphicsExposeEvent):
        (WebCore::PluginView::paintUsingXPixmap):
        (WebCore::setSharedXEventFields):
        (WebCore::PluginView::initXEvent):
        (WebCore::PluginView::setXKeyEventSpecificFields):
        (WebCore::setXButtonEventSpecificFields):
        (WebCore::setXMotionEventSpecificFields):
        (WebCore::setXCrossingEventSpecificFields):
        (WebCore::PluginView::setNPWindowIfNeeded):
        (WebCore::PluginView::setParentVisible):
        (WebCore::PluginView::platformGetValue):
        (WebCore::PluginView::invalidateRect):
        (WebCore::getVisualAndColormap):
        Refactored this function to make it more clear
        what does it actually do.
        (WebCore::PluginView::platformStart):
        (WebCore::PluginView::platformDestroy):

2012-05-07  Antti Koivisto  <antti@apple.com>

        Inline Node::traverseNextNode
        https://bugs.webkit.org/show_bug.cgi?id=85844

        Reviewed by Ryosuke Niwa.

        Inline traverseNextNode and traverseNextSibling to reduce entry/exit overhead and allow better code generation
        for many hot loops. Also added separate versions of stayWithin and unscoped cases (the function is
        so simple that this seemed like the cleanest way to do it, the most reliable too) and used UNLIKELY for the 
        end-of-traversal conditions.
        
        The traversal function can show up to ~1% in normal page loading profiles.
        
        run-perf-tests seems to think this is a progression in some subtests though bots will tell for certain.

        * WebCore.exp.in:
        * dom/ContainerNode.h:
        
            Following the existing pattern, function bodies go to ContainerNode.h so they can call parentNode().
            (which returns ContainerNode, not Node).

        (WebCore::Node::traverseNextNode):
        (WebCore):
        (WebCore::Node::traverseNextSibling):
        * dom/Node.cpp:
        (WebCore):
        * dom/Node.h:
        (Node):

2012-05-05  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: make JavaScriptSourceFrame use breakpoint manager's breakpoints store.
        https://bugs.webkit.org/show_bug.cgi?id=85714

        Reviewed by Yury Semikhatsky.

        It is currently using its own copy of breakpoints which is not necessary.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager):
        (WebInspector.BreakpointManager.prototype.restoreBreakpoints):
        (WebInspector.BreakpointManager.prototype.setBreakpoint):
        (WebInspector.BreakpointManager.prototype._innerSetBreakpoint):
        (WebInspector.BreakpointManager.prototype.findBreakpoint):
        (WebInspector.BreakpointManager.prototype.reset):
        (WebInspector.BreakpointManager.prototype._debuggerReset):
        (WebInspector.BreakpointManager.prototype._breakpointResolved):
        (WebInspector.BreakpointManager.prototype._uiLocationAdded):
        (WebInspector.BreakpointManager.prototype._uiLocationRemoved):
        (WebInspector.BreakpointManager.Breakpoint.prototype._breakpointStorageId):
        (WebInspector.BreakpointManager.Storage.prototype._restoreBreakpoints):
        (set WebInspector.BreakpointManager.Storage.Item):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.consoleMessagesCleared):
        (WebInspector.JavaScriptSource.prototype.breakpointStorageId):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype._onContentChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.populateLineGutterContextMenu):
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointAdded):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointRemoved):
        (WebInspector.JavaScriptSourceFrame.prototype.onTextViewerContentLoaded):
        (WebInspector.JavaScriptSourceFrame.prototype._continueToLine):
        (WebInspector.JavaScriptSourceFrame.prototype._updateBreakpointsAfterLiveEdit):

2012-05-07  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: do not create locations for resolved provisional breakpoints
        https://bugs.webkit.org/show_bug.cgi?id=85716

        Reviewed by Yury Semikhatsky.

        Marked provisional breakpoints as such.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.prototype._debuggerReset):
        (WebInspector.BreakpointManager.prototype._breakpointResolved):

2012-05-07  Simon Fraser  <simon.fraser@apple.com>

        Compositing layers with transformed children not large enough to show contents
        https://bugs.webkit.org/show_bug.cgi?id=85855

        Reviewed by Dan Bernstein.
        
        r114518 added a code path to RenderLayer::calculateLayerBounds() which
        does an early return if the layer has clipping. However, this code
        path omitted to take local transforms into account.
        
        Fix is to handle transforms as we do in the non-clipped case.

        Test: compositing/geometry/bounds-clipped-composited-child.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateLayerBounds):

2012-05-07  Scott Graham  <scottmg@chromium.org>

        Fix signed/unsigned mismatch
        https://bugs.webkit.org/show_bug.cgi?id=85845

        Make literal in assert be unsigned to match comparison on LHS. Avoids
        warning on Windows.

        Reviewed by Eric Seidel.

        No new tests. No intended functionality change.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::splitColumn):

2012-05-07  Emil A Eklund  <eae@chromium.org>

        Fix performance regression for floats caused by LayoutUnit change
        https://bugs.webkit.org/show_bug.cgi?id=85834

        Reviewed by Eric Seidel.

        Fix performance regression caused by r116009 by disabling the use of
        64bit math in FractionalLayoutUnit, simplifying the pixelSnappedMaxX/Y
        math, inlining a couple of methods and replacing the literal 0 (zero)
        with ZERO_LAYOUT_UNIT.

        No new tests, no change in functionality.

        * platform/FractionalLayoutUnit.h:
        (WebCore::boundedMultiply):
        (WebCore::operator*):
        (WebCore::operator/):
        Disable the use of 64bit (long long) math in the case where the fraction
        is set to 1.
        
        * platform/graphics/FractionalLayoutRect.h:
        (WebCore::FractionalLayoutRect::pixelSnappedMaxX):
        (WebCore::FractionalLayoutRect::pixelSnappedMaxY):
        Simplify the pixel snapping logic for maxX/maxY.
        
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::isSelfCollapsingBlock):
        (WebCore::RenderBlock::layoutBlock):
        (WebCore::RenderBlock::computeOverflow):
        (WebCore::RenderBlock::clearFloatsIfNeeded):
        (WebCore::RenderBlock::paintChildren):
        (WebCore::RenderBlock::blockSelectionGap):
        (WebCore::RenderBlock::logicalLeftSelectionGap):
        (WebCore::RenderBlock::logicalRightSelectionGap):
        (WebCore::RenderBlock::computeLogicalLocationForFloat):
        (WebCore::RenderBlock::lowestFloatLogicalBottom):
        (WebCore::RenderBlock::getClearDelta):
        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths):
        (WebCore::RenderBlock::addFocusRingRects):
        (WebCore::RenderBlock::adjustLinePositionForPagination):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::availableLogicalWidthForLine):
        (WebCore::RenderBlock::availableLogicalWidthForContent):
        (WebCore::RenderBlock::FloatingObject::x):
        (WebCore::RenderBlock::FloatingObject::maxX):
        (WebCore::RenderBlock::FloatingObject::y):
        (WebCore::RenderBlock::FloatingObject::maxY):
        (WebCore::RenderBlock::FloatingObject::width):
        (WebCore::RenderBlock::FloatingObject::height):
        (FloatingObject):
        (WebCore::RenderBlock::FloatingObject::pixelSnappedX):
        (WebCore::RenderBlock::FloatingObject::pixelSnappedMaxX):
        (WebCore::RenderBlock::FloatingObject::pixelSnappedY):
        (WebCore::RenderBlock::FloatingObject::pixelSnappedMaxY):
        (WebCore::RenderBlock::FloatingObject::pixelSnappedWidth):
        (WebCore::RenderBlock::FloatingObject::pixelSnappedHeight):
        (WebCore::RenderBlock::RenderBlockRareData::positiveMarginBeforeDefault):
        (WebCore::RenderBlock::RenderBlockRareData::negativeMarginBeforeDefault):
        (WebCore::RenderBlock::RenderBlockRareData::positiveMarginAfterDefault):
        (WebCore::RenderBlock::RenderBlockRareData::negativeMarginAfterDefault):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::accumulateRelativePositionOffsets):
        (WebCore::RenderBoxModelObject::offsetLeft):
        (WebCore::RenderBoxModelObject::offsetTop):
        (WebCore::RenderBoxModelObject::computedCSSPaddingTop):
        (WebCore::RenderBoxModelObject::computedCSSPaddingBottom):
        (WebCore::RenderBoxModelObject::computedCSSPaddingLeft):
        (WebCore::RenderBoxModelObject::computedCSSPaddingRight):
        (WebCore::RenderBoxModelObject::computedCSSPaddingBefore):
        (WebCore::RenderBoxModelObject::computedCSSPaddingAfter):
        (WebCore::RenderBoxModelObject::computedCSSPaddingStart):
        (WebCore::RenderBoxModelObject::computedCSSPaddingEnd):

2012-05-07  Dongwoo Im  <dw.im@samsung.com>

        width/height attributes of input element cannot be accessed by JavaScript.
        https://bugs.webkit.org/show_bug.cgi?id=70304

        Reviewed by Darin Adler.

        If the type of input element is image button, width/height attributes should be supported.
        These attributes are defined in HTML5 spec.
        http://www.w3.org/TR/html5/the-map-element.html#attr-dim-width

        Tests: fast/forms/input-width-height-attributes-without-renderer-loaded-image.html
               fast/forms/input-width-height-attributes-without-renderer-not-loaded-image.html
               fast/forms/input-width-height-attributes-without-renderer.html
               fast/forms/input-width-height-attributes.html

        * html/HTMLInputElement.cpp: Add setter/getter functions to query/set width/height of input element.
        (WebCore):
        (WebCore::HTMLInputElement::height): Gets height of input element.
        (WebCore::HTMLInputElement::width): Gets width of input element.
        (WebCore::HTMLInputElement::setHeight): Sets height of input element.
        (WebCore::HTMLInputElement::setWidth): Sets width of input element.
        * html/HTMLInputElement.h: Add public prototype.
        (HTMLInputElement):
        * html/HTMLInputElement.idl: Add width/height attributes.
        * html/ImageInputType.cpp: Add getter functions if the element is an image button.
        (WebCore):
        (WebCore::ImageInputType::height): Gets height of input element.
        (WebCore::ImageInputType::width): Gets width of input element.
        * html/ImageInputType.h: Add prototype.
        (ImageInputType):
        * html/InputType.cpp: Add getter functions.
        (WebCore::InputType::height): Returns zero.
        (WebCore):
        (WebCore::InputType::width): Returns zero.
        * html/InputType.h: Add prototype.
        (InputType):

2012-05-07  Kinuko Yasuda  <kinuko@chromium.org>

        Support cross-filesystem operations in FileSystem API
        https://bugs.webkit.org/show_bug.cgi?id=84135

        Reviewed by David Levin.

        Currently we pass Entry's fullPath to AsyncFileSystem layer where
        we convert the given path to filesystem URL which includes origin and
        filesystem type information, but in that way we cannot handle
        cross-filesystem operations (e.g. cross-filesystem copy and move)
        well since we end up with always attaching the source filesystem's
        origin and type information for argument paths.

        This patch does:
        - change AsyncFileSystem's operation methods not to take entry paths
          but complete filesystem URLs.
        - move type and rootURL information from AsyncFileSystem instance into
          DOMFileSystemBase instance (platform layer to Modules/filesystem layer)
        - move filesystem-type related code in AsyncFileSystemChromium.cpp into
          DOMFileSystemChromium.cpp, which implements chromioum-specific
          DOMFileSystem code.
        - move platform/FileSystemType.h into Modules/filesystem/FileSystemType.h.
        - adding FileSystemType.h entry to build files (e.g. WebCore.gypi, WebCore.xcodeproj etc)

        Test: fast/filesystem/cross-filesystem-op.html

        * Modules/filesystem/DOMFileSystem.cpp:
        (WebCore::DOMFileSystem::create):
        (WebCore::DOMFileSystem::DOMFileSystem):
        (WebCore::DOMFileSystem::createWriter):
        (WebCore::DOMFileSystem::createFile):
        * Modules/filesystem/DOMFileSystem.h:
        * Modules/filesystem/DOMFileSystemBase.cpp:
        (WebCore::DOMFileSystemBase::DOMFileSystemBase):
        (WebCore::DOMFileSystemBase::createFileSystemURL): Added as an internal
        implementation of Entry.toURL().
        (WebCore::DOMFileSystemBase::getMetadata):
        (WebCore::verifyAndGetDestinationPathForCopyOrMove):
        (WebCore::DOMFileSystemBase::move):
        (WebCore::DOMFileSystemBase::copy):
        (WebCore::DOMFileSystemBase::remove):
        (WebCore::DOMFileSystemBase::removeRecursively):
        (WebCore::DOMFileSystemBase::getParent):
        (WebCore::DOMFileSystemBase::getFile):
        (WebCore::DOMFileSystemBase::getDirectory):
        (WebCore::DOMFileSystemBase::readDirectory):
        * Modules/filesystem/DOMFileSystemBase.h: Changed to make each
        DOMFileSystemBase instance have filesystem type and rootURL (they were
        held by AsyncFileSystem previously)
        (WebCore::DOMFileSystemBase::create): Changed to take additional parameters.
        (WebCore::DOMFileSystemBase::type): Added.(Moved from AsyncFileSystem::type)
        (WebCore::DOMFileSystemBase::rootURL): Added.(Moved from AsyncFileSystem::rootURL).
        * Modules/filesystem/DOMFileSystemSync.cpp:
        (WebCore::DOMFileSystemSync::create):
        (WebCore::DOMFileSystemSync::DOMFileSystemSync):
        (WebCore::DOMFileSystemSync::createFile):
        (WebCore::DOMFileSystemSync::createWriter):
        * Modules/filesystem/DOMFileSystemSync.h:
        (WebCore::DOMFileSystemSync::create):
        * Modules/filesystem/DOMWindowFileSystem.cpp:
        (WebCore::DOMWindowFileSystem::webkitRequestFileSystem):
        (WebCore::DOMWindowFileSystem::webkitResolveLocalFileSystemURL):
        * Modules/filesystem/EntryBase.cpp:
        (WebCore::EntryBase::toURL):
        * Modules/filesystem/FileSystemCallbacks.cpp:
        (WebCore::FileSystemCallbacks::create):
        (WebCore::FileSystemCallbacks::FileSystemCallbacks):
        (WebCore::FileSystemCallbacks::didOpenFileSystem):
        (WebCore::ResolveURICallbacks::create):
        (WebCore::ResolveURICallbacks::ResolveURICallbacks):
        (WebCore::ResolveURICallbacks::didOpenFileSystem):
        * Modules/filesystem/FileSystemCallbacks.h:
        (FileSystemCallbacks):
        (ResolveURICallbacks):
        * Modules/filesystem/FileSystemType.h: Renamed from Source/WebCore/platform/FileSystemType.h.
        * Modules/filesystem/LocalFileSystem.cpp:
        (WebCore::openFileSystem):
        (WebCore::LocalFileSystem::readFileSystem):
        (WebCore::LocalFileSystem::requestFileSystem):
        * Modules/filesystem/LocalFileSystem.h:
        * Modules/filesystem/WorkerContextFileSystem.cpp:
        (WebCore::WorkerContextFileSystem::webkitRequestFileSystem):
        (WebCore::WorkerContextFileSystem::webkitRequestFileSystemSync):
        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemURL):
        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL):
        * Modules/filesystem/chromium/DOMFileSystemChromium.cpp: Added for chromium-specific
        implementation. Almost all of the code is moved from AsyncFileSystemChromium.
        (WebCore::DOMFileSystemBase::isValidType):
        (WebCore::DOMFileSystemBase::crackFileSystemURL):
        (WebCore::DOMFileSystemBase::supportsToURL):
        (WebCore::DOMFileSystemBase::createFileSystemURL):
        (WebCore::DOMFileSystemChromium::createIsolatedFileSystem):
        * Modules/filesystem/chromium/DOMFileSystemChromium.h: Added.
        * Modules/filesystem/chromium/DataTransferItemFileSystemChromium.cpp:
        (WebCore::DataTransferItemFileSystem::webkitGetAsEntry):
        * Modules/filesystem/chromium/DraggedIsolatedFileSystem.cpp:
        (WebCore::DraggedIsolatedFileSystem::getDOMFileSystem):
        * WebCore.gypi:
        * platform/AsyncFileSystem.cpp:
        (WebCore::AsyncFileSystem::openFileSystem):
        * platform/AsyncFileSystem.h:
        (AsyncFileSystem):
        (WebCore::AsyncFileSystem::AsyncFileSystem):
        * platform/AsyncFileSystemCallbacks.h:
        (WebCore::AsyncFileSystemCallbacks::didOpenFileSystem):
        * platform/blackberry/AsyncFileSystemBlackBerry.cpp:
        (WebCore::AsyncFileSystem::create):
        (WebCore::AsyncFileSystem::openFileSystem):
        (WebCore::AsyncFileSystemBlackBerry::AsyncFileSystemBlackBerry):
        (WebCore::AsyncFileSystemBlackBerry::move):
        (WebCore::AsyncFileSystemBlackBerry::copy):
        (WebCore::AsyncFileSystemBlackBerry::remove):
        (WebCore::AsyncFileSystemBlackBerry::removeRecursively):
        (WebCore::AsyncFileSystemBlackBerry::readMetadata):
        (WebCore::AsyncFileSystemBlackBerry::createFile):
        (WebCore::AsyncFileSystemBlackBerry::createDirectory):
        (WebCore::AsyncFileSystemBlackBerry::fileExists):
        (WebCore::AsyncFileSystemBlackBerry::directoryExists):
        (WebCore::AsyncFileSystemBlackBerry::readDirectory):
        (WebCore::AsyncFileSystemBlackBerry::createWriter):
        (WebCore::AsyncFileSystemBlackBerry::createSnapshotFileAndReadMetadata):
        * platform/blackberry/AsyncFileSystemBlackBerry.h:
        * platform/chromium/PlatformSupport.h:
        * platform/gtk/AsyncFileSystemGtk.cpp:
        (WebCore::AsyncFileSystem::create):
        (WebCore::AsyncFileSystem::openFileSystem):
        (WebCore::AsyncFileSystemGtk::AsyncFileSystemGtk):
        (WebCore::AsyncFileSystemGtk::move):
        (WebCore::AsyncFileSystemGtk::copy):
        (WebCore::AsyncFileSystemGtk::remove):
        (WebCore::AsyncFileSystemGtk::removeRecursively):
        (WebCore::AsyncFileSystemGtk::readMetadata):
        (WebCore::AsyncFileSystemGtk::createFile):
        (WebCore::AsyncFileSystemGtk::createDirectory):
        (WebCore::AsyncFileSystemGtk::fileExists):
        (WebCore::AsyncFileSystemGtk::directoryExists):
        (WebCore::AsyncFileSystemGtk::readDirectory):
        (WebCore::AsyncFileSystemGtk::createWriter):
        * platform/gtk/AsyncFileSystemGtk.h:

        * GNUmakefile.list.am: Added FileSystemType.h.
        * WebCore.gypi: Added FileSystemType.h.
        * WebCore.vcproj/WebCore.vcproj: Added FileSystemType.h.
        * WebCore.xcodeproj/project.pbxproj: Added FileSystemType.h.

2012-05-07  Adam Barth  <abarth@webkit.org>

        [Chromium] Android wishes to use an empty implementation if AXObjectCache
        https://bugs.webkit.org/show_bug.cgi?id=85842

        Reviewed by Eric Seidel.

        Add proper HAVE(ACCESSIBILITY) ifdefs so that Chromium builds without
        accessibility.

        * accessibility/chromium/AXObjectCacheChromium.cpp:
        * accessibility/chromium/AccessibilityObjectChromium.cpp:

2012-05-07  Greg Billock  <gbillock@google.com>

        [Web Intents] Flagged-off implementation of an intent tag for registration.
        https://bugs.webkit.org/show_bug.cgi?id=73039

        Reviewed by Adam Barth.

        The intent tag is a declarative way for pages to register that they
        accept delivery of web intent invocations of particular types. See the
        spec at http://dvcs.w3.org/hg/web-intents/raw-file/tip/spec/Overview.html

        After discussion on the WhatWG list (see thread at
        http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-April/035301.html)
        the current plan is to combine declarative registration of Web
        Intents and protocol/content handlers with this tag. Alternatives
        considered were the meta and link tags.

        * WebCore.gypi:
        * html/HTMLAttributeNames.in:
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLIntentElement.cpp: Added.
        (WebCore::HTMLIntentElement::HTMLIntentElement):
        (WebCore::HTMLIntentElement::create):
        (WebCore::HTMLIntentElement::insertedIntoDocument):
        * html/HTMLIntentElement.h: Added.
        * html/HTMLIntentElement.idl: Added.
        * html/HTMLTagNames.in:
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::registerIntentService):
        * page/DOMWindow.idl:

2012-05-07  Dana Jansens  <danakj@chromium.org>

        Region::intersects() and Region::contains() are slow due to copy overhead
        https://bugs.webkit.org/show_bug.cgi?id=81076

        Reviewed by Anders Carlsson.

        Testing contains() and intersects() requires a copy which ends up
        invoking a malloc on sufficiently complicated web pages, and slows down
        the test unnecessarily. These methods can be done by iterating over the
        Region::Shape values rather than making a copy of the entire region and
        manipulating it.

        This uses Region::Shape::compareShapes() to walk the query regions and
        compute the result of the intersects or contains tests without making a
        copy.

        This change improves the performance of the Region overlap testing for
        composited layers, and allows for testing contains() before unite() to
        avoid unnecessary copies of the Region when inserting into complex
        Regions. With a layout test that has 225 composited layers, and tests
        Region.intersects() for 1000 layers above them, this change decreases
        the running time of the test by 1.2% by avoiding a copy of the 225
        rects each time.

        Unit test: RegionTest.intersectsRegion
                   RegionTest.containsRegion

        * platform/graphics/Region.cpp:
        (WebCore::Region::contains):
        (WebCore::Region::intersects):
        (WebCore):
        (WebCore::Region::Shape::compareShapes):
        (Region::Shape::CompareContainsOperation):
        (WebCore::Region::Shape::CompareContainsOperation::aOutsideB):
        (WebCore::Region::Shape::CompareContainsOperation::bOutsideA):
        (WebCore::Region::Shape::CompareContainsOperation::aOverlapsB):
        (Region::Shape::CompareIntersectsOperation):
        (WebCore::Region::Shape::CompareIntersectsOperation::aOutsideB):
        (WebCore::Region::Shape::CompareIntersectsOperation::bOutsideA):
        (WebCore::Region::Shape::CompareIntersectsOperation::aOverlapsB):
        * platform/graphics/Region.h:
        (Shape):

2012-05-07  David Tseng  <dtseng@google.com>

        Correct logical error in accessibilityIsIgnored.
        https://bugs.webkit.org/show_bug.cgi?id=85828

        Reviewed by Chris Fleizach.

        Covered by existing tests.

        * accessibility/AccessibilityMenuListOption.cpp:
        (WebCore::AccessibilityMenuListOption::accessibilityIsIgnored):
        * accessibility/AccessibilityMenuListPopup.cpp:
        (WebCore::AccessibilityMenuListPopup::accessibilityIsIgnored):

2012-05-04  Zhenyao Mo  <zmo@google.com>

        vertexAttribPointer needs to reject large negative offsets
        https://bugs.webkit.org/show_bug.cgi?id=85117

        Reviewed by Kenneth Russell.

        * html/canvas/WebGLRenderingContext.cpp: Use long long for GLsizeiptr and GLintptr
        (WebCore):
        (WebCore::WebGLRenderingContext::bufferData):
        (WebCore::WebGLRenderingContext::bufferSubData):
        (WebCore::WebGLRenderingContext::drawElements):
        (WebCore::WebGLRenderingContext::getVertexAttribOffset):
        (WebCore::WebGLRenderingContext::vertexAttribPointer):
        * html/canvas/WebGLRenderingContext.h: Ditto
        (WebGLRenderingContext):
        * html/canvas/WebGLRenderingContext.idl: Ditto

2012-05-07  Pravin D  <pravind.2k4@gmail.com>

        :first-line text-decorations are not rendered
        https://bugs.webkit.org/show_bug.cgi?id=6047

        Text-decorations are applied during paint phase. The style was not being properly selected in case of
        first line box. The patch fixes this. 

        Reviewed by Eric Seidel.

        Tests: fast/css/first-line-text-decoration-inherited-from-parent.html
               fast/css/first-line-text-decoration.html

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintDecoration):
        Inform the decoration color retriever if this box is part of the first line box or not.

        * rendering/RenderObject.cpp:
        (WebCore::decorationColor):
        Changed the argument from RenderObject* to RenderStyle*. As this function is just a helper to getTextDecorationColors
        as used RenderObject solely to retrieve the corresponding RenderStyle, which(RenderStyle*) was already available with the latter function. 

        (WebCore::RenderObject::getTextDecorationColors):
        Take a new variable to check if first line style or the regular style has to be used.
        Sends RenderStyle* as an argument to decorationColor(). 

        * rendering/RenderObject.h:
        (RenderObject):

2012-05-07  Julien Chaffraix  <jchaffraix@webkit.org>

        Refactor windowClipRectForLayer to remove the explicit RenderLayer dependency
        https://bugs.webkit.org/show_bug.cgi?id=84090

        Reviewed by David Hyatt.

        No observable change in behavior.

        The function name was ambiguous as it was not a general purpose function but was
        working directly on HTMLFrameOwnerElement. The rename makes this more obvious as
        well as removes the explicit dependency on RenderLayer.

        One of the slight change of this refactoring is that we now always null-check the
        HTMLFrameOwnerElement's renderer as part windowClipRectForFrameOwner as I don't see
        any evidence for the other code paths not to hit that. Also we may recur more on our
        frame tree if we have no layer as we now call windowClipRect() in this case.

        * page/FrameView.h:
        (FrameView):
        * plugins/PluginView.cpp:
        (WebCore::PluginView::windowClipRect):
        * WebCore.exp.in:
        * WebCore.order:
        * page/FrameView.cpp:
        (WebCore::FrameView::windowClipRect):
        Updated after windowClipRectForLayer name and signature change.

        (WebCore::FrameView::windowClipRectForFrameOwner):
        This function now takes the HTMLFrameOwnerElement directly.

        * plugins/PluginView.cpp:
        (WebCore::PluginView::PluginView):
        (WebCore::PluginView::create):
        * plugins/PluginView.h:
        (PluginView):
        Updated |m_element| to be an HTMLPlugInElement as this was what was
        passed by every caller. This makes the conversion to HTMLFrameOwnerElement
        possible.

2012-05-07  Enrica Casucci  <enrica@apple.com>

        REGRESSION (r101575): Chinese input is broken when composing mail in iCloud using Safari.
        https://bugs.webkit.org/show_bug.cgi?id=85840
        <rdar://problem/11115520> 
        
        Reviewed by Alexey Proskuryakov.

        The revision that broke this, introduced a way to sanitize the markup when deleting a range selection.
        iCloud listens for DOM modification events and clears the selection, altering the input method state.
        The fix consists in adding a paramenter to DeleteSelectionCommand to control when we sanitize the
        markup.
        
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::deleteSelection):
        * editing/CompositeEditCommand.h:
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand):
        (WebCore::DeleteSelectionCommand::doApply):
        * editing/DeleteSelectionCommand.h:
        (WebCore::DeleteSelectionCommand::create):
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::doApply):

2012-05-07  Andy Estes  <aestes@apple.com>

        ENABLE_IFRAME_SEAMLESS should be part of FEATURE_DEFINES.

        * Configurations/FeatureDefines.xcconfig:

2012-05-06  Martin Robinson  <mrobinson@igalia.com>

        [Cairo] Implement ImageBuffer::copyImage for BackingStoreCopy == DontCopyBackingStore
        https://bugs.webkit.org/show_bug.cgi?id=85728

        Reviewed by Alejandro G. Castro.

        No new tests. This should not change functionality, only increase performance.

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::copyImage): Add an implementation that knows how to avoid copying the backing store.
        (WebCore::ImageBuffer::draw): Use the copyImage constructor now that it knows how to
        avoid copying the backing store.
        (WebCore::ImageBuffer::drawPattern): Ditto.
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::updateBackingStore): Use DontCopyBackingStore for Cairo
        as well.

2012-05-07  Noel Gordon  <noel.gordon@gmail.com>

        [CG] Separate image encoding from dataURL construction
        https://bugs.webkit.org/show_bug.cgi?id=85782

        Reviewed by Kenneth Russell.

        Remove the implicit assumption that a dataURL is the only desired output format
        of the image encoding phase.

        No new tests. No behavioral change. Covered by canvas 2d and 3d tests:
            canvas/philip/tests/*toDataURL*.html
            fast/canvas/webgl/premultiplyalpha-test.html

        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::CGImageEncodeToData): Image encoding helper: encode the image using the
        uti-defined encoder (PNG/JPEG/etc) and output to the given CFMutableDataRef data.
        (WebCore):
        (WebCore::CGImageToDataURL): Refactor to use CGImageEncodeToData().

2012-05-07  Scott Graham  <scottmg@chromium.org>

        [Chromium] Suppress switch-without-cases warning
        https://bugs.webkit.org/show_bug.cgi?id=85830

        Warnings like 
        ...\webkit\CSSGrammar.cpp(2075) : warning C4065: switch statement contains 'default' but no 'case' labels
        are generated. These are bogus, so just suppress them in the build
        settings.

        Reviewed by Dirk Pranke

        No new tests, no intended functionlity change. Just changing compiler
        settings.

        * WebCore.gyp/WebCore.gyp:

2012-05-07  Adrienne Walker  <enne@google.com>

        [chromium] Allow for asymmetric tile sizes on composited tiled layers
        https://bugs.webkit.org/show_bug.cgi?id=85687

        Reviewed by James Robinson.

        Update TiledLayerChromium/CCLayerTilingData/TilingData to allow for a
        the width and height of tile sizes to differ. Modify TilingData to use
        IntSize everywhere for these width/height pairs.

        Also, remove some unused functions from TilingData.

        Test: TilingDataTest.*

        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::TiledLayerChromium):
        (WebCore::TiledLayerChromium::updateTileSizeAndTilingOption):
        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
        (WebCore::CCLayerTilingData::CCLayerTilingData):
        (WebCore::CCLayerTilingData::setTileSize):
        (WebCore):
        (WebCore::CCLayerTilingData::tileSize):
        (WebCore::CCLayerTilingData::operator=):
        (WebCore::CCLayerTilingData::tileRect):
        (WebCore::CCLayerTilingData::setBounds):
        (WebCore::CCLayerTilingData::bounds):
        * platform/graphics/chromium/cc/CCLayerTilingData.h:
        (CCLayerTilingData):
        * platform/graphics/gpu/Texture.cpp:
        (WebCore::Texture::Texture):
        (WebCore::Texture::create):
        (WebCore::Texture::load):
        (WebCore::Texture::updateSubRect):
        * platform/graphics/gpu/TilingData.cpp:
        (WebCore::TilingData::TilingData):
        (WebCore::TilingData::setTotalSize):
        (WebCore::TilingData::setMaxTextureSize):
        (WebCore::TilingData::tileXIndexFromSrcCoord):
        (WebCore::TilingData::tileYIndexFromSrcCoord):
        (WebCore::TilingData::tileBounds):
        (WebCore::TilingData::tileSizeX):
        (WebCore::TilingData::tileSizeY):
        (WebCore::TilingData::recomputeNumTiles):
        * platform/graphics/gpu/TilingData.h:
        (TilingData):
        (WebCore::TilingData::totalSize):
        (WebCore::TilingData::maxTextureSize):
        (WebCore::TilingData::TilingData):

2012-05-07  Raymond Toy  <rtoy@google.com>

        ConvolverNode setBuffer() should not ASSERT on null buffer
        https://bugs.webkit.org/show_bug.cgi?id=85653

        Reviewed by Chris Rogers.

        Test: webaudio/convolver-setBuffer-null.html

        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::setBuffer):  Don't ASSERT on null buffer.

2012-05-07  Ken Buchanan  <kenrb@chromium.org>

        Crash due to positioned object list not being cleared during block flow split
        https://bugs.webkit.org/show_bug.cgi?id=85074

        Reviewed by Abhishek Arya.

        When an element is being split due to a column span element being
        inserted, any of its ancestors that are underneath the column
        containing block also get split. If an ancestor has an object in
        its positioned object list from a previous layout, then the list
        will have to be cleared because the positioned object could have moved
        to be under the continuation. This patch causes the list to be
        cleared.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::splitBlocks):

2012-05-07  Eric Seidel  <eric@webkit.org>

        Add ENABLE_IFRAME_SEAMLESS so Apple can turn off SEAMLESS if needed
        https://bugs.webkit.org/show_bug.cgi?id=85822

        Reviewed by Adam Barth.

        * Configurations/FeatureDefines.xcconfig:
        * dom/Document.cpp:
        (WebCore::Document::shouldDisplaySeamlesslyWithParent):

2012-05-07  Shezan Baig  <shezbaig.wk@gmail.com>

        Selection Background Color Error
        https://bugs.webkit.org/show_bug.cgi?id=80382

        Reviewed by David Hyatt.

        Determine the text colors and selection colors before painting the
        background behind the text.  This is because when determining whether
        to invert the selection background, the selection text color should be
        used instead of the regular text color.  With this patch, the selection
        text color is passed to 'paintSelection' so that the selection
        background can be compared against it, instead of comparing against the
        CSSPropertyColor value.

        Test: fast/backgrounds/selection-background-color.html

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paint):
            Pass selection text color to paintSelection

        (WebCore::InlineTextBox::paintSelection):
            Use the selection text color instead of CSSPropertyColor

        * rendering/InlineTextBox.h:
        (InlineTextBox):
            Adjust signature of paintSelection to accept text color

2012-05-07  David Reveman  <reveman@chromium.org>

        [Chromium] Use GL_CHROMIUM_command_buffer_query to throttle texture uploads.
        https://bugs.webkit.org/show_bug.cgi?id=81004

        Reviewed by Adrienne Walker.

        Add ThrottledTextureUploader class that uses GL_CHROMIUM_command_buffer_query
        to throttle texture uploads based on number of currently pending queries.

        Unit test: ThrottledTextureUploaderTest.IsBusy

        * WebCore.gypi:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::create):
        (WebCore::LayerRendererChromium::LayerRendererChromium):
        (WebCore::LayerRendererChromium::initializeSharedObjects):
        * platform/graphics/chromium/LayerRendererChromium.h:
        (LayerRendererChromium):
        * platform/graphics/chromium/TextureUploader.cpp: Removed.
        * platform/graphics/chromium/TextureUploader.h:
        (TextureUploader):
        * platform/graphics/chromium/ThrottledTextureUploader.cpp: Added.
        (WebCore):
        (WebCore::ThrottledTextureUploader::Query::Query):
        (WebCore::ThrottledTextureUploader::Query::~Query):
        (WebCore::ThrottledTextureUploader::Query::begin):
        (WebCore::ThrottledTextureUploader::Query::end):
        (WebCore::ThrottledTextureUploader::Query::isPending):
        (WebCore::ThrottledTextureUploader::Query::wait):
        (WebCore::ThrottledTextureUploader::ThrottledTextureUploader):
        (WebCore::ThrottledTextureUploader::~ThrottledTextureUploader):
        (WebCore::ThrottledTextureUploader::isBusy):
        (WebCore::ThrottledTextureUploader::beginUploads):
        (WebCore::ThrottledTextureUploader::endUploads):
        (WebCore::ThrottledTextureUploader::uploadTexture):
        (WebCore::ThrottledTextureUploader::processQueries):
        * platform/graphics/chromium/ThrottledTextureUploader.h: Copied from Source/WebCore/platform/graphics/chromium/TextureUploader.h.
        (WebCore):
        (ThrottledTextureUploader):
        (WebCore::ThrottledTextureUploader::create):
        (Query):
        (WebCore::ThrottledTextureUploader::Query::create):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::create):
        (WebCore::UnthrottledTextureUploader::~UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::isBusy):
        (WebCore::UnthrottledTextureUploader::beginUploads):
        (WebCore::UnthrottledTextureUploader::endUploads):
        (WebCore::UnthrottledTextureUploader::uploadTexture):
        (WebCore::UnthrottledTextureUploader::UnthrottledTextureUploader):
        (WebCore):
        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
        (WebCore::CCSingleThreadProxy::recreateContext):
        (WebCore::CCSingleThreadProxy::doCommit):
        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
        (WebCore::CCTextureUpdater::update):
        * platform/graphics/chromium/cc/CCTextureUpdater.h:
        (CCTextureUpdater):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore):
        (UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::create):
        (WebCore::UnthrottledTextureUploader::~UnthrottledTextureUploader):
        (WebCore::UnthrottledTextureUploader::isBusy):
        (WebCore::UnthrottledTextureUploader::beginUploads):
        (WebCore::UnthrottledTextureUploader::endUploads):
        (WebCore::UnthrottledTextureUploader::uploadTexture):
        (WebCore::UnthrottledTextureUploader::UnthrottledTextureUploader):
        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
        (WebCore::CCThreadProxy::recreateContextOnImplThread):

2012-05-07  Rob Buis  <rbuis@rim.com>

        Shrink SVGInlineTextBox object size
        https://bugs.webkit.org/show_bug.cgi?id=85805

        Reviewed by Darin Adler.

        Reduce the object size of SVGInlineTextBox by using bitfields. This
        should be 4 bytes on 32-bits and 8 bytes on 64-bits systems.

        * rendering/svg/RenderSVGResource.h:
        * rendering/svg/SVGInlineTextBox.cpp:
        (ExpectedSVGInlineTextBoxSize):
        (WebCore):
        * rendering/svg/SVGInlineTextBox.h:
        (SVGInlineTextBox):

2012-05-07  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116334.
        http://trac.webkit.org/changeset/116334
        https://bugs.webkit.org/show_bug.cgi?id=85816

        Broke the Chromium Win/Mac compile (Requested by
        ojan_gardening on #webkit).

        * WebCore.gypi:
        * platform/graphics/chromium/AnimationIdVendor.cpp: Removed.
        * platform/graphics/chromium/AnimationIdVendor.h: Removed.
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (std):
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::mapAnimationNameToId):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore):
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LinkHighlightLayerDelegate.cpp: Removed.
        * platform/graphics/chromium/LinkHighlightLayerDelegate.h: Removed.

2012-05-07  Adrienne Walker  <enne@google.com>

        Fix containerForRepaint() assumption about non-null enclosingLayer()
        https://bugs.webkit.org/show_bug.cgi?id=85807

        Reviewed by Simon Fraser.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containerForRepaint):

2012-05-07  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Replace numeric constants with strings
        https://bugs.webkit.org/show_bug.cgi?id=84894

        Reviewed by Tony Chang.

        Test: storage/indexeddb/legacy-constants.html

        Update IDBObjectStore.openCursor, IDBIndex.openCursor,
        IDBIndex.openKeyCursor, IDBDatabase.transaction,
        IDBCursor.direction, IDBTransaction.mode, and
        IDBRequest.readyState to meet the latest spec. All of these APIs
        now support string-based values in addition to the
        legacy/deprecated enum-based values.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore):
        (WebCore::IDBCursor::direction):
        (WebCore::IDBCursor::stringToDirection):
        (WebCore::IDBCursor::directionToString):
        * Modules/indexeddb/IDBCursor.h:
        (IDBCursor):
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::transaction):
        (WebCore):
        * Modules/indexeddb/IDBDatabase.h:
        (IDBDatabase):
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::openCursor):
        (WebCore):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::openCursor):
        (IDBIndex):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::openCursor):
        (WebCore):
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::openCursor):
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::readyState):
        (WebCore::IDBRequest::markEarlyDeath):
        (WebCore::IDBRequest::resetReadyState):
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::finishCursor):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::stop):
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore):
        (WebCore::IDBTransaction::mode):
        (WebCore::IDBTransaction::stringToMode):
        (WebCore::IDBTransaction::modeToString):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl:

2012-05-07  W. James MacLean  <wjmaclean@chromium.org>

        [chromium] Create LinkHighlightLayerChromium class to provide link-highlight preview animations for GraphicsLayerChromium.
        https://bugs.webkit.org/show_bug.cgi?id=85084

        Reviewed by Adrienne Walker.

        Unit test provided.

        Creates a layer delegate class to provide link highlight animations for link-preview feature.
        These are added to a GraphicsLayerChromium via provided methods. Moves dispensing of animation
        ids into a separate class.

        * WebCore.gypi:
        * platform/graphics/chromium/AnimationIdVendor.cpp: Added.
        (WebCore):
        (WebCore::AnimationIdVendor::getNextAnimationId):
        (WebCore::AnimationIdVendor::getNextGroupId):
        * platform/graphics/chromium/AnimationIdVendor.h: Added.
        (WebCore):
        (AnimationIdVendor):
        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::updateNames):
        (WebCore::GraphicsLayerChromium::addAnimation):
        (WebCore::GraphicsLayerChromium::addLinkHighlightLayer):
        (WebCore):
        (WebCore::GraphicsLayerChromium::didFinishLinkHighlightLayer):
        (WebCore::GraphicsLayerChromium::updateChildList):
        (WebCore::GraphicsLayerChromium::mapAnimationNameToId):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (WebCore):
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LinkHighlightLayerDelegate.cpp: Added.
        (WebCore):
        (WebCore::LinkHighlightLayerDelegate::create):
        (WebCore::LinkHighlightLayerDelegate::LinkHighlightLayerDelegate):
        (WebCore::LinkHighlightLayerDelegate::~LinkHighlightLayerDelegate):
        (WebCore::LinkHighlightLayerDelegate::getContentLayer):
        (WebCore::LinkHighlightLayerDelegate::paintContents):
        (WebCore::LinkHighlightLayerDelegate::didScroll):
        (WebCore::LinkHighlightLayerDelegate::notifyAnimationStarted):
        (WebCore::LinkHighlightLayerDelegate::notifyAnimationFinished):
        * platform/graphics/chromium/LinkHighlightLayerDelegate.h: Added.
        (WebCore):
        (LinkHighlightLayerDelegate):

2012-05-07  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: LevelDB coding for bools is broken
        https://bugs.webkit.org/show_bug.cgi?id=85810

        Reviewed by Tony Chang.

        Code was appending to a pre-sized Vector, rather than using an
        index setter. This caused uninitialized data to be written out.
        Issue was detected on the Chromium side in http://crbug.com/126388

        Tests: webkit_unit_tests --gtest_filter='IDBLevelDBCodingTest.*codeBool'

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::encodeBool):

2012-05-07  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] CCMathUtil projectPoint needs to avoid divide-by-zero
        https://bugs.webkit.org/show_bug.cgi?id=85560

        Reviewed by Adrienne Walker.

        Unit test added: CCMathUtilTest.cpp - verifyProjectionOfPerpendicularPlane
        Unit test updated/renamed: CCLayerTreeHostCommonTest.cpp - verifyVisibleRectFor3dPerspectiveWhenClippedByW

        The divide-by-zero occurs in an innocuous case where the layers
        are probably invisible anyway. However, producing Infs and NaNs
        could cause values to be used when un-intended, so its appropriate
        to handle the divide-by-zero correctly.

        * platform/graphics/chromium/cc/CCMathUtil.cpp:
        (WebCore::projectPoint):

2012-05-07  Pravin D  <pravind.2k4@gmail.com>

        Wrong positioning due to wrong width calculation wrt width:0
        https://bugs.webkit.org/show_bug.cgi?id=50135

        Reviewed by Eric Seidel.

        Test: fast/block/block-parent-with-zero-width-child.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computePreferredLogicalWidths):
        When width is fixed, the specified width must be taken, provided the value is positive.
        Width=0 case was being ignored.

2012-05-07  Noel Gordon  <noel.gordon@gmail.com>

        [CG] ImageBuffer::ImageDataToDataURL: Remove alpha stuffing when encoding to JPEG
        https://bugs.webkit.org/show_bug.cgi?id=85779

        Reviewed by Eric Seidel.

        No change in behavior. Covered by fast/canvas/webgl/premultiplyalpha-test.html

        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageDataToDataURL): Remove the need to stuff the alpha channel with 255.
        Rename dataVector to premultipliedData and verify that its resize() worked. Rewrite
        the premultiplication loop without the alpha channel = 255 part and ask the CG JPEG
        encoder to ignore the alpha channel (kCGImageAlphaNoneSkipLast) instead.

2012-05-07  Dominik Röttsches  <dominik.rottsches@linux.intel.com>

        [GTK] media/video-seek-past-end-playing.html times out
        https://bugs.webkit.org/show_bug.cgi?id=84858

        Reviewed by Philippe Normand.

        Removing the intentional state change to PAUSED on didEnd().
        My understanding is that the fix works because the additional
        state transition to PAUSED was resetting the internal m_seeking state to early,
        so that updatePlayState() in HTMLMediaElement was not able to
        correctly figure out/recover playstate after seeking.

        No new tests, covered by existing media tests, and fixing
        video-seek-past-end-playing.html flakiness on GTK, failure on EFL.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

2012-05-07  Abhishek Arya  <inferno@chromium.org>

        Crash in RenderBlock::updateFirstLetterStyle.
        https://bugs.webkit.org/show_bug.cgi?id=85759

        Reviewed by Julien Chaffraix.

        Test: fast/css-generated-content/first-letter-next-sibling-crash.html

        RenderBlock::removeChild can bring up the children from last single anonymous block,
        causing |nextSibling| in RenderBlock::updateFirstLetterStyle to go stale. We prevent
        this by removing the child safely using removeChildNode before destroying it.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::updateFirstLetterStyle):

2012-05-07  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Rename MediaStreamCenter::didConstructMediaStream
        https://bugs.webkit.org/show_bug.cgi?id=85796

        Reviewed by Adam Barth.

        Renamed MediaStreamCenter::didConstructMediaStream to didCreateMediaStream,
        and change so that it is only called for MediaStreams created from JS.

        Not really testable.

        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::create):
        * platform/mediastream/MediaStreamCenter.h:
        (MediaStreamCenter):
        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
        (WebCore::MediaStreamCenterChromium::didCreateMediaStream):
        * platform/mediastream/chromium/MediaStreamCenterChromium.h:
        (MediaStreamCenterChromium):
        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp:
        (WebCore::MediaStreamCenterGStreamer::didCreateMediaStream):
        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h:
        (MediaStreamCenterGStreamer):

2012-05-07  Nat Duca  <nduca@chromium.org>

        Unreviewed, rolling out r115525.
        http://trac.webkit.org/changeset/115525
        https://bugs.webkit.org/show_bug.cgi?id=66683

        Too many pages rely on DOMTimeStamp as first argument.
        Reverting while we consider next steps.

        * WebCore.exp.in:
        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
        * dom/Document.cpp:
        (WebCore::Document::serviceScriptedAnimations):
        * dom/Document.h:
        (Document):
        * dom/RequestAnimationFrameCallback.h:
        (RequestAnimationFrameCallback):
        * dom/RequestAnimationFrameCallback.idl:
        * dom/ScriptedAnimationController.cpp:
        (WebCore::ScriptedAnimationController::ScriptedAnimationController):
        (WebCore::ScriptedAnimationController::serviceScriptedAnimations):
        (WebCore):
        (WebCore::ScriptedAnimationController::windowScreenDidChange):
        (WebCore::ScriptedAnimationController::scheduleAnimation):
        (WebCore::ScriptedAnimationController::animationTimerFired):
        * dom/ScriptedAnimationController.h:
        (ScriptedAnimationController):
        (WebCore::ScriptedAnimationController::displayRefreshFired):
        * page/FrameView.cpp:
        (WebCore::FrameView::serviceScriptedAnimations):
        * page/FrameView.h:
        (FrameView):
        * platform/graphics/DisplayRefreshMonitor.cpp:
        (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor):
        (WebCore::DisplayRefreshMonitor::notifyClients):
        * platform/graphics/DisplayRefreshMonitor.h:
        (DisplayRefreshMonitor):
        * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp:
        (WebCore::DisplayRefreshMonitor::displayLinkFired):
        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
        (WebCore):
        (WebCore::DisplayRefreshMonitor::requestRefreshCallback):
        (WebCore::DisplayRefreshMonitor::displayLinkFired):

2012-05-07  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Allow UserMediaRequest::succeed to take an MediaStreamDescriptor
        https://bugs.webkit.org/show_bug.cgi?id=85798

        Reviewed by Adam Barth.

        Adding another UserMediaRequest::succeed function that takes an MediaStreamDescriptor
        instead of the two MediaStreamSource arrays.

        Not currently testable.

        * Modules/mediastream/LocalMediaStream.cpp:
        (WebCore::LocalMediaStream::create):
        (WebCore):
        (WebCore::LocalMediaStream::LocalMediaStream):
        * Modules/mediastream/LocalMediaStream.h:
        (LocalMediaStream):
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::succeed):
        (WebCore):
        * Modules/mediastream/UserMediaRequest.h:
        (WebCore):
        (UserMediaRequest):

2012-05-07  Michal Mocny  <mmocny@google.com>

        [chromium] setContentsMemoryAllocationLimitBytes needs to setNeedsCommit.
        https://bugs.webkit.org/show_bug.cgi?id=85801

        Reviewed by Adrienne Walker.

        CCLayerTreeHost::setContentsMemoryAllocationLimitBytes needs to call setNeedsCommit after adjusting memory
        limits, so that we push a new frame.  In particular, when returning from non visibile state, we adjust
        memory allocation from 0 to non 0, and we need to push a non blank frame.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::setVisible):
        (WebCore::CCLayerTreeHost::setContentsMemoryAllocationLimitBytes):

2012-05-07  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] media/track/track-cue-rendering-snap-to-lines-not-set.html fails
        https://bugs.webkit.org/show_bug.cgi?id=85602

        Reviewed by Eric Carlson.

        Fix positioning of the controls panel back to relative, as it is
        in the parent CSS.

        * css/mediaControlsEfl.css:
        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):

2012-05-07  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        MediaStream should not be an ActiveDOMObject
        https://bugs.webkit.org/show_bug.cgi?id=85191

        Reviewed by Adam Barth.

        The model with MediaStreamDescriptor and MediaStream (and LocalMediaStream)
        allows the JavaScript objects (MediaStream and LocalMediaStream) to be
        cleaned up while the MediaStreamDescriptor lives on to manage the stream in
        the platform. This happens for example when a URL is created to represent
        a MediaStream (using createObjectURL()). In that case, the MediaStreamDescriptor
        is put into the MediaStreamRegistry and even though the MediaStream object is
        lost, the URL still works since the descriptor is kept in the registry.

        The changes introduced in r113460 (http://webkit.org/b/83143) turned
        MediaStream and LocalMediaStream into ActiveDOMObjects. For example on page
        reload, LocalMediaStream calls MediaStreamCenter::didStopLocalMediaStream()
        via its ActiveDOMObject::stop() method. However, when a page reload occurs,
        the LocalMediaStream object may have been cleaned up already and
        MediaStreamCenter::didStopLocalMediaStream() will not be called.

        One way to make the behavior consistent would be to call
        MediaStreamCenter::didStopLocalMediaStream() when the descriptor is cleaned up,
        cause then we wouldn't be dependent on the LocalMediaStream object being alive.
        However, calling MediaStreamCenter::didStopLocalMediaStream() might not be the
        correct thing to do when all references to the descriptor are lost since there
        can be MediaStream objects constructed from the tracks of the LocalMediaStream
        that should continue to work. MediaStreamCenter::didStopLocalMediaStream() was
        intended for LocalMediaStream.stop() which is used to revoke access to devices;
        that should not necessarily happen when the descriptor of a LocalMediaStream is
        cleaned up. If it's necessary for some ports to signal to the platform that a
        MediaStreamDescriptor is cleaned up, then I would suggest adding a new function,
        willDestroyMediaStreamDescriptor(), to the MediaStreamCenter interface.

        The current resolution is to make MediaStream a ContextDestructionObserver
        instead of an ActiveDOMObject.

        Currently not testable.

        * Modules/mediastream/LocalMediaStream.cpp:
        (WebCore::LocalMediaStream::create):
        * Modules/mediastream/LocalMediaStream.h:
        (LocalMediaStream):
        * Modules/mediastream/LocalMediaStream.idl:
        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::create):
        (WebCore::MediaStream::MediaStream):
        (WebCore::MediaStream::scriptExecutionContext):
        * Modules/mediastream/MediaStream.h:

2012-05-07  Liam Quinn  <lquinn@rim.com>

        [BlackBerry] WWW-Authenticate header on 200 response pops up authentication dialog
        https://bugs.webkit.org/show_bug.cgi?id=85643

        Reviewed by George Staikos.

        RIM PR: 151992
        Ignore WWW-Authenticate header if the response code is not 401.
        Ignore Proxy-Authenticate header if the response code is not 407.

        Manual test added to observe whether the authentication dialog appears on a 200 response with WWW-Authenticate.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyHeaderReceived):

2012-05-07  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [TextPrompt] Event listeners and CSS style are not removed on detachment
        https://bugs.webkit.org/show_bug.cgi?id=85789

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/TextPrompt.js:
        (WebInspector.TextPrompt.prototype._attachInternal):
        (WebInspector.TextPrompt.prototype.detach):

2012-05-07  Csaba Osztrogonác  <ossy@webkit.org>

        Buildfix for buggy GCC
        https://bugs.webkit.org/show_bug.cgi?id=85781

        Reviewed by Zoltan Herczeg.

        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::MarginInfo::clearMargin):

2012-05-07  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [REGRESSION] Context menu for the left Script view gutter is broken
        https://bugs.webkit.org/show_bug.cgi?id=85785

        Reviewed by Pavel Feldman.

        Fixed remaining usages of WebInspector.save to be WebInspector.fileManager.save.

        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkLogView.prototype._exportAll):
        (WebInspector.NetworkLogView.prototype._exportRequest):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.FrameResourceTreeElement.prototype._appendSaveAsAction.doSave):
        (WebInspector.ResourceRevisionTreeElement.prototype._handleContextMenuEvent.doSave):
        * inspector/front-end/TextViewer.js:
        (WebInspector.TextViewer.prototype._contextMenu):


2012-05-07  Antti Koivisto  <antti@apple.com>

        Share stylesheet data structures between documents
        https://bugs.webkit.org/show_bug.cgi?id=85598

        Reviewed by Darin Adler.

        We currently make a copy of the data structures when restoring a cached stylesheet. This patch lets us share
        the data until someone uses a mutating CSSOM API to modify the sheet.
        
        The patch implements copy-on-write for the internal style sheet data structures. If any mutating CSSOM API is
        invoked, we check if the mutation is safe (there is only one client, the sheet is not cached). If not then the
        internal structures are copied and any existing CSSOM objects are re-attached to the new style tree. The copied
        tree is mutated while the other clients stay attached to the original tree.
        
        Sharing can save significant amount of memory on sites with large stylesheets. For example if you have
        multiple articles open on wsj.com this saves ~2.6MB per tab.
        
        Test: http/tests/css/shared-stylesheet-mutation.html
              http/tests/css/shared-stylesheet-mutation-preconstruct.html

        * css/CSSFontFaceRule.cpp:
        (WebCore::CSSFontFaceRule::reattach):
        (WebCore):
        * css/CSSFontFaceRule.h:
        (CSSFontFaceRule):
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::insertRule):
        (WebCore::CSSMediaRule::deleteRule):
        (WebCore::CSSMediaRule::reattach):
        (WebCore):
        * css/CSSMediaRule.h:
        (CSSMediaRule):
        * css/CSSPageRule.cpp:
        (WebCore::CSSPageRule::setSelectorText):
        (WebCore::CSSPageRule::reattach):
        (WebCore):
        * css/CSSPageRule.h:
        (CSSPageRule):
        * css/CSSRule.cpp:
        (WebCore::CSSRule::reattach):
        
            After the internal stylerule tree has been copied, the existing wrappers are re-attached using recursive reattach() function.

        * css/CSSRule.h:
        (WebCore):
        (CSSRule):
        * css/CSSStyleRule.cpp:
        (WebCore::CSSStyleRule::setSelectorText):
        (WebCore::CSSStyleRule::reattach):
        (WebCore):
        * css/CSSStyleRule.h:
        (CSSStyleRule):
        * css/CSSStyleSheet.cpp:
        (WebCore::StyleSheetInternal::StyleSheetInternal):
        (WebCore::StyleSheetInternal::isCacheable):
        (WebCore::StyleSheetInternal::ruleAt):
        
            Add ruleAt(), use it for both wrapper creation and reattaching.  Remove createChildRuleCSSOMWrapper .

        (WebCore):
        (WebCore::StyleSheetInternal::wrapperInsertRule):
        (WebCore::StyleSheetInternal::wrapperDeleteRule):
        
            Invalidation moves to the calling wrapper.

        (WebCore::StyleSheetInternal::addedToMemoryCache):
        (WebCore::StyleSheetInternal::removedFromMemoryCache):
        (WebCore::CSSStyleSheet::willMutateRules):
        
            This is called whenever StyleSheetInternal is going to be mutated. It will do copy-on-write if needed.
            
            Usually invoked by CSSStyleSheet::RuleMutation RAII type.

        (WebCore::CSSStyleSheet::didMutateRules):
        
            This is called after the mutation is complete and will trigger the style recalc in the document.

        (WebCore::CSSStyleSheet::didMutate):
        
            This is called directly after mutations that don't change StyleSheetInternal so don't require copy-on-write.

        (WebCore::CSSStyleSheet::reattachChildRuleCSSOMWrappers):
        (WebCore::CSSStyleSheet::setDisabled):
        (WebCore::CSSStyleSheet::insertRule):
        (WebCore::CSSStyleSheet::deleteRule):
        * css/CSSStyleSheet.h:
        (StyleSheetInternal):
        (WebCore::StyleSheetInternal::hasOneClient):
        (WebCore::StyleSheetInternal::isMutable):
        (WebCore::StyleSheetInternal::setMutable):
        
            Track mutability. Mutation is allowed only after willMutate call.

        (WebCore::StyleSheetInternal::isInMemoryCache):
        
            Track if the object is in memory cache.

        (WebCore::CSSStyleSheet::clearOwnerRule):
        (CSSStyleSheet):
        * css/MediaList.cpp:
        (WebCore::MediaList::setMediaText):
        (WebCore::MediaList::deleteMedium):
        (WebCore::MediaList::appendMedium):
        (WebCore::MediaList::didMutate):
        (WebCore):
        (WebCore::MediaList::reattach):
        * css/MediaList.h:
        (MediaList):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        (WebCore):
        (WebCore::StyleRuleCSSStyleDeclaration::willMutate):
        (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
        (WebCore::StyleRuleCSSStyleDeclaration::reattach):
        (WebCore::InlineCSSStyleDeclaration::didMutate):
        * css/PropertySetCSSStyleDeclaration.h:
        (WebCore::PropertySetCSSStyleDeclaration::willMutate):
        (WebCore::PropertySetCSSStyleDeclaration::didMutate):
        (StyleRuleCSSStyleDeclaration):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::WebKitCSSKeyframesRule::setName):
        (WebCore::WebKitCSSKeyframesRule::insertRule):
        (WebCore::WebKitCSSKeyframesRule::deleteRule):
        (WebCore::WebKitCSSKeyframesRule::reattach):
        (WebCore):
        * css/WebKitCSSKeyframesRule.h:
        (WebKitCSSKeyframesRule):
        * css/WebKitCSSRegionRule.cpp:
        (WebCore::WebKitCSSRegionRule::reattach):
        * css/WebKitCSSRegionRule.h:
        (WebKitCSSRegionRule):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::reparseStyleSheet):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::~CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::destroyDecodedData):
        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
        
            Don't copy when restoring. It is no longer necessary.
            Set the cache bit on the stylesheet.

        (WebCore::CachedCSSStyleSheet::saveParsedStyleSheet):

2012-05-06  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: Change boolean synchronous flag argument into enum in FileSystem API code
        https://bugs.webkit.org/show_bug.cgi?id=85741

        Reviewed by David Levin.

        No new tests as this change has no functional effects.

        * Modules/filesystem/DOMWindowFileSystem.cpp:
        (WebCore::DOMWindowFileSystem::webkitRequestFileSystem):
        * Modules/filesystem/LocalFileSystem.cpp:
        (WebCore::LocalFileSystem::requestFileSystem):
        * Modules/filesystem/LocalFileSystem.h:
        (LocalFileSystem):
        * Modules/filesystem/WorkerContextFileSystem.cpp:
        (WebCore::WorkerContextFileSystem::webkitRequestFileSystem):
        (WebCore::WorkerContextFileSystem::webkitRequestFileSystemSync):
        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL):
        * platform/FileSystemType.h: Added FileSystemSynchronousType enum.

2012-05-07  Antti Koivisto  <antti@apple.com>

        Revert the previous.

        Not reviewed.
        
        Apparently r116235 was already rolled out.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):

2012-05-07  Antti Koivisto  <antti@apple.com>

        REGRESSION(r116235): broke a lot of tests on all chromium debug bots
        https://bugs.webkit.org/show_bug.cgi?id=85773

        Not reviewed.

        Try to fix assert when scoped stylesheets are enabled.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):

2012-05-06  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: Move FileSystem API type definitions into a separate header file
        https://bugs.webkit.org/show_bug.cgi?id=85738

        Reviewed by David Levin.

        Move FileSystem API type definitions from AsyncFileSystem.h and
        AsyncFileSystemChromium.cpp for chromium port into a single separate
        header file: FileSystemType.h

        By doing this we make it clearer that every filesystem type can be
        found in the header file and also can save including entire
        AsyncFileSystem definition just for referring type enum value.

        No new tests as this change has no visible or functional changes.

        * Modules/filesystem/DOMFileSystemBase.cpp:
        (WebCore::pathToAbsolutePath):
        * Modules/filesystem/DOMWindowFileSystem.cpp:
        (WebCore::DOMWindowFileSystem::webkitRequestFileSystem):
        (WebCore::DOMWindowFileSystem::webkitResolveLocalFileSystemURL):
        (WebCore):
        * Modules/filesystem/DOMWindowFileSystem.h:
        * Modules/filesystem/LocalFileSystem.h:
        (LocalFileSystem):
        * Modules/filesystem/WorkerContextFileSystem.cpp:
        (WebCore::WorkerContextFileSystem::webkitRequestFileSystem):
        (WebCore::WorkerContextFileSystem::webkitRequestFileSystemSync):
        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemURL):
        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL):
        (WebCore):
        * Modules/filesystem/WorkerContextFileSystem.h:
        * platform/AsyncFileSystem.cpp:
        (WebCore::AsyncFileSystem::isValidType):
        (WebCore::AsyncFileSystem::create):
        (WebCore::AsyncFileSystem::openFileSystem):
        * platform/AsyncFileSystem.h:
        (AsyncFileSystem):
        (WebCore::AsyncFileSystem::type):
        (WebCore::AsyncFileSystem::AsyncFileSystem):
        * platform/FileSystemType.h: Added.
        (WebCore):
        * platform/blackberry/AsyncFileSystemBlackBerry.cpp:
        (WebCore::AsyncFileSystem::isValidType):
        (WebCore::AsyncFileSystem::create):
        (WebCore::AsyncFileSystem::openFileSystem):
        (WebCore::AsyncFileSystem::crackFileSystemURL):
        (WebCore::AsyncFileSystemBlackBerry::AsyncFileSystemBlackBerry):
        * platform/blackberry/AsyncFileSystemBlackBerry.h:
        (AsyncFileSystemBlackBerry):
        * platform/gtk/AsyncFileSystemGtk.cpp:
        (WebCore::AsyncFileSystem::isValidType):
        (WebCore::AsyncFileSystem::create):
        (WebCore::AsyncFileSystem::openFileSystem):
        (WebCore::AsyncFileSystem::crackFileSystemURL):
        (WebCore::AsyncFileSystemGtk::AsyncFileSystemGtk):
        * platform/gtk/AsyncFileSystemGtk.h:
        (AsyncFileSystemGtk):

2012-05-06  MORITA Hajime  <morrita@google.com>

        https://bugs.webkit.org/show_bug.cgi?id=85265
        [Shadow DOM] ShadowTree needs a better name

        Reviewed by Dimitri Glazkov.

        Renamed ShadowTree to ElementShadow, The ElementShadow class is
        going to be a facade of Shadow related APIs.

        Following renames follow:
        - Element::shadowTree() to Element::shadow()
        - ShadowRoot::tree() to ShadowRoot::owner()
        - ShadowTree::recalcShadowTreeStyle() to ElementShadow::recalcStyle()

        No new tests. Just renames.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.exp.in:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::shadowFor):
        (WebCore::shadowOfParent):
        (WebCore::ComposedShadowTreeWalker::traverseChild):
        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
        (WebCore::ComposedShadowTreeWalker::traverseParent):
        * dom/ContainerNodeAlgorithms.cpp:
        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument):
        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoTree):
        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument):
        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromTree):
        * dom/DOMAllInOne.cpp:
        * dom/Document.cpp:
        (WebCore::Document::buildAccessKeyMap):
        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore::Element::willRemove):
        (WebCore::Element::attach):
        (WebCore::Element::detach):
        (WebCore::Element::recalcStyle):
        (WebCore::Element::hasShadowRoot):
        (WebCore::Element::shadow):
        (WebCore::Element::ensureShadow):
        (WebCore::Element::ensureShadowRoot):
        (WebCore::Element::childrenChanged):
        * dom/Element.h:
        (WebCore):
        (Element):
        * dom/ElementRareData.h:
        (ElementRareData):
        (WebCore::ElementRareData::~ElementRareData):
        * dom/ElementShadow.cpp: Renamed from Source/WebCore/dom/ShadowTree.cpp.
        (WebCore):
        (WebCore::ElementShadow::ElementShadow):
        (WebCore::ElementShadow::~ElementShadow):
        (WebCore::validateShadowRoot):
        (WebCore::ElementShadow::addShadowRoot):
        (WebCore::ElementShadow::removeAllShadowRoots):
        (WebCore::ElementShadow::willRemove):
        (WebCore::ElementShadow::setParentTreeScope):
        (WebCore::ElementShadow::attach):
        (WebCore::ElementShadow::attachHost):
        (WebCore::ElementShadow::detach):
        (WebCore::ElementShadow::detachHost):
        (WebCore::ElementShadow::insertionPointFor):
        (WebCore::ElementShadow::selectionFor):
        (WebCore::ElementShadow::reattach):
        (WebCore::ElementShadow::childNeedsStyleRecalc):
        (WebCore::ElementShadow::needsStyleRecalc):
        (WebCore::ElementShadow::recalcStyle):
        (WebCore::ElementShadow::needsReattachHostChildrenAndShadow):
        (WebCore::ElementShadow::hostChildrenChanged):
        (WebCore::ElementShadow::setNeedsReattachHostChildrenAndShadow):
        (WebCore::ElementShadow::reattachHostChildrenAndShadow):
        * dom/ElementShadow.h: Renamed from Source/WebCore/dom/ShadowTree.h.
        (WebCore):
        (ElementShadow):
        (WebCore::ElementShadow::hasShadowRoot):
        (WebCore::ElementShadow::youngestShadowRoot):
        (WebCore::ElementShadow::oldestShadowRoot):
        (WebCore::ElementShadow::selector):
        (WebCore::ElementShadow::clearNeedsReattachHostChildrenAndShadow):
        (WebCore::ElementShadow::host):
        (ShadowRootVector):
        (WebCore::ShadowRootVector::ShadowRootVector):
        * dom/Node.cpp:
        (WebCore::oldestShadowRootFor):
        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::NodeRenderingContext):
        (WebCore::NodeRenderingContext::hostChildrenChanged):
        * dom/NodeRenderingContext.h:
        (WebCore):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::create):
        (WebCore::ShadowRoot::owner):
        * dom/ShadowRoot.h:
        (WebCore):
        (ShadowRoot):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::shadowFor):
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        (WebCore::TreeScopeAdopter::moveTreeToNewDocument):
        (WebCore::TreeScopeAdopter::moveShadowToNewDocument):
        * dom/TreeScopeAdopter.h:
        (TreeScopeAdopter):
        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::createShadowSubtree):
        (WebCore::ColorInputType::shadowColorSwatch):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::createShadowSubtree):
        (WebCore::FileInputType::multipleAttributeChanged):
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::findMainSummary):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::shadowSelect):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaControls):
        (WebCore::HTMLMediaElement::hasMediaControls):
        * html/HTMLSummaryElement.cpp:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::innerTextElement):
        (WebCore::HTMLTextAreaElement::updatePlaceholderText):
        * html/InputType.cpp:
        (WebCore::InputType::destroyShadowSubtree):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::handleMouseDownEvent):
        (WebCore::RangeInputType::createShadowSubtree):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::createShadowSubtree):
        (WebCore::TextFieldInputType::updatePlaceholderText):
        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::deleteBubbleTree):
        * html/shadow/HTMLContentElement.cpp:
        (WebCore::HTMLContentElement::parseAttribute):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::attach):
        (WebCore::InsertionPoint::detach):
        (WebCore::InsertionPoint::distributeHostChildren):
        (WebCore::InsertionPoint::clearDistribution):
        * html/shadow/InsertionPoint.h:
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderThumbElementOf):
        (WebCore::RenderSliderContainer::layout):
        (WebCore::trackLimiterElementOf):
        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::getDecorationRootAndDecoratedRoot):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::unbind):
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        * page/FocusController.cpp:
        (WebCore::FocusScope::focusScopeOf):
        (WebCore::FocusScope::focusScopeOwnedByShadowHost):
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::uploadButton):
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::updateReferencedText):
        (WebCore::SVGTRefElement::detachTarget):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::clearResourceReferences):
        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
        (WebCore::SVGUseElement::buildShadowTree):
        * testing/Internals.cpp:
        (WebCore::Internals::ensureShadowRoot):
        (WebCore::Internals::youngestShadowRoot):
        (WebCore::Internals::oldestShadowRoot):
        (WebCore::Internals::removeShadowRoot):

2012-05-06  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116235.
        http://trac.webkit.org/changeset/116235
        https://bugs.webkit.org/show_bug.cgi?id=85773

        broke a lot of tests on all chromium debug bots (Requested by
        caseq_ on #webkit).

        * bindings/objc/DOMCSS.mm:
        * css/CSSFontFaceRule.cpp:
        * css/CSSFontFaceRule.h:
        (CSSFontFaceRule):
        * css/CSSImportRule.cpp:
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::insertRule):
        (WebCore::CSSMediaRule::deleteRule):
        * css/CSSMediaRule.h:
        (CSSMediaRule):
        * css/CSSPageRule.cpp:
        (WebCore::CSSPageRule::setSelectorText):
        * css/CSSPageRule.h:
        (CSSPageRule):
        * css/CSSRule.cpp:
        * css/CSSRule.h:
        (CSSRule):
        (WebCore::CSSRule::parserContext):
        * css/CSSStyleRule.cpp:
        (WebCore::CSSStyleRule::setSelectorText):
        * css/CSSStyleRule.h:
        * css/CSSStyleSheet.cpp:
        (WebCore::StyleSheetInternal::StyleSheetInternal):
        (WebCore::StyleSheetInternal::isCacheable):
        (WebCore::StyleSheetInternal::createChildRuleCSSOMWrapper):
        (WebCore::StyleSheetInternal::wrapperInsertRule):
        (WebCore::StyleSheetInternal::wrapperDeleteRule):
        (WebCore::StyleSheetInternal::styleSheetChanged):
        (WebCore):
        (WebCore::CSSStyleSheet::setDisabled):
        (WebCore::CSSStyleSheet::item):
        (WebCore::CSSStyleSheet::insertRule):
        (WebCore::CSSStyleSheet::deleteRule):
        * css/CSSStyleSheet.h:
        (StyleSheetInternal):
        (WebCore::StyleSheetInternal::hasCharsetRule):
        (WebCore::CSSStyleSheet::styleSheetChanged):
        (CSSStyleSheet):
        * css/MediaList.cpp:
        (WebCore::MediaList::setMediaText):
        (WebCore::MediaList::deleteMedium):
        (WebCore::MediaList::appendMedium):
        (WebCore::MediaList::notifyChanged):
        * css/MediaList.h:
        (MediaList):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        (WebCore::PropertySetCSSStyleDeclaration::didMutate):
        (WebCore):
        (WebCore::StyleRuleCSSStyleDeclaration::setNeedsStyleRecalc):
        (WebCore::InlineCSSStyleDeclaration::setNeedsStyleRecalc):
        * css/PropertySetCSSStyleDeclaration.h:
        (WebCore::PropertySetCSSStyleDeclaration::setNeedsStyleRecalc):
        (PropertySetCSSStyleDeclaration):
        (StyleRuleCSSStyleDeclaration):
        * css/StylePropertySet.cpp:
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::WebKitCSSKeyframesRule::setName):
        (WebCore::WebKitCSSKeyframesRule::insertRule):
        (WebCore::WebKitCSSKeyframesRule::deleteRule):
        * css/WebKitCSSKeyframesRule.h:
        (WebKitCSSKeyframesRule):
        * css/WebKitCSSRegionRule.cpp:
        * css/WebKitCSSRegionRule.h:
        (WebKitCSSRegionRule):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::reparseStyleSheet):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::~CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::destroyDecodedData):
        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
        (WebCore::CachedCSSStyleSheet::saveParsedStyleSheet):

2012-05-06  Adam Barth  <abarth@webkit.org>

        Attempt to fix the !ENABLE(INSPECTOR) build by making InspectorValues
        available unconditionally.  We should probably rename these classes to
        JSONValues and move them into WebCore/platform.

        * inspector/InspectorValues.cpp:
        * inspector/InspectorValues.h:

2012-05-06  Adam Barth  <abarth@webkit.org>

        CSP violation reports should have all the fields required by the spec
        https://bugs.webkit.org/show_bug.cgi?id=85682

        Reviewed by Darin Adler.

        This patch updates our CSP violation reports to include all the fields
        in the spec.  We've discussed all these fields in the working group,
        and we have fairly high confidence that these are safe to expose.

        Tests: http/tests/security/contentSecurityPolicy/report-and-enforce.html
               http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.html
               http/tests/security/contentSecurityPolicy/report-blocked-uri.html
               http/tests/security/contentSecurityPolicy/report-only-from-header.html
               http/tests/security/contentSecurityPolicy/report-only.html
               http/tests/security/contentSecurityPolicy/report-uri-from-child-frame.html
               http/tests/security/contentSecurityPolicy/report-uri.html

        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::reportViolation):
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):

2012-05-06  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: FileSystem API's Entry.toURL() impl should return KURL instead of String
        https://bugs.webkit.org/show_bug.cgi?id=85736

        Change the return type of Entry::toURL() from String to KURL.

        Reviewed by David Levin.

        No new tests as this change should not have any visible impact in the javascript layer.

        * Modules/filesystem/EntryBase.cpp:
        (WebCore::EntryBase::toURL):
        * Modules/filesystem/EntryBase.h:
        * platform/AsyncFileSystem.h:
        * platform/blackberry/AsyncFileSystemBlackberry.cpp:
        (AsyncFileSystemBlackberry::toURL):
        * platform/blackberry/AsyncFileSystemBlackberry.h:
        * platform/gtk/AsyncFileSystemGtk.cpp:
        (AsyncFileSystemGtk::toURL):
        * platform/gtk/AsyncFileSystemGtk.h:

2012-05-06  Kentaro Hara  <haraken@chromium.org>

        [V8][Performance] Remove Isolate lookup from the call path
        to get a cached JS wrapper object by getDOMXXXXMap().
        https://bugs.webkit.org/show_bug.cgi?id=85205

        Reviewed by Adam Barth.

        The patch improves the performance of getting a cached JS wrapper
        by getDOMXXXXMap(). For example, it improves the performance
        of toV8(NodeList*) in getElementsByTagName(), getElementsByName(),
        getElementsByClassName() by 7 ~ 9%.

        Performance tests: https://bugs.webkit.org/attachment.cgi?id=139468

        The performance test results in my Linux desktop:

        getElementsByTagName :   40.76 ms => 37.52ms (+8.6%)
        getElementsByName :      41.02 ms => 37.42ms (+9.6%)
        getElementsByClassName : 40.32 ms => 37.68ms (+7.0%)

        Unfortunately we cannot observe performance improvement in
        Dromaeo/dom-query.html, which are testing getElementsByTagName(),
        getElementsByName(), getElementsByClassName(). This is because
        the bottleneck of these Dromaeo tests is not toV8(NodeList*) but
        .length and .nodeType accesses. The patch for optimizing them
        will be coming soon.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm: Modified as described above.
        (GenerateHeader):
        (GenerateNormalAttrGetter):
        (GetDomMapFunction):
        (NativeToJSValue):
        * bindings/v8/DOMData.cpp:
        (WebCore::DOMData::getCurrentStore):

        * bindings/scripts/test/V8/V8Float64Array.h: Updated run-bindings-tests results.
        (WebCore::V8Float64Array::wrap):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (WebCore::V8TestActiveDOMObject::wrap):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (WebCore::V8TestCustomNamedGetter::wrap):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (WebCore::V8TestEventConstructor::wrap):
        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
        (WebCore::TestEventTargetV8Internal::itemCallback):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (WebCore::V8TestEventTarget::wrap):
        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::TestInterfaceV8Internal::supplementalNodeAttrGetter):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (WebCore::V8TestInterface::wrap):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (WebCore::V8TestMediaQueryListListener::wrap):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (WebCore::V8TestNamedConstructor::wrap):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::readOnlyTestObjAttrAttrGetter):
        (WebCore::TestObjV8Internal::cachedAttribute1AttrGetter):
        (WebCore::TestObjV8Internal::cachedAttribute2AttrGetter):
        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        * bindings/scripts/test/V8/V8TestObj.h:
        (WebCore::V8TestObj::wrap):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (WebCore::V8TestSerializedScriptValueInterface::wrap):

2012-05-06  Adam Barth  <abarth@webkit.org>

        Content Security Policy reports should be reported with content-type application/json, should contain all required fields
        https://bugs.webkit.org/show_bug.cgi?id=61360

        Reviewed by Eric Seidel.

        This patch changes ContentSecurityPolicy to use JSON format for sending
        violation reports rather than wwwform-encoding.  This patch aligns our
        behavior with the specification and with Mozilla.  A follow up patch
        will update the list of fields in the report to match the spec.

        * loader/PingLoader.cpp:
        (WebCore::PingLoader::reportContentSecurityPolicyViolation):
        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::reportViolation):

2012-05-06  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] Support html5 download attribute.
        https://bugs.webkit.org/show_bug.cgi?id=85044

        Reviewed by Antonio Gomes.

        Pass download attribute filename to networkJob and it could be
        overridden by the Content-Disposition HTTP header's filename parameter.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::initialize):
        * platform/network/blackberry/ResourceRequest.h:
        (WebCore::ResourceRequest::setSuggestSaveName):
        (WebCore::ResourceRequest::suggestSaveName):
        (ResourceRequest):
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::ResourceRequest::initializePlatformRequest):

2012-05-06  Kenichi Ishibashi  <bashi@chromium.org>

        Disallow unquoted -webkit-font-feature-settings tags
        https://bugs.webkit.org/show_bug.cgi?id=85362

        Reviewed by Kent Tamura.

        Disallow unquoted tags to follow the current draft.
        http://dev.w3.org/csswg/css3-fonts/#font-feature-settings-prop

        No new tests. css3/font-feature-settings-parsing.html was updated.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFontFeatureTag): Accepts only 4-characters string.

2012-05-06  Raphael Kubo da Costa  <rakuco@webkit.org>

        Unreviewed build fix for r116260.

        COMPILE_ASSERT() does not expect a string in its second parameter.

        * platform/graphics/TextRun.cpp:
        (WebCore):

2012-05-06  Rob Buis  <rbuis@rim.com>

        Shrink TextRun object size
        https://bugs.webkit.org/show_bug.cgi?id=85751

        Reviewed by Darin Adler.

        Reorder the member variables in TextRun so it shrinks from 56 to 40 bytes on my 64-bit build. This is important
        for SVG, since RenderSVGText shrinks because of this.

        Also add a compile assert for the expected object size.

        * platform/graphics/TextRun.cpp:
        (ExpectedTextRunSize):
        (WebCore):
        * platform/graphics/TextRun.h:
        (WebCore::TextRun::TextRun):
        (WebCore::TextRun::direction):
        (TextRun):

2012-05-06  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] Autofill backing store implementation upstream
        https://bugs.webkit.org/show_bug.cgi?id=85575

        Reviewed by Rob Buis.

        Implemented class AutofillBackingStore which is responsible
        for handling interaction with autofill database.

        Replaced static function
        CredentialBackingStore* CredentialBackingStore::instance()
        with a helper function
        CredentialBackingStore& credentialBackingStore(),
        and used DEFINE_STATIC_LOCAL to construct the singleton
        object.
        Also removed unnecessary function close() and combined with
        the destructor of class CredentialBackingStore.

        Initial upstream, No new tests.

        * PlatformBlackBerry.cmake:
        * platform/network/blackberry/AutofillBackingStore.cpp: Added.
        (WebCore):
        (WebCore::autofillBackingStore):
        (WebCore::AutofillBackingStore::AutofillBackingStore):
        (WebCore::AutofillBackingStore::~AutofillBackingStore):
        (WebCore::AutofillBackingStore::open):
        (WebCore::AutofillBackingStore::add):
        (WebCore::AutofillBackingStore::update):
        (WebCore::AutofillBackingStore::contains):
        (WebCore::AutofillBackingStore::get):
        (WebCore::AutofillBackingStore::clear):
        * platform/network/blackberry/AutofillBackingStore.h: Added.
        (WebCore):
        (AutofillBackingStore):
        * platform/network/blackberry/CredentialBackingStore.cpp:
        (WebCore::credentialBackingStore):
        (WebCore::CredentialBackingStore::~CredentialBackingStore):
        * platform/network/blackberry/CredentialBackingStore.h:
        (CredentialBackingStore):
        (WebCore):
        * platform/network/blackberry/CredentialStorageBlackBerry.cpp:
        (WebCore::CredentialStorage::getFromPersistentStorage):

2012-05-06  MORITA Hajime  <morrita@google.com>

        [Shadow DOM] Node distribution should be refreshed before style recalc.
        https://bugs.webkit.org/show_bug.cgi?id=85259

        Reviewed by Dimitri Glazkov.

        Element::recalcStyle() calls child element's recalcStyle()
        recursively, following ShadowTree::recalcShadowTreeStyle(). But
        recalcShadowTreeStyle() should be called before such recursion if
        necessary.

        This is because style calculation and following renderer attachment
        of each child element depends on up-to-date node distribution result
        which is computed during the recalcShadowTreeStyle().

        Test: fast/dom/shadow/shadow-dynamic-style-change-via-mutation-and-selector.html

        * dom/Element.cpp: Moved recalcShadowTreeStyle() before child traversals.
        (WebCore::Element::recalcStyle):

2012-05-06  Adam Barth  <abarth@webkit.org>

        CSP should let sites both enforce one policy and monitor another
        https://bugs.webkit.org/show_bug.cgi?id=85561

        Reviewed by Eric Seidel.

        This patch lets us enforce and/or monitor multiple CSP policies.
        Rather than having a single directive list, we now have a vector of
        directive lists.

        Tests: http/tests/security/contentSecurityPolicy/combine-multiple-policies.html
               http/tests/security/contentSecurityPolicy/report-and-enforce.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::copyStateFrom):
        (WebCore::ContentSecurityPolicy::didReceiveHeader):
        (WebCore::ContentSecurityPolicy::deprecatedHeader):
        (WebCore::ContentSecurityPolicy::deprecatedHeaderType):
            - Even after this patch, workers aren't smart enough to enforce
              multiple policies.  They just use the first header, like they did
              before.  We'll need to teach workers how to enforce multiple
              policies in a future patch.
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
        (WebCore::ContentSecurityPolicy::allowInlineScript):
        (WebCore::ContentSecurityPolicy::allowInlineStyle):
        (WebCore::ContentSecurityPolicy::allowEval):
        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
        (WebCore::ContentSecurityPolicy::allowImageFromSource):
        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
        (WebCore::ContentSecurityPolicy::allowFontFromSource):
        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
        (WebCore::ContentSecurityPolicy::allowConnectFromSource):
        * page/ContentSecurityPolicy.h:
        * workers/DefaultSharedWorkerRepository.cpp:
        (WebCore::SharedWorkerScriptLoader::notifyFinished):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerContext):

2012-05-06  Rob Buis  <rbuis@rim.com>

        InlineBox::setHasBadParent should be debug only
        https://bugs.webkit.org/show_bug.cgi?id=85748

        Reviewed by Eric Seidel.

        Do not provide InlineBox::setHasBadParent in release builds.

        * rendering/InlineBox.h:
        (InlineBox):
        (WebCore):
        (WebCore::InlineBox::setHasBadParent):

2012-05-06  Mike West  <mkwst@chromium.org>

        KURL::isBlankURL would be a nicer idiom than KURL::protocolIs("about")
        https://bugs.webkit.org/show_bug.cgi?id=85641

        Reviewed by Adam Barth.

        * dom/Document.cpp:
        (WebCore::shouldInheritSecurityOriginFromOwner):
        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::allowObjectFromSource):
        (WebCore::CSPDirectiveList::allowChildFrameFromSource):
        * page/PageSerializer.cpp:
        (WebCore::SerializerMarkupAccumulator::appendCustomAttributes):
        (WebCore::PageSerializer::serializeFrame):
        * platform/KURL.cpp:
        (WebCore::KURL::isBlankURL):
        (WebCore):
        * platform/KURL.h:
        (KURL):
        (WebCore):

2012-05-06  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] Layer images is uploaded to the GPU for each sync
        https://bugs.webkit.org/show_bug.cgi?id=85727

        Reviewed by Noam Rosenthal.

        No new tests. This does not change functionality,
        it only improves performance.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::updateBackingStore): Reset the needsDisplay
        and needsDisplayRect variables after uploading the layer image.

2012-05-06  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Convert isPageBoxVisible to use Internals interface.
        https://bugs.webkit.org/show_bug.cgi?id=85692

        Reviewed by Darin Adler.

        Add isPageBoxVisible functions, because it is able to work in the
        cross-port way through the Internals interface.

        No new tests, since we are improving here the infra-structure for testing
        a specific method.

        * testing/Internals.cpp:
        (WebCore):
        (WebCore::Internals::isPageBoxVisible):
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2012-05-06  Eugene Klyuchnikov  <eustas.bug@gmail.com>

        Web Inspector: "Goto Function" filtering should be less restrictive.
        https://bugs.webkit.org/show_bug.cgi?id=85586

        Reviewed by Pavel Feldman.

        Added tests for generated regex.

        Changes:
        1) Avoid asterisks in filtering queue.
        2) Optimization: do not create regexp for each item.

        * inspector/front-end/FilteredItemSelectionDialog.js: 
        (WebInspector.FilteredItemSelectionDialog.prototype.get _itemsLoaded):
        Applied new filtering workflow.
        (WebInspector.FilteredItemSelectionDialog.prototype._checkItemAt):
        Removed.
        (WebInspector.FilteredItemSelectionDialog.prototype._createSearchRegExp):
        Removed unused "suffix" logic; changed the way regexp is composed from query.
        (WebInspector.FilteredItemSelectionDialog.prototype._filterItems):
        Applied new filtering workflow.
        (WebInspector.FilteredItemSelectionDialog.prototype._onKeyDown):
        Removed unused var.

2012-05-06  Kent Tamura  <tkent@chromium.org>

        Rename ICULocale to LocaleICU, part 2
        https://bugs.webkit.org/show_bug.cgi?id=85695

        Reviewed by Kentaro Hara.

        No behavior change

        * platform/text/LocaleICU.cpp: Rename ICULocale to LocaleICU.
        * platform/text/LocaleICU.h: ditto.
        Also, update obsolete comments.
        * platform/text/LocalizedDateICU.cpp: Rename ICULocale to LocaleICU.
        (WebCore::parseLocalizedDate):
        (WebCore::formatLocalizedDate):
        (WebCore::localizedDateFormatText):
        (WebCore::monthLabels):
        (WebCore::weekDayShortLabels):
        (WebCore::firstDayOfWeek):
        * platform/text/LocalizedNumberICU.cpp: ditto.
        (WebCore::convertToLocalizedNumber):
        (WebCore::convertFromLocalizedNumber):

2012-05-06  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed. Build fixes for recent trunk changes.

        * platform/graphics/SimpleFontData.h:
        (SimpleFontData):
        * platform/graphics/wx/FontPlatformData.h:
        (FontPlatformData):
        (WebCore::FontPlatformData::isCompositeFontReference):
        * platform/graphics/wx/SimpleFontDataWx.cpp:
        (WebCore):
        (WebCore::SimpleFontData::getCompositeFontReferenceFontData):
        * plugins/mac/PluginViewMac.mm:
        * rendering/RenderObject.h:

2012-05-06  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: take timeline frame mode out of experimental
        https://bugs.webkit.org/show_bug.cgi?id=85707

        Reviewed by Pavel Feldman.

        - remove "Vertical timeline overview" experiment;
        - add supportsFrameInstrumentation capability to InspectorTimelineAgent;
        - show frame mode selector conditionally on supportsFrameInstrumentation capability.

        * inspector/Inspector.json: Add Timeline.supportsFrameInstrumentation capability;
        * inspector/InspectorClient.h: Add supportsFrameInstrumentation();
        (InspectorClient):
        (WebCore::InspectorClient::supportsFrameInstrumentation):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::supportsFrameInstrumentation):
        (WebCore):
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent): Added FrameInstrumentationSupport parameter.
        * inspector/InspectorTimelineAgent.h:
        (WebCore):
        (WebCore::InspectorTimelineAgent::create): ditto.
        (InspectorTimelineAgent):
        * inspector/WorkerInspectorController.cpp: Updated call site for InspectorTimelineAgent::create() to indicate frame instrumentation not supported.
        (WebCore::WorkerInspectorController::WorkerInspectorController):
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings): Removed "Vertical Overview" experiment.
        * inspector/front-end/TimelineOverviewPane.js: Expose frame mode conditionally on capability, not the experiment.
        (WebInspector.TimelineOverviewPane):
        * inspector/front-end/inspector.js: Added initialization for Capabilities.timelineSupportsFrameInstrumentation;
        (WebInspector.doLoadedDone):

2012-05-06  Antti Koivisto  <antti@apple.com>

        Build fix.

        Not reviewed.

        * css/PropertySetCSSStyleDeclaration.cpp:

2012-05-04  Antti Koivisto  <antti@apple.com>

        Share stylesheet data structures between documents
        https://bugs.webkit.org/show_bug.cgi?id=85598

        Reviewed by Darin Adler.

        We currently make a copy of the data structures when restoring a cached stylesheet. This patch lets us share
        the data until someone uses CSSOM to modify the sheet.
        
        The patch implements copy-on-write for the internal style sheet data structures. If any mutation CSSOM API is
        invoked, we check if the stylesheet can be safely mutated (we are the only client, it is not cached). If not
        then the internal structures are copied and any existing CSSOM objects are re-attached to the new tree.
        
        Sharing can save significant amount of memory on sites with large stylesheets. For example if you have
        multiple articles open on wsj.com this saves ~2.6MB per tab.
        
        Test: http/tests/css/shared-stylesheet-mutation.html
              http/tests/css/shared-stylesheet-mutation-preconstruct.html

        * css/CSSFontFaceRule.cpp:
        (WebCore::CSSFontFaceRule::reattach):
        (WebCore):
        * css/CSSFontFaceRule.h:
        (CSSFontFaceRule):
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::insertRule):
        (WebCore::CSSMediaRule::deleteRule):
        (WebCore::CSSMediaRule::reattach):
        (WebCore):
        * css/CSSMediaRule.h:
        (CSSMediaRule):
        * css/CSSPageRule.cpp:
        (WebCore::CSSPageRule::setSelectorText):
        (WebCore::CSSPageRule::reattach):
        (WebCore):
        * css/CSSPageRule.h:
        (CSSPageRule):
        * css/CSSRule.cpp:
        (WebCore::CSSRule::reattach):
        
            After the internal stylerule tree has been copied, the existing wrappers are re-attached using recursive reattach() function.

        * css/CSSRule.h:
        (WebCore):
        (CSSRule):
        * css/CSSStyleRule.cpp:
        (WebCore::CSSStyleRule::setSelectorText):
        (WebCore::CSSStyleRule::reattach):
        (WebCore):
        * css/CSSStyleRule.h:
        (CSSStyleRule):
        * css/CSSStyleSheet.cpp:
        (WebCore::StyleSheetInternal::StyleSheetInternal):
        (WebCore::StyleSheetInternal::isCacheable):
        (WebCore::StyleSheetInternal::ruleAt):
        
            Add ruleAt(), use it for both wrapper creation and reattaching.  Remove createChildRuleCSSOMWrapper .

        (WebCore):
        (WebCore::StyleSheetInternal::wrapperInsertRule):
        (WebCore::StyleSheetInternal::wrapperDeleteRule):
        
            Invalidation moves to the calling wrapper.

        (WebCore::StyleSheetInternal::addedToMemoryCache):
        (WebCore::StyleSheetInternal::removedFromMemoryCache):
        (WebCore::CSSStyleSheet::willMutateRules):
        
            This is called whenever StyleSheetInternal is going to be mutated. It will do copy-on-write if needed.
            
            Usually invoked by CSSStyleSheet::RuleMutation RAII type.

        (WebCore::CSSStyleSheet::didMutateRules):
        
            This is called after the mutation is complete and will trigger the style recalc in the document.

        (WebCore::CSSStyleSheet::didMutate):
        
            This is called directly after mutations that don't change StyleSheetInternal so don't require copy-on-write.

        (WebCore::CSSStyleSheet::reattachChildRuleCSSOMWrappers):
        (WebCore::CSSStyleSheet::setDisabled):
        (WebCore::CSSStyleSheet::insertRule):
        (WebCore::CSSStyleSheet::deleteRule):
        * css/CSSStyleSheet.h:
        (StyleSheetInternal):
        (WebCore::StyleSheetInternal::hasOneClient):
        (WebCore::StyleSheetInternal::isMutable):
        (WebCore::StyleSheetInternal::setMutable):
        
            Track mutability. Mutation is allowed only after willMutate call.

        (WebCore::StyleSheetInternal::isInMemoryCache):
        
            Track if the object is in memory cache.

        (WebCore::CSSStyleSheet::clearOwnerRule):
        (CSSStyleSheet):
        * css/MediaList.cpp:
        (WebCore::MediaList::setMediaText):
        (WebCore::MediaList::deleteMedium):
        (WebCore::MediaList::appendMedium):
        (WebCore::MediaList::didMutate):
        (WebCore):
        (WebCore::MediaList::reattach):
        * css/MediaList.h:
        (MediaList):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
        (WebCore):
        (WebCore::StyleRuleCSSStyleDeclaration::willMutate):
        (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
        (WebCore::StyleRuleCSSStyleDeclaration::reattach):
        (WebCore::InlineCSSStyleDeclaration::didMutate):
        * css/PropertySetCSSStyleDeclaration.h:
        (WebCore::PropertySetCSSStyleDeclaration::willMutate):
        (WebCore::PropertySetCSSStyleDeclaration::didMutate):
        (StyleRuleCSSStyleDeclaration):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::WebKitCSSKeyframesRule::setName):
        (WebCore::WebKitCSSKeyframesRule::insertRule):
        (WebCore::WebKitCSSKeyframesRule::deleteRule):
        (WebCore::WebKitCSSKeyframesRule::reattach):
        (WebCore):
        * css/WebKitCSSKeyframesRule.h:
        (WebKitCSSKeyframesRule):
        * css/WebKitCSSRegionRule.cpp:
        (WebCore::WebKitCSSRegionRule::reattach):
        * css/WebKitCSSRegionRule.h:
        (WebKitCSSRegionRule):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::reparseStyleSheet):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::~CachedCSSStyleSheet):
        (WebCore::CachedCSSStyleSheet::destroyDecodedData):
        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
        
            Don't copy when restoring. It is no longer necessary.
            Set the cache bit on the stylesheet.

        (WebCore::CachedCSSStyleSheet::saveParsedStyleSheet):

2012-05-05  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116221.
        http://trac.webkit.org/changeset/116221
        https://bugs.webkit.org/show_bug.cgi?id=85722

        broke builds that use -Wshorten-64-to-32 (Requested by pizlo
        on #webkit).

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore):
        (WebCore::WebGLRenderingContext::bufferData):
        (WebCore::WebGLRenderingContext::bufferSubData):
        (WebCore::WebGLRenderingContext::drawElements):
        (WebCore::WebGLRenderingContext::getVertexAttribOffset):
        (WebCore::WebGLRenderingContext::vertexAttribPointer):
        * html/canvas/WebGLRenderingContext.h:
        (WebGLRenderingContext):
        * html/canvas/WebGLRenderingContext.idl:

2012-05-05  Martin Robinson  <mrobinson@igalia.com>

        [GTK] WebKit should properly set the input method context window location
        https://bugs.webkit.org/show_bug.cgi?id=84981

        Reviewed by Gustavo Noronha Silva.

        * platform/gtk/GtkInputMethodFilter.cpp:
        (WebCore::GtkInputMethodFilter::setCursorRect): Add this method to plumb the
        cursor rect through to the input method.
        * platform/gtk/GtkInputMethodFilter.h: Add the new method declaration.

2012-05-05  Dean Jackson  <dino@apple.com>

        Add new Setting/Preference to disable requestAnimationFrame
        https://bugs.webkit.org/show_bug.cgi?id=85693

        Reviewed by Simon Fraser.

        Hook up the new WebPreference for disabling requestAnimationFrame
        to Settings. This isn't disabling the feature in the typical
        WebKit ENABLE() way - it's still available in the DOM, it's
        just that the animations will never be serviced. This allows a client
        to disable the machinery without breaking content (other than the
        animations).

        The new test is currently skipped on all platforms because toggling
        the preference interferes with the other tests that are running
        at the same time (and expect a working requestAnimationFrame).
        https://bugs.webkit.org/show_bug.cgi?id=85689

        Test: fast/animation/request-animation-frame-disabled.html

        * dom/ScriptedAnimationController.cpp:
        (WebCore::ScriptedAnimationController::serviceScriptedAnimations):
        (WebCore::ScriptedAnimationController::windowScreenDidChange):
        (WebCore::ScriptedAnimationController::scheduleAnimation):
        Check the setting before deciding to act.
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setRequestAnimationFrameEnabled):
        (WebCore::Settings::requestAnimationFrameEnabled):
        (Settings):

2012-05-05  Gustavo Noronha Silva  <gns@gnome.org>

        Unreviewed, make distcheck fix.

        * GNUmakefile.list.am: Add missing headers to the sources list.

2012-05-05  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: convert standalone functions save/append/savedURL/appendedToURL into WebInspector.FileManager object.
        https://bugs.webkit.org/show_bug.cgi?id=85710

        The idea is to have an object and be able to add/remove event listeners from it.

        Reviewed by Yury Semikhatsky.

        * English.lproj/localizedStrings.js:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/FileManager.js: Copied from Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js.
        (WebInspector.FileManager):
        (WebInspector.FileManager.prototype.canSave):
        (WebInspector.FileManager.prototype.canAppend):
        (WebInspector.FileManager.prototype.append):
        (WebInspector.FileManager.prototype.appendedToURL):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapProfileHeader.prototype.canSave):
        (WebInspector.HeapProfileHeader.prototype.save):
        * inspector/front-end/InspectorFrontendHostStub.js:
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-05-05  Zhenyao Mo  <zmo@google.com>

        vertexAttribPointer needs to reject large negative offsets
        https://bugs.webkit.org/show_bug.cgi?id=85117

        Reviewed by Kenneth Russell.

        * html/canvas/WebGLRenderingContext.cpp: Use long long for GLsizeiptr and GLintptr
        (WebCore):
        (WebCore::WebGLRenderingContext::bufferData):
        (WebCore::WebGLRenderingContext::bufferSubData):
        (WebCore::WebGLRenderingContext::drawElements):
        (WebCore::WebGLRenderingContext::getVertexAttribOffset):
        (WebCore::WebGLRenderingContext::vertexAttribPointer):
        * html/canvas/WebGLRenderingContext.h: Ditto
        (WebGLRenderingContext):
        * html/canvas/WebGLRenderingContext.idl: Ditto

2012-05-05  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: add separate timeline overview item for the frame mode
        https://bugs.webkit.org/show_bug.cgi?id=85706

        - remove two-buttons horizontal/vertical mode switch from Timelines item of the timeline overview menu;
        - rename "Timeline" into "Events";
        - add "Frames" item;
        - replace overview sidebar icons with smaller, monochrome ones.

        * English.lproj/localizedStrings.js: Added "Frames" and "Events".
        * inspector/front-end/Images/statusbarButtonGlyphs.png: Added icon for "Memory".
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane):
        (WebInspector.TimelineOverviewPane.prototype._showEvents):
        (WebInspector.TimelineOverviewPane.prototype._showFrames):
        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
        (WebInspector.TimelineOverviewPane.prototype._setMode):
        * inspector/front-end/timelinePanel.css:
        (#timeline-overview-sidebar .sidebar-tree-item):
        (#timeline-overview-sidebar .sidebar-tree-item .titles.no-subtitle):
        (#timeline-overview-sidebar .icon):
        (.timeline-overview-sidebar-events .icon):
        (.timeline-overview-sidebar-frames .icon):
        (.timeline-overview-sidebar-memory .icon):

2012-05-05  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: save HeapSnapshot implementation.
        https://bugs.webkit.org/show_bug.cgi?id=85595

        HeapSnapshot specific implementation for loading was moved
        from ProfilesPanel to HeapProfileHeader class.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotView.prototype.get profileWrapper):
        (WebInspector.HeapSnapshotView.prototype.get baseProfileWrapper):
        (WebInspector.HeapProfileHeader):
        (WebInspector.HeapProfileHeader.prototype.load.setProfileWait):
        (WebInspector.HeapProfileHeader.prototype.load.done):
        (WebInspector.HeapProfileHeader.prototype.load):
        (WebInspector.HeapProfileHeader.prototype._saveStatusUpdate):
        (WebInspector.HeapProfileHeader.prototype.pushJSONChunk):
        (WebInspector.HeapProfileHeader.prototype.finishHeapSnapshot):
        (WebInspector.HeapProfileHeader.prototype.canSave):
        (WebInspector.HeapProfileHeader.prototype.save):
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.appendedToURL):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._registerProfileType):
        (WebInspector.ProfilesPanel.prototype._handleContextMenuEvent):
        (WebInspector.ProfilesPanel.prototype.loadHeapSnapshot):
        (WebInspector.ProfilesPanel.prototype._addHeapSnapshotChunk):
        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot):
        (WebInspector.ProfileSidebarTreeElement.prototype.set searchMatches):
        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):
        * inspector/front-end/inspector.js:
        (WebInspector.append):
        (WebInspector.appendedToURL):

2012-05-05  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: allow overriding the script mapping on the UI level
        https://bugs.webkit.org/show_bug.cgi?id=85702

        Reviewed by Yury Semikhatsky.

        This allows formatting update live locations all over the place automatically.

        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.rawLocationToUILocation):
        (WebInspector.Script.Location):
        (WebInspector.Script.Location.prototype.update):
        (WebInspector.Script.Location.prototype.dispose):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):
        (WebInspector.UISourceCode.prototype.addLiveLocation):
        (WebInspector.UISourceCode.prototype.removeLiveLocation):
        (WebInspector.UISourceCode.prototype.updateLiveLocations):
        (WebInspector.UISourceCode.prototype.overrideLocation):

2012-05-05  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: simplify the JavaScriptOutline dialog interaction.
        https://bugs.webkit.org/show_bug.cgi?id=85701

        Reviewed by Yury Semikhatsky.

        Removed bidirectional dependency between scripts panel and outline dialog.

        * inspector/front-end/FilteredItemSelectionDialog.js:
        (WebInspector.JavaScriptOutlineDialog):
        (WebInspector.JavaScriptOutlineDialog.show):
        (WebInspector.JavaScriptOutlineDialog.prototype.requestItems):
        (WebInspector.JavaScriptOutlineDialog.prototype._didBuildOutlineChunk):
        (WebInspector.JavaScriptOutlineDialog.prototype.selectItem):
        * inspector/front-end/ScriptFormatterWorker.js:
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.addToWatch):
        (WebInspector.ScriptsPanel.prototype._showJavaScriptOutlineDialog):

2012-05-04  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: annotate ProfilerAgent.
        https://bugs.webkit.org/show_bug.cgi?id=85630

        Reviewed by Pavel Feldman.

        * inspector/Inspector.json:
        * inspector/InspectorProfilerAgent.cpp:
        (WebCore::InspectorProfilerAgent::createProfileHeader):
        (WebCore::InspectorProfilerAgent::createSnapshotHeader):
        (WebCore::InspectorProfilerAgent::getProfileHeaders):
        (WebCore):
        (WebCore::InspectorProfilerAgent::getProfile):
        * inspector/InspectorProfilerAgent.h:
        (InspectorProfilerAgent):
        * inspector/front-end/CSSSelectorProfileView.js:
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotProfileType.prototype.createProfile):
        * inspector/front-end/ProfileView.js:
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
        (WebInspector.ProfilesPanel.prototype._addHeapSnapshotChunk):
        (WebInspector.ProfilerDispatcher.prototype.resetProfiles):

2012-05-04  Gustavo Noronha Silva  <gns@gnome.org>

        [GTK] Simplify how libWebCoreModules is linked in, and fix WebKit2 build
        https://bugs.webkit.org/show_bug.cgi?id=85691

        * GNUmakefile.am: link libWebCoreModules into libWebCore.

2012-05-04  Kent Tamura  <tkent@chromium.org>

        Rename ICULocale to LocaleICU, part 1
        https://bugs.webkit.org/show_bug.cgi?id=85688

        Reviewed by Kentaro Hara.

        Rename it for consistency. Our convention is Foo<Platform>.{cpp,h}.
        This patch changes only file names. We'll rename ICULocale class
        by a following patch.

        No behavior changes.

        * WebCore.gypi:
        * platform/text/LocaleICU.cpp: Renamed from Source/WebCore/platform/text/ICULocale.cpp.
        * platform/text/LocaleICU.h: Renamed from Source/WebCore/platform/text/ICULocale.h.
        * platform/text/LocalizedDateICU.cpp: Rename ICULocale.h to LocaleICU.h.
        * platform/text/LocalizedNumberICU.cpp: ditto.

2012-05-04  Julien Chaffraix  <jchaffraix@webkit.org>

        Leaf non self-painting layers should bail out early in RenderLayer::paintLayer
        https://bugs.webkit.org/show_bug.cgi?id=85678

        Reviewed by Darin Adler.

        Performance optimization, no expected change in behavior.

        The gist of the change is that leaf non self-painting layers don't need to be painted as their
        associated RenderBoxModelObject should properly paint itself without any help.

        For RenderLayer trees that have a large number of leafs nodes (like a table with a leaf RenderLayer for
        each cells), not bailing out is a big overhead as it ends up doing a lot of computation for no real
        painting. See http://dglazkov.github.com/performance-tests/biggrid.html for a benchmark for that. On
        my machine, it reduces the paint time when scrolling to 70ms from 120ms (45% speedup).

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintLayer):

2012-05-04  Rob Buis  <rbuis@rim.com>

        Remove InlineBox::next()
        https://bugs.webkit.org/show_bug.cgi?id=85668

        Reviewed by Nikolas Zimmermann.

        InlineBox::next() not needed since nextOnLine() does the same.

        * rendering/InlineBox.h:
        (InlineBox):
        * rendering/InlineFlowBox.h:
        (WebCore::InlineFlowBox::setConstructed):

2012-05-04  Chris Rogers  <crogers@google.com>

        Oscillator must implement noteOn() and noteOff()
        https://bugs.webkit.org/show_bug.cgi?id=85236

        Reviewed by Kenneth Russell.

        Test: webaudio/oscillator-scheduling.html
        to be landed separately to get proper platform baselines

        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::process):
        Simplify/remove zeroing-out silence at end of buffer, since it's now handled in the base-class AudioScheduledSourceNode::updateSchedulingInfo().

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createBufferSource):
        Improve comment about ownership and dynamic-lifetime of AudioBufferSourceNode.

        (WebCore::AudioContext::createOscillator):
        AudioContext keeps a reference to the Oscillator and that reference is released in AudioScheduledSourceNode,
        when it has finished playing.

        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::updateSchedulingInfo):
        updateSchedulingInfo() is now responsible for zeroing out the very start (before a note starts)
        and the very end (after note ends) of the output AudioBus.  We've also simplified the number
        of arguments passed to this method, because of this. It now handles playbackState transition to FINISHED_STATE.

        * Modules/webaudio/Oscillator.cpp:
        (WebCore::Oscillator::Oscillator):
        (WebCore::Oscillator::calculateSampleAccuratePhaseIncrements):
        The frequency value needs to snap immediately to its correct value the very first time.
        This bug needs to be fixed here so that the Oscillator layout scheduling test works correctly.

        (WebCore::Oscillator::process):
        Since Oscillator in now changing to be a AudioScheduledSourceNode, we need to call AudioScheduledSourceNode::updateSchedulingInfo()
        to handle playbackState for us.

        (WebCore::Oscillator::propagatesSilence):
        Add scheduling logic for propagatesSilence().

        (Oscillator):
        * Modules/webaudio/Oscillator.idl:
        Add noteOn(), noteOff() methods and playbackState according to specification.

2012-05-04  Andy Estes  <aestes@apple.com>

        Remove uses of ASSERT(false)
        https://bugs.webkit.org/show_bug.cgi?id=85686

        Reviewed by Dean Jackson.

        Replace uses of ASSERT(false) with ASSERT_NOT_REACHED(). Also, in two places, there was code structured like:

        if (expr) {
            // do something
        } else {
            ASSERT(false);
        }

        Replace this with:

        ASSERT(expr);
        if (!expr)
            return;

        // do something

        * Modules/webdatabase/DatabaseTracker.cpp:
        (WebCore::DatabaseTracker::deleteOrigin):
        (WebCore::DatabaseTracker::doneCreatingDatabase):
        (WebCore::DatabaseTracker::doneDeletingDatabase):
        (WebCore::DatabaseTracker::deleteDatabase):
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::invokeObjcMethod):
        * bridge/objc/objc_utility.mm:
        (JSC::Bindings::convertObjcValueToValue):
        (JSC::Bindings::objcValueTypeForType):
        * dom/Node.cpp:
        (WebCore::Node::createRenderer):
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::setIconURLForPageURLInSQLDatabase):
        (WebCore::IconDatabase::setIconIDForPageURLInSQLDatabase):
        * platform/graphics/GraphicsContext3D.cpp:
        (WebCore::doPacking):
        * platform/text/BidiResolver.h:
        (WebCore::::createBidiRunsForLine):

2012-05-04  Noel Gordon  <noel.gordon@gmail.com>

        [CG] Minor refactor of ImageBuffer::CGImageToDataURL and its callers
        https://bugs.webkit.org/show_bug.cgi?id=85280

        Reviewed by Kenneth Russell.

        This patch means to simplify the diff of an upcoming patch. Refactoring
        here in preparation for that patch.

        No new tests. No behavioral change. Covered by canvas 2d and 3d tests:
          canvas/philip/tests/*toDataURL*.html
          fast/canvas/webgl/premultiplyalpha-test.html

        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::CGImageToDataURL): Move the invalid image (!image) test here.
        The comments are about JPEG images; say that. Rename out to base64Data.
        (WebCore::ImageBuffer::toDataURL): Remove the !image test.
        (WebCore::ImageDataToDataURL): Move and define variables where used and
        make the code flow read similarly to toDataURL. Remove the !image test.

2012-05-04  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Changes to layer tree structure need to be tracked properly
        https://bugs.webkit.org/show_bug.cgi?id=85421

        Reviewed by Adrienne Walker.

        Unit test added: TreeSynchronizerTest.syncSimpleTreeAndTrackStackingOrderChange

        Earlier, we were relying on WebCore behavior that always called
        setNeedsDisplay whenever the layer tree structure changed.
        However, in general it is more correct to consider layer tree
        changes even when things don't need repainting; for example Aura
        code is encountring this bug now. This patch corrects the
        compositor so that layer tree structural changes are considered
        property changes, without requiring that layers needed to be
        repainted.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::insertChild):
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::setStackingOrderChanged):
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (CCLayerImpl):

2012-05-04  Jeffrey Pfau  <jpfau@apple.com>

        Unreviewed; build fix after r116191.

        * bindings/js/JSEventListener.h:

2012-05-04  Enrica Casucci  <enrica@apple.com>

        REGRESSION: Cursor jumps to the first line after deleting the last word.
        https://bugs.webkit.org/show_bug.cgi?id=85334
        <rdar://problem/11210059>

        Reviewed by Ryosuke Niwa.

        This regression was introduced with the work to remove redundant divs.
        When we decide to remove a DIV, we need to adjust the selection, if it is
        expressed in terms of the node being removed. The new position was computed
        using updatePositionForNodeRemoval that was not designed for the case where we
        remove preserving children.
        This patch adds a new method to CompositeEditCommand to do this properly.
        
        Test: editing/deleting/delete-word-from-unstyled-div.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::isRemovableBlock): Code clenup.
        (WebCore::CompositeEditCommand::updatePositionForNodeRemovalPreservingChildren): Added.
         * editing/CompositeEditCommand.h:
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::removeRedundantBlocks): Uses updatePositionForNodeRemovalPreservingChildren.

2012-05-04  Jeffrey Pfau  <jpfau@apple.com>

        Prevent early EventListener deletion
        https://bugs.webkit.org/show_bug.cgi?id=73970

        Reviewed by Oliver Hunt.

        Test: fast/events/attribute-listener-deletion-crash.html

        * bindings/js/JSEventListener.h:
        (WebCore::JSEventListener::jsFunction):

2012-05-04  Yongjun Zhang  <yongjun_zhang@apple.com>

        Add "combining short stroke overlay character (u0335)" to lookalike characters blacklist.
        https://bugs.webkit.org/show_bug.cgi?id=85440

        Reviewed by David Kilzer.

        We should add u0335 to the characters blacklist.

        * platform/mac/WebCoreNSURLExtras.mm:
        (WebCore::isLookalikeCharacter):

2012-05-04  Satoru Takabayashi  <satorux@chromium.org>

        [chromium] Add plumbing for file display names for drag and drop
        https://bugs.webkit.org/show_bug.cgi?id=85673

        Reviewed by Darin Fisher.

        No new tests: this change itself shouldn't change existing behavior.

        * platform/chromium/ChromiumDataObject.cpp:
        (WebCore::ChromiumDataObject::addFilename):
        * platform/chromium/ChromiumDataObject.h:
        (ChromiumDataObject):

2012-05-04  Levi Weintraub  <leviw@chromium.org>

        Correct pixel snapping in RenderSVGRoot::paintReplaced
        https://bugs.webkit.org/show_bug.cgi?id=85671

        Reviewed by Eric Seidel.

        SVG root elements are still painted on pixel boundaries, so their children should
        apply transforms based on their actual painted location, not their sub-pixel
        one. This corrects a clipping and painting issue where these sub-pixel units are
        incorrectly applied to the graphics context.

        Covered by existing tests when sub-pixel layout is enabled.

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::paintReplaced):

2012-05-04  Adam Barth  <abarth@webkit.org>

        Refactor CSP state to prepare for having both a ReportOnly and an Enforced policy
        https://bugs.webkit.org/show_bug.cgi?id=85662

        Reviewed by Eric Seidel.

        This patch refactors the ContentSecurityPolicy state into a separate
        DirectiveList class to prepare for
        https://bugs.webkit.org/show_bug.cgi?id=85561, which will cause us to
        need two directive lists: one for enforcement and one for monitoring.

        This patch shouldn't cause any change in behavior.

        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::header):
        (WebCore::CSPDirectiveList::headerType):
        (WebCore::CSPDirectiveList::denyIfEnforcingPolicy):
        (WebCore):
        (WebCore::CSPDirectiveList::CSPDirectiveList):
        (WebCore::CSPDirectiveList::create):
        (WebCore::CSPDirectiveList::reportViolation):
        (WebCore::CSPDirectiveList::logUnrecognizedDirective):
        (WebCore::CSPDirectiveList::checkEval):
        (WebCore::CSPDirectiveList::operativeDirective):
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
        (WebCore::CSPDirectiveList::allowInlineScript):
        (WebCore::CSPDirectiveList::allowInlineStyle):
        (WebCore::CSPDirectiveList::allowEval):
        (WebCore::CSPDirectiveList::allowScriptFromSource):
        (WebCore::CSPDirectiveList::allowObjectFromSource):
        (WebCore::CSPDirectiveList::allowChildFrameFromSource):
        (WebCore::CSPDirectiveList::allowImageFromSource):
        (WebCore::CSPDirectiveList::allowStyleFromSource):
        (WebCore::CSPDirectiveList::allowFontFromSource):
        (WebCore::CSPDirectiveList::allowMediaFromSource):
        (WebCore::CSPDirectiveList::allowConnectFromSource):
        (WebCore::CSPDirectiveList::parse):
        (WebCore::CSPDirectiveList::parseDirective):
        (WebCore::CSPDirectiveList::parseReportURI):
        (WebCore::CSPDirectiveList::createCSPDirective):
        (WebCore::CSPDirectiveList::applySandboxPolicy):
        (WebCore::CSPDirectiveList::addDirective):
        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
        (WebCore::ContentSecurityPolicy::~ContentSecurityPolicy):
        (WebCore::ContentSecurityPolicy::copyStateFrom):
        (WebCore::ContentSecurityPolicy::didReceiveHeader):
        (WebCore::ContentSecurityPolicy::setOverrideAllowInlineStyle):
        (WebCore::ContentSecurityPolicy::header):
        (WebCore::ContentSecurityPolicy::headerType):
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
        (WebCore::ContentSecurityPolicy::allowInlineScript):
        (WebCore::ContentSecurityPolicy::allowInlineStyle):
        (WebCore::ContentSecurityPolicy::allowEval):
        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
        (WebCore::ContentSecurityPolicy::allowImageFromSource):
        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
        (WebCore::ContentSecurityPolicy::allowFontFromSource):
        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
        (WebCore::ContentSecurityPolicy::allowConnectFromSource):
        * page/ContentSecurityPolicy.h:
        (WebCore):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerContext):

2012-05-04  Abhishek Arya  <inferno@chromium.org>

        ASSERT(beforeChildAnonymousContainer->isTable()); fails in RenderBlock::addChildIgnoringAnonymousColumnBlocks.
        https://bugs.webkit.org/show_bug.cgi?id=84606

        Reviewed by Julien Chaffraix.

        RenderBlock::removeChild forgot to set display on the anonymous block, causing it
        to display as INLINE. To prevent this kind of failure in future, we replace
        createAnonymousStyle with createAnonymousStyleWithDisplay to make everyone explictly
        pass display as the argument.

        Test: fast/block/block-add-child-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeChild): 
        (WebCore::RenderBlock::createAnonymousWithParentRendererAndDisplay):
        (WebCore::RenderBlock::createAnonymousColumnsWithParentRenderer):
        (WebCore::RenderBlock::createAnonymousColumnSpanWithParentRenderer):
        * rendering/RenderInline.cpp:
        (WebCore::updateStyleOfAnonymousBlockContinuations):
        (WebCore::RenderInline::addChildIgnoringContinuation):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::propagateStyleToAnonymousChildren):
        * rendering/RenderRuby.cpp:
        (WebCore::createAnonymousRubyInlineBlock):
        * rendering/RenderRubyRun.cpp:
        (WebCore::RenderRubyRun::createRubyBase):
        (WebCore::RenderRubyRun::staticCreateRubyRun):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::createAnonymousWithParentRenderer):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::createAnonymousWithParentRenderer):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::createAnonymousWithParentRenderer):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::createAnonymousWithParentRenderer):
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::RenderMathMLBlock::createAlmostAnonymousBlock):
        * rendering/mathml/RenderMathMLRow.cpp:
        (WebCore::RenderMathMLRow::createAnonymousWithParentRenderer):
        * rendering/mathml/RenderMathMLSubSup.cpp:
        (WebCore::RenderMathMLSubSup::addChild):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::createAnonymousStyleWithDisplay):
        * rendering/style/RenderStyle.h:

2012-04-27  Erik Arvidsson  <arv@chromium.org>

        WebKit IDL does not use exception syntax
        https://bugs.webkit.org/show_bug.cgi?id=85100

        Reviewed by Dimitri Glazkov.

        This adds support for exception ExceptionName { ... } which currently sets a flag
        on the domClass.

        Binding tests updated.

        * Modules/indexeddb/IDBDatabaseException.idl:
        * Modules/webdatabase/SQLException.idl:
        * bindings/scripts/IDLParser.pm:
        (ParseInterface):
        (DetermineParseMode):
        (ProcessSection):
        * bindings/scripts/IDLStructure.pm:
        * bindings/scripts/test/CPP/WebDOMTestException.cpp: Added.
        (WebDOMTestException::WebDOMTestExceptionPrivate::WebDOMTestExceptionPrivate):
        (WebDOMTestException::WebDOMTestExceptionPrivate):
        (WebDOMTestException::WebDOMTestException):
        (WebDOMTestException::operator=):
        (WebDOMTestException::impl):
        (WebDOMTestException::~WebDOMTestException):
        (WebDOMTestException::name):
        (toWebCore):
        (toWebKit):
        * bindings/scripts/test/CPP/WebDOMTestException.h: Added.
        (WebCore):
        (WebDOMTestException):
        * bindings/scripts/test/GObject/WebKitDOMTestException.cpp: Added.
        (WebKit):
        (WebKit::kit):
        (WebKit::core):
        (WebKit::wrapTestException):
        (webkit_dom_test_exception_finalize):
        (webkit_dom_test_exception_set_property):
        (webkit_dom_test_exception_get_property):
        (webkit_dom_test_exception_constructed):
        (webkit_dom_test_exception_class_init):
        (webkit_dom_test_exception_init):
        (webkit_dom_test_exception_get_name):
        * bindings/scripts/test/GObject/WebKitDOMTestException.h: Added.
        (_WebKitDOMTestException):
        (_WebKitDOMTestExceptionClass):
        * bindings/scripts/test/GObject/WebKitDOMTestExceptionPrivate.h: Added.
        (WebKit):
        * bindings/scripts/test/JS/JSTestException.cpp: Added.
        (WebCore):
        (WebCore::JSTestExceptionConstructor::JSTestExceptionConstructor):
        (WebCore::JSTestExceptionConstructor::finishCreation):
        (WebCore::JSTestExceptionConstructor::getOwnPropertySlot):
        (WebCore::JSTestExceptionConstructor::getOwnPropertyDescriptor):
        (WebCore::JSTestExceptionPrototype::self):
        (WebCore::JSTestException::JSTestException):
        (WebCore::JSTestException::finishCreation):
        (WebCore::JSTestException::createPrototype):
        (WebCore::JSTestException::destroy):
        (WebCore::JSTestException::~JSTestException):
        (WebCore::JSTestException::getOwnPropertySlot):
        (WebCore::JSTestException::getOwnPropertyDescriptor):
        (WebCore::jsTestExceptionName):
        (WebCore::jsTestExceptionConstructor):
        (WebCore::JSTestException::getConstructor):
        (WebCore::isObservable):
        (WebCore::JSTestExceptionOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestExceptionOwner::finalize):
        (WebCore::toJS):
        (WebCore::toTestException):
        * bindings/scripts/test/JS/JSTestException.h: Added.
        (WebCore):
        (JSTestException):
        (WebCore::JSTestException::create):
        (WebCore::JSTestException::createStructure):
        (WebCore::JSTestException::impl):
        (WebCore::JSTestException::releaseImpl):
        (WebCore::JSTestException::releaseImplIfNotNull):
        (JSTestExceptionOwner):
        (WebCore::wrapperOwner):
        (WebCore::wrapperContext):
        (JSTestExceptionPrototype):
        (WebCore::JSTestExceptionPrototype::create):
        (WebCore::JSTestExceptionPrototype::createStructure):
        (WebCore::JSTestExceptionPrototype::JSTestExceptionPrototype):
        (JSTestExceptionConstructor):
        (WebCore::JSTestExceptionConstructor::create):
        (WebCore::JSTestExceptionConstructor::createStructure):
        * bindings/scripts/test/ObjC/DOMTestException.h: Added.
        * bindings/scripts/test/ObjC/DOMTestException.mm: Added.
        (-[DOMTestException dealloc]):
        (-[DOMTestException finalize]):
        (-[DOMTestException name]):
        (core):
        (kit):
        * bindings/scripts/test/ObjC/DOMTestExceptionInternal.h: Added.
        (WebCore):
        * bindings/scripts/test/TestException.idl: Copied from Source/WebCore/xml/XPathException.idl.
        * bindings/scripts/test/V8/V8TestException.cpp: Added.
        (WebCore):
        (TestExceptionV8Internal):
        (WebCore::TestExceptionV8Internal::V8_USE):
        (WebCore::TestExceptionV8Internal::nameAttrGetter):
        (WebCore::ConfigureV8TestExceptionTemplate):
        (WebCore::V8TestException::GetRawTemplate):
        (WebCore::V8TestException::GetTemplate):
        (WebCore::V8TestException::HasInstance):
        (WebCore::V8TestException::wrapSlow):
        (WebCore::V8TestException::derefObject):
        * bindings/scripts/test/V8/V8TestException.h: Added.
        (WebCore):
        (V8TestException):
        (WebCore::V8TestException::toNative):
        (WebCore::V8TestException::wrap):
        (WebCore::toV8):
        * dom/DOMCoreException.idl:
        * dom/EventException.idl:
        * dom/RangeException.idl:
        * fileapi/FileException.idl:
        * fileapi/OperationNotAllowedException.idl:
        * svg/SVGException.idl:
        * xml/XMLHttpRequestException.idl:
        * xml/XPathException.idl:

2012-05-04  Rafael Weinstein  <rafaelw@chromium.org>

        V8RecursionScope not declared in V8Proxy::newInstance which causes ASSERT() failure from NPAPI
        https://bugs.webkit.org/show_bug.cgi?id=85659

        Reviewed by Ojan Vafai.

        Added a stack-allocted V8RecursionScope to the newInstance call.

        No new tests. No change in observable behavior.

        * bindings/v8/V8Proxy.cpp:
        (WebCore::V8Proxy::newInstance):

2012-05-04  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Remove all index metadata records when deleting an index
        https://bugs.webkit.org/show_bug.cgi?id=85557

        Reviewed by Tony Chang.

        An assert is hit when re-loading database from backing store due to stale index
        metadata entry. Do a range delete to clear all metadata entries when deleting an
        index. Define metadata entries as enum and limits as consts instead of hardcoded ints.

        No new tests - issue does not repro as layout test. Will land test in Chromium.

        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::getBool): Helper functions; replaces pattern of putInt()/read only lead byte.
        (WebCore):
        (WebCore::putBool):
        (WebCore::IDBLevelDBBackingStore::getObjectStores): Skip stale data. Use enums, helpers.
        (WebCore::IDBLevelDBBackingStore::createObjectStore): Use enums.
        (WebCore::IDBLevelDBBackingStore::deleteObjectStore): Use enums.
        (WebCore::getNewVersionNumber): Use enums.
        (WebCore::IDBLevelDBBackingStore::getIndexes): Skip stale data. Use enums, helpers.
        (WebCore::getNewIndexId): Use enums.
        (WebCore::IDBLevelDBBackingStore::createIndex): Use enums.
        (WebCore::IDBLevelDBBackingStore::deleteIndex): Delete metadata by range.
        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (IDBLevelDBCoding): Add constants for metadata maximum values.
        (WebCore::IDBLevelDBCoding::encodeBool):
        (WebCore::IDBLevelDBCoding::decodeBool):
        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::encodeMaxKey): Use consts.
        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::encodeMaxKey): Use consts.
        * Modules/indexeddb/IDBLevelDBCoding.h:
        (IDBLevelDBCoding): Expose enums for metadata types.

2012-05-04  Anders Carlsson  <andersca@apple.com>

        Move markPagesForFullStyleRecalc to PageCache
        https://bugs.webkit.org/show_bug.cgi?id=85664

        Reviewed by Dan Bernstein.

        Instead of going through all the history items in the back/forward list looking for cached pages, just iterate over the cached pages in the page.

        * history/BackForwardController.cpp:
        * history/BackForwardController.h:
        * history/HistoryItem.cpp:
        * history/HistoryItem.h:
        * history/PageCache.cpp:
        (WebCore::PageCache::markPagesForFullStyleRecalc):
        (WebCore):
        * history/PageCache.h:
        (PageCache):
        * page/Frame.cpp:
        (WebCore::Frame::setPageAndTextZoomFactors):
        * page/Page.cpp:
        (WebCore::Page::setDeviceScaleFactor):
        (WebCore::Page::setPagination):

2012-05-04  Tony Chang  <tony@chromium.org>

        The computed style of flex-item-align should never be auto.
        https://bugs.webkit.org/show_bug.cgi?id=85656

        Reviewed by Ojan Vafai.

        If the node lacks a parent and flex-item-align is auto, we should
        return stretch. This was recently clarified in the spec.

        New testcase in css3/flexbox/css-properties.html.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):

2012-05-04  Christophe Dumez  <christophe.dumez@intel.com>

        [soup] URL of the ResourceResponse passed to willSendRequest is incorrect
        https://bugs.webkit.org/show_bug.cgi?id=85072

        Reviewed by Gustavo Noronha Silva.

        Store the response message by catching the "got-headers" signal so
        that it can be passed later to willSendRequest() in case of
        redirection. This is required because the SoupMessage headers and URL
        have already been updated once restartedCallback() is called.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore):
        (WebCore::gotHeadersCallback):
        (WebCore::restartedCallback):
        (WebCore::sendRequestCallback):
        (WebCore::startHTTPRequest):

2012-05-04  Ian Vollick  <vollick@chromium.org>

        [chromium] CCProxy's shouldn't try to draw if there is no layer renderer
        https://bugs.webkit.org/show_bug.cgi?id=85218

        Reviewed by Adrienne Walker.

        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):

2012-05-04  Rob Buis  <rbuis@rim.com>

        [BlackBerry] Rendering bmp file as text file when Content-Type:image/x-ms-bmp from apache web server.
        https://bugs.webkit.org/show_bug.cgi?id=85036

        Reviewed by Antonio Gomes.

        Move getNormalizedMIMEType from WebKit into MIMETypeRegistry. This way we support uncommon mime types like image/pjpeg
        and image/x-ms-bmp out of the box since we map to the more common image/jpeg and image/bmp respectively.

        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes):
        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
        (WebCore):
        (WebCore::mimeTypeAssociationMap):
        (WebCore::MIMETypeRegistry::getNormalizedMIMEType):
        * platform/MIMETypeRegistry.h:
        (MIMETypeRegistry):

2012-05-04  Sami Kyostila  <skyostil@chromium.org>

        [chromium] Revert compositor layer scrolling
        https://bugs.webkit.org/show_bug.cgi?id=85644

        Reviewed by Steve Block.

        This patch reverts the following commits because they were found to
        trigger crashes. See discussion at http://code.google.com/p/chromium/issues/detail?id=124393.

            [chromium] Allow scrolling non-root layers in the compositor thread
            http://trac.webkit.org/changeset/114651

            [chromium] Don't crash when scrolling empty layer tree
            http://trac.webkit.org/changeset/114761

            [chromium] Don't keep pointers to released layer tree
            http://trac.webkit.org/changeset/115080

        * platform/graphics/chromium/ContentLayerChromium.cpp:
        * platform/graphics/chromium/ContentLayerChromium.h:
        (ContentLayerChromium):
        * platform/graphics/chromium/GraphicsLayerChromium.h:
        (GraphicsLayerChromium):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::applyScrollAndScale):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
        (CCLayerTreeHostCommon):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
        (WebCore::CCLayerTreeHostImpl::contentSize):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        (WebCore::findScrollLayer):
        (WebCore::CCLayerTreeHostImpl::setRootLayer):
        (WebCore::CCLayerTreeHostImpl::setPageScaleFactorAndLimits):
        (WebCore):
        (WebCore::CCLayerTreeHostImpl::adjustScrollsForPageScaleChange):
        (WebCore::CCLayerTreeHostImpl::setPageScaleDelta):
        (WebCore::CCLayerTreeHostImpl::applyPageScaleDeltaToScrollLayer):
        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
        (WebCore::CCLayerTreeHostImpl::scrollBegin):
        (WebCore::CCLayerTreeHostImpl::scrollBy):
        (WebCore::CCLayerTreeHostImpl::scrollEnd):
        (WebCore::CCLayerTreeHostImpl::pinchGestureUpdate):
        (WebCore::CCLayerTreeHostImpl::computePinchZoomDeltas):
        (WebCore::CCLayerTreeHostImpl::makeScrollAndScaleSet):
        (WebCore::CCLayerTreeHostImpl::processScrollDeltas):
        (WebCore::CCLayerTreeHostImpl::animatePageScale):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore::CCLayerTreeHostImpl::releaseRootLayer):
        (WebCore::CCLayerTreeHostImpl::scrollLayer):
        (CCLayerTreeHostImpl):

2012-05-04  Ojan Vafai  <ojan@chromium.org>

        Remove file that was deleted in http://trac.webkit.org/changeset/116085/.
        For some reason, this was breaking the chromium build (probably a gyp bug
        since chromium shouldn't be pulling in this file).

        * WebCore.gypi:

2012-05-04  Tony Chang  <tony@chromium.org>

        fix bit packing in FillLayer on Windows
        https://bugs.webkit.org/show_bug.cgi?id=85636

        Reviewed by Ryosuke Niwa.

        Use unsigned for all bit packed types. I manually verified that
        the current uses of these member variables always assign true or false.

        No new tests, adding a compile assert to verify bit packing.

        * rendering/style/FillLayer.cpp:
        (SameSizeAsFillLayer): Added compile assert.
        (WebCore):
        (WebCore::FillLayer::FillLayer): Reorder m_sizeLength so bit packed fields are adjacent.
        (WebCore::FillLayer::operator=): Ditto.
        * rendering/style/FillLayer.h:
        (FillLayer): Convert bools to unsigned to match other bit packed fields.

2012-05-04  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Make PeerConnection00's API fully compliant with the draft
        https://bugs.webkit.org/show_bug.cgi?id=85491

        Reviewed by Adam Barth.

        Mainly making the relevant API's use objects (aka Dictionaries) instead of the temporary strings,
        but also making a few API's exception aware and changing the name of a flag.

        Test: fast/mediastream/peerconnection-iceoptions.html

        * Modules/mediastream/PeerConnection00.cpp:
        (WebCore::PeerConnection00::createMediaHints):
        (WebCore::PeerConnection00::createOffer):
        (WebCore):
        (WebCore::PeerConnection00::createAnswer):
        (WebCore::PeerConnection00::createIceOptions):
        (WebCore::PeerConnection00::createDefaultIceOptions):
        (WebCore::PeerConnection00::startIce):
        (WebCore::PeerConnection00::addStream):
        (WebCore::PeerConnection00::changeReadyState):
        * Modules/mediastream/PeerConnection00.h:
        (WebCore):
        (PeerConnection00):
        * Modules/mediastream/PeerConnection00.idl:
        * platform/mediastream/chromium/PeerConnection00HandlerInternal.cpp:
        (WebCore::PeerConnection00HandlerInternal::startIce):

2012-05-04  David Tseng  <dtseng@google.com>

        Chromium should include MenuListPopups' and MenuListOptions' within the ax tree.
        https://bugs.webkit.org/show_bug.cgi?id=85541

        Reviewed by Chris Fleizach.

        Covered by existing tests. 
        LayoutTests/accessibility/menu-list-sends-change-notification.html

        * accessibility/AccessibilityMockObject.h:
        (WebCore::AccessibilityMockObject::accessibilityIsIgnored):
        * accessibility/chromium/AccessibilityObjectChromium.cpp:
        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

2012-05-04  Levi Weintraub <leviw@chromium.org>

        Unreviewed. Fixing ChangeLog conflict markers after 116009.

2012-05-04  Dan Winship  <danw@gnome.org>

        [GTK] ASSERTION FAILED: shouldLoadAsEmptyDocument(r.url()) ||
        !defersLoading() in MainResourceLoader.cpp:382

        Remove a soup_session_pause_message() call that got left behind,
        update the defersLoading stuff to handle this case.

        https://bugs.webkit.org/show_bug.cgi?id=85159

        Reviewed by Martin Robinson.

        No new tests. Now passes loader/load-defer-resume-crash.html under
        debug build.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::sendRequestCallback):
        (WebCore::ResourceHandle::platformSetDefersLoading):

2012-05-03  Martin Robinson  <mrobinson@igalia.com>

        [GTK] Rework IME handling to fix bugs and prepare for WebKit2
        https://bugs.webkit.org/show_bug.cgi?id=84556

        Reviewed by Gustavo Noronha Silva.

        No new tests. This change is already covered by a suite of keyboard
        handling unit tests in WebKitGTK+. There are some changes in behavior,
        but they are difficult to test without mocking out an entire GtkIMContext.

        Add a struct, CompositionResults, which is used by PlatformKeyboardEvent
        to package composition information with a keyboard event. Also add some logic
        to PlatformKeyboardEvent to give the right information when it has composition
        results.

        * GNUmakefile.list.am: Added new sources to the list.
        * platform/PlatformKeyboardEvent.h:  Added a new CompositionResults member,
        getter, and argument to the constructor.
        * platform/gtk/CompositionResults.h: Added.
        * platform/gtk/GtkInputMethodFilter.cpp: Added.
        * platform/gtk/GtkInputMethodFilter.h: Added.
        * platform/gtk/PlatformKeyboardEventGtk.cpp:
        (WebCore::PlatformKeyboardEvent::windowsKeyCodeForGdkKeyCode): When
        the key value is void return the VK_PROCESS keycode, which is the keycode
        that web content expects with keystrokes that trigger composition events.
        (WebCore::eventTypeForGdkKeyEvent): Abstract out this helper.
        (WebCore::modifiersForGdkKeyEvent): Abstract out this helper.
        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent): When a PlatformKeyEvent
        has composition results, use VK_PROCESS as the keycode for this event.
        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent): When this event is
        transformed into a Char event, the PlatformKeyboardEvent used for DOM keypress
        events, and it has composition results clear the text members. This forces the
        EventHandler code to drop the keypress event. Platform events that change the
        composition states do not have corresponding keypress DOM events (only keydown
        and keyup events), so this is necessary to ensure web compatibility.

2012-05-04  Jochen Eisinger  <jochen@chromium.org>

        Correctly update the outgoing referrer when navigating back from an history item created by pushState/replaceState
        https://bugs.webkit.org/show_bug.cgi?id=85374

        Reviewed by Nate Chapin.

        Test: http/tests/history/history-navigations-set-referrer.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadInSameDocument):

2012-05-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        [Qt] Clean up and split features.prf into a static list of defaults

        The static list of feature defaults is used as a fallback for any
        feature that's not dynamically detected or overriden on the command
        line (though build-webkit or passing DEFINES+= to qmake).

        The static list is complete, which allows for auto-generation based
        on Features.py (see bug https://bugs.webkit.org/show_bug.cgi?id=85456)

        https://bugs.webkit.org/show_bug.cgi?id=85611

        Reviewed by Simon Hausmann.

        * Target.pri:

2012-05-04  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116085, r116091, and r116095.
        http://trac.webkit.org/changeset/116085
        http://trac.webkit.org/changeset/116091
        http://trac.webkit.org/changeset/116095
        https://bugs.webkit.org/show_bug.cgi?id=85628

        We are not ready with dependencies on all platform yet (mac) +
        problems with debug builds. (Requested by Zoltan on #webkit).

        * Target.pri:
        * WebCore.pri:
        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes):
        (WebCore::initializeSupportedImageMIMETypesForEncoding):
        * platform/graphics/ImageSource.cpp:
        * platform/graphics/ImageSource.h:
        (WebCore):
        * platform/graphics/qt/ImageDecoderQt.cpp:
        (WebCore::ImageDecoder::create):
        (WebCore):
        (WebCore::ImageDecoderQt::filenameExtension):
        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
        (WebCore::ImageDecoderQt::clearPointers):
        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::create):
        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageFrame::getAddr):
        (ImageFrame):
        * platform/image-decoders/qt/ImageFrameQt.cpp: Added.
        (WebCore):
        (WebCore::ImageFrame::ImageFrame):
        (WebCore::ImageFrame::operator=):
        (WebCore::ImageFrame::clearPixelData):
        (WebCore::ImageFrame::zeroFillPixelData):
        (WebCore::ImageFrame::copyBitmapData):
        (WebCore::ImageFrame::setSize):
        (WebCore::ImageFrame::asNewNativeImage):
        (WebCore::ImageFrame::hasAlpha):
        (WebCore::ImageFrame::setHasAlpha):
        (WebCore::ImageFrame::setColorProfile):
        (WebCore::ImageFrame::setStatus):
        (WebCore::ImageFrame::setPixmap):
        (WebCore::ImageFrame::width):
        (WebCore::ImageFrame::height):

2012-05-04  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: eliminate temporaryProfile property from ProfilesPanel.
        https://bugs.webkit.org/show_bug.cgi?id=85623

        We can run different profilers at the same time therefore we have to keep temorary profile per profiler type.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.createView):
        (WebInspector.CSSSelectorProfileType.prototype.createTemporaryProfile):
        (WebInspector.CSSSelectorProfileType.prototype.createProfile):
        * inspector/front-end/HeapSnapshotView.js:
        (WebInspector.HeapSnapshotProfileType.prototype.createView):
        (WebInspector.HeapSnapshotProfileType.prototype.createTemporaryProfile):
        (WebInspector.HeapSnapshotProfileType.prototype.createProfile):
        * inspector/front-end/ProfileView.js:
        (WebInspector.CPUProfileType.prototype.startRecordingProfile):
        (WebInspector.CPUProfileType.prototype.createView):
        (WebInspector.CPUProfileType.prototype.createTemporaryProfile):
        (WebInspector.CPUProfileType.prototype.createProfile):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
        (WebInspector.ProfileType.prototype.createTemporaryProfile):
        (WebInspector.ProfileType.prototype.createProfile):
        (WebInspector.ProfileHeader):
        (WebInspector.HeapProfileHeader):
        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
        (WebInspector.ProfilesPanel.prototype.findTemporaryProfile):
        (WebInspector.ProfilesPanel.prototype._removeTemporaryProfile):
        (WebInspector.ProfilesPanel.prototype._populateProfiles.populateCallback.var):
        (WebInspector.ProfilesPanel.prototype._populateProfiles.populateCallback):
        (WebInspector.ProfilesPanel.prototype._populateProfiles):
        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot):
        (WebInspector.ProfilesPanel.prototype._reportHeapSnapshotProgress):
        (WebInspector.ProfilerDispatcher.prototype.addProfileHeader):

2012-05-04  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: [chromium] ScriptGCEvent should not be static.
        https://bugs.webkit.org/show_bug.cgi?id=80788

        The static members of ScriptGCEvent were moved into per isolate data structure.
        Drive by fix: Sometimes the used heap size after a GC is slightly more than it was before.

        Reviewed by Yury Semikhatsky.

        * bindings/v8/ScriptGCEvent.cpp:
        (WebCore::ScriptGCEvent::gcPrologueCallback):
        (WebCore::ScriptGCEvent::gcEpilogueCallback):
        * bindings/v8/V8Binding.h:
        (WebCore::GCEventData::GCEventData):
        (WebCore::GCEventData::clear):
        (GCEventData):
        (WebCore):
        (WebCore::V8BindingPerIsolateData::gcEventData):
        (V8BindingPerIsolateData):

2012-05-04  Kent Hansen <kent.hansen@nokia.com>

        [Qt] Update Qt bridge after changes to QMetaMethod
        https://bugs.webkit.org/show_bug.cgi?id=85478

        Reviewed by Tor Arne Vestbø.

        QMetaMethod::signature() has been renamed to methodSignature() and
        returns a QByteArray.

        The new function QMetaMethod::name() gives direct access to a
        method's name. returnType(), parameterCount(), and parameterType()
        give direct access to type information.

        Ported the custom QtConnectionObject meta-object to revision 7;
        revision 6 and below aren't supported (and don't compile) with Qt5.

        * Target.pri:
        * bridge/qt/qt_class.cpp:
        (JSC::Bindings::QtClass::fallbackObject):
        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtInstance::getPropertyNames):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::findMethodIndex):
        (Bindings):
        (qt_meta_stringdata_QtConnectionObject_t):
        (JSC::Bindings::QtConnectionObject::qt_static_metacall):
        (JSC::Bindings::QtConnectionObject::qt_metacast):
        (JSC::Bindings::QtConnectionObject::qt_metacall):
        (JSC::Bindings::QtConnectionObject::execute):
        * bridge/qt/qt_runtime.h:
        (QtConnectionObject):
        * bridge/qt/qt_runtime_qt4.cpp: Copied from Source/WebCore/bridge/qt/qt_runtime.cpp.
        (Bindings):
        (QWKNoDebug):
        (JSC::Bindings::QWKNoDebug::QWKNoDebug):
        (JSC::Bindings::QWKNoDebug::~QWKNoDebug):
        (JSC::Bindings::QWKNoDebug::operator<<):
        (JSC::Bindings::operator<<):
        (RuntimeConversion):
        (JSC::Bindings::registerCustomType):
        (JSC::Bindings::isJSUint8ClampedArray):
        (JSC::Bindings::valueRealType):
        (JSC::Bindings::convertValueToQVariantMap):
        (JSC::Bindings::convertValueToQVariant):
        (JSC::Bindings::convertQVariantToValue):
        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
        (JSC::Bindings::QtRuntimeMethod::finishCreation):
        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod):
        (JSC::Bindings::QtRuntimeMethod::destroy):
        (JSC::Bindings::QtRuntimeMethodData::~QtRuntimeMethodData):
        (JSC::Bindings::QtRuntimeMethodData::finalize):
        (JSC::Bindings::QtRuntimeMetaMethodData::~QtRuntimeMetaMethodData):
        (JSC::Bindings::QtRuntimeConnectionMethodData::~QtRuntimeConnectionMethodData):
        (QtMethodMatchType):
        (JSC::Bindings::QtMethodMatchType::QtMethodMatchType):
        (JSC::Bindings::QtMethodMatchType::kind):
        (JSC::Bindings::QtMethodMatchType::isValid):
        (JSC::Bindings::QtMethodMatchType::isVariant):
        (JSC::Bindings::QtMethodMatchType::isMetaType):
        (JSC::Bindings::QtMethodMatchType::isUnresolved):
        (JSC::Bindings::QtMethodMatchType::isMetaEnum):
        (JSC::Bindings::QtMethodMatchType::enumeratorIndex):
        (JSC::Bindings::QtMethodMatchType::variant):
        (JSC::Bindings::QtMethodMatchType::metaType):
        (JSC::Bindings::QtMethodMatchType::metaEnum):
        (JSC::Bindings::QtMethodMatchType::unresolved):
        (JSC::Bindings::QtMethodMatchType::typeId):
        (JSC::Bindings::QtMethodMatchType::name):
        (QtMethodMatchData):
        (JSC::Bindings::QtMethodMatchData::QtMethodMatchData):
        (JSC::Bindings::QtMethodMatchData::isValid):
        (JSC::Bindings::QtMethodMatchData::firstUnresolvedIndex):
        (JSC::Bindings::indexOfMetaEnum):
        (JSC::Bindings::findMethodIndex):
        (JSC::Bindings::findSignalIndex):
        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
        (JSC::Bindings::QtRuntimeMetaMethod::finishCreation):
        (JSC::Bindings::QtRuntimeMetaMethod::visitChildren):
        (JSC::Bindings::QtRuntimeMetaMethod::call):
        (JSC::Bindings::QtRuntimeMetaMethod::getCallData):
        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertySlot):
        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyDescriptor):
        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyNames):
        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter):
        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
        (JSC::Bindings::QtRuntimeConnectionMethod::QtRuntimeConnectionMethod):
        (JSC::Bindings::QtRuntimeConnectionMethod::finishCreation):
        (JSC::Bindings::QtRuntimeConnectionMethod::call):
        (JSC::Bindings::QtRuntimeConnectionMethod::getCallData):
        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertySlot):
        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyDescriptor):
        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyNames):
        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter):
        (JSC::Bindings::QtConnectionObject::QtConnectionObject):
        (JSC::Bindings::QtConnectionObject::~QtConnectionObject):
        (JSC::Bindings::QtConnectionObject::metaObject):
        (JSC::Bindings::QtConnectionObject::qt_metacast):
        (JSC::Bindings::QtConnectionObject::qt_metacall):
        (JSC::Bindings::isJavaScriptFunction):
        (JSC::Bindings::QtConnectionObject::execute):
        (JSC::Bindings::QtConnectionObject::match):
        (JSC::Bindings::QtConnectionObject::createWithInternalJSC):
        (JSC::Bindings::::QtArray):
        (JSC::Bindings::::~QtArray):
        (JSC::Bindings::::rootObject):
        (JSC::Bindings::::setValueAt):
        (JSC::Bindings::::valueAt):

2012-05-04  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: use single method for retrieving evaluation context in the runtime agent
        https://bugs.webkit.org/show_bug.cgi?id=85621

        Reviewed by Pavel Feldman.

        Merged two script state retrieval methods into one. Moved Page specific logic
        into PageRuntimeAgent.

        * inspector/InspectorRuntimeAgent.cpp:
        (WebCore::InspectorRuntimeAgent::evaluate):
        * inspector/InspectorRuntimeAgent.h:
        (InspectorRuntimeAgent):
        * inspector/PageRuntimeAgent.cpp:
        (WebCore::PageRuntimeAgent::scriptStateForEval):
        * inspector/PageRuntimeAgent.h:
        (PageRuntimeAgent):
        * inspector/WorkerRuntimeAgent.cpp:
        (WebCore::WorkerRuntimeAgent::scriptStateForEval):
        * inspector/WorkerRuntimeAgent.h:
        (WorkerRuntimeAgent):

2012-05-04  Jochen Eisinger  <jochen@chromium.org>

        Unreviewed, rolling out r115549.
        http://trac.webkit.org/changeset/115549
        https://bugs.webkit.org/show_bug.cgi?id=83894

        The newly added CRASH() statements are triggered too often

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::init):
        (WebCore::FrameLoader::setupForReplace):
        (WebCore::FrameLoader::stopAllLoaders):
        (WebCore::FrameLoader::clearProvisionalLoad):
        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):

2012-05-04  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Error message fix after r116091
        https://bugs.webkit.org/show_bug.cgi?id=85614

        Reviewed by Alexis Menard.

        No new tests : error message fix.

        * WebCore.pri:

2012-05-04  Alexis Menard  <alexis.menard@openbossa.org>

        [Qt] Build fix when using libpng version > 1.2.
        https://bugs.webkit.org/show_bug.cgi?id=85614

        Reviewed by Tor Arne Vestbø.

        Don't enforce the version of libpng when passing the option to the linker.

        No new tests : build fix.

        * WebCore.pri:

2012-05-04  Simon Hausmann  <simon.hausmann@nokia.com>

        [Qt] Images are scaled badly in WebKit2
        https://bugs.webkit.org/show_bug.cgi?id=85610

        Reviewed by Jocelyn Turcotte.

        Enable smooth pixmap transforms when rendering into the GraphicsSurface image.
        This class is only used in WK2.

        * platform/graphics/surfaces/qt/GraphicsSurfaceQt.cpp:
        (WebCore::GraphicsSurface::platformBeginPaint):

2012-05-04  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Remove unnecessary executeable bits after r116085

        No new tests.

        * Target.pri:
        * WebCore.pri:
        * platform/graphics/ImageSource.cpp:
        * platform/graphics/ImageSource.h:
        * platform/graphics/qt/ImageDecoderQt.cpp:
        * platform/graphics/qt/ImageDecoderQt.h:
        * platform/image-decoders/ImageDecoder.cpp:
        * platform/image-decoders/ImageDecoder.h:

2012-05-04  Zoltan Horvath  <zoltan@webkit.org>

        [Qt] Set WebCore imagedecoders as default and add fallback to QImageDecoder
        https://bugs.webkit.org/show_bug.cgi?id=80400

        This change modifies the default ImageDecoder for Qt-port from QImageDecoder to WebCore ImageDecoder.
        The new behavior is to use QImageDecoder only if WebCoreImageDecoder doesn't support the requested
        image type.
        The WTF_USE_QT_IMAGE_DECODER macro has been removed, since it is no longer needed.

        This change adds build depedency for libpng-dev and libjpeg-dev packages, becuase PNG and JPEG imagedecoders
        need not only these libraries, but their headers also. Qmake-config tests for these libraries were
        introduced in r110045.

        Reviewed by Simon Hausmann.

        No new tests needed.

        * Target.pri: Move WebCore ImageDecoder files out of guards. Remove ImageFrameQt.cpp from sources.
        * WebCore.pri: Move WebCore ImageDecoder include paths out of guards.
        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes): Add WebCore supported and Qt supported MIME types.
        (WebCore::initializeSupportedImageMIMETypesForEncoding): Use Qt supported MIME types.
        * platform/graphics/ImageSource.cpp: Remove unnecessary includes.
        * platform/graphics/ImageSource.h: Remove unnecessary typedefs.
        (WebCore):
        * platform/graphics/qt/ImageDecoderQt.cpp:
        (WebCore::ImageDecoderQt::filenameExtension): Remove unnecessary semicolon.
        (WebCore::ImageDecoderQt::internalHandleCurrentImage): Use QImage and ImageFrame instead of QPixmap.
        (WebCore):
        (WebCore::ImageFrame::asNewNativeImage): Moved here from removed ImageFrameQt.cpp.
        * platform/image-decoders/ImageDecoder.cpp: Reorganize the includes of the header.
        (WebCore::ImageDecoder::create): Add platform macro guarded fallback case for QImageDecoder.
        * platform/image-decoders/ImageDecoder.h: Remove Qt-specific codes.
        (WebCore::ImageFrame::getAddr): Remove Qt-specific case, since it is no longer needed.
        (ImageFrame):
        * platform/image-decoders/qt/ImageFrameQt.cpp: Removed. Dead code, other code has been moved to
        ImageDecoderQt.cpp.

2012-05-03  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: createRawLocationByURL is too slow if a big number of evals happen.
        https://bugs.webkit.org/show_bug.cgi?id=85477

        It iterates through all the _scripts even they have no url.
        We can keep a separate map of scripts with url.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel):
        (WebInspector.DebuggerModel.prototype._globalObjectCleared):
        (WebInspector.DebuggerModel.prototype._resetScriptsMap):
        (WebInspector.DebuggerModel.prototype._parsedScriptSource):
        (WebInspector.DebuggerModel.prototype.createRawLocationByURL):

2012-05-03  David Barr  <davidbarr@chromium.org>

        Antialias single-edge solid borders
        https://bugs.webkit.org/show_bug.cgi?id=85031

        Reviewed by Simon Fraser.

        Antialiasing is avoided for adjacent edges due to artifacts at the seam.
        There are no such artifacts for single-edge borders so enable antialiasing.

        Test: fast/css/border-solid-single-edge-antialias.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintBorder):

2012-05-03  Adam Barth  <abarth@webkit.org>

        CSP: Eval isn't blocked in about:blank subframes
        https://bugs.webkit.org/show_bug.cgi?id=85553

        Reviewed by Eric Seidel.

        ContentSecurityPolicy has a back pointer to ScriptExecutionContext.
        That means we shouldn't share a single ContentSecurityPolicy object
        between multiple ScriptExecutionContexts.  This patch copies the state
        from one ScriptExecutionContext to another rather than sharing the
        ContentSecurityPolicy object itself.

        This resulted in a subtle but w.r.t. blocking eval.  Because we block
        eval by setting a bit in the JavaScript engine when enforcing the
        policy, that bit wasn't copied along with the rest of the state when we
        were sharing the ContentSecurityPolicy object.  Now that we use the
        more robust ContentSecurityPolicy::copyStateFrom function, we don't
        have that bug.

        Test: http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe.html

        * dom/Document.cpp:
        (WebCore::Document::initSecurityContext):
        (WebCore):
        (WebCore::Document::initContentSecurityPolicy):
        * dom/Document.h:
        (Document):
        * dom/SecurityContext.cpp:
        (WebCore::SecurityContext::setContentSecurityPolicy):
        * dom/SecurityContext.h:
        (SecurityContext):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::didBeginDocument):
        * page/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::create):

2012-05-03  Abhishek Arya  <inferno@chromium.org>

        Regression(r113769): Crash in AudioNodeOutput::disconnectAllParams.
        https://bugs.webkit.org/show_bug.cgi?id=85196

        Reviewed by Chris Rogers.

        RefPtr the AudioParam hashset in AudioNodeOutput to prevent accessing
        destroyed entries.

        No new tests. Unable to reproduce it in DRT.

        * Modules/webaudio/AudioNodeOutput.cpp:
        (WebCore::AudioNodeOutput::disconnectAllParams):
        * Modules/webaudio/AudioNodeOutput.h:
        (AudioNodeOutput):

2012-05-03  Noel Gordon  <noel.gordon@gmail.com>

        PNGImageDecoder: Clean up rowAvailable() some more
        https://bugs.webkit.org/show_bug.cgi?id=85464

        Reviewed by Eric Seidel.

        No new tests. Covered by existing tests: fast/images/png-extra-row-crash.html in
        particular.

        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageDecoder::rowAvailable): Use colorChannels consistently. Split
        the useful libpng comments in two, then place the early-out code and conditions
        inbetween. The png variable is only used in one place so move it there.

2012-05-03  Ojan Vafai  <ojan@chromium.org>

        Histogram total allocated bytes in the arena in addition to the render tree size
        https://bugs.webkit.org/show_bug.cgi?id=85537

        Reviewed by Eric Seidel.

        We only free bytes allocated to a RenderArena when destroying the Document.
        Histogram both the render tree size and the total bytes allocated. This
        gives a better sense of the overhead of RenderArena as well as giving a more
        accurate number for the amount of actual memory used by the render tree.

        No new tests. This is not webfacing, so this can't be tested without adding
        API to layout test controller, which doesn't seem worth it for this code.

        * page/Page.cpp:
        (WebCore::Page::renderTreeSize):
        (WebCore::Page::setVisibilityState):
        * page/Page.h:
        (Page):
        * platform/Arena.cpp:
        (WebCore::ArenaAllocate):
        * platform/Arena.h:
        (WebCore):
        * rendering/RenderArena.cpp:
        (WebCore::RenderArena::allocate):
        * rendering/RenderArena.h:
        (WebCore::RenderArena::totalRenderArenaAllocatedBytes):
        (RenderArena):

2012-05-03  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] Add missed member in CrossThreadResourceRequestData
        https://bugs.webkit.org/show_bug.cgi?id=85448

        Reviewed by Antonio Gomes.

        * platform/network/blackberry/ResourceRequest.h:
        (CrossThreadResourceRequestData):
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::ResourceRequest::doPlatformCopyData):
        (WebCore::ResourceRequest::doPlatformAdopt):

2012-05-03  Adam Barth  <abarth@webkit.org>

        CSP shouldn't block about:blank for iframes
        https://bugs.webkit.org/show_bug.cgi?id=85233

        Reviewed by Eric Seidel.

        As discussed at the W3C WebAppSec face-to-face meeting, there's no
        point in blocking about:blank iframes or objects because blocking a
        frame or object just results in displaying about:blank anyway.  This
        patch just removes the spurious console message and violation report.

        Test: http/tests/security/contentSecurityPolicy/frame-src-about-blank-allowed-by-default.html

        * page/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):

2012-05-03  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r116040.
        http://trac.webkit.org/changeset/116040
        https://bugs.webkit.org/show_bug.cgi?id=85559

        Broke a few IndexedDB browsertests (Requested by zhenyao on
        #webkit).

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::direction):
        * Modules/indexeddb/IDBCursor.h:
        (IDBCursor):
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::transaction):
        (WebCore):
        * Modules/indexeddb/IDBDatabase.h:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::openCursor):
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::openCursor):
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::readyState):
        (WebCore::IDBRequest::markEarlyDeath):
        (WebCore::IDBRequest::resetReadyState):
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::finishCursor):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::stop):
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::mode):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl:

2012-05-03  Raphael Kubo da Costa  <rakuco@webkit.org>

        [CMake] Rewrite FindCairo.cmake.
        https://bugs.webkit.org/show_bug.cgi?id=84895

        Reviewed by Daniel Bates.

        The old approach relied on pkg-config for finding Cairo (which
        introduced a dependency on pkg-config that could be avoided), used
        the LibFindMacros code that we should probably remove in the
        future and did not use the FindPackageHandleStandardArguments
        module.

        Change all that by rewriting the module.
        - Use the pkg-config output optionally instead of requiring it
        like LibFindMacros did.
        - Remove the implicit dependency on FreeType which often found it
        the wrong way via pkg-config and without considering
        CMAKE_PREFIX_PATH.
        - Retrieve the Cairo version by looking at cairo-version.h instead
        of relying on pkg-config. It requires some additional code for
        checking if the desired version has been found, but that will not
        be needed once we start depending on CMake 2.8.3 or later.

        The only downside is that FPHSA sets <UPPERCASED_NAME>_FOUND
        instead of <Name>_FOUND, and to keep things consistent
        Cairo_LIBRARIES and Cairo_INCLUDE_DIRS have become CAIRO_LIBRARIES
        and CAIRO_INCLUDE_DIRS.

        No new tests, build system change.

        * PlatformEfl.cmake: Use CAIRO_FOO instead of Cairo_FOO.

2012-05-03  Anders Carlsson  <andersca@apple.com>

        Focus ring only appears in top-left tile
        https://bugs.webkit.org/show_bug.cgi?id=85556
        <rdar://problem/11359656>

        Reviewed by Simon Fraser.

        It is sufficient to just apply the current CTM to the clip rect and set that as the focus ring clip rect.

        * platform/graphics/mac/WebLayer.mm:
        (drawLayerContents):

2012-05-03  Alec Flett  <alecflett@chromium.org>

        IndexedDB: Replace numeric constants with strings
        https://bugs.webkit.org/show_bug.cgi?id=84894

        Reviewed by Tony Chang.

        Test: storage/indexeddb/legacy-constants.html

        Update IDBObjectStore.openCursor, IDBIndex.openCursor,
        IDBIndex.openKeyCursor, IDBDatabase.transaction,
        IDBCursor.direction, IDBTransaction.mode, and
        IDBRequest.readyState to meet the latest spec. All of these APIs
        now support string-based values in addition to the
        legacy/deprecated enum-based values.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore):
        (WebCore::IDBCursor::direction):
        (WebCore::IDBCursor::stringToDirection):
        (WebCore::IDBCursor::directionToString):
        * Modules/indexeddb/IDBCursor.h:
        (IDBCursor):
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::transaction):
        (WebCore):
        * Modules/indexeddb/IDBDatabase.h:
        (IDBDatabase):
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::openCursor):
        (WebCore):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::openCursor):
        (IDBIndex):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::openCursor):
        (WebCore):
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::openCursor):
        (IDBObjectStore):
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::readyState):
        (WebCore::IDBRequest::markEarlyDeath):
        (WebCore::IDBRequest::resetReadyState):
        (WebCore::IDBRequest::abort):
        (WebCore::IDBRequest::finishCursor):
        (WebCore::IDBRequest::onSuccess):
        (WebCore::IDBRequest::stop):
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore):
        (WebCore::IDBTransaction::mode):
        (WebCore::IDBTransaction::stringToMode):
        (WebCore::IDBTransaction::modeToString):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * Modules/indexeddb/IDBTransaction.idl:

2012-05-03  Sam Weinig  <sam@webkit.org>

        Add an eventPhase NONE constant
        https://bugs.webkit.org/show_bug.cgi?id=85397

        Reviewed by Anders Carlsson.

        Updates existing tests.

        * dom/Event.h:
        * dom/Event.idl:
        Add NONE constant.

2012-05-03  Tony Chang  <tony@chromium.org>

        Height overflow when nesting multiple new Flexbox'es.
        https://bugs.webkit.org/show_bug.cgi?id=83572

        Reviewed by Ojan Vafai.

        Test: css3/flexbox/nested-stretch.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeAvailableFreeSpace):

2012-05-03  Julien Chaffraix  <jchaffraix@webkit.org>

        ASSERT(!m_zOrderListsDirty) is triggering in Safari
        https://bugs.webkit.org/show_bug.cgi?id=85512

        Reviewed by Simon Fraser.

        Unfortunately no test as I don't think the 2 cases are testable reliably.

        A better fix would be to introduce some iterator that handle updating the
        lists for you. For now, just adding the missing updateLayerListsIfNeeded()
        calls.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::hasVisibleNonCompositingDescendantLayers):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::layerHas3DContent):

2012-05-03  Philip Rogers  <pdr@google.com>

        Fix numeric precision issue in SVG animations
        https://bugs.webkit.org/show_bug.cgi?id=85502

        Reviewed by Dirk Schulze.

        r93938 had a bug where floating point numbers where compared exactly,
        exposing a bug when floating point precision was not sufficient. This
        change compares against an epsilon value to get around these precision
        issues.

        Test: svg/animations/animate-end-attribute-numeric-precision.html

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::calculateAnimationPercentAndRepeat):

2012-05-03  Joshua Bell  <jsbell@chromium.org>

        Fix coding style issues in IDBLevelDBCoding.cpp
        https://bugs.webkit.org/show_bug.cgi?id=85536

        Reviewed by Tony Chang.

        No tests - just code formatting changes.

        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (WebCore::IDBLevelDBCoding::encodeIDBKey):
        (WebCore::IDBLevelDBCoding::decodeIDBKey):
        (WebCore::IDBLevelDBCoding::extractEncodedIDBKey):
        (WebCore::IDBLevelDBCoding::compareEncodedIDBKeys):

2012-04-30  Filip Pizlo  <fpizlo@apple.com>

        PageCache autorelease should not wait until 3 seconds and 42 pages
        https://bugs.webkit.org/show_bug.cgi?id=85254
        <rdar://problem/11349613>

        Reviewed by Geoffrey Garen.

        No new tests, since there is no change in behavior.

        * history/PageCache.cpp:
        (WebCore):
        (WebCore::PageCache::PageCache):
        (WebCore::PageCache::releaseAutoreleasedPagesNowDueToTimer):
        * history/PageCache.h:
        (PageCache):

2012-05-03  Levi Weintraub  <leviw@chromium.org>

        Unreviewed build fix for Mac WK2. Adding a mistakenly removed symbol back to WebCore.exp.in.

        * WebCore.exp.in:

2012-05-03  Levi Weintraub  <leviw@chromium.org>

        Unreviewed build fix for Qt after 116009. No changes in behavior.

        * rendering/RenderTreeAsText.cpp:
        (WebCore::RenderTreeAsText::writeRenderObject):

2012-05-03  W. James MacLean  <wjmaclean@chromium.org>

        [chromium] Revise touchpad fling curve to use exponential curve, to improve feel and small fling performance.
        https://bugs.webkit.org/show_bug.cgi?id=85530

        Reviewed by Kenneth Russell.

        Existing unit tests updated for new curve.

        Modifies TouchpadFLingGestureCurve to use an exponential, rather than polynomial, curve.
        This change appears to improve the overall feel of touchpad fling, and substantially
        improves small-fling performance.

        * platform/TouchpadFlingPlatformGestureCurve.cpp:
        (WebCore::TouchpadFlingPlatformGestureCurve::create):
        (WebCore):
        (WebCore::position):
        (WebCore::velocity):
        (WebCore::TouchpadFlingPlatformGestureCurve::TouchpadFlingPlatformGestureCurve):

2012-04-23  Levi Weintraub  <leviw@chromium.org> and Emil A Eklund <eae@chromium.org>

        [meta] Switch away from integers representing pixels for layout/event handling/rendering
        https://bugs.webkit.org/show_bug.cgi?id=60318

        Reviewed by Eric Seidel.

        Swapping the LayoutUnit backend to FractionalLayoutUnit from int.
        
        FractionalLayoutUnit is a new type that uses an integer to represent a fraction of a pixel.
        We're also adding a feature flag -- ENABLE_SUBPIXEL_LAYOUT -- that toggles this fraction
        between 1/1 and 1/60. Initially, all platforms will default to subpixel layout being off,
        so FractionalLayoutUnits will effectively continue to act as integers.
        
        With ENABLE_SUBPIXEL_LAYOUT turned on, FractionalLayoutUnits accumulate error from sub-pixel
        CSS values and applied zooming, and painting uses pixel-snapping to align these values
        to pixels. See http://trac.webkit.org/wiki/LayoutUnit for details.

        In a number of previous patches, LayoutUnits were plumbed throughout the rendering tree
        to prepare for this change. This included a number of functions in LayoutTypes.h and
        the IntRect/Point/Size classes that were effectively no-ops while LayoutUnits were
        integers. Subsequent patches will remove unnecessary versions of these functions; see
        http://webkit.org/b/84616 for tracking these changes.

        Tests: fast/sub-pixel/client-width-height-snapping.html
               fast/sub-pixel/layout-boxes-with-zoom.html
               fast/sub-pixel/size-of-box-with-zoom.html

        * WebCore.exp.in: Updating function signatures that expose FractionalLayoutUnits.
        * WebCore.xcodeproj/project.pbxproj: Adding missing FractionalLayoutPoint.h header.
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::zoomAdjustedPixelValue): Using adjustFloatForAbsoluteZoom instead of int
        to make use of extra precision before returning the pixel value.
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::computeLength): No longer rounds for imprecise conversion
        when sub-pixel layout is enabled.
        (WebCore::CSSPrimitiveValue::customCssText): Returning integer values for pixels.
        * dom/Element.cpp:
        (WebCore::adjustForLocalZoom): Using rounding instead of incrementing the value before
        adjusting to account for truncation when sub-pixel layout is enabled.
        * page/SpatialNavigation.cpp:
        (WebCore::distanceDataForNode): Using FractionalLayoutUnit::abs instead of std::abs.
        * platform/FractionalLayoutUnit.h: Adding some missing operators and a flag around the
        constant denominator to switch it between 1/1 and 1/60 depending on the feature flag.
        * platform/Length.h: Changing the default type for value to float, and adding intValue
        since this more closely matches usage in a sub-pixel layout world.
        * platform/win/PopupMenuWin.cpp:
        (WebCore::PopupMenuWin::paint): Using minimumIntValueForLength in this platform code
        instead of LayoutUnits.
        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
        * rendering/LayoutTypes.h: This file contains the actual switch for changing LayoutUnits
        to be FractionalLayoutUnits. Also updating stub methods with their proper implementations.
        * rendering/PaintInfo.h:
        (WebCore::PaintInfo::infiniteRect): Ensuring the infiniteRect doesn't overflow the
        FractionalLayoutUnit bounds.
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::checkPaginationAndFloatsAtEndLine): Switch to
        FractionalLayoutUnit's abs function instead of std::abs.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Add rounding for
        setting the phase of the background geometry before applying modulo from the tile size.
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): Stop applying flex when
        we have less than a pixel to distribute.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::backgroundClipRect): Replace PaintInfo::infiniteRect with the
        LayoutRect equivalent.
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::rangeIntersectsRect): Using FractionalLayoutUnit::abs
        instead of std::abs.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Ditto.
        * rendering/RenderObject.h:
        (WebCore): Removing unnecessary adjustForAbsoluteZoom function.
        (WebCore::RenderObject::outlineSize): Outlines remain ints.
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::styleOrColLogicalWidth): Build fix. Using floats because
        colWidthSum is a Length which uses floats.
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton): Explicit templatization
        for max.
        * rendering/RenderTreeAsText.cpp: Adding code to minimize test expectation churn. It
        may be worth outputting float values in test expectations, but this isn't done with
        the inline box tree yet, either.
        * rendering/RenderTreeAsText.h:
        (WebCore): Adding a FractionalLayoutPoint operator.
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::updateWidgetGeometry): Adding missing pixel snapping, and switching
        absoluteContentBox to an IntRect, as this is what boundingBox returns.
        * rendering/svg/SVGRenderTreeAsText.cpp:
        (WebCore::writePositionAndStyle): Adding an enclosingIntRect for consistency with old results.

2012-05-03  Levi Weintraub  <leviw@chromium.org> and Emil A Eklund <eae@chromium.org>

        [meta] Switch away from integers representing pixels for layout/event handling/rendering
        https://bugs.webkit.org/show_bug.cgi?id=60318

        Reviewed by Eric Seidel.

        Swapping the LayoutUnit backend to FractionalLayoutUnit from int.
        
        FractionalLayoutUnit is a new type that uses an integer that can represent a fraction of a
        pixel. The ENABLE_SUBPIXEL_LAYOUT feature flags toggles this fraction between 1/1 and 1/60.
        Initially, all platforms will default to subpixel layout being off, so FractionalLayoutUnits
        will effectively continue to act as integers.
        
        With ENABLE_SUBPIXEL_LAYOUT turned on, FractionalLayoutUnits accumulate error from sub-pixel
        CSS values and applied zooming, and painting uses pixel-snapping to align these values
        to pixels and prevent unwanted anti-aliasing. See http://trac.webkit.org/wiki/LayoutUnit for
        details.

        In a number of previous patches, LayoutUnits were plumbed throughout the rendering tree to
        prepare for this change. This included a number of functions in LayoutTypes.h and the
        IntRect/Point/Size classes that were effectively no-ops while LayoutUnits were integers. See
        http://webkit.org/b/60318 for the exhaustive list of changes that were done in preparation
        for this. Subsequent patches will remove unnecessary versions of these functions.
        http://webkit.org/b/84616 tracks these changes.

        Tests: fast/sub-pixel/client-width-height-snapping.html
               fast/sub-pixel/layout-boxes-with-zoom.html
               fast/sub-pixel/size-of-box-with-zoom.html

        * WebCore.exp.in: Updating function signatures that expose FractionalLayoutUnits.
        * WebCore.order: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Adding missing FractionalLayoutPoint.h header.
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::computeLength): No longer rounds for imprecise conversion
        when sub-pixel layout is enabled.
        * dom/Element.cpp:
        (WebCore::adjustForLocalZoom): Using rounding instead of incrementing the value before
        adjusting to account for truncation when sub-pixel layout is enabled.
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore): Fixing a static initializer build error by moving an integer constant to be
        an int.
        * rendering/LayoutTypes.h: This file contains the actual switch for changing LayoutUnits
        to be FractionalLayoutUnits. Also updating stub methods with their proper implementations.
        * rendering/PaintInfo.h:
        (WebCore::PaintInfo::infiniteRect): Ensuring the infiniteRect doesn't overflow the
        FractionalLayoutUnit bounds. LayoutRect::infiniteRect() is the largest rectangle that can
        be represented using LayoutUnits.
        * rendering/RenderLayer.h:
        (WebCore::ClipRect::operator!=): Add overload of != to fix complaining compilers when
        * rendering/RenderTreeAsText.cpp: Adding code to minimize test expectation churn. It
        may be worth outputting float values in test expectations, but this isn't done with
        the inline box tree yet, either.
        * rendering/RenderTreeAsText.h:
        (WebCore): Adding a FractionalLayoutPoint operator.
        * rendering/svg/SVGRenderTreeAsText.cpp:
        (WebCore::writePositionAndStyle):
        (WebCore): Adding a FractionalLayoutPoint operator.

2012-05-03  Anders Carlsson  <andersca@apple.com>

        Move repaint counter drawing code out into a separate function
        https://bugs.webkit.org/show_bug.cgi?id=85539

        Reviewed by Simon Fraser.

        The majority of code in TileCache::drawLayer deals with drawing the repaint counter. Move this code out
        into a separate function to make it more clear what drawLayer does.

        * platform/graphics/ca/mac/TileCache.h:
        (TileCache):
        * platform/graphics/ca/mac/TileCache.mm:
        (WebCore::TileCache::drawLayer):
        (WebCore::TileCache::drawRepaintCounter):
        (WebCore):

2012-05-03  Simon Fraser  <simon.fraser@apple.com>

        Compositing 'requiresOwnBackingStore' logic caused new clip rect assertions
        https://bugs.webkit.org/show_bug.cgi?id=85455

        Reviewed by Dean Jackson.
        
        r114283 added logic that allows compositing layers to avoid allocating their own
        backing store and to paint into an ancestor instead. However, that caused
        assertions in RenderLayer::updateClipRects() about m_clipRectsRoot being
        incorrect, because clip rect code assumed that compositing layers
        always painted themselves.
        
        Fixed by calling paintsIntoCompositedAncestor() in RenderLayer::clippingRoot(),
        so that clip rect computation matches painting.

        I wasn't able to easily make a test that reproduces the assertion in DRT.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::clippingRoot):

2012-05-03  Tim Horton  <timothy_horton@apple.com>

        REGRESSION(99539): SVG <img> disregards page scale and device scale
        https://bugs.webkit.org/show_bug.cgi?id=77237
        <rdar://problem/10767413>

        Reviewed by Simon Fraser.

        Rename SVGImageCache::SizeAndZoom to SVGImageCache::SizeAndScales, as it carries more than just zoom now.

        Pass the product of the device and page scales through everything that takes a SVGImageCache::SizeAndScales,
        using it to inflate the size of the buffer created in lookupOrCreateBitmapImageForRenderer,
        and to inflate the destination rectangle passed to SVGImage::draw, which will cause a transformation
        on the context being drawn into.

        Invalidate the SVGImageCache entry on device/page scale changes in addition to zoom changes.

        This patch does not cause SVGImageCache to take into account scale caused by CSS transforms; that is tracked
        separately by https://bugs.webkit.org/show_bug.cgi?id=85335.

        Tests: svg/as-image/image-respects-deviceScaleFactor.html
               svg/as-image/image-respects-pageScaleFactor.html

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::setContainerSizeForRenderer):
        (WebCore::CachedImage::imageSizeForRenderer):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::drawSVGToImageBuffer):
        * svg/graphics/SVGImage.h:
        * svg/graphics/SVGImageCache.cpp:
        (WebCore::SVGImageCache::~SVGImageCache):
        (WebCore::SVGImageCache::removeRendererFromCache):
        (WebCore::SVGImageCache::setRequestedSizeAndScales):
        (WebCore::SVGImageCache::requestedSizeAndScales):
        (WebCore::SVGImageCache::redraw):
        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):
        * svg/graphics/SVGImageCache.h:
        (WebCore::SVGImageCache::SizeAndScales::SizeAndScales):
        (SizeAndScales):
        (SVGImageCache):
        (WebCore::SVGImageCache::ImageData::ImageData):
        (ImageData):

2012-05-03  Fady Samuel  <fsamuel@chromium.org>

        Removing line in computeViewportAttributes that enforces a minimum scale factor to never allow zooming out more than viewport
        https://bugs.webkit.org/show_bug.cgi?id=70609

        Reviewed by Kenneth Rohde Christiansen.

        Make Viewport Attributes' layoutSize be a FloatRect to avoid rounding
        too early, and the occasional off by one fixed layout dimensions.

        * dom/ViewportArguments.cpp:
        (WebCore::computeViewportAttributes):
        * dom/ViewportArguments.h:
        (ViewportAttributes):

2012-05-03  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Handle generated keys up to 2^53
        https://bugs.webkit.org/show_bug.cgi?id=85114

        The spec defines the behavior for generated keys up to 2^53
        (the maximum integer storable as an ECMAScript number) and
        the error case when going beyond that. Ensure that we can
        handle values up to that point and generate errors beyond.

        Reviewed by Tony Chang.

        Test: storage/indexeddb/key-generator.html

        * Modules/indexeddb/IDBBackingStore.h:
        (IDBBackingStore):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::nextAutoIncrementNumber):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::genAutoIncrementKey):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):

2012-05-03  Simon Fraser  <simon.fraser@apple.com>

        Remove RenderLayerCompositor::didStartAcceleratedAnimation()
        https://bugs.webkit.org/show_bug.cgi?id=85514

        Reviewed by Antti Koivisto.
        
        Remove RenderLayerCompositor::didStartAcceleratedAnimation(), which is no longer
        needed.

        Code removal, no new tests.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::startAnimation):
        (WebCore::RenderLayerBacking::startTransition):
        * rendering/RenderLayerCompositor.cpp:
        * rendering/RenderLayerCompositor.h:

2012-05-03  Andreas Kling  <kling@webkit.org>

        REGRESSION(r111387): CSSOM representation of 'background-image' values should be CSSPrimitiveValue.
        <http://webkit.org/b/85500>

        Reviewed by Antti Koivisto.

        Use the cloneForCSSOM() mechanism in CSSValue to expose CSSImageValue to bindings as a URI
        primitive value. This matches the specced behavior of computed image values, and restores our
        previous behavior without having CSSImageValue subclass CSSPrimitiveValue.

        Also added a failsafe return after the isCSSOMSafe() assertion in the JSC bindings, since it's
        better to expose an incorrect return value than an insecurely shared one, should we have or add
        bugs in this code.

        * bindings/js/JSCSSValueCustom.cpp:
        (WebCore::toJS):
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::cloneForCSSOM):
        * css/CSSImageValue.h:
        * css/CSSValue.cpp:
        (WebCore::CSSValue::cloneForCSSOM):

2012-05-03  Keishi Hattori  <keishi@webkit.org>

        Crash in HTMLFormControlElement::m_fieldSetAncestor
        https://bugs.webkit.org/show_bug.cgi?id=85453

        Reviewed by Kent Tamura.

        Modified tests: fast/forms/datalist/datalist-child-validation.html
                        fast/forms/form-control-element-crash.html

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::removedFrom): Only set the invalid ancestor flag.
        The element will be detached from the document so there is no need to update the style.
        And the validation message will be hidden by the blur event.
        (WebCore::HTMLFormControlElement::willValidate): Because of the change to removedFrom,
        m_ancestorsValid may be false.

2012-05-03  Simon Fraser  <simon.fraser@apple.com>

        Keep overlap testing for compositing on pages with 3d transforms when possible
        https://bugs.webkit.org/show_bug.cgi?id=62487

        Reviewed by Antti Koivisto.
        
        Change RenderLayerCompositor to always use overlap testing when possible.

        Rather than turn off overlap testing wholesale when encountering a non-affine
        transform, or starting an accelerated transform animation, we constrain
        the disabling of overlap testing to within overflow:hidden areas when possible.

        Tests: compositing/layer-creation/overlap-animation.html
               compositing/layer-creation/overlap-transforms.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setCompositedBounds): Whitespace fix.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::CompositingState::CompositingState):
        (CompositingState): Add a member boolean to track whether we're testing overlap. Add a copy
        constructor.
        (WebCore::RenderLayerCompositor::updateCompositingLayers): Initialize the 'testing overlap'
        setting based on m_compositingConsultsOverlap (though this will always be true until removed
        in a future commit).
        (WebCore::RenderLayerCompositor::updateBacking): No longer turn off overlap testing
        when we see a non-affine transform.
        (WebCore::RenderLayerCompositor::computeCompositingRequirements): No need for the 'struct'
        in the arguments.
        Consult compositingState.m_testingOverlap to see if we want to test overlap.
        Use the new CompositingState copy ctor for childState, but set m_subtreeIsCompositing to false
        as before.
        If this layer is composited, look to see if need to disable over lap testing based on
        the transform or an animation.
        Just as we propagate m_subtreeIsCompositing, we have to propagate m_testingOverlap=false
        for the rest of the traverse.
        If we've just processed a layer which clips compositing descendants, we can go back
        to testing for overlap.
        (WebCore::RenderLayerCompositor::didStartAcceleratedAnimation): No need to do anything
        here now. It will be removed in future.
        (WebCore::RenderLayerCompositor::hasNonAffineTransform): No longer check
        perspective here, since that doesn't affect whether _this_ layer should disable
        overlap testing. Checking for a non-affine transform is sufficient.
        (WebCore::RenderLayerCompositor::isRunningAcceleratedTransformAnimation):
        New method to check if AnimationController is running a transform animation.
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):

2012-05-03  Chris Fleizach  <cfleizach@apple.com>

        accessibility/misspelled-attributed-string.html test sometimes throws exceptions
        https://bugs.webkit.org/show_bug.cgi?id=85081

        Reviewed by Darin Adler.

        Add in more range checking in case we get back ranges from spell checking that are wrong.

        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
        (AXAttributeStringSetFont):
        (AXAttributeStringSetColor):
        (AXAttributeStringSetNumber):
        (AXAttributeStringSetBlockquoteLevel):
        (AXAttributeStringSetHeadingLevel):
        (AXAttributeStringSetElement):

2012-05-03  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: move canonical mime type calculation to Resource
        https://bugs.webkit.org/show_bug.cgi?id=85507

        Reviewed by Yury Semikhatsky.

        Drive-by: small refactoring that prepares code for formatter extraction.

        * inspector/front-end/BreakpointsSidebarPane.js:
        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel.prototype.createLiveLocation):
        (WebInspector.DebuggerModel.prototype.rawLocationToUILocation):
        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModelResourceBinding.prototype._uiSourceCodeForResource):
        * inspector/front-end/NetworkManager.js:
        (WebInspector.NetworkDispatcher.prototype._createNetworkRequest):
        (get WebInspector):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype.requestContent):
        (WebInspector.Resource.prototype.canonicalMimeType):
        (WebInspector.Resource.prototype._innerRequestContent.callback):
        (WebInspector.Resource.prototype._innerRequestContent):
        * inspector/front-end/ResourceView.js:
        (WebInspector.ResourceSourceFrame.prototype.requestContent):
        (WebInspector.ResourceSourceFrame.prototype._contentChanged):

2012-05-03  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: 'expires' value is incorrect for cookies
        https://bugs.webkit.org/show_bug.cgi?id=85489

        Reviewed by Pavel Feldman.

        Fixed cookie 'expires' property type from integer to number so that
        we don't lose precision when assembling Cookie parameter in InspectorResourceAgent.

        * inspector/Inspector.json:

2012-05-03  Dan Bernstein  <mitz@apple.com>

        highlight for Ruby text is mispositioned in the Web Inspector
        https://bugs.webkit.org/show_bug.cgi?id=82684

        Reviewed by Simon Fraser.

        Tests: fast/writing-mode/flipped-blocks-inline-map-local-to-container-expected.html
               fast/writing-mode/flipped-blocks-inline-map-local-to-container.html

        In flipped blocks writing modes, flipping was being applied twice to box descendants of
        inline children of the flipped block, once during RenderBox::mapLocalToContainer, and then
        again by RenderInline::mapLocalToContainer. The fix is to make the latter only apply the
        flip to local coordinates originating in the inline or a descendant inline. This is done
        by adding a parameter of type ApplyContainerFlipOrNot, which defaults to ApplyContainerFlip
        but is reset to DoNotApplyContainerFlip in recursive calls into mapLocalToContainer().

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer): Added ApplyContainerFlipOrNot parameter, passing
        DoNotApplyContainerFlip when recursing into the container.
        * rendering/RenderBox.h:

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::mapLocalToContainer): Added ApplyContainerFlipOrNot paramerer, and
        made the flipping conditional on its value.

        * rendering/RenderInline.h:

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::mapLocalToContainer): Added ApplyContainerFlipOrNot parameter,
        passing DoNotApplyContainerFlip when recursing into the container.
        (WebCore::RenderObject::localToContainerQuad): Pass ApplyContainerFlip.
        (WebCore::RenderObject::localToContainerPoint): Ditto.
        * rendering/RenderObject.h:

        * rendering/RenderView.cpp:
        (WebCore::RenderView::mapLocalToContainer): Added ApplyContainerFlipOrNot parameter.
        * rendering/RenderView.h:

        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::mapLocalToContainer): Ditto.
        * rendering/svg/RenderSVGForeignObject.h:

        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::mapLocalToContainer): Ditto.
        * rendering/svg/RenderSVGInline.h:

        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::mapLocalToContainer): Ditto.
        * rendering/svg/RenderSVGModelObject.h:

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::mapLocalToContainer): Ditto.
        * rendering/svg/RenderSVGRoot.h:

        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::mapLocalToContainer): Ditto.
        * rendering/svg/RenderSVGText.h:

        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::mapLocalToContainer): Pass DoNotApplyContainerFlip when
        recursing into the parent.

2012-05-03  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: make Script a ContentProvider.
        https://bugs.webkit.org/show_bug.cgi?id=85486

        Reviewed by Yury Semikhatsky.

        This allows us to get rid of the corresponding content provider wrapper.

        * inspector/front-end/ContentProviders.js:
        * inspector/front-end/RawSourceCode.js:
        (WebInspector.RawSourceCode.prototype._createContentProvider):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.contentURL):
        (WebInspector.Script.prototype.requestContent.didGetScriptSource):
        (WebInspector.Script.prototype.requestContent):
        * inspector/front-end/SnippetsModel.js:
        (WebInspector.SnippetsScriptMapping.prototype._createUISourceCodeForScript):

2012-05-03  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

        Remove extra checks for empty string when parsing CSS value
        https://bugs.webkit.org/show_bug.cgi?id=85480

        Reviewed by Alexis Menard.

        Each parse value helper function was checking whether the value string was empty. For the
        common case this check is already done by StylePropertySet::setProperty(). So this patch
        make CSSParser::parseValue() assume the value string is not empty, and fix the other two
        clients.

        Test: fast/html/font-face-empty-should-not-crash.html

        * css/CSSParser.cpp:
        (WebCore::parseColorValue): Replace the string empty check by an ASSERT() to document
        function's expectations.
        (WebCore::parseSimpleLengthValue): Ditto.
        (WebCore::parseKeywordValue): Ditto.
        (WebCore::CSSParser::parseFontFaceValue): This will be covered by the added test.
        (WebCore::CSSParser::parseValue):
        * css/WebKitCSSMatrix.cpp:
        (WebCore::WebKitCSSMatrix::setMatrixValue): This is already covered by
        transforms/cssmatrix-2d-interface.xhtml.

2012-05-03  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        Broken handling of pseudo-elements in selectors API
        https://bugs.webkit.org/show_bug.cgi?id=83446

        Reviewed by Antti Koivisto.

        Test: fast/dom/Window/querySelectorAll-with-pseudo-elements.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::SelectorChecker):
        Setting the default value for the enum member m_mode to ResolvingStyle.

        (WebCore::SelectorChecker::checkSelector):
        Instead of verifying against the bool m_isCollectingRulesOnly, we now check whether or not
        m_mode is set to ResolvingStyle.

        (WebCore::SelectorChecker::checkOneSelector):
        Instead of verifying against the bool m_isCollectingRulesOnly, we now check whether or not
        m_mode is set to ResolvingStyle. Also, for the pseudo-elements case we check if its
        value is set to QueryingRules in which case we return false.

        * css/SelectorChecker.h:
        (WebCore::SelectorChecker::mode):
        Returns the mode (m_mode) value.

        (WebCore::SelectorChecker::setMode):
        Sets the mode (m_mode) to the passed enum value.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::sortAndTransferMatchedRules):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        Retrieves SelectorChecker's mode value.

        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQuery::SelectorQuery):
        Sets SelectorChecker's mode to QueryingRules.

        * html/shadow/ContentSelectorQuery.cpp:
        (WebCore::ContentSelectorQuery::ContentSelectorQuery):
        Sets SelectorChecker's mode to CollectingRules.

2012-05-03  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: EXC_BAD_ACCESS in DOM breakpoint processing code.
        https://bugs.webkit.org/show_bug.cgi?id=85482

        Reviewed by Yury Semikhatsky.

        0 check added since we are guaranteed to get immediate parent, but not the whole ancestor tree.

        * inspector/InspectorDOMDebuggerAgent.cpp:
        (WebCore::InspectorDOMDebuggerAgent::descriptionForDOMEvent):

2012-05-03  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: compile time ambiguity happens when I try to assign a TypeBuilder object to an out argument.
        https://bugs.webkit.org/show_bug.cgi?id=85462

        It happens because we have type casting operators for both types RefPtr<*Type*> and PassRefPtr<*Type*>.
        I think we can drop PassRefPtr type casting operator and use a named function 'release'.

        Reviewed by Yury Semikhatsky.

        * inspector/CodeGeneratorInspector.py:
        * inspector/ContentSearchUtils.cpp:
        (WebCore::ContentSearchUtils::buildObjectForSearchMatch):
        * inspector/InspectorApplicationCacheAgent.cpp:
        (WebCore::InspectorApplicationCacheAgent::buildObjectForApplicationCache):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::buildObjectForCookie):
        (WebCore::buildObjectForSearchResult):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::buildObjectForTiming):
        (WebCore::InspectorResourceAgent::buildInitiatorObject):
        * inspector/ScriptCallFrame.cpp:
        (WebCore::ScriptCallFrame::buildInspectorObject):

2012-05-03  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: crash in InspectorResourceAgent::didReceiveWebSocketFrame
        https://bugs.webkit.org/show_bug.cgi?id=85394

        Reviewed by Pavel Feldman.

        Pass string length explicitely when creating String object from non-null-terminated
        char* strings.

        * inspector/InspectorResourceAgent.cpp:
        (WebCore):
        (WebCore::InspectorResourceAgent::didReceiveWebSocketFrame):
        (WebCore::InspectorResourceAgent::didSendWebSocketFrame):

2012-05-03  'Pavel Feldman'  <pfeldman@chromium.org>

        Not reviewed: never surround InspectorInstrumentation:: with ENABLED(INSPECTOR)

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::replaceChild):
        (WebCore::ContainerNode::appendChild):
        (WebCore::dispatchChildRemovalEvents):

2012-04-30  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: migrate breakpoint manager to live locations.
        https://bugs.webkit.org/show_bug.cgi?id=85136

        Reviewed by Yury Semikhatsky.

        - Merges Breakpoint and UIBreakpoint to have single instance
        - Extracts storage from the breakpoint manager
        - Makes breakpoint manager use source mapping from the script, not the presentation model
        - Removes breakpoints collection from the UISourceCode
        Unfortunately, there are too many inter-dependencies that require that these changes are done simultaneously.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager):
        (WebInspector.BreakpointManager.prototype.setBreakpoint):
        (WebInspector.BreakpointManager.prototype.breakpoint):
        (WebInspector.BreakpointManager.prototype.breakpointLocationsForUISourceCode):
        (WebInspector.BreakpointManager.prototype.removeAllBreakpoints):
        (WebInspector.BreakpointManager.prototype.reset):
        (WebInspector.BreakpointManager.prototype.debuggerReset):
        (WebInspector.BreakpointManager.prototype._breakpointResolved):
        (WebInspector.BreakpointManager.prototype._removeBreakpoint):
        (WebInspector.BreakpointManager.prototype._uiLocationAdded):
        (WebInspector.BreakpointManager.prototype._uiLocationRemoved):
        (WebInspector.BreakpointManager.prototype.storage):
        (WebInspector.BreakpointManager.Breakpoint):
        (WebInspector.BreakpointManager.Breakpoint.prototype.primaryUILocation):
        (WebInspector.BreakpointManager.Breakpoint.prototype._addResolvedLocation):
        (WebInspector.BreakpointManager.Breakpoint.prototype.enabled):
        (WebInspector.BreakpointManager.Breakpoint.prototype.setEnabled):
        (WebInspector.BreakpointManager.Breakpoint.prototype.condition):
        (WebInspector.BreakpointManager.Breakpoint.prototype.setCondition):
        (WebInspector.BreakpointManager.Breakpoint.prototype._updateBreakpoint):
        (WebInspector.BreakpointManager.Breakpoint.prototype.remove):
        (WebInspector.BreakpointManager.Breakpoint.prototype._setInDebugger.didSetBreakpoint):
        (WebInspector.BreakpointManager.Breakpoint.prototype._setInDebugger):
        (WebInspector.BreakpointManager.Breakpoint.prototype._removeFromDebugger):
        (WebInspector.BreakpointManager.Breakpoint.prototype._resetLocations):
        (WebInspector.BreakpointManager.Breakpoint.prototype._breakpointStorageId):
        (WebInspector.BreakpointManager.Breakpoint.prototype._fakeBreakpointAtPrimaryLocation):
        (WebInspector.BreakpointManager.Storage.get this):
        (WebInspector.BreakpointManager.Storage):
        (WebInspector.BreakpointManager.Storage.prototype.restoreBreakpoints):
        (WebInspector.BreakpointManager.Storage.prototype._updateBreakpoint):
        (WebInspector.BreakpointManager.Storage.prototype._removeBreakpoint):
        (WebInspector.BreakpointManager.Storage.prototype._save):
        (set WebInspector.BreakpointManager.Storage.Item):
        * inspector/front-end/BreakpointsSidebarPane.js:
        (WebInspector.JavaScriptBreakpointsSidebarPane):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointAdded.didRequestContent):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointAdded):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointRemoved):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.highlightBreakpoint):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._createBreakpointItemId):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointClicked):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointContextMenu):
        * inspector/front-end/DebuggerModel.js:
        (WebInspector.DebuggerModel):
        (WebInspector.DebuggerModel.prototype.breakpointsActive):
        (WebInspector.DebuggerModel.prototype.createLiveLocation):
        * inspector/front-end/DebuggerPresentationModel.js:
        (WebInspector.DebuggerPresentationModel.prototype._handleUISourceCodeListChanged):
        (WebInspector.DebuggerPresentationModelResourceBinding.prototype._setContentWithInitialContent):
        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource):
        (WebInspector.JavaScriptSource.prototype.consoleMessagesCleared):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype.canEditSource):
        (WebInspector.JavaScriptSourceFrame.prototype.editContent):
        (WebInspector.JavaScriptSourceFrame.prototype._onContentChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.populateLineGutterContextMenu):
        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
        (WebInspector.JavaScriptSourceFrame.prototype.didEditContent):
        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition.finishEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointAdded):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointRemoved):
        (WebInspector.JavaScriptSourceFrame.prototype.onTextViewerContentLoaded):
        (WebInspector.JavaScriptSourceFrame.prototype._setBreakpoint):
        (WebInspector.JavaScriptSourceFrame.prototype._continueToLine):
        (WebInspector.JavaScriptSourceFrame.prototype._updateBreakpointsAfterLiveEdit):
        * inspector/front-end/Script.js:
        (WebInspector.Script.prototype.rawLocationToUILocation):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
        (WebInspector.ScriptsPanel.prototype._uiSourceCodeRemoved):
        (WebInspector.ScriptsPanel.prototype._debuggerPaused.else.didGetUILocation):
        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
        (WebInspector.ScriptsPanel.prototype._uiSourceCodeReplaced):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.contentChanged):

2012-05-03  Andrey Kosyakov  <caseq@chromium.org>

        Unreviewed attemp to fix chromium win build broken at r115943.

        * notifications/NotificationClient.h:
        (WebCore):

2012-05-03  Vivek Galatage  <vivekgalatage@gmail.com>

        Linker warnings due to duplicate symbols for SimplifyMarkupCommand.cpp on Windows
        https://bugs.webkit.org/show_bug.cgi?id=85467

        Reviewed by Ryosuke Niwa.

        Removed the multiple inclusion of the file SimplifyMarkupCommand.cpp 

        No new tests required.

        * WebCore.vcproj/WebCore.vcproj:

2012-05-03  Uday Kiran  <udaykiran@motorola.com>

        CSS clip: auto clips to box borders instead of removing clipping
        https://bugs.webkit.org/show_bug.cgi?id=36772

        Reviewed by Andreas Kling.

        According to CSS 2.1 spec, http://www.w3.org/TR/CSS2/visufx.html#propdef-clip,
        clip property with value 'auto' the element does not clip.
        Also getPropertyValue for clip when auto is specified should return "auto"
        and not "rect(0px 0px 0px 0px)".

        Tests: css2.1/20110323/clip-001-expected.html
               css2.1/20110323/clip-001.html

        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyClip::applyValue):

2012-05-02  Antti Koivisto  <antti@apple.com>

        Add temporary feature define for parsed stylesheet caching
        https://bugs.webkit.org/show_bug.cgi?id=85413

        Rubber-stamped by Nikolas Zimmermann.

        While not an externally visible feature this is still a significant internal change.
        It is good to have define in case someone has an urgent need to turn it off.
        
        Caching is enabled by default on all platforms. The define should be removed after some bake time.

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::setCSSStyleSheet):

2012-05-03  Nikolas Zimmermann  <nzimmermann@rim.com>

        Accumulation for values-animation is broken
        https://bugs.webkit.org/show_bug.cgi?id=85158

        Reviewed by Zoltan Herczeg.

        Follow-up patch: Add const Foo& foo() const accessors to SVGAnimatedType,
        to avoid the "Foo& foo = animated->foo()" idiom in all cases where we
        don't need to mutate 'foo'. Use "const Foo& foo = animated->foo()" instead.
        Inline all of these methods to avoid the function call overhead.

        For to-animations we actually mutated the from value before, but it wasn't a
        problem in practive, as we did that on every animation step. Fully avoid these
        inconsitencies by never mutating the from/to types stored in SVGAnimateElement.

        Cache toAtEndOfDurationType just like m_toType/m_fromType in SVGAnimateElement,
        to avoid reconstructing it on every animation step.

        No new tests, only design/performance fixes.

        * svg/SVGAnimateElement.cpp:
        (WebCore::SVGAnimateElement::calculateAnimatedValue):
        (WebCore::SVGAnimateElement::calculateToAtEndOfDurationValue):
        (WebCore::SVGAnimateElement::targetElementWillChange):
        * svg/SVGAnimateElement.h:
        (SVGAnimateElement):
        * svg/SVGAnimateMotionElement.cpp:
        (WebCore::SVGAnimateMotionElement::SVGAnimateMotionElement):
        (WebCore::SVGAnimateMotionElement::calculateToAtEndOfDurationValue):
        (WebCore::SVGAnimateMotionElement::calculateFromAndToValues):
        (WebCore::SVGAnimateMotionElement::calculateFromAndByValues):
        (WebCore::SVGAnimateMotionElement::calculateAnimatedValue):
        * svg/SVGAnimateMotionElement.h:
        (SVGAnimateMotionElement):
        * svg/SVGAnimatedAngle.cpp:
        (WebCore::SVGAnimatedAngleAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedAngleAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedBoolean.cpp:
        (WebCore::SVGAnimatedBooleanAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedColor.cpp:
        (WebCore::SVGAnimatedColorAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedEnumeration.cpp:
        (WebCore::SVGAnimatedEnumerationAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedInteger.cpp:
        (WebCore::SVGAnimatedIntegerAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedIntegerOptionalInteger.cpp:
        (WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedLength.cpp:
        (WebCore::SVGAnimatedLengthAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedLengthAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedLengthList.cpp:
        (WebCore::SVGAnimatedLengthListAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedLengthListAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedNumber.cpp:
        (WebCore::SVGAnimatedNumberAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedNumberList.cpp:
        (WebCore::SVGAnimatedNumberListAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedNumberListAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedNumberOptionalNumber.cpp:
        (WebCore::SVGAnimatedNumberOptionalNumberAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedNumberOptionalNumberAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedPath.cpp:
        (WebCore::SVGAnimatedPathAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedPointList.cpp:
        (WebCore::SVGAnimatedPointListAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedPointListAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedPreserveAspectRatio.cpp:
        (WebCore::SVGAnimatedPreserveAspectRatioAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedRect.cpp:
        (WebCore::SVGAnimatedRectAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedString.cpp:
        (WebCore::SVGAnimatedStringAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedTransformList.cpp:
        (WebCore::SVGAnimatedTransformListAnimator::addAnimatedTypes):
        (WebCore::SVGAnimatedTransformListAnimator::calculateAnimatedValue):
        * svg/SVGAnimatedType.cpp:
        * svg/SVGAnimatedType.h:
        (WebCore::SVGAnimatedType::angleAndEnumeration):
        (SVGAnimatedType):
        (WebCore::SVGAnimatedType::boolean):
        (WebCore::SVGAnimatedType::color):
        (WebCore::SVGAnimatedType::enumeration):
        (WebCore::SVGAnimatedType::integer):
        (WebCore::SVGAnimatedType::integerOptionalInteger):
        (WebCore::SVGAnimatedType::length):
        (WebCore::SVGAnimatedType::lengthList):
        (WebCore::SVGAnimatedType::number):
        (WebCore::SVGAnimatedType::numberList):
        (WebCore::SVGAnimatedType::numberOptionalNumber):
        (WebCore::SVGAnimatedType::path):
        (WebCore::SVGAnimatedType::pointList):
        (WebCore::SVGAnimatedType::preserveAspectRatio):
        (WebCore::SVGAnimatedType::rect):
        (WebCore::SVGAnimatedType::string):
        (WebCore::SVGAnimatedType::transformList):
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::currentValuesForValuesAnimation):
        (WebCore::SVGAnimationElement::startedActiveInterval):
        (WebCore::SVGAnimationElement::updateAnimation):
        * svg/SVGAnimationElement.h:
        (WebCore::SVGAnimationElement::adjustFromToListValues):
        (WebCore::SVGAnimationElement::animateDiscreteType):
        (SVGAnimationElement):

2012-05-02  Alexander Færøy  <ahf@0x90.dk>

        Rename deviceDPI to devicePixelRatio
        https://bugs.webkit.org/show_bug.cgi?id=85049

        Reviewed by Kenneth Rohde Christiansen.

        No new tests added since this is a minor refactoring with no changes
        that should affect tests.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setDevicePixelRatio):
        (WebCore::Settings::devicePixelRatio):
        (Settings):

2012-05-03  Nikolas Zimmermann  <nzimmermann@rim.com>

        Fix multiple begin values support - especially with seeking through setCurrentTime
        https://bugs.webkit.org/show_bug.cgi?id=85372

        Reviewed by Zoltan Herczeg.

        Multiple begin values aka. begin="0s; 2s" aren't correctly handled - resulting in broken & unexpected behavior.
        Supporting seeking properly on documents containing such animations is very important, otherwise we can't reliable
        test animations using either reftests or the SVG JS animation test framework.

        Testcase:
        <rect height="100" fill="green">
            <animate attributeName="width" begin="0s; 2s" dur="8s" from="0" to="100" fill="freeze"/>
        </rect>

        What's expected?
        Two times should be contained in the 'begin' times list in SVGSMILElement: m_beginTimes = { 0s, 2s }.
        The initial first resolved interval is: m_intervalBegin=0.0s, m_intervalEnd=8.0s.

        During t=0s..1.9999s the m_intervalBegin/m_intervalEnd are correct.
        At t=2s, a new interval can be started. m_intervalEnd should be set to nextBeginTime, where nextBeginTime=2s.
        The current interval should get cropped to: m_intervalBegin=0s, m_intervalEnd=2s. The following call to
        resolveNextInterval() sees that elapsed >= m_intervalEnd, and thus moves on to the next interval.
        m_intervalBegin should be 2s and m_intervalEnd=10s after that.

        In trunk this behavior is only partly implemented and broken. Especially broken together with seeking via SVGSVGElement.setCurrentTime.
        That's because we don't correctly seek to the right interval in case of multiple begin values, eg. if we sample an animation with
        begin="0s; 3s" dur="6s" we always remain in the first interval and don't move on.

        Fix all of these issues, making lots more tests work in Dr. Olaf Hofmanns SVG Animation test suite.

        Tests: svg/animations/multiple-begin-additive-animation.html
               svg/animations/multiple-begin-animation-discrete-expected.svg
               svg/animations/multiple-begin-animation-discrete.svg
               svg/animations/multiple-begin-animation-expected.svg
               svg/animations/multiple-begin-animation.svg

        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::begin):
        (WebCore::SMILTimeContainer::setElapsed):
        (WebCore::SMILTimeContainer::updateAnimations):
        * svg/animation/SMILTimeContainer.h:
        (SMILTimeContainer):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::findInstanceTime):
        (WebCore::SVGSMILElement::resolveInterval):
        (WebCore::SVGSMILElement::resolveNextInterval):
        (WebCore):
        (WebCore::SVGSMILElement::checkRestart):
        (WebCore::SVGSMILElement::seekToIntervalCorrespondingToTime):
        (WebCore::SVGSMILElement::progress):
        * svg/animation/SVGSMILElement.h:
        (SVGSMILElement):

2012-05-03  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't add small opaque areas to the occlusion tracker's Region
        https://bugs.webkit.org/show_bug.cgi?id=85297

        Reviewed by Adrienne Walker.

        Don't add small opaque areas (smaller than 160x160) to the occlusion
        tracker's Region objects to avoid high Region::unite() costs.

        We would like Region to just be fast enough that this isn't a concern,
        and there are patches in flight to do this, but at the moment, small
        opaque areas add significant cost if there is many of them, for
        potentially small gains since they do not cover entire tiles.

        Comments in http://code.google.com/p/chromium/issues/detail?id=124687
        motivate this approach for now, and point to around 160x160 being
        a reasonable threshold.

        Removes the opaque paint tracking flag while we're here. The flag is
        no longer used, and was broken when we moved the "paint vs opaque
        flag" distinction out to the layers.

        Unit test: CCOcclusionTrackerTestMinimumTrackingSize

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::::CCOcclusionTrackerBase):
        (WebCore::addOcclusionBehindLayer):
        (WebCore::::markOccludedBehindLayer):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (WebCore::CCOcclusionTrackerBase::setMinimumTrackingSize):
        (CCOcclusionTrackerBase):
        (WebCore::CCOcclusionTrackerBase::preferredMinimumTrackingSize):

2012-05-02  Jon Lee  <jonlee@apple.com>

        Migrate permission functions to Notification from NotificationCenter
        https://bugs.webkit.org/show_bug.cgi?id=80485
        <rdar://problem/10965458>

        Reviewed by Jian Li.

        * notifications/Notification.idl: Add permission functions.
        * notifications/DOMWindowNotifications.idl: Wrap webkitNotifications as part of legacy API.

        * notifications/Notification.cpp: New permission functions are wrapped with ENABLE(NOTIFICATIONS)
        (WebCore::Notification::taskTimerFired): Use the new permission functions to determine whether we can show the
        notification.
        (WebCore::Notification::permissionLevel):
        (WebCore::Notification::permissionString): Declare three static locals for each of the values, and return
        based on the permission enum.
        (WebCore::Notification::requestPermission): Forward request to client.
        * notifications/Notification.h:

        * notifications/NotificationPermissionCallback.h: Added.
        (NotificationPermissionCallback):
        (WebCore::NotificationPermissionCallback::~NotificationPermissionCallback):
        * notifications/NotificationPermissionCallback.idl: Added.

        * notifications/NotificationCenter.cpp: Wrap permission functions in ENABLE(LEGACY_NOTIFICATIONS)
        * notifications/NotificationCenter.h: Wrap permission functions in ENABLE(LEGACY_NOTIFICATIONS)
        * notifications/NotificationCenter.idl: Refactor conditionals to make the center available only when
        ENABLE(LEGACY_NOTIFICATIONS) is on.
        * notifications/NotificationPresenter.h:
        (WebCore::NotificationPresenter::requestPermission): Add new requestPermission() function for new
        NotificationPermissionCallback type. Make it a stub implementation until all ports have adopted.

        * notifications/NotificationClient.h: Add another requestPermission() client call, wrapped in
        ENABLE(NOTIFICATIONS) that accepts the NotificationPermissionCallback. Wrap the original one in
        ENABLE(LEGACY_NOTIFICATIONS).

        * bindings/js/JSDesktopNotificationsCustom.cpp: Change to include the implementation only in
        ENABLE(LEGACY_NOTIFICATIONS).
        * bindings/js/JSNotificationsCustom.cpp: Custom implementation of requestPermission().
        * bindings/v8/custom/V8NotificationCustom.cpp: Custom implementation of requestPermission().

        * notifications/WorkerContextNotifications.idl: Make webktNotifications available only in legacy API.
        * CMakeLists.txt: Add new callback idl.
        * DerivedSources.make: Add new callback idl.
        * DerivedSources.pri: Add new callback idl.
        * GNUmakefile.list.am: Add NotificationPermissionCallback files.
        * Target.pri: Include JSNotificationCustom.cpp, V8NotificationCustom.cpp
        * UseJSC.cmake: Include JSNotificationCustom.cpp
        * UseV8.cmake: Include V8NotificationCustom.cpp
        * WebCore.gypi: Include JSNotificationCustom.cpp, V8NotificationCustom.cpp, JSNotificationPermissionCallback.{h,cpp}
        * WebCore.vcproj/WebCore.vcproj: Include JSNotificationCustom.cpp, JSNotificationPermissionCallback.{h,cpp}
        * WebCore.exp.in: Export permissionString().
        * WebCore.xcodeproj/project.pbxproj: Add callback idl, h, and cpp files.

2012-05-02  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r115907.
        http://trac.webkit.org/changeset/115907
        https://bugs.webkit.org/show_bug.cgi?id=85458

        It broke all viewport tests on Qt and on GTK (Requested by
        Ossy on #webkit).

        * dom/ViewportArguments.cpp:
        (WebCore::computeViewportAttributes):
        * dom/ViewportArguments.h:
        (ViewportAttributes):

2012-05-02  Gustavo Noronha Silva  <gns@gnome.org>

        [GTK] Finish moving modules into libWebCoreModules.la
        https://bugs.webkit.org/show_bug.cgi?id=85449

        Unreviewed build fix.

        * GNUmakefile.list.am: move remaining modules source files into the
        libWebCoreModules library, this should fix the problems people had
        building the 1.9.1 tarball with unpatched make.

2012-05-02  Dongwoo Im  <dw.im@samsung.com>

        [EFL] Unreviewed, Fix build break when WEB_AUDIO is enabled.
        https://bugs.webkit.org/show_bug.cgi?id=85443

        Unreviewed build fix.

        Three new files were added in the Modules/webaudio directory.
        These files should be included into the CMakeLists.txt file.

        * CMakeLists.txt: Add the newly created files into the CMakeLists.txt

2012-05-02  Eric Seidel  <eric@webkit.org>

        Sort ENABLE_ defines in FeatureDefines.xcconfig files to make them easier to compare with one another (and easier to autogenerate)
        https://bugs.webkit.org/show_bug.cgi?id=85433

        Reviewed by Adam Barth.

        I have a script which can autogenerate these xcconfig files as well as the
        vsprops files (and soon the Chromium, cmake, gnumake and qmake) feature lists
        from a central feature list file.
        In preparation for posting such a tool, I'm re-sorting these xcconfig files to be
        alphabetically ordered (currently they're close, but not quite).
        There is also at least one inconsistency between these files (CSS_LEGACY_PREFIXES) which
        I will fix in a second pass.  I will also sort the FEATURE_DEFINES = line in a follow-up patch.

        * Configurations/FeatureDefines.xcconfig:

2012-05-02  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't occlude pixels in a surface that are needed for a background filter blur
        https://bugs.webkit.org/show_bug.cgi?id=84317

        Reviewed by Adrienne Walker.

        Blur filters move pixels around, so a pixel can influence the value of
        pixels at some distance away. If a pixel is not occluded, then all
        pixels within the radius of the blur may influence the value of that
        pixel, so they should also stay unoccluded.

        For background filters, the pixels are read from the filter's target
        surface, so we remove occlusion from that target surface from pixels
        that will blur into visible pixels.

        Unit test: CCOcclusionTrackerTestDontOccludePixelsNeededForBackgroundFilter
                   CCOcclusionTrackerTestTwoBackgroundFiltersReduceOcclusionTwice
                   CCOcclusionTrackerTestDontOccludePixelsNeededForBackgroundFilterWithClip
                   CCOcclusionTrackerTestDontReduceOcclusionBelowBackgroundFilter
                   CCOcclusionTrackerTestDontReduceOcclusionIfBackgroundFilterIsOccluded
                   CCOcclusionTrackerTestReduceOcclusionWhenBackgroundFilterIsPartiallyOccluded

        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::reduceOcclusion):
        (WebCore):
        (WebCore::reduceOcclusionBelowSurface):
        (WebCore::::leaveToTargetRenderSurface):
        (WebCore::::unoccludedContributingSurfaceContentRect):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
        (CCOcclusionTrackerBase):
        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
        (WebCore::CCQuadCuller::appendSurface):
        (WebCore::CCQuadCuller::appendReplica):

2012-05-02  Levi Weintraub  <leviw@chromium.org>

        Convert FractionalLayoutUnit overflow assertions to stderr warnings
        https://bugs.webkit.org/show_bug.cgi?id=85393

        Reviewed by Eric Seidel.

        Writing warnings to stderr when FractionalLayoutUnits overflow on debug builds instead of asserting
        and crashing. It can be very useful to WebKit developers know when overflow is occurring, but it's
        not always a programming error, so assert wasn't the right action.

        No new tests. No change in behavior.

        * platform/FractionalLayoutUnit.h:
        (WebCore):
        (WebCore::FractionalLayoutUnit::FractionalLayoutUnit):
        (WebCore::FractionalLayoutUnit::toUnsigned):
        (WebCore::FractionalLayoutUnit::setRawValue):

2012-04-18  Jon Honeycutt  <jhoneycutt@apple.com>

        FrameLoaderClient::dispatchWillSendSubmitEvent() should be given more
        information about the form being submitted
        https://bugs.webkit.org/show_bug.cgi?id=84297

        Reviewed by Andy Estes.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::prepareForSubmission):
        Get the form field names and values, and use them to create a FormState
        object. Pass this object when calling dispatchWillSendSubmitEvent().
        (WebCore::HTMLFormElement::getTextFieldValues):
        Loop over the associated elements, looking for <input> elements.
        Collect their names and values.

        * html/HTMLFormElement.h:
        Declare getTextFieldData().

        * loader/EmptyClients.h:
        (WebCore::EmptyFrameLoaderClient::dispatchWillSendSubmitEvent):
        Updated declaration for new parameter type.

        * loader/FrameLoaderClient.h:
        Updated declaration of dispatchWillSendSubmitEvent() for new param
        type.

2012-04-13  Jon Honeycutt  <jhoneycutt@apple.com>

        Make Page::setDefersLoading() have a call count so that each time
        loading is deferred, it must be balanced with a call to resume.
        https://bugs.webkit.org/show_bug.cgi?id=84522

        Reviewed by Andy Estes.

        * page/Page.cpp:
        (WebCore::Page::Page):
        Initialize new call count member.
        (WebCore::Page::setDefersLoading):
        Check whether the callers wants balanced defer/resume loading behavior.
        If the call count is not changing from 0 to 1 or 1 to 0, return early.
        Otherwise, defer or resume loading for frames in this page.

        * page/Page.h:
        (WebCore::Page::defersLoading):
        Added a member to hold the call count.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        Initialized new member m_wantsBalancedSetDefersLoadingBehavior.

        * page/Settings.h:
        (Settings):
        Added new member m_wantsBalancedSetDefersLoadingBehavior.
        (WebCore::Settings::setWantsBalancedSetDefersLoadingBehavior):
        Setter.
        (WebCore::Settings::wantsBalancedSetDefersLoadingBehavior):
        Getter.

2012-05-02  Ojan Vafai  <ojan@chromium.org>

        Add a histogram for rendertree size
        https://bugs.webkit.org/show_bug.cgi?id=85226

        Reviewed by Eric Seidel.

        We record it when the page gets hidden, since this is a point
        at which, in theory, we could kill the rendertree.

        No new tests. This isn't web visible, so there's no way to test it.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear):
        * page/Page.cpp:
        (WebCore::Page::renderTreeSize):
        (WebCore):
        (WebCore::Page::setVisibilityState):
        * page/Page.h:
        (Page):
        * platform/HistogramSupport.cpp:
        (WebCore::HistogramSupport::histogramCustomCounts):
        (WebCore):
        * platform/HistogramSupport.h:
        (HistogramSupport):
        * platform/chromium/HistogramSupportChromium.cpp:
        (WebCore::HistogramSupport::histogramCustomCounts):
        (WebCore):

2012-05-02  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r115902.
        http://trac.webkit.org/changeset/115902
        https://bugs.webkit.org/show_bug.cgi?id=85441

        Compile failure on linux 32 (Requested by zhenyao on #webkit).

        * Modules/indexeddb/IDBBackingStore.h:
        (IDBBackingStore):
        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
        (WebCore::IDBLevelDBBackingStore::nextAutoIncrementNumber):
        * Modules/indexeddb/IDBLevelDBBackingStore.h:
        (IDBLevelDBBackingStore):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::putInternal):
        (WebCore::IDBObjectStoreBackendImpl::genAutoIncrementKey):
        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
        (IDBObjectStoreBackendImpl):

2012-05-02  Julien Chaffraix  <jchaffraix@webkit.org>

        Add ASSERTs to avoid querying dirtied z-index or normal flow lists on RenderLayer
        https://bugs.webkit.org/show_bug.cgi?id=84920

        Reviewed by Simon Fraser.

        Covered by existing tests in Debug (at least several time!).

        This change adds some ASSERTs on RenderLayer that prevent any use of its lists if they
        are dirtied.

        On top of this change, we added an invariant that non-stacking contexts should have their
        z-index lists NULL (instead of empty or NULL previously). This is enforced at
        updateZOrderLists time as we now ensure that it is called in a timely manner.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateLayerBounds):
        Added call to updateLayersIfNeeded as we will query them later and there is no guarantee
        that they are not dirty (we recurse in our children as part of calculateLayerBounds).
        This was causing the new ASSERTs to trigger on css3/filter/ tests.

        (WebCore::RenderLayer::dirtyZOrderLists):
        Added a comment as to why we can't ASSERT that we are in a stacking context here.

        (WebCore::RenderLayer::rebuildZOrderLists):
        Added an ASSERT that we only rebuild z-index lists for dirtied stacking context.

        (WebCore::RenderLayer::updateLayerListsIfNeeded):
        Updated to ensure that the reflection layer has its layers updated too. This was triggering
        the new ASSERTs on fast/runins/run-in-layer-not-removed-crash.html.

        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
        Updated to use the new isDirtyStackingContext function.

        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::isDirtyStackingContext):
        New helper function. Also made updateLayerListsIfNeeded() the only way
        to update layer. That should prevent any misuse.

        (WebCore::RenderLayer::posZOrderList):
        (WebCore::RenderLayer::negZOrderList):
        (WebCore::RenderLayer::normalFlowList):
        ASSERT that we don't query any of the previous lists if they are dirty. Also
        enforce the invariant that non-stacking contexts should have NULL z-index lists.

        (WebCore::RenderLayer::clearZOrderLists):
        New function to clearZOrderLists so that we can enfore the previous invariant.

        (WebCore::RenderLayer::updateZOrderLists):
        Updated to clear the dirty flag and the z-index lists for non-stacking context.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
        Removed the explicit ASSERTs.

        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
        (WebCore::RenderLayerCompositor::canBeComposited):
        Disabled compositing on RenderLayer in flow thread. Because flow thread's
        RenderLayer are not collected as part of RenderLayer's lists and could be composited,
        this was causing the new ASSERTs to trigger (e.g. on fast/regions/webkit-flow-renderer-layer.html).

        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeLayers):
        Updated to use updateLayerListsIfNeeded().

2012-05-02  Levi Weintraub  <leviw@chromium.org>

        Remove unused adjustForAbsoluteZoom method in RenderObject.h
        https://bugs.webkit.org/show_bug.cgi?id=85396

        Reviewed by Eric Seidel.

        We only want to use the integer adjustForAbsoluteZoom method, so this remnant is both unused
        and potentially confusing.

        No new tests. Removing unused code.

        * rendering/RenderObject.h:
        (WebCore):

2012-05-02  Fady Samuel  <fsamuel@chromium.org>

        Removing line in computeViewportAttributes that enforces a minimum scale factor to never allow zooming out more than viewport
        https://bugs