classList.toggle(name, force) treats undefined `force` argument as false

[WebKit-https.git] / Source / WebCore / ChangeLog

2015-09-18  Chris Dumez  <cdumez@apple.com>

        classList.toggle(name, force) treats undefined `force` argument as false
        https://bugs.webkit.org/show_bug.cgi?id=148582
        <rdar://problem/22545600>

        Reviewed by Ryosuke Niwa.

        classList.toggle(name, force) treats undefined `force` argument as false.
        However, according to the Web IDL specification, we should treat undefined
        as if the value was missing for optional parameters that do not have a
        default value:
        https://heycam.github.io/webidl/#dfn-overload-resolution-algorithm (Step 14.4).

        For optional parameters that have a default value, undefined should be
        converted into the default value. This is supported as of r189957.

        In this patch, we use custom bindings to provide a spec-compliant version
        of DOMTokenList.toggle(). Unfortunately, adding such support in the
        bindings generator would be a non-trivial task (I guess, we would have to
        generalize using WTF::Optional<> type for all optional parameters in our
        implementation. Also we cannot use the default value support added in
        r189957 because the toggle() implementation needs to be able to
        distinguish all 3 states for the 'force' parameter: true, false or
        missing.

        The new behavior matches the behavior of Firefox and the specification.

        Test: fast/dom/Element/class-list-toggle.html

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDOMTokenListCustom.cpp: Added.
        (WebCore::JSDOMTokenList::toggle):
        * html/DOMTokenList.h:
        * html/DOMTokenList.idl:

2015-09-17  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Remove unused canClearBrowserCookies / canClearBrowserCache protocol methods
        https://bugs.webkit.org/show_bug.cgi?id=149307

        Reviewed by Brian Burg.

        * inspector/InspectorClient.h:
        (WebCore::InspectorClient::canClearBrowserCache): Deleted.
        (WebCore::InspectorClient::clearBrowserCache): Deleted.
        (WebCore::InspectorClient::canClearBrowserCookies): Deleted.
        (WebCore::InspectorClient::clearBrowserCookies): Deleted.
        These were unimplemented by any ports.

        * inspector/CommandLineAPIHost.cpp:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::InspectorResourceAgent):
        (WebCore::InspectorResourceAgent::canClearBrowserCache): Deleted.
        (WebCore::InspectorResourceAgent::clearBrowserCache): Deleted.
        (WebCore::InspectorResourceAgent::canClearBrowserCookies): Deleted.
        (WebCore::InspectorResourceAgent::clearBrowserCookies): Deleted.
        * inspector/InspectorResourceAgent.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
        * inspector/InspectorTimelineAgent.h:
        * inspector/WorkerInspectorController.cpp:
        (WebCore::WorkerInspectorController::WorkerInspectorController):
        Remove uses of InspectorClient where it is no longer needed.

2015-09-16  Ryosuke Niwa  <rniwa@webkit.org>

        Update features.json for Shadow DOM and Web Components
        https://bugs.webkit.org/show_bug.cgi?id=149249

        Reviewed by Antti Koivisto.

        Updated the status of Shadow DOM and made myself the point of contact for shadow DOM and web components.

        * features.json:

2015-09-17  Chris Dumez  <cdumez@apple.com>

        [WebIDL] Add support for default parameter values
        https://bugs.webkit.org/show_bug.cgi?id=149263
        <rdar://problem/22545600>

        Reviewed by Ryosuke Niwa.

        Add support for default parameter values to our Web IDL parser and JS
        bindings generator. This allows the bindings to convert undefined to
        the parameter's default value for optional parameters:
        https://heycam.github.io/webidl/#dfn-optional-argument-default-value

        Previously, our bindings generator would just convert undefined to
        0 / false / "undefined" for optional parameters, depending on the
        parameter type.

        This patch uses the new default parameter support to fix a bug in
        document.createNodeIterator() / document.createTreeWalker()'s handling
        of the whatToShow parameter:
        https://dom.spec.whatwg.org/#document

        WebKit currently was undefined to 0 in this case, even though it should
        use the parameter's default value: OxFFFFFFFF.

        I am planning to go through other optional parameters in a follow-up
        patch and add default values where needed.

        No new tests, already covered by existing layout tests and
        added bindings tests coverage.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        * bindings/scripts/IDLParser.pm:
        (parseOptionalOrRequiredArgument):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_method_with_optional_arg_and_default_value):
        (webkit_dom_test_obj_method_with_optional_string_and_default_value):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringAndDefaultValue):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj methodWithOptionalArgAndDefaultValue:]):
        (-[DOMTestObj methodWithOptionalStringAndDefaultValue:]):
        * bindings/scripts/test/TestObj.idl:
        * dom/Document.idl:

2015-09-17  Dean Jackson  <dino@apple.com>

        Multi-hop reference cycles not detected.
        https://bugs.webkit.org/show_bug.cgi?id=149181

        Reviewed by Jon Honeycutt.

        SVG's cycle detection was not picking up a
        case where an element was drawing a pattern, that
        referenced another pattern, that referenced another
        pattern, that referenced the original pattern.

        The issue was that we were forgetting to check the
        children of the renderer itself, rather than just
        the children of the referenced renderers.

        Found by running a test from Blink.

        I also took the opportunity to clean up the debugging
        code that logs cycle detection.

        Test: svg/custom/pattern-3-step-cycle.html

        * platform/Logging.h: Add a new SVG channel. I can't believe we
        didn't already have one!
        * rendering/svg/SVGResourcesCycleSolver.cpp:
        (WebCore::SVGResourcesCycleSolver::resourceContainsCycles): Check the referenced
        resources for cycles.
        (WebCore::SVGResourcesCycleSolver::resolveCycles): Logging update.

2015-09-17  Dean Jackson  <dino@apple.com>

        Cyclic resources were not detected if the reference had deep containers
        https://bugs.webkit.org/show_bug.cgi?id=149182

        Reviewed by Jon Honeycutt.

        During our examination of the SVG rendering tree looking for cycles,
        if a resource pointed to something that had a nested structure, and
        one of the parent nodes in that structure was a container object
        without resources itself, we were not looking into the children.

        Test: svg/custom/pattern-content-cycle-w-resourceless-container.html

        * rendering/svg/SVGResourcesCycleSolver.cpp:
        (WebCore::SVGResourcesCycleSolver::resourceContainsCycles): We should still
        check all children resources, but not exit early if there are none. Instead
        we should recurse into any children.
        (WebCore::SVGResourcesCycleSolver::resolveCycles): Changes to some debug
        code that no longer compiled (it's still off by default, but at least
        it will work now).

2015-09-17  Myles C. Maxfield  <mmaxfield@apple.com>

        REGRESSION(r188871): 50% regression in page load time of Wikipedia home page
        https://bugs.webkit.org/show_bug.cgi?id=149320

        Reviewed by Daniel Bates.

        This is due to <rdar://problem/22144016> about how language-specific
        font fallback is an order of magnitude slower than regular non-language-
        specific font-fallback. This performance problem has been fixed, but not
        for iOS 9.

        No new tests because there is no correctness change.

        * platform/graphics/ios/FontCacheIOS.mm:
        (WebCore::platformLookupFallbackFont):

2015-09-17  Ryosuke Niwa  <rniwa@webkit.org>

        Add HTMLSlotElement, Element.slot, and NonDocumentTypeChildNode.assignedSlot
        https://bugs.webkit.org/show_bug.cgi?id=149241

        Reviewed by Antti Koivisto.

        Implement the slotting algorithm and related features: slot element, slot attribute, and assignedSlot
        as specified by https://w3c.github.io/webcomponents/spec/shadow/#slotting-algorithm
        as of 8bf56e8ea5521a7a911efd1cabeb2be0d5c3ca74.

        The slotting algorithm is implemented by the newly introduced SlotAssignment class which is created on
        demand by ShadowRoot when a HTMLSlotElement is inserted into the shadow root. SlotAssignment contains
        a HashMap of a slot name to SlotInfo structure, which holds the number of slot elements of the said name,
        the first element if it's known, and an ordered list of the assigned nodes.

        When there is exactly one slot element of a given name, "element" returns the slot element in O(1).
        When another slot of the same name is inserted into the same shadow tree, we increment "elementCount" and
        set "element" to nullptr since we don't know which slot element comes first in the tree order without O(n)
        tree traversal, which is lazily done in resolveAllSlotElements.

        Observe that SlotInfo's "element" can be nullptr in two occasions: (1) when there is no slot element of
        the given name (SlotAssignment::assignSlots may insert such an entry), and (2) when there are more than
        one slot elements of the same name and we haven't run resolveAllSlotElements.

        Resolving assigned nodes, on the other hand, is always O(n) unless all assignments are up to date, and
        lazily computed by assignSlots. This is because inserting or removing a node doesn't tell us the relative
        ordering of the node with respect to other nodes assigned to the same slot. For example, let's say we have
        child nodes (A, B, C, D) and (A, D) are assigned to slot Alpha and (B, C) are assigned to slot Beta. If we
        insert a new node E between nodes B and C and this node is assigned to slot Alpha, then we must create an
        ordered list (A, E, D) for slot Alpha. Unfortunately, determining where to insert E in this list can cost
        O(n) child traversal in the worst case.

        Tests: fast/shadow-dom/HTMLSlotElement-interface.html
               fast/shadow-dom/NonDocumentTypeChildNode-interface-assignedSlot.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged): Invalidate the slot assignments when slot attribute is changed.
        (WebCore::Element::childrenChanged): Ditto for when a child node is inserted or removed. We can avoid it
        when there is no default slot and only text nodes are removed or added in the future.
        * dom/Element.idl: Added slot attribute on Element.
        * dom/Node.cpp:
        (WebCore::Node::assignedSlot): Added. Returns the assigned slot if the slot is in an open shadow tree.
        * dom/Node.h:
        * dom/NonDocumentTypeChildNode.idl: Added assignedSlot. Only expose in JS for now to avoid generating
        the binding code for HTMLSlotElement in other languages.
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::findAssignedSlot): Added. Forwards it to the implementation in SlotAssignment.
        (WebCore::ShadowRoot::addSlotElementByName): Ditto.
        (WebCore::ShadowRoot::removeSlotElementByName): Ditto.
        (WebCore::ShadowRoot::invalidateSlotAssignments): Ditto.
        (WebCore::ShadowRoot::assignedNodesForSlot): Ditto.
        * dom/ShadowRoot.h:
        (WebCore::ShadowRoot): Added m_slotAssignments as a member.
        * dom/SlotAssignment.cpp: Added.
        (WebCore::treatNullAsEmpty): Added. See https://w3c.github.io/webcomponents/spec/shadow/#dfn-default-slot
        (WebCore::SlotAssignment::findAssignedSlot): Find the slot element to which a given node is assigned.
        Since there could be multiple slot elements of the same name (or lack thereof), call findFirstSlotElement
        to find the first slot element.
        (WebCore::SlotAssignment::addSlotElementByName): Added. Called when a new slot element is inserted into
        the associated shadow tree. When a slot element's name is changed, removeSlotElementByName is called on
        with the old name before addSlotElementByName is called with the new name.
        (WebCore::SlotAssignment::removeSlotElementByName): Ditto for removal.
        (WebCore::SlotAssignment::assignedNodesForSlot): Added. Finds the ordered list of assigned nodes for
        a given slot element. When there are multiple slot elements of the same name, we return the list only if
        SlotInfo::element matches the argument. 
        (WebCore::SlotAssignment::findFirstSlotElement): Added. Resolves SlotInfo::element if needed.
        (WebCore::SlotAssignment::resolveAllSlotElements): Finds SlotInfo::element for all slots. We resolve all
        slots simultaneously to avoid doing O(number of nodes) tree traversal for O(number of slots) to avoid
        the worst case O(n^2) behavior when all nodes in the shadow tree are slot elements of the same name. 
        (WebCore::SlotAssignment::assignSlots): Added. Computes the slot assignments by traversing each child
        of the shadow host and adding to the appropriate SlotInfo::assignedNodes, creating a new entry if needed.
        * dom/SlotAssignment.h: Added.
        (WebCore::SlotAssignment::SlotAssignment):
        (WebCore::SlotAssignment::invalidate):
        (WebCore::SlotAssignment::SlotInfo::SlotInfo):
        (WebCore::SlotAssignment::SlotInfo::hasSlotElements):
        (WebCore::SlotAssignment::SlotInfo::hasDuplicatedSlotElements):
        (WebCore::SlotAssignment::SlotInfo::shouldResolveSlotElement):
        * html/HTMLAttributeNames.in: Added slot attribute.
        * html/HTMLSlotElement.cpp: Added.
        (WebCore::HTMLSlotElement::create):
        (WebCore::HTMLSlotElement::HTMLSlotElement):
        (WebCore::HTMLSlotElement::insertedInto): Calls addSlotElementByName.
        (WebCore::HTMLSlotElement::removedFrom): Calls removeSlotElementByName. Because the element had already
        been removed from the shadow tree, we can't use containingShadowRoot() to find the ShadowRoot here.
        (WebCore::HTMLSlotElement::attributeChanged): Calls removeSlotElementByName and addSlotElementByName.
        (WebCore::HTMLSlotElement::getDistributedNodes): Returns an ordered list of the assigned nodes.
        * html/HTMLSlotElement.h: Added.
        * html/HTMLSlotElement.idl: Added.
        * html/HTMLTagNames.in: Added slot element.

2015-09-17  Chris Dumez  <cdumez@apple.com>

        Regression(r189881): release assertion hit in toJS(ExecState*, JSDOMGlobalObject*, DocumentFragment*)
        https://bugs.webkit.org/show_bug.cgi?id=149281

        Reviewed by Ryosuke Niwa.

        After r189881, we started generating a toJS() function for DocumentFragment
        as an optimization. DocumentFragment has a subclass (ShadowRoot) but the
        default toJS() implementation should have still been acceptable given that
        the subclass is not web-exposed and therefore does not have a JS wrapper.

        However, the ShadowRoot interface was introduced shortly after in r189841
        and to toJS() implementation for DocumentFragment is now invalid. This
        patch introduces a ShadowRoot-aware custom implementation of toJS() for
        DocumentFragment to address the problem.

        No new tests, already covered by:
        plugins/snapshotting/snapshot-plugin-not-quite-blocked-by-image.html

        * bindings/js/JSDocumentFragmentCustom.cpp:
        (WebCore::createNewDocumentFragmentWrapper):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        Provide a ShadowRoot-aware custom implementation of toJS() /
        toJSNewlyCreated() for DocumentFragment.

        * bindings/js/JSNodeCustom.cpp:
        (WebCore::createWrapperInline):
        Fix bug in toJS() implementation for Node as it was not handling
        ShadowRoots properly either.

        * dom/DocumentFragment.idl:
        Use [CustomToJSObject] so we can provide our own custom implementation
        of toJS().

2015-09-17  Antti Koivisto  <antti@apple.com>

        De-template ContainerNodeAlgorithms
        https://bugs.webkit.org/show_bug.cgi?id=149286

        Reviewed by Andreas Kling.

        These are always used with ContainerNode/Node.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::removeDetachedChildren):
        (WebCore::destroyRenderTreeIfNeeded):
        (WebCore::ContainerNode::takeAllChildrenFrom):
        (WebCore::ContainerNode::insertBeforeCommon):
        (WebCore::ContainerNode::appendChildCommon):

            Make append a member for consistency with insert.

        (WebCore::ContainerNode::notifyChildInserted):
        (WebCore::ContainerNode::notifyChildRemoved):
        (WebCore::ContainerNode::parserInsertBefore):
        (WebCore::ContainerNode::replaceChild):
        (WebCore::ContainerNode::appendChild):
        (WebCore::ContainerNode::parserAppendChild):

            Also make rest of these ownership-taking functions take Ref<>&&.

        * dom/ContainerNode.h:
        (WebCore::NoEventDispatchAssertion::NoEventDispatchAssertion):
        (WebCore::ContainerNode::setFirstChild):
        * dom/ContainerNodeAlgorithms.cpp:
        (WebCore::notifyChildNodeRemoved):
        (WebCore::addChildNodesToDeletionQueue):
        (WebCore::removeDetachedChildrenInContainer):
        (WebCore::collectFrameOwners):
        (WebCore::assertConnectedSubrameCountIsConsistent):
        (WebCore::disconnectSubframes):
        * dom/ContainerNodeAlgorithms.h:
        (WebCore::removeDetachedChildrenInContainer): Deleted.
        (WebCore::appendChildToContainer): Deleted.
        (WebCore::Private::NodeRemovalDispatcher::dispatch): Deleted.
        (WebCore::Private::addChildNodesToDeletionQueue): Deleted.
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::insert):
        (WebCore::executeInsertTask):
        (WebCore::executeReparentTask):
        (WebCore::executeInsertAlreadyParsedChildTask):
        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTTreeBuilder::constructTreeFromToken):
        * xml/XMLErrors.cpp:
        (WebCore::XMLErrors::appendErrorMessage):
        (WebCore::createXHTMLParserErrorHeader):
        (WebCore::XMLErrors::insertErrorMessageBlock):
        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::enterText):
        (WebCore::toString):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::startElementNs):
        (WebCore::XMLDocumentParser::processingInstruction):
        (WebCore::XMLDocumentParser::cdataBlock):
        (WebCore::XMLDocumentParser::comment):

2015-09-17  Tim Horton  <timothy_horton@apple.com>

        Block Objective-C exceptions in DictionaryLookup
        https://bugs.webkit.org/show_bug.cgi?id=149256

        Reviewed by Anders Carlsson.

        * editing/mac/DictionaryLookup.mm:
        (WebCore::DictionaryLookup::rangeForSelection):
        (WebCore::DictionaryLookup::rangeAtHitTestResult):
        (WebCore::expandSelectionByCharacters):
        (WebCore::DictionaryLookup::stringForPDFSelection):
        (WebCore::showPopupOrCreateAnimationController):
        (WebCore::DictionaryLookup::hidePopup):
        It is possible for Lookup to throw an exception if one of its
        related services dies for some reason. This shouldn't take down
        our UI process, so block the exceptions.

2015-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>

        [ES6] Add more fine-grained APIs and additional hooks to control module loader from WebCore
        https://bugs.webkit.org/show_bug.cgi?id=149129

        Reviewed by Saam Barati.

        No behavior change.

        * bindings/js/JSDOMWindowBase.cpp:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:

2015-09-17  Alex Christensen  <achristensen@webkit.org>

        Switch AppleWin build to use CMake
        https://bugs.webkit.org/show_bug.cgi?id=149163

        Reviewed by Brent Fulgham.

        * bindings/scripts/preprocess-idls.pl:
        (CygwinPathIfNeeded):
        (WriteFileIfChanged):
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        Fix new cygwin quirks.  Cygwin is now using some paths from CMake.

2015-09-17  Zalan Bujtas  <zalan@apple.com>

        Remove integral snapping functions from InlineBox class.
        https://bugs.webkit.org/show_bug.cgi?id=136419

        Reviewed by Simon Fraser.

        We should not integral snap inlines during layout time.

        Covered by existing tests.

        * rendering/InlineBox.h:
        (WebCore::InlineBox::pixelSnappedLogicalLeft): Deleted.
        (WebCore::InlineBox::pixelSnappedLogicalRight): Deleted.
        (WebCore::InlineBox::pixelSnappedLogicalTop): Deleted.
        (WebCore::InlineBox::pixelSnappedLogicalBottom): Deleted.
        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
        (WebCore::InlineFlowBox::addBoxShadowVisualOverflow):
        (WebCore::InlineFlowBox::addBorderOutsetVisualOverflow):
        (WebCore::InlineFlowBox::addTextBoxVisualOverflow):

2015-09-17  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo] Compile error, include file not found.
        https://bugs.webkit.org/show_bug.cgi?id=149282

        Reviewed by Alex Christensen.

        * PlatformWin.cmake:
        Copy forwarding headers from new legacy directory, fixing CMake clean builds since r189746.

2015-09-17  Tim Horton  <timothy_horton@apple.com>

        Delete some dead code
        https://bugs.webkit.org/show_bug.cgi?id=149255

        Reviewed by Dan Bernstein.

        No new tests, just cleanup.

        * platform/RuntimeApplicationChecksIOS.h:
        * platform/RuntimeApplicationChecksIOS.mm:
        (WebCore::applicationIsEpicurious): Deleted.
        (WebCore::applicationIsMASH): Deleted.
        Nothing uses these application checks anymore.

        * platform/ios/SoundIOS.mm:
        (WebCore::systemBeep):
        What a beep should be on iOS, I don't know.
        What it should not be is a NSLog.

2015-09-17  Saam barati  <sbarati@apple.com>

        Interpreter::unwind() shouldn't be responsible for filtering out uncatchable exceptions
        https://bugs.webkit.org/show_bug.cgi?id=149228

        Reviewed by Mark Lam.

        No new tests, already covered by current tests. This is not an observable behavior change.

        * bindings/js/JSNodeFilterCustom.cpp:
        (WebCore::JSNodeFilter::acceptNode):

2015-09-17  Zalan Bujtas  <zalan@apple.com>

        column-rule-style: outset/inset doesn't work
        https://bugs.webkit.org/show_bug.cgi?id=148815
        <rdar://problem/22582644>

        Reviewed by David Hyatt.

        https://drafts.csswg.org/css-multicol-1/#crs
        The <‘border-style’> values are interpreted as in the collapsing border model.

        Unskipped 4 multicolumn tests, 

        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::paintColumnRules):
        * rendering/RenderTableCell.cpp:
        (WebCore::collapsedBorderStyle): Deleted.
        * rendering/style/RenderStyle.h:
        (WebCore::collapsedBorderStyle):

2015-09-17  Chris Dumez  <cdumez@apple.com>

        Range.deleteContents cannot delete DocType
        https://bugs.webkit.org/show_bug.cgi?id=148773
        <rdar://problem/22571280>

        Reviewed by Ryosuke Niwa.

        Range.deleteContents() was not able to delete a DocumentType Node, and
        was throwing a HIERARCHY_REQUEST_ERR. The DOM specification does not
        say we should throw in such case:
        https://dom.spec.whatwg.org/#dom-range-deletecontents

        However, Range.extractContents() should still throw an exception
        if any of the contained children in a DocumentType Node:
        https://dom.spec.whatwg.org/#concept-range-extract (Step 12)

        No new tests, already covered by existing test.

        * dom/Range.cpp:
        (WebCore::Range::deleteContents):
        (WebCore::Range::extractContents):
        (WebCore::Range::checkDeleteExtract):
        * dom/Range.h:

2015-09-17  Eric Carlson  <eric.carlson@apple.com>

        [Mac MediaStream] Cleanup capture source classes
        https://bugs.webkit.org/show_bug.cgi?id=149233

        Reviewed by Jer Noble.

        * platform/cf/CoreMediaSoftLink.cpp: Soft-link CMAudioFormatDescriptionGetStreamBasicDescription,
          CMSampleBufferGetAudioBufferListWithRetainedBlockBuffer, and CMSampleBufferGetNumSamples.
        * platform/cf/CoreMediaSoftLink.h:

        * platform/mediastream/mac/AVAudioCaptureSource.h:
        (WebCore::AVAudioCaptureSource::Observer::~Observer):
        * platform/mediastream/mac/AVAudioCaptureSource.mm:
        (WebCore::AVAudioCaptureSource::AVAudioCaptureSource): Initialize m_inputDescription.
        (WebCore::AVAudioCaptureSource::capabilities): 0 -> nullptr.
        (WebCore::AVAudioCaptureSource::addObserver): New, add an observer and tell it to prepare.
        (WebCore::AVAudioCaptureSource::removeObserver): New.
        (WebCore::operator==): Compare AudioStreamBasicDescription.
        (WebCore::operator!=):
        (WebCore::AVAudioCaptureSource::captureOutputDidOutputSampleBufferFromConnection): Call 
          observer->prepare when passed a new stream description, call observer->process.

        * platform/mediastream/mac/AVCaptureDeviceManager.mm:
        (WebCore::refreshCaptureDeviceList): Set m_groupID and m_localizedName.
        (WebCore::AVCaptureDeviceManager::sessionSupportsConstraint): Invalid constraint names should
          be ignored, so return true when passed one.
        (WebCore::AVCaptureDeviceManager::getSourcesInfo): This just didn't work, fix it.
        (WebCore::AVCaptureDeviceManager::verifyConstraintsForMediaType): Optional constraints are
          optional so they don't need to be validated.
        (WebCore::AVCaptureDeviceManager::bestSourcesForTypeAndConstraints): m_audioSource -> m_audioAVMediaCaptureSource,
          m_videoSource -> m_videoAVMediaCaptureSource.
        (WebCore::AVCaptureDeviceManager::sourceWithUID): Ditto.

        * platform/mediastream/mac/AVMediaCaptureSource.h:
        (WebCore::AVMediaCaptureSource::session):
        (WebCore::AVMediaCaptureSource::device):
        (WebCore::AVMediaCaptureSource::currentStates):
        (WebCore::AVMediaCaptureSource::constraints):
        (WebCore::AVMediaCaptureSource::statesDidChanged):
        (WebCore::AVMediaCaptureSource::createWeakPtr):
        (WebCore::AVMediaCaptureSource::buffer): Deleted.
        (WebCore::AVMediaCaptureSource::setBuffer): Deleted.
        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::AVMediaCaptureSource): Initilize m_weakPtrFactory.
        (WebCore::AVMediaCaptureSource::scheduleDeferredTask): New, call a function asynchronously on
          the main thread.
        (-[WebCoreAVMediaCaptureSourceObserver captureOutput:didOutputSampleBuffer:fromConnection:]): Don't
          dispatch calls to the main thread, let the derived classes do that if necessary.

        * platform/mediastream/mac/AVVideoCaptureSource.h:
        (WebCore::AVVideoCaptureSource::width):
        (WebCore::AVVideoCaptureSource::height):
        (WebCore::AVVideoCaptureSource::previewLayer):
        (WebCore::AVVideoCaptureSource::currentFrameSampleBuffer):
        * platform/mediastream/mac/AVVideoCaptureSource.mm:
        (WebCore::AVVideoCaptureSource::setFrameRateConstraint): Remove unwanted logging.
        (WebCore::AVVideoCaptureSource::setupCaptureSession): Configure the AVCaptureVideoDataOutput so
          it delivers 32-bit BGRA samples.
        (WebCore::AVVideoCaptureSource::calculateFramerate): Return bool to signal if the frame rate
          changed.
        (WebCore::AVVideoCaptureSource::processNewFrame): New. Process sample buffer, invalidate cached
          image, signal when characteristics change.
        (WebCore::AVVideoCaptureSource::captureOutputDidOutputSampleBufferFromConnection): Schedule
          call to processNewFrame on the main thread so we do all video processing on main thread.
        (WebCore::AVVideoCaptureSource::currentFrameImage): Create and return a CVImageBuffer of the
          current video frame.
        (WebCore::AVVideoCaptureSource::paintCurrentFrameInContext): Draw the current frame to a context.

2015-09-15  Sergio Villar Senin  <svillar@igalia.com>

        [CSS Grid Layout]  Using automatic (instead of min-content) minimums for 'auto' tracks
        https://bugs.webkit.org/show_bug.cgi?id=142329

        Reviewed by Darin Adler.

        Based on Blink's r198697 by <svillar@igalia.com> and r200478 by <jfernandez@igalia.com>

        More precisely (syntax-wise), this would allow 'auto' to be used within the
        minmax() function (it's currently forbidden) and have the 'auto' keyword map
        to minmax(auto, auto) instead of minmax(min-content, max-content).
        - As a minimum, 'auto' would mean "use the specified minimum size, or if
        that is auto, treat as 0 or min-content per Flexbox rules".
        - As a maximum, 'auto' would mean "use the max-content size".

        Regarding the implementation, a new phase is added to the track sizing
        algorithm called ResolveIntrinsicMinimums (the former ResolveIntrinsicMinimums
        is now called ResolveContentBasedMinimums which does not include 'auto'
        resolution) which will be run before any other. This phase uses the minimum
        size of grid items (as specified by min-width/height).

        Tests: fast/css-grid-layout/grid-automatic-minimum-for-auto-columns.html
               fast/css-grid-layout/grid-automatic-minimum-for-auto-rows.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridBreadth):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfMinLength):
        (WebCore::RenderGrid::computeUsedBreadthOfMaxLength):
        (WebCore::RenderGrid::minSizeForChild):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::trackSizeForTrackSizeComputationPhase):
        (WebCore::RenderGrid::shouldProcessTrackForTrackSizeComputationPhase):
        (WebCore::RenderGrid::trackShouldGrowBeyondGrowthLimitsForTrackSizeComputationPhase):
        (WebCore::RenderGrid::markAsInfinitelyGrowableForTrackSizeComputationPhase):
        (WebCore::RenderGrid::updateTrackSizeForTrackSizeComputationPhase):
        (WebCore::RenderGrid::currentItemSizeForTrackSizeComputationPhase):
        * rendering/RenderGrid.h:
        * rendering/style/GridTrackSize.h:
        (WebCore::GridTrackSize::minTrackBreadth):
        (WebCore::GridTrackSize::maxTrackBreadth):
        (WebCore::GridTrackSize::cacheMinMaxTrackBreadthTypes):
        (WebCore::GridTrackSize::hasIntrinsicMinTrackBreadth):
        (WebCore::GridTrackSize::hasAutoMinTrackBreadth):
        (WebCore::GridTrackSize::hasAutoMaxTrackBreadth):
        (WebCore::GridTrackSize::hasMaxContentOrAutoMaxTrackBreadth):
        (WebCore::GridTrackSize::hasAutoOrMinContentMinTrackBreadthAndIntrinsicMaxTrackBreadth):
        (WebCore::GridTrackSize::hasMinContentMinTrackBreadthAndMinOrMaxContentMaxTrackBreadth): Deleted.

2015-09-17  Javier Fernandez  <jfernandez@igalia.com>

        [CSS Grid Layout] Relayout whenever Box Alignment properties change
        https://bugs.webkit.org/show_bug.cgi?id=148070

        Reviewed by Darin Adler.

        We were Reattaching the styles to the RenderTree whenever Content Alignment
        properties (align-items and justify-items) changed their values, since the
        Self Alignment properties depend on such values to resolve 'auto' values
        during layout.

        This patch removes such restriction, since we resolve the auto values
        whenever we access the alignment properties. The only thing we need to
        do is to mark a grid item for layout whenever the Default Alignment
        properties change from/to stretch, since it implies a resize of the grid
        items using 'auto' values for the Self Alignment properties.

        Tests: fast/css-grid-layout/relayout-align-items-changed.html
               fast/css-grid-layout/relayout-align-self-changed.html
               fast/css-grid-layout/relayout-justify-items-changed.html
               fast/css-grid-layout/relayout-justify-self-changed.html
               fast/repaint/align-items-change.html
               fast/repaint/align-items-overflow-change.html
               fast/repaint/align-self-change.html
               fast/repaint/align-self-overflow-change.html
               fast/repaint/justify-items-change.html
               fast/repaint/justify-items-legacy-change.html
               fast/repaint/justify-items-overflow-change.html
               fast/repaint/justify-self-change.html
               fast/repaint/justify-self-overflow-change.html

        * rendering/RenderGrid.cpp:
        (WebCore::defaultAlignmentIsStretch):
        (WebCore::RenderGrid::styleDidChange):
        * rendering/RenderGrid.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::resolveAlignmentOverflow):
        (WebCore::RenderStyle::changeRequiresLayout):
        * style/StyleResolveTree.cpp:
        (WebCore::Style::determineChange): Deleted.

2015-09-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        printing does not use minimum page zoom factor
        https://bugs.webkit.org/show_bug.cgi?id=108507

        Reviewed by Darin Adler.

        * page/PrintContext.cpp:
        (WebCore::PrintContext::beginAndComputePageRectsWithPageSize):
        Helper function to share common code from numberOfPages() and
        spoolAllPagesWithBoundaries().
        (WebCore::PrintContext::numberOfPages): Use beginAndComputePageRectsWithPageSize().
        (WebCore::PrintContext::spoolAllPagesWithBoundaries): Use
        beginAndComputePageRectsWithPageSize() and don't flip the Y axis
        for non Cocoa platforms.
        * page/PrintContext.h:

2015-09-16  Ryosuke Niwa  <rniwa@webkit.org>

        removeShadow shouldn't call ChildNodeRemovalNotifier with the shadow host as the removal point
        https://bugs.webkit.org/show_bug.cgi?id=149244

        Reviewed by Antti Koivisto.

        Since a shadow host is in a different tree than nodes in its shadow tree, it's incorrect to call
        removedFrom with the shadow host as the removal point. This causes HTMLSlotElement::removedFrom
        which will be added in the bug 149241 to call methods on a wrong ShadowRoot.

        We still keep the ad-hoc behavior of using the shadow host as the insertion/removal point when
        calling insertedInto and removedFrom on the shadow root itself to update the InDocument node flag.
        We may want to re-visit this design in the future.

        No new tests since I couldn't quite create a reduction. However, tests I'm adding in the bug 149241
        will crash without this change.

        I separated this patch from the bug 149241 to isolate the high-risk code change here.

        * dom/Element.cpp:
        (WebCore::Element::addShadowRoot): Call insertedInto on ShadowRoot, and then call it on all its
        children separately with the insertion point set to the shadow root since insertedInto relies on
        insertion point's inDocument flag to be true when the shadow host is in the document.
        (WebCore::Element::removeShadowRoot): Ditto in the reverse order.

2015-09-16  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove all uses of PassRefPtr in WebCore/inspector
        https://bugs.webkit.org/show_bug.cgi?id=149156

        Reviewed by Darin Adler.

        * inspector/DOMEditor.cpp:
        (WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
        (WebCore::DOMEditor::ReplaceChildNodeAction::ReplaceChildNodeAction):
        (WebCore::DOMEditor::insertBefore):
        (WebCore::DOMEditor::replaceChild):
        * inspector/DOMEditor.h:
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::removeChildAndMoveToNew):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::highlightSelector):
        * inspector/InspectorDatabaseAgent.cpp:
        (WebCore::InspectorDatabaseAgent::didOpenDatabase):
        * inspector/InspectorDatabaseAgent.h:
        * inspector/InspectorDatabaseInstrumentation.h:
        * inspector/InspectorDatabaseResource.h:
        (WebCore::InspectorDatabaseResource::setDatabase):
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::FrontendMenuProvider::create):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didOpenDatabaseImpl):
        * inspector/InspectorLayerTreeAgent.h:
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::highlightNodeList):
        * inspector/InspectorOverlay.h:
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::sharedBufferContent):
        * inspector/InspectorPageAgent.h:
        * inspector/InspectorResourceAgent.cpp:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::startProfiling):
        (WebCore::stopProfiling):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        * inspector/InspectorTimelineAgent.h:
        * inspector/InspectorWorkerResource.h:
        (WebCore::InspectorWorkerResource::create):
        * inspector/InstrumentingAgents.h:
        * inspector/NetworkResourcesData.cpp:
        (WebCore::createOtherResourceTextDecoder):
        (WebCore::NetworkResourcesData::addResourceSharedBuffer):
        * inspector/NetworkResourcesData.h:
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::createQuad):
        * inspector/WebInjectedScriptHost.h:
        * inspector/WebInjectedScriptManager.cpp:
        (WebCore::WebInjectedScriptManager::WebInjectedScriptManager):
        * inspector/WebInjectedScriptManager.h:

2015-09-16  Brady Eidson  <beidson@apple.com>

        Have window.indexedDB.open return an IDBOpenDBRequest.
        https://bugs.webkit.org/show_bug.cgi?id=149234

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/opendatabase-request.html

        * Modules/indexeddb/client/IDBFactoryImpl.cpp:
        (WebCore::IDBClient::IDBFactory::open):
        (WebCore::IDBClient::IDBFactory::openInternal):
        * Modules/indexeddb/client/IDBFactoryImpl.h:

2015-09-16  Antti Koivisto  <antti@apple.com>

        Turn ChildNodeInsertion/RemovalNotifier classes into functions
        https://bugs.webkit.org/show_bug.cgi?id=149236

        Reviewed by Ryosuke Niwa.

        Less architecture, more readability.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::notifyChildInserted):
        (WebCore::ContainerNode::notifyChildRemoved):
        (WebCore::ContainerNode::removeChildren):
        * dom/ContainerNodeAlgorithms.cpp:
        (WebCore::notifyDescendantInsertedIntoDocument):
        (WebCore::notifyDescendantInsertedIntoTree):
        (WebCore::notifyNodeInsertedIntoDocument):
        (WebCore::notifyNodeInsertedIntoTree):
        (WebCore::notifyChildNodeInserted):
        (WebCore::notifyNodeRemovedFromDocument):
        (WebCore::notifyNodeRemovedFromTree):
        (WebCore::notifyChildNodeRemoved):
        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument): Deleted.
        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoTree): Deleted.
        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument): Deleted.
        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromTree): Deleted.
        * dom/ContainerNodeAlgorithms.h:
        (WebCore::ChildNodeInsertionNotifier::ChildNodeInsertionNotifier): Deleted.
        (WebCore::ChildNodeRemovalNotifier::ChildNodeRemovalNotifier): Deleted.
        (WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument): Deleted.
        (WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoTree): Deleted.
        (WebCore::ChildNodeInsertionNotifier::notify): Deleted.
        (WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument): Deleted.
        (WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromTree): Deleted.
        (WebCore::ChildNodeRemovalNotifier::notify): Deleted.
        * dom/Element.cpp:
        (WebCore::Element::addShadowRoot):
        (WebCore::Element::removeShadowRoot):
        (WebCore::Element::createShadowRoot):

2015-09-16  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove all uses of PassRefPtr in WebCore/bindings
        https://bugs.webkit.org/show_bug.cgi?id=149207

        Reviewed by Darin Adler.

        If RefPtr<>&& argument is passed to new variable or other function, we use copyRef() or WTF::move().
        copyRef() should be used when the argument continues to be used in following code. If it is final use
        inside function, we have to use WTF::move().

        * bridge/NP_jsobject.cpp:
        * bridge/NP_jsobject.h:
        * bridge/c/CRuntimeObject.cpp:
        (JSC::Bindings::CRuntimeObject::CRuntimeObject):
        * bridge/c/CRuntimeObject.h:
        (JSC::Bindings::CRuntimeObject::create):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CInstance::CInstance):
        * bridge/c/c_instance.h:
        (JSC::Bindings::CInstance::create):
        * bridge/jsc/BridgeJSC.cpp:
        (JSC::Bindings::Array::Array):
        (JSC::Bindings::Instance::Instance):
        * bridge/jsc/BridgeJSC.h:
        * bridge/objc/ObjCRuntimeObject.h:
        (JSC::Bindings::ObjCRuntimeObject::create):
        * bridge/objc/ObjCRuntimeObject.mm:
        (JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):
        * bridge/objc/WebScriptObjectProtocol.h:
        * bridge/objc/objc_instance.h:
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::ObjcInstance):
        (ObjcInstance::create):
        * bridge/objc/objc_runtime.h:
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcArray::ObjcArray):
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::RuntimeObject):
        * bridge/runtime_object.h:
        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::create):
        * bridge/runtime_root.h:

2015-09-16  Chris Dumez  <cdumez@apple.com>

        Element's attribute NS API should defined treat undefined namespace as null
        https://bugs.webkit.org/show_bug.cgi?id=149238
        <rdar://problem/22562204>

        Reviewed by Ryosuke Niwa.

        Element's attribute NS API should treat defined undefined namespace as null
        instead of converting it to the "undefined" String. This is because the
        namespace parameter is a nullable String as per the DOM spec:
        - https://dom.spec.whatwg.org/#element

        The attribute is nullable and WebIDL says undefined should be converted
        to null for nullable parameters:
        - https://heycam.github.io/webidl/#es-nullable-type (step 3)

        Firefox follows the specification.

        No new tests, already covered by existing test.

        * dom/Element.idl:

2015-09-16  Chris Dumez  <cdumez@apple.com>

        Possible small iOS PLT regression from r189537
        https://bugs.webkit.org/show_bug.cgi?id=149232

        Reviewed by Ryosuke Niwa.

        r189537 may have regressed PLT a bit on iOS. That change added a couple
        of extra branches to throw exceptions. This patch marks those branches
        as UNLIKELY() as we already do for other similar checks in the JS
        bindings.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_get_property):
        (webkit_dom_test_obj_class_init):
        (webkit_dom_test_obj_get_strict_type_checking_attribute):
        (webkit_dom_test_obj_set_strict_type_checking_attribute):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjStrictTypeCheckingAttribute):
        (WebCore::setJSTestObjStrictTypeCheckingAttribute):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj strictTypeCheckingAttribute]):
        (-[DOMTestObj setStrictTypeCheckingAttribute:]):
        * bindings/scripts/test/TestObj.idl:
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::setTHead):
        (WebCore::HTMLTableElement::setTFoot):

2015-09-16  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Fix common typo "supress" => "suppress"
        https://bugs.webkit.org/show_bug.cgi?id=149199

        Reviewed by Gyuyoung Kim.

        * html/shadow/ContentDistributor.h:
        (WebCore::ContentDistributor::needsDistribution):
        * page/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation):
        * platform/NotImplemented.h:
        * platform/graphics/ca/win/LayerChangesFlusher.cpp:
        (WebCore::LayerChangesFlusher::hookCallback):
        * platform/mac/HIDGamepadProvider.cpp:
        (WebCore::HIDGamepadProvider::deviceRemoved):
        * platform/win/makesafeseh.asm:

2015-09-16  Chris Dumez  <cdumez@apple.com>

        WebIDL: Rename [ReturnNewObject] to [NewObject] and use it more consistently in DOM
        https://bugs.webkit.org/show_bug.cgi?id=149192

        Reviewed by Darin Adler.

        Rename [ReturnNewObject] to [NewObject] and use it more consistently in
        DOM.

        This aligns our IDL extended attribute naming with standard Web IDL:
        https://heycam.github.io/webidl/#NewObject

        We already have [ReturnNewObject] in most places that the DOM
        specification uses [NewObject] but we are missing a few so I'll
        fix this as well:
        https://dom.spec.whatwg.org/#interface-document

        Using [NewObject] lets the bindings generator know that the API in
        question always returns new objects and that we can bypass the check
        for existing wrappers and directly create a new wrapper for the
        returned object.

        This patch also adds support for generating the toJSNewlyCreated()
        utility function for most types. Previously, to use [ReturnNewObject]
        for a new type, you needed to add the type to a hard-coded list in
        the bindings generator then provide your own implementation for
        toJSNewlyCreated() as custom bindings.

        No new-exposed behavior change.

        * bindings/js/JSDocumentCustom.cpp:
        * bindings/js/JSEventCustom.cpp:
        * bindings/js/JSNodeListCustom.cpp:
        Add toJSNewlyCreated() custom implementation for Node, Event and
        Document, that shares code with the existing toJS() implementation for
        those types.

        * bindings/js/JSCDATASectionCustom.cpp: Removed.
        * bindings/js/JSTextCustom.cpp: Removed.
        * bindings/js/JSTouchCustom.cpp: Removed.
        * bindings/js/JSTouchListCustom.cpp: Removed.
        Drop several custom bindings files as the bindings generator is
        now able to generate the toJSNewlyCreated() utility function for
        most types.

        * bindings/scripts/CodeGeneratorJS.pm:
        - Rename [ReturnNewObject] to [NewObject].
        - Generate a toJSNewlyCreated() whenever we generate a toJS() already.
          Get rid of the hard-coded list of types that need a
          toJSNewlyCreated().

        * bindings/scripts/IDLAttributes.txt:
        Rename [ReturnNewObject] to [NewObject].

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/JS/JSattribute.h:
        * bindings/scripts/test/JS/JSreadonly.cpp:
        * bindings/scripts/test/JS/JSreadonly.h:
        Rebaseline bindings tests.

        * dom/Attr.idl:
        * dom/CDATASection.idl:
        * dom/Comment.idl:
        * dom/DocumentFragment.idl:
        * dom/DocumentType.idl:
        * dom/EntityReference.idl:
        * dom/ProcessingInstruction.idl:
        Add [JSGenerateToJSObject] so that the bindings generator generates
        a toJS() / toJSNewlyCreated() for this type. While it is not strictly
        needed, it avoids falling back to using the toJS() from Node which
        calls the virtual nodeType() function to determine the node type.
        This change was made for efficiency purposes.

        * dom/DOMImplementation.idl:
        Rename [ReturnNewObject] to [NewObject] and add it to createHTMLDocument()
        as well, as per the specification:
        https://dom.spec.whatwg.org/#interface-domimplementation

        * dom/Document.idl:
        Rename [ReturnNewObject] to [NewObject] and add it to more operations
        as per he DOM specification:
        https://dom.spec.whatwg.org/#document

        * dom/Node.idl:
        Add [NewObject] to cloneNode() as per the DOM specification:
        https://dom.spec.whatwg.org/#node

        * dom/ParentNode.idl:
        Add [NewObject] to querySelectorAll() as per the DOM specification:
        https://dom.spec.whatwg.org/#parentnode

        * dom/Range.idl:
        Add [NewObject] for several operations, as per the DOM specification:
        https://dom.spec.whatwg.org/#interface-range

2015-09-16  Brady Eidson  <beidson@apple.com>

        Have window.indexedDB.deleteDatabase return an IDBOpenDBRequest.
        https://bugs.webkit.org/show_bug.cgi?id=149229

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/deletedatabase-request.html
              storage/indexeddb/modern/deletedatabase-null-name-exception.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBDatabaseIdentifier.cpp: Added.
        (WebCore::IDBDatabaseIdentifier::IDBDatabaseIdentifier):
        * Modules/indexeddb/IDBDatabaseIdentifier.h: Added.
        (WebCore::IDBDatabaseIdentifier::IDBDatabaseIdentifier):
        (WebCore::IDBDatabaseIdentifier::isHashTableDeletedValue):
        (WebCore::IDBDatabaseIdentifier::hash):
        (WebCore::IDBDatabaseIdentifier::isValid):
        (WebCore::IDBDatabaseIdentifier::operator==):
        (WebCore::IDBDatabaseIdentifier::databaseName):
        (WebCore::IDBDatabaseIdentifierHash::hash):
        (WebCore::IDBDatabaseIdentifierHash::equal):
        (WebCore::IDBDatabaseIdentifierHashTraits::isEmptyValue):

        * Modules/indexeddb/client/IDBFactoryImpl.cpp:
        (WebCore::IDBClient::shouldThrowSecurityException):
        (WebCore::IDBClient::IDBFactory::getDatabaseNames):
        (WebCore::IDBClient::IDBFactory::open):
        (WebCore::IDBClient::IDBFactory::deleteDatabase):
        * Modules/indexeddb/client/IDBFactoryImpl.h:

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.cpp.
        (WebCore::IDBClient::IDBOpenDBRequest::IDBOpenDBRequest):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.cpp.
        (WebCore::IDBClient::IDBOpenDBRequest::create):

        * Modules/indexeddb/client/IDBRequestImpl.cpp: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.cpp.
        (WebCore::IDBClient::IDBRequest::IDBRequest):
        (WebCore::IDBClient::IDBRequest::result):
        (WebCore::IDBClient::IDBRequest::errorCode):
        (WebCore::IDBClient::IDBRequest::error):
        (WebCore::IDBClient::IDBRequest::source):
        (WebCore::IDBClient::IDBRequest::transaction):
        (WebCore::IDBClient::IDBRequest::readyState):
        (WebCore::IDBClient::IDBRequest::eventTargetInterface):
        (WebCore::IDBClient::IDBRequest::activeDOMObjectName):
        (WebCore::IDBClient::IDBRequest::canSuspendForPageCache):
        * Modules/indexeddb/client/IDBRequestImpl.h: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.h.

        * platform/Logging.h:

2015-09-16  Chris Dumez  <cdumez@apple.com>

        Add initial support for [Unforgeable] IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=149147

        Reviewed by Darin Adler.

        Add initial support for [Unforgeable] IDL extended attribute:
        https://heycam.github.io/webidl/#Unforgeable

        In particular, attributes marked as unforgeable are now:
        - on the instance rather than the prototype
        - non-configurable. WebKit does not match the Web IDL specification
          and most properties are currently non-configurable already. However,
          I added an extra check for [Unforgeable] so that unforgeable
          attributes stay unconfigurable if we later decide to match the spec
          and mark properties as configurable.

        Operation marked as unforgeable are now non-configurable. However, this
        patch does not move them from the prototype to the instance yet. This
        needs to be addressed in a follow-up patch as this is a larger change.

        This patch also drops support for the undocumented
        [OperationsNotDeletable] IDL extended attribute. It is no longer needed
        now that we support [Unforgeable] and still support [NotDeletable] for
        operations.

        Test: fast/dom/unforgeable-attributes.html

        * Modules/plugins/QuickTimePluginReplacement.idl:
        Drop [OperationsNotDeletable] on the interface and mark the only
        operation on this interface as [NotDeletable]. There is no behavior
        change but this allows us to drop support for a non-standard and
        undocumented IDL extended attribute.

        * bindings/scripts/CodeGeneratorJS.pm:
        (AttributeShouldBeOnInstance):
        (GenerateAttributesHashTable):
        (GenerateImplementation):
        Add initial support for [Unforgeable] IDL extended attribute.

        * bindings/scripts/IDLAttributes.txt:
        Add [Unforgeable]. Drop [OperationsNotDeletable].

        * crypto/CryptoKeyPair.idl:
        Drop [OperationsNotDeletable] on the interface as this interface has
        no operations.

        * dom/Document.idl:
        * page/DOMWindow.idl:
        * page/Location.idl:
        Mark attributes / interfaces as [Unforgeable] as per the latest HTML
        specification:
        https://html.spec.whatwg.org/multipage/dom.html#document
        https://html.spec.whatwg.org/multipage/browsers.html#window
        https://html.spec.whatwg.org/multipage/browsers.html#the-location-interface

2015-09-16  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Glitch selecting long text.
        https://bugs.webkit.org/show_bug.cgi?id=149204
        rdar://problem/22646472

        Reviewed by Antti Koivisto.

        When long text is split into multiple RenderText objects, we ignore renderer boundaries while
        collecting wrapping positions (so that we don't end up wrapping unbreakable fragments at the end of each renderer).
        This patch ensures that fragments with hypen character ignore renderer boundaries too.

        Test: fast/text/multiple-renderers-with-hypen-on-boundary.html

        * rendering/SimpleLineLayoutTextFragmentIterator.cpp:
        (WebCore::SimpleLineLayout::TextFragmentIterator::skipToNextPosition):

2015-09-16  Brady Eidson  <beidson@apple.com>

        Remove stray logging string mistakenly left in r189746.

        * Modules/indexeddb/legacy/LegacyFactory.cpp:
        (WebCore::LegacyFactory::deleteDatabase):

2015-09-16  Chris Fleizach  <cfleizach@apple.com>

        AX: No VoiceOver typing feedback in some search fields
        https://bugs.webkit.org/show_bug.cgi?id=149177

        Reviewed by Mario Sanchez Prada.

        If SearchFieldRole is not marked as a TextControl, it does not end up returning the accessibilityValue,
        which is needed to output the right text to VoiceOver.

        Test: accessibility/ax-value-with-search.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::isTextControl):

2015-09-16  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Grid container's height should include scrollbar
        https://bugs.webkit.org/show_bug.cgi?id=149210

        Reviewed by Sergio Villar Senin.

        Add scrollbar's size in the grid container's height calculation at
        RenderGrid::layoutGridItems().

        Test: fast/css-grid-layout/grid-container-margin-border-padding-scrollbar.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutGridItems): Include scrollbarLogicalHeight()
        while computing the grid's logical height.

2015-09-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r189676.

        webkit_dom_character_data_append_data() used to raise exceptions.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (FunctionUsedToRaiseException):

2015-09-15  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r189847.
        https://bugs.webkit.org/show_bug.cgi?id=149208

        Asserts on all the tests (Requested by ap on #webkit).

        Reverted changeset:

        "Simple line layout: Glitch selecting long text."
        https://bugs.webkit.org/show_bug.cgi?id=149204
        http://trac.webkit.org/changeset/189847

2015-09-15  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Glitch selecting long text.
        https://bugs.webkit.org/show_bug.cgi?id=149204
        rdar://problem/22646472

        Reviewed by Antti Koivisto.

        When long text is split into multiple RenderText objects, we ignore renderer boundaries while
        collecting wrapping positions (so that we don't end up wrapping unbreakable fragments at the end of each renderer).
        This patch ensures that fragments with hypen character ignore renderer boundaries too.

        Test: fast/text/multiple-renderers-with-hypen-on-boundary.html

        * rendering/SimpleLineLayoutTextFragmentIterator.cpp:
        (WebCore::SimpleLineLayout::TextFragmentIterator::skipToNextPosition):

2015-09-15  Ryosuke Niwa  <rniwa@webkit.org>

        GTK+ build fix attempt after r189841.

        * PlatformGTK.cmake:

2015-09-15  Chris Dumez  <cdumez@apple.com>

        Document.createElement(localName) does not handle correctly missing or null parameter
        https://bugs.webkit.org/show_bug.cgi?id=149184
        <rdar://problem/22565070>

        Reviewed by Ryosuke Niwa.

        Document.createElement(localName) does not handle correct missing or
        null parameter:
        - https://dom.spec.whatwg.org/#interface-document

        As per the specification, the parameter is a non-nullable DOMString and
        is mandatory. Therefore, as per Web IDL, we should have the following
        behavior:
        1. If the parameter is missing, we should throw an exception
        2. If the parameter is null, we should convert it to the "null" string
           and create a <null> element.

        Chrome and Firefox behave according to the specification. However,
        WebKit was doing:
        1. Create a <undefined> element
        2. Throw an InvalidCharacterError

        This patch aligns WebKit's behavior with the specification and other
        major browsers.

        No new tests, already covered by existing tests.

        * dom/Document.idl:

2015-09-15  Ryosuke Niwa  <rniwa@webkit.org>

        Add ShadowRoot interface and Element.prototype.attachShadow
        https://bugs.webkit.org/show_bug.cgi?id=149187

        Reviewed by Antti Koivisto.

        Add back ShadowRoot IDL interface and Element.prototype.attachShadow in accordance with
        http://w3c.github.io/webcomponents/spec/shadow/ at db27e6e36eab512d86edcdabb33ed27b5751acd7 excluding getSelection(),
        elementFromPoint(), elementsFromPoint(), caretPositionFromPoint(), and styleSheets attribute on ShadowRoot interface.

        The feature is enabled by default on Mac and iOS ports for testing and disabled by default elsewhere.

        Also added HTMLElement::canHaveUserAgentShadowRoot which returns false by default and overridden elsewhere to return true
        to distinguish elements for which attachShadow is supposed to throw NotSupported.
        See https://w3c.github.io/webcomponents/spec/shadow/#widl-Element-attachShadow-ShadowRoot-ShadowRootInit-shadowRootInitDict

        Tests: fast/shadow-dom/Element-interface-attachShadow.html
               fast/shadow-dom/Element-interface-shadowRoot-attribute.html
               fast/shadow-dom/ShadowRoot-interface.html

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * PlatformGTK.cmake:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::matchRecursively):
        * dom/Element.cpp:
        (WebCore::Element::bindingsOffsetParent):
        (WebCore::Element::offsetParent):
        (WebCore::Element::addShadowRoot):
        (WebCore::Element::createShadowRoot):
        (WebCore::Element::attachShadow): Added.
        (WebCore::Element::bindingShadowRoot): Added. Returns null unless the attached shadow root is in the "open" mode.
        * dom/Element.h:
        * dom/Element.idl: Added attachShadow and shadowRoot. We only expose these to JS for now since Dictionary argument isn't
        supported by other binding code.
        * dom/ShadowRoot.cpp: Removed an unused enum.
        * dom/ShadowRoot.h:
        (WebCore::ShadowRoot::Type): Replaced old-style enum "ShadowRootType" by an enum class named "Type". Also added two new
        values Open and Closed for author shadow roots.
        (WebCore::ShadowRoot::type):
        * dom/ShadowRoot.idl: Added.
        * html/HTMLButtonElement.h:
        * html/HTMLDetailsElement.h:
        (HTMLButtonElement::canHaveUserAgentShadowRoot): Ditto.
        * html/HTMLElement.h:
        (WebCore::HTMLElement::canHaveUserAgentShadowRoot): Added. Returns false by default.
        * html/HTMLInputElement.h:
        * html/HTMLKeygenElement.h:
        * html/HTMLMarqueeElement.h:
        * html/HTMLMediaElement.h:
        * html/HTMLMeterElement.h:
        * html/HTMLPlugInElement.h:
        * html/HTMLProgressElement.h:
        * html/HTMLSelectElement.h:
        * html/HTMLSummaryElement.h:
        * html/HTMLTextAreaElement.h:
        * html/shadow/InsertionPoint.h:
        (ShadowRootWithInsertionPoints::ShadowRootWithInsertionPoints):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::selectionPseudoStyle):
        * rendering/RenderLayer.cpp:
        (WebCore::rendererForScrollbar):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::correspondingUseElement):
        * testing/Internals.cpp:
        (WebCore::Internals::shadowRootType):

2015-09-15  Brent Fulgham  <bfulgham@apple.com>

        [Win] Unreviewed release fix after r189832

        * platform/graphics/ca/win/PlatformCALayerWin.h: The implementation
        should exist in Release builds as well.

2015-09-15  Benjamin Poulain  <bpoulain@apple.com>

        Style invalidation affecting siblings does not work with inline-style changes
        https://bugs.webkit.org/show_bug.cgi?id=149189

        Reviewed by Antti Koivisto.

        Style::resolveTree() made the assumption that inline style changes only affect
        descendants and should not participate in "StyleRecalcAffectsNextSiblingElementStyle".
        That was wrong. If the inline style change through CSSOM, it can cause the creation
        of a style attribute, which is observable through "StyleRecalcAffectsNextSiblingElementStyle".

        This patch removes the incorrect assumption. Style invalidation is always propagated now.

        Tests: fast/css/style-attribute-invalidation-propagates-to-counted-siblings.html
               fast/css/style-attribute-invalidation-propagates-to-direct-siblings.html
               fast/css/style-attribute-invalidation-propagates-to-indirect-siblings.html

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::InlineCSSStyleDeclaration::didMutate): Deleted.
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::inlineStyleChanged):
        * dom/StyledElement.h:
        (WebCore::StyledElement::invalidateStyleAttribute):
        Clean up inline-style invalidation a tiny bit.

        * style/StyleResolveTree.cpp:
        (WebCore::Style::resolveTree):
        Fix the bug.

2015-09-15  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Paused Debugger prevents page reload
        https://bugs.webkit.org/show_bug.cgi?id=148174

        Reviewed by Brian Burg.

        When navigating the page while paused, suppress any pausing until the page
        has completed navigation. If not paused and navigating, you can still pause
        in pagehide and unload handlers or other late page events.

        Could not write a reliable test for this at the moment.
        InspectorTest.reloadPage has multiple issues with the output,
        so I'll investigate making reload tests more reliable later.

        * inspector/InspectorController.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::resume): Deleted.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
        We now use existing InspectorInstrumentation functions instead of a method
        on InspectorController during load. In dropping the method InspectorController
        can drop a member variable no longer used.

        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::willStartProvisionalLoad):
        Add a new instrumentation hook.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::willStartProvisionalLoadImpl):
        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
        When starting or completing main frame navigations, let the PageDebuggerAgent do some work.

        * inspector/PageDebuggerAgent.h:
        * inspector/PageDebuggerAgent.cpp:
        (WebCore::PageDebuggerAgent::mainFrameStartedLoading):
        (WebCore::PageDebuggerAgent::mainFrameStoppedLoading):
        (WebCore::PageDebuggerAgent::mainFrameNavigated):
        Suppress pausing if navigating while paused. Otherwise behave as normal.

2015-09-15  Brent Fulgham  <bfulgham@apple.com>

        [Win] Provide a means for viewing the layer tree
        https://bugs.webkit.org/show_bug.cgi?id=149165

        Reviewed by Simon Fraser.

        Revise the old fprintf logic to generate a string
        containing the layer tree so that it can be output
        to the debugger (or elsewhere).

        * platform/graphics/ca/PlatformCALayer.h: Rename 'printTree'
        to 'printLayerTree', and make it available in release builds.
        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        (WebCore::CACFLayerTreeHost::printLayerTree): Added. Calls into
        the PlatformCALayer implementation.
        * platform/graphics/ca/win/CACFLayerTreeHost.h:
        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (printIndent): Revise to use two-space indent and use StringBuilder.
        (printTransform): Ditto.
        (printColor): Added helper function.
        (printLayer): Revised to output information on the layer contents.
        (PlatformCALayerWin::printLayerTree): Renamed from 'printTree'.
        (PlatformCALayerWin::printTree): Deleted.
        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
        (PlatformCALayerWinInternal::drawRepaintCounters): Drive-by fix. Match the
        cocoa repaint counter logic by not painting counters for the layers that
        contain the tile grid.
        * platform/graphics/ca/win/PlatformCALayerWin.h:
        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
        (PlatformCALayerWinInternal::drawRepaintCounters):

2015-09-15  Myles C. Maxfield  <mmaxfield@apple.com>

        REGRESSION(r155554): Nested isolates can cause an infinite loop when laying out bidi runs
        https://bugs.webkit.org/show_bug.cgi?id=149153

        Reviewed by David Hyatt.

        When traversing bidi runs, we might encounter a run which is supposed to be isolated. In this
        situation, we will append a placeholder run in the run list, and remember a pointer to these
        isolated runs inside BidiResolver. Then, once we're done traversing the bidi runs, we return
        to the isolated runs and handle them separately (and replace the placeholder with the result).

        However, due to the fact that our BidiRuns start at leaf nodes, we have to keep track of which
        local root of the render tree we were inspecting (to ensure that we visit the same node
        multiple times if there are nested isolate spans). We were not correctly keeping track of this
        local root, which was leading us to consider the same root multiple times, thereby leading to
        an infinite loop.

        The solution is simply to keep root information alongside the isolated run information inside
        BidiResolver. However, BidiResolver is inside platform/, which means that this new type should
        be a template argument, just like how BidiRun itself is a template argument.

        This new type, BidiIsolatedRun, holds all the information that our isolate-revisiting logic
        needs inside constructBidiRunsForSegment(). It also holds a reference to the placeholder run
        which we will replace.

        Test: fast/text/international/unicode-bidi-isolate-nested-crash.html

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawBidiText): BidiIsolatedRun template argument is unused, so pass
        in Void.
        * platform/text/BidiResolver.h: Add template argument.
        (WebCore::BidiResolver::isolatedRuns):
        (WebCore::IsolatedRun>::~BidiResolver):
        (WebCore::IsolatedRun>::appendRun):
        (WebCore::IsolatedRun>::embed):
        (WebCore::IsolatedRun>::checkDirectionInLowerRaiseEmbeddingLevel):
        (WebCore::IsolatedRun>::lowerExplicitEmbeddingLevel):
        (WebCore::IsolatedRun>::raiseExplicitEmbeddingLevel):
        (WebCore::IsolatedRun>::commitExplicitEmbedding):
        (WebCore::IsolatedRun>::updateStatusLastFromCurrentDirection):
        (WebCore::IsolatedRun>::reorderRunsFromLevels):
        (WebCore::IsolatedRun>::createBidiRunsForLine):
        (WebCore::IsolatedRun>::setMidpointForIsolatedRun): Use references instead of pointers.
        (WebCore::IsolatedRun>::midpointForIsolatedRun): Ditto.
        (WebCore::Run>::~BidiResolver): Deleted.
        (WebCore::Run>::appendRun): Deleted.
        (WebCore::Run>::embed): Deleted.
        (WebCore::Run>::checkDirectionInLowerRaiseEmbeddingLevel): Deleted.
        (WebCore::Run>::lowerExplicitEmbeddingLevel): Deleted.
        (WebCore::Run>::raiseExplicitEmbeddingLevel): Deleted.
        (WebCore::Run>::commitExplicitEmbedding): Deleted.
        (WebCore::Run>::updateStatusLastFromCurrentDirection): Deleted.
        (WebCore::Run>::reorderRunsFromLevels): Deleted.
        (WebCore::Run>::createBidiRunsForLine): Deleted.
        (WebCore::Run>::setMidpointForIsolatedRun): Deleted.
        (WebCore::Run>::midpointForIsolatedRun): Deleted.
        * rendering/InlineIterator.h:
        (WebCore::BidiIsolatedRun::BidiIsolatedRun): New type.
        (WebCore::addPlaceholderRunForIsolatedInline): Create new type, and include local root
        information.
        (WebCore::IsolateTracker::addFakeRunIfNecessary): Include local root information.
        (WebCore::InlineBidiResolver::appendRun): Ditto.
        * rendering/RenderBlockLineLayout.cpp: Update for new BidiIsolatedRun type.
        (WebCore::setUpResolverToResumeInIsolate):
        (WebCore::constructBidiRunsForSegment):
        * rendering/line/TrailingObjects.h:

2015-09-15  Brady Eidson  <beidson@apple.com>

        Add empty IDBFactory implementation for Modern IDB.
        https://bugs.webkit.org/show_bug.cgi?id=149191

        Reviewed by Jer Noble.

        No new tests (No behavior change).

        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::indexedDB):
        
        * Modules/indexeddb/client/IDBFactoryImpl.cpp: 
        (WebCore::IDBClient::IDBFactory::create):
        (WebCore::IDBClient::IDBFactory::IDBFactory):
        (WebCore::IDBClient::IDBFactory::getDatabaseNames):
        (WebCore::IDBClient::IDBFactory::open):
        (WebCore::IDBClient::IDBFactory::deleteDatabase):
        (WebCore::IDBClient::IDBFactory::cmp):
        * Modules/indexeddb/client/IDBFactoryImpl.h: 
        
        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        
        * loader/EmptyClients.cpp:
        * page/DatabaseProvider.h:

2015-09-15  Antti Koivisto  <antti@apple.com>

        Split FontDescription into lower and higher level types
        https://bugs.webkit.org/show_bug.cgi?id=149036

        Reviewed by Darin Adler.

        Currently FontDescription is used through the text subsystem. However much of the data it
        carries is only needed by FontCascade and text layout but not by the lower level Font/FontCache
        layer. This makes code confusing. For example families specified in FontDescription are ignored
        at lower levels.

        Split it into a low level FontDescription and a high level FontCascadeDescription type:

        FontDescription <-> Font
        FontCascadeDescription <-> FontCascade

        The former only carries information that is needed to instantiate a Font or fetch it from the FontCache.
        The latter has additional data for CSS font cascade semantics and other higher level features.

2015-09-15  Myles C. Maxfield  <mmaxfield@apple.com>

        GraphicsContext::drawBidiText()'s BidiResolver should not have isolated runs
        https://bugs.webkit.org/show_bug.cgi?id=149193

        Reviewed by Anders Carlsson.

        There are two users of BidiResolver, one which needs isolated runs (in RenderBlockLineLayout) and
        one which doesn't (in GraphicsContext::drawBidiText()). Because of [1], the isolated runs vector
        is migrating to a new type outside of platform/. Therefore, only the first user of BidiResolver
        should have this member variable.

        This is achieved by creating two subclasses of BidiResolver, and using the Curiously Repeating
        Template pattern to downcast into specializations.

        [1] https://bugs.webkit.org/show_bug.cgi?id=149153

        No new tests because there is no behavior change.

        * platform/text/BidiResolver.h:
        (WebCore::BidiResolverBase::BidiResolverBase):
        (WebCore::BidiResolverBase::increment):
        (WebCore::BidiResolverBase::appendRun):
        (WebCore::BidiResolverBase::incrementInternal):
        (WebCore::IsolateRun>::~BidiResolverWithIsolate):
        (WebCore::Subclass>::appendRunInternal):
        (WebCore::Subclass>::embed):
        (WebCore::Subclass>::checkDirectionInLowerRaiseEmbeddingLevel):
        (WebCore::Subclass>::lowerExplicitEmbeddingLevel):
        (WebCore::Subclass>::raiseExplicitEmbeddingLevel):
        (WebCore::Subclass>::commitExplicitEmbedding):
        (WebCore::Subclass>::updateStatusLastFromCurrentDirection):
        (WebCore::Subclass>::reorderRunsFromLevels):
        (WebCore::Subclass>::createBidiRunsForLine):
        (WebCore::Subclass>::setMidpointForIsolatedRun):
        (WebCore::Subclass>::midpointForIsolatedRun):
        (WebCore::BidiResolver::BidiResolver): Deleted.
        (WebCore::BidiResolver::increment): Deleted.
        (WebCore::BidiResolver::isolatedRuns): Deleted.
        (WebCore::Run>::~BidiResolver): Deleted.
        (WebCore::Run>::appendRun): Deleted.
        (WebCore::Run>::embed): Deleted.
        (WebCore::Run>::checkDirectionInLowerRaiseEmbeddingLevel): Deleted.
        (WebCore::Run>::lowerExplicitEmbeddingLevel): Deleted.
        (WebCore::Run>::raiseExplicitEmbeddingLevel): Deleted.
        (WebCore::Run>::commitExplicitEmbedding): Deleted.
        (WebCore::Run>::updateStatusLastFromCurrentDirection): Deleted.
        (WebCore::Run>::reorderRunsFromLevels): Deleted.
        (WebCore::Run>::createBidiRunsForLine): Deleted.
        (WebCore::Run>::setMidpointForIsolatedRun): Deleted.
        (WebCore::Run>::midpointForIsolatedRun): Deleted.
        * rendering/InlineIterator.h:
        (WebCore::InlineBidiResolver::incrementInternal):
        (WebCore::InlineBidiResolver::appendRunInternal):
        (WebCore::InlineBidiResolver::increment): Deleted.
        (WebCore::InlineBidiResolver::appendRun): Deleted.
        * rendering/line/TrailingObjects.h:

2015-09-15  Chris Dumez  <cdumez@apple.com>

        new Event() without parameter should throw
        https://bugs.webkit.org/show_bug.cgi?id=149146
        <rdar://problem/22565070>

        Reviewed by Ryosuke Niwa.

        new Event() without parameter should throw because the type parameter
        is mandatory as per the specification:
        https://dom.spec.whatwg.org/#interface-event

        Both Firefox and Chrome throw in this case. However, WebKit was
        creating an event whose type is the string "undefined". This patch
        aligns our behavior with the specification and other major browsers.

        No new tests, already covered by existing test.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::constructJSTestEventConstructor):

2015-09-15  Carlos Alberto Lopez Perez  <clopez@igalia.com>

        [GTK] Build failure with ACCELERATED_2D_CANVAS when cairo-gl has built with OpenGLESv2 support only.
        https://bugs.webkit.org/show_bug.cgi?id=149172

        Reviewed by Martin Robinson.

        No new tests, no behavior change.

        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore::GLContextGLX::cairoDevice):

2015-09-15  Chris Dumez  <cdumez@apple.com>

        Element.getAttributeNS() should return null if the attribute does not exist
        https://bugs.webkit.org/show_bug.cgi?id=149180
        <rdar://problem/22561011>

        Reviewed by Ryosuke Niwa.

        Element.getAttributeNS() should return null if the attribute does not
        exist, similarly to what Element.getAttribute() does:
        - https://dom.spec.whatwg.org/#element (both return a nullable DOMString).
        - https://dom.spec.whatwg.org/#dom-element-getattributens (step 2)

        Firefox and Chrome match the specification. However, WebKit was returning
        an empty string for getAttributeNS() and null for getAttribute(). This
        patch aligns WebKit's behavior with the specification and other browsers.

        No new tests, already covered by existing tests.

        * dom/Element.idl:

2015-09-15  Ryosuke Niwa  <rniwa@webkit.org>

        ContentDistribution should be only used for details elements
        https://bugs.webkit.org/show_bug.cgi?id=149148

        Reviewed by Antti Koivisto.

        Extracted ShadowRootWithInsertionPoints out of ShadowRoot for HTMLDetailsElement and HTMLSummaryElement.

        We don't add a separate .h and .cpp files since this is a temporary measure until we replace it with
        a slot-based shadow DOM implementation.

        No new tests. There should be no observable behavioral change.

        * dom/Element.cpp:
        (WebCore::Element::addShadowRoot): Removed the call to didShadowBoundaryChange since this function is only
        called in ensureUserAgentShadowRoot. Also moved the call to didAddUserAgentShadowRoot for
        HTMLDetailsElement's shadow root which uses this function instead of ensureUserAgentShadowRoot.
        (WebCore::Element::removeShadowRoot): Removed the call to invalidateDistribution since it's only called by
        ~Element.
        (WebCore::Element::createShadowRoot):
        (WebCore::Element::ensureUserAgentShadowRoot): Moved the call didAddUserAgentShadowRoot into addShadowRoot
        since HTMLDetailsElement uses a subclass of ShadowRoot.
        (WebCore::Element::childrenChanged):
        (WebCore::Element::removeAllEventListeners):

        * dom/Element.h:
        (Element::addShadowRoot): Made this function a protected member as it's now used by HTMLDetailsElement.

        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::childrenChanged): Deleted.

        * dom/ShadowRoot.h:
        (WebCore::ShadowRoot::distributor): Made this a virtual function and return nullptr by default.
        (WebCore::ShadowRoot::isOrphan):

        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::create): Uses ShadowRootWithInsertionPoints instead of ShadowRoot.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::runPostTypeUpdateTasks): Removed the call to invalidateDistribution since it's
        only relevant for HTMLDetailsElement's shadow DOM.

        * html/HTMLSummaryElement.cpp:
        (WebCore::HTMLSummaryElement::create): Uses ShadowRootWithInsertionPoints instead of ShadowRoot.

        * html/shadow/ContentDistributor.cpp:
        (WebCore::ContentDistributor::distribute):
        (WebCore::ContentDistributor::ensureDistribution):
        (WebCore::ContentDistributor::invalidateDistribution):

        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::childrenChanged):
        (WebCore::InsertionPoint::insertedInto):
        (WebCore::InsertionPoint::removedFrom):
        (WebCore::findInsertionPointOf):
        (WebCore::ShadowRootWithInsertionPoints::childrenChanged): Moved from ShadowRoot.

        * html/shadow/InsertionPoint.h:
        (WebCore::ShadowRootWithInsertionPoints::create): Added.
        (WebCore::ShadowRootWithInsertionPoints::ShadowRootWithInsertionPoints): Added.

2015-09-15  Brent Fulgham  <bfulgham@apple.com>

        [Win] Tiled drawing is rendering more times than it should
        https://bugs.webkit.org/show_bug.cgi?id=149144
        <rdar://problem/22313905>

        Reviewed by Simon Fraser.

        Provide a more faithful implemenation of the Objective C tiled drawing logic.
        (1) Create a new WebTiledBackingLayerWin class that represents a the
            container of tiles. This matches the Objective C design.
        (2) Move implementation of several methods (e.g., isOpaque) to the internal
            class implementation so that the Tile Drawing logic can perform special
            handling in these cases.
        (3) Remove the duplicated Tiled Drawing logic from PlatformCALayerWinInternal,
            since it was just duplicating code in TileController and TileGrid.
        (4) Clean up the display callback code to avoid performing incorrect flipping
            of the coordinate system.

        * PlatformAppleWin.cmake: Add new WebTiledBackingLayerWin file.            
        * WebCore.vcxproj/WebCore.vcxproj: Add the new WebTiledBackingLayerWin files.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * platform/graphics/ca/PlatformCALayer.cpp:
        (PlatformCALayer::flipContext): Added convenience method.
        (PlatformCALayer::drawRepaintIndicator): Ditto.
        * platform/graphics/ca/TileGrid.cpp:
        (TileGrid::platformCALayerPaintContents): Flip the context before drawing the repaint
        indicator on Windows.
        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayerWin::PlatformCALayerWin): Create a WebTiledBackingLayerWin
        object if using tiled drawing.
        (PlatformCALayerWin::~PlatformCALayerWin):
        (PlatformCALayerWin::isOpaque): Move implementation to internal class.
        (PlatformCALayerWin::setOpaque): Ditto.
        (PlatformCALayerWin::setBorderWidth): Ditto.
        (PlatformCALayerWin::setBorderColor): Ditto.
        (PlatformCALayerWin::contentsScale): Ditto.
        (PlatformCALayerWin::setContentsScale): Ditto.
        (PlatformCALayerWin::cornerRadius): Ditto.
        (PlatformCALayerWin::tiledBacking): Ditto.
        (PlatformCALayerWin::drawTextAtPoint): New helper method to draw repaint counter
        text. Needed to work around bug in CG.
        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
        (PlatformCALayerWinInternal::PlatformCALayerWinInternal): Remove tiling-logic
        related member variables.
        (PlatformCALayerWinInternal::~PlatformCALayerWinInternal):
        (shouldInvertBeforeDrawingContent): Added convenience method.
        (shouldInvertBeforeDrawingRepaintCounters): Ditto.
        (PlatformCALayerWinInternal::displayCallback):
        (PlatformCALayerWinInternal::drawRepaintCounters): Helper method to
        share code between the two layer classes.
        (PlatformCALayerWinInternal::internalSetNeedsDisplay): use nullptr.
        (PlatformCALayerWinInternal::setNeedsDisplay): Ditto.
        (PlatformCALayerWinInternal::setNeedsDisplayInRect): Move tiled code
        to WebTiledBackingLayerWin and simplify the remaing code.
        (PlatformCALayerWinInternal::setSublayers): Remove tile code.
        (PlatformCALayerWinInternal::getSublayers): Ditto.
        (PlatformCALayerWinInternal::removeAllSublayers): Ditto.
        (PlatformCALayerWinInternal::insertSublayer): Ditto.
        (PlatformCALayerWinInternal::sublayerCount): Ditto.
        (PlatformCALayerWinInternal::indexOfSublayer): Ditto.
        (PlatformCALayerWinInternal::sublayerAtIndex): Ditto.
        (PlatformCALayerWinInternal::setBounds): Ditto.
        (PlatformCALayerWinInternal::setFrame): Ditto.
        (PlatformCALayerWinInternal::isOpaque): Ditto.
        (PlatformCALayerWinInternal::setOpaque): Ditto.
        (PlatformCALayerWinInternal::contentsScale): Ditto.
        (PlatformCALayerWinInternal::setContentsScale): Ditto.
        (PlatformCALayerWinInternal::setBorderWidth): Ditto.
        (PlatformCALayerWinInternal::setBorderColor): Ditto.
        (layerTypeIsTiled): Deleted.
        (PlatformCALayerWinInternal::constrainedSize): Deleted.
        (PlatformCALayerWinInternal::tileDisplayCallback): Deleted.
        (PlatformCALayerWinInternal::addTile): Deleted.
        (PlatformCALayerWinInternal::removeTile): Deleted.
        (PlatformCALayerWinInternal::tileAtIndex): Deleted.
        (PlatformCALayerWinInternal::tileCount): Deleted.
        (PlatformCALayerWinInternal::updateTiles): Deleted.
        (PlatformCALayerWinInternal::drawTile): Deleted.
        (PlatformCALayerWinInternal::createTileController): Deleted.
        (PlatformCALayerWinInternal::tiledBacking): Deleted.
        * platform/graphics/ca/win/PlatformCALayerWinInternal.h:
        (WebCore::PlatformCALayerWinInternal::owner):
        * platform/graphics/ca/win/WebTiledBackingLayerWin.cpp: Added.
        (WebTiledBackingLayerWin::WebTiledBackingLayerWin):
        (WebTiledBackingLayerWin::~WebTiledBackingLayerWin):
        (DisplayOnMainThreadContext::DisplayOnMainThreadContext):
        (redispatchOnMainQueue):
        (WebTiledBackingLayerWin::displayCallback):
        (WebTiledBackingLayerWin::setNeedsDisplay):
        (WebTiledBackingLayerWin::setNeedsDisplayInRect):
        (WebTiledBackingLayerWin::setBounds):
        (WebTiledBackingLayerWin::isOpaque):
        (WebTiledBackingLayerWin::setOpaque):
        (WebTiledBackingLayerWin::contentsScale):
        (WebTiledBackingLayerWin::setContentsScale):
        (WebTiledBackingLayerWin::setBorderWidth):
        (WebTiledBackingLayerWin::setBorderColor):
        (WebTiledBackingLayerWin::createTileController):
        (WebTiledBackingLayerWin::tiledBacking):
        (WebTiledBackingLayerWin::invalidate):
        * platform/graphics/ca/win/WebTiledBackingLayerWin.h: Added.

2015-09-14  David Hyatt  <hyatt@apple.com>

        [New Block-Inside-Inline Model] Implement margin collapsing across contiguous anonymous inline blocks.
        https://bugs.webkit.org/show_bug.cgi?id=149132

        Reviewed by Zalan Bujtas.

        Added new tests inside fast/block/inside-inlines/

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::anonymousInlineBlock):
        Change this accessor to be more robust and be willing to both recur (in case we ever do decide intermediate line boxes should exist)
        and to type check. This is not currently needed, but I'm just being paranoid and future proof.

        (WebCore::InlineFlowBox::addToLine):
        Again, for thoroughness, I am making sure to propagate the hasAnonymousInlineBlock() bit through to parents. This is only needed
        if we build intermediate line boxes for lines with anonymous inline blocks.

        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
        Anonymous inline blocks receive a layout via layoutBlockChild, in order to make sure that margin collapsing runs. This means
        that unlike other line objects, the position of the child has been determined already. Therefore we simply set the position
        of the line box that wraps the anonymous inline block to the already-computed position for that block.

        Also patch the code that sets lineTop and lineBottom using the root box's dimensions. We don't really care about the root line
        box on anonymous inline block lines and just want to set lineTop and lineBottom to fit the anonymous inline block.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::collapseMargins):
        (WebCore::RenderBlockFlow::collapseMarginsWithChildInfo):
        Refactor collapseMargins to call a helper function that can pass in a previous "sibling", and that can handle the child
        being null. We do this to perform a margin collapse when anonymous inline blocks run up against regular lines (which is like
        collapsing with a sibling block "child").

        * rendering/RenderBlockFlow.h:
        Tweak the MarginInfo constructor to take a const RenderBlockFlow. Tweak some line layout methods to pass in the LineLayoutState
        so that MarginInfo is available during line layout.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::createLineBoxes):
        When we create a new line box, if it is not an anonymous inline block line and our previous line was, simulate a margin
        collapse in order to possibly push the line box down or up. Re-use the pagination adjustment code to rewind line layout
        and perform it again if pushed below a float.

        (WebCore::constructBidiRunsForSegment):
        (WebCore::RenderBlockFlow::layoutRunsAndFloats):
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlockFlow::layoutLineBoxes):
        (WebCore::RenderBlockFlow::determineStartPosition):
        (WebCore::RenderBlockFlow::matchedEndLine):
        (WebCore::RenderBlockFlow::updateRegionForLine):
        (WebCore::RenderBlockFlow::marginCollapseLinesFromStart):
        Patch line layout to run margin collapsing when anonymous inline blocks are encountered. This involves making sure
        margin info and float bottom positions are passed through so that layoutBlockChild can be properly called on
        anonymous inline blocks that we encounter.

        In addition line layout when it syncs dirty lines has to run margin collapsing on earlier lines in order to make
        sure margin info is properly set up at the first dirty line position.

        Note that there will be more improvements/changes in this area (dirty line syncing), as the current model is inefficient
        when many anonymous inline blocks are scattered throughout a large-scale line box tree.

        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
        (WebCore::RootInlineBox::ascentAndDescentForBox):
        Make sure to rely on the block layout code for the placement of the boxes themselves. Set up the line box code to not have
        an effect on ascent/descent.

        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::BreakingContext):
        (WebCore::BreakingContext::handleReplaced):
        When we encounter an anonymous inline block, lay it out when it is seen. We have to delay the layout, since we have
        to be able to perform it mid-line-layout when the containing block's logical height is at the correct value and all previous
        lines are placed. Margin info also has to be current.

        * rendering/line/LineBreaker.cpp:
        * rendering/line/LineBreaker.h:
        Patched to pass LineLayoutState through so that the stuff we need to perform block layout is available (margin info and float vars).

        * rendering/line/LineLayoutState.h:
        Add the block layout margin and float bottom information to the line layout state so that we have it available when performing
        layouts and margin collapses on anonymous inline block children.

2015-09-15  Brady Eidson  <beidson@apple.com>

        Make the IDBAny::Type enum into an enum class.
        https://bugs.webkit.org/show_bug.cgi?id=149169.

        Reviewed by Oliver Hunt.

        No new tests (Cleanup, no behavior change).

        * Modules/indexeddb/IDBAny.h:
        * Modules/indexeddb/legacy/LegacyAny.cpp:
        (WebCore::LegacyAny::createInvalid):
        (WebCore::LegacyAny::createNull):
        (WebCore::LegacyAny::LegacyAny):
        (WebCore::LegacyAny::domStringList):
        (WebCore::LegacyAny::idbCursor):
        (WebCore::LegacyAny::idbCursorWithValue):
        (WebCore::LegacyAny::idbDatabase):
        (WebCore::LegacyAny::idbFactory):
        (WebCore::LegacyAny::idbIndex):
        (WebCore::LegacyAny::idbObjectStore):
        (WebCore::LegacyAny::idbTransaction):
        (WebCore::LegacyAny::scriptValue):
        (WebCore::LegacyAny::string):
        (WebCore::LegacyAny::integer):
        (WebCore::LegacyAny::legacyCursor):
        (WebCore::LegacyAny::legacyCursorWithValue):
        (WebCore::LegacyAny::legacyDatabase):
        (WebCore::LegacyAny::legacyFactory):
        (WebCore::LegacyAny::legacyIndex):
        (WebCore::LegacyAny::legacyObjectStore):
        (WebCore::LegacyAny::legacyTransaction):
        * Modules/indexeddb/legacy/LegacyCursor.cpp:
        (WebCore::LegacyCursor::LegacyCursor):
        (WebCore::LegacyCursor::effectiveObjectStore):
        * Modules/indexeddb/legacy/LegacyObjectStore.cpp:
        * Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp:
        (WebCore::LegacyOpenDBRequest::dispatchEvent):
        * Modules/indexeddb/legacy/LegacyRequest.cpp:
        (WebCore::LegacyRequest::getResultCursor):
        (WebCore::effectiveObjectStore):
        * bindings/js/JSIDBAnyCustom.cpp:
        (WebCore::toJS):
        * inspector/InspectorIndexedDBAgent.cpp:
        * page/DatabaseProvider.h:

2015-09-15  Brady Eidson  <beidson@apple.com>

        Move most IDB object encoding/decoding from WebKit2 to WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=149152

        Reviewed by Alex Christensen.

        No new tests (Cleanup, no behavior change).

        * Modules/indexeddb/IDBDatabaseMetadata.h:
        (WebCore::IDBDatabaseMetadata::encode):
        (WebCore::IDBDatabaseMetadata::decode):
        * Modules/indexeddb/IDBIndexMetadata.h:
        (WebCore::IDBIndexMetadata::encode):
        (WebCore::IDBIndexMetadata::decode):
        * Modules/indexeddb/IDBKeyData.h:
        (WebCore::IDBKeyData::encode):
        (WebCore::IDBKeyData::decode):
        * Modules/indexeddb/IDBKeyPath.h:
        (WebCore::IDBKeyPath::encode):
        (WebCore::IDBKeyPath::decode):
        * Modules/indexeddb/IDBKeyRangeData.h:
        (WebCore::IDBKeyRangeData::encode):
        (WebCore::IDBKeyRangeData::decode):
        * Modules/indexeddb/IDBObjectStoreMetadata.h:
        (WebCore::IDBObjectStoreMetadata::encode):
        (WebCore::IDBObjectStoreMetadata::decode):

2015-09-14  Brady Eidson  <beidson@apple.com>

        Make the enum IDBKey::Type into a utility enum class.
        https://bugs.webkit.org/show_bug.cgi?id=149149

        Reviewed by Alex Christensen.

        No new tests (Cleanup, no behavior change).

        * Modules/indexeddb/IDBKey.cpp:
        (WebCore::IDBKey::isValid):
        (WebCore::IDBKey::compare):
        * Modules/indexeddb/IDBKey.h:
        (WebCore::IDBKey::createNumber):
        (WebCore::IDBKey::createDate):
        (WebCore::IDBKey::createMultiEntryArray):
        (WebCore::IDBKey::createArray):
        (WebCore::IDBKey::type):
        (WebCore::IDBKey::array):
        (WebCore::IDBKey::string):
        (WebCore::IDBKey::date):
        (WebCore::IDBKey::number):
        (WebCore::IDBKey::compareTypes):
        (WebCore::IDBKey::IDBKey):
        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::IDBKeyData):
        (WebCore::IDBKeyData::maybeCreateIDBKey):
        (WebCore::IDBKeyData::isolatedCopy):
        (WebCore::IDBKeyData::encode):
        (WebCore::IDBKeyData::decode):
        (WebCore::IDBKeyData::compare):
        (WebCore::IDBKeyData::loggingString):
        (WebCore::IDBKeyData::setArrayValue):
        (WebCore::IDBKeyData::setStringValue):
        (WebCore::IDBKeyData::setDateValue):
        (WebCore::IDBKeyData::setNumberValue):
        * Modules/indexeddb/IDBKeyData.h:
        (WebCore::IDBKeyData::IDBKeyData):
        (WebCore::IDBKeyData::minimum):
        (WebCore::IDBKeyData::maximum):
        * Modules/indexeddb/IndexedDB.h:
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::idbKeyToJSValue):
        (WebCore::createIDBKeyFromValue):
        (WebCore::createIDBKeyFromScriptValueAndKeyPath):
        (WebCore::generateIndexKeysForValue):
        * inspector/InspectorIndexedDBAgent.cpp:

2015-09-15  Javier Fernandez  <jfernandez@igalia.com>

        [CSS Grid Layout] Using {row, column}-axis terms in alignment related logic
        https://bugs.webkit.org/show_bug.cgi?id=148942

        Reviewed by Sergio Villar Senin.

        This patch changes the names of several functions and variables
        defined to implement the alignment logic. We want to use from now
        on the terms row-axis and column-axis when referring to the
        alignment direction the logic is applied to.

        No new tests, no new functionality.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        (WebCore::RenderGrid::findChildLogicalPosition):
        * rendering/RenderGrid.h:

2015-09-14  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove all uses of PassRefPtr in WebCore/xml
        https://bugs.webkit.org/show_bug.cgi?id=149114

        Reviewed by Darin Adler.

        * dom/DecodedDataDocumentParser.h:
        * dom/DocumentParser.h:
        * dom/RawDataDocumentParser.h:
        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::append):
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::append):
        * html/parser/HTMLDocumentParser.h:
        * html/parser/TextDocumentParser.cpp:
        (WebCore::TextDocumentParser::append):
        * html/parser/TextDocumentParser.h:
        * xml/NativeXPathNSResolver.cpp:
        (WebCore::NativeXPathNSResolver::NativeXPathNSResolver):
        * xml/NativeXPathNSResolver.h:
        (WebCore::NativeXPathNSResolver::create):
        * xml/XMLErrors.cpp:
        (WebCore::createXHTMLParserErrorHeader):
        * xml/XMLHttpRequestProgressEventThrottle.cpp:
        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchReadyStateChangeEvent):
        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchEvent):
        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchDeferredEvents):
        * xml/XMLHttpRequestProgressEventThrottle.h:
        * xml/XMLSerializer.h:
        * xml/XPathEvaluator.cpp:
        (WebCore::XPathEvaluator::createExpression):
        (WebCore::XPathEvaluator::createNSResolver):
        (WebCore::XPathEvaluator::evaluate):
        * xml/XPathEvaluator.h:
        * xml/XPathNodeSet.h: Fix style errors.
        (WebCore::XPath::NodeSet::NodeSet):
        (WebCore::XPath::NodeSet::append):
        * xml/XPathPath.cpp:
        (WebCore::XPath::Filter::evaluate):
        (WebCore::XPath::LocationPath::evaluate):
        * xml/XPathValue.h: ditto.
        (WebCore::XPath::Value::Value):
        (WebCore::XPath::Value::Data::create):
        (WebCore::XPath::Value::Data::Data):
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::transformToDocument):
        (WebCore::XSLTProcessor::transformToFragment):
        * xml/XSLTProcessor.h:
        (WebCore::XSLTProcessor::setXSLStyleSheet):
        (WebCore::XSLTProcessor::importStylesheet):
        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::append):
        * xml/parser/XMLDocumentParser.h:

2015-09-14  Dewei Zhu  <dewei_zhu@apple.com>

        Polish code for r189579.
        https://bugs.webkit.org/show_bug.cgi?id=149131

        Reviewed by Chris Dumez.

        Use more self-explaining function name "characterSetWithUTF8Fallback" instead of
        "characterSetForBindings". Optimize the way to get text encoding.

        * dom/Document.cpp:
        (WebCore::Document::characterSetWithUTF8Fallback):
        (WebCore::Document::encoding): Deleted.
        (WebCore::Document::characterSetForBindings): Deleted.
        * dom/Document.h:
        (WebCore::Document::encoding):
        (WebCore::Document::textEncoding):
        * dom/Document.idl:
        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::createDecoderIfNeeded):
        * loader/FormSubmission.cpp:
        (WebCore::encodingFromAcceptCharset):

2015-09-14  Chris Dumez  <cdumez@apple.com>

        Drop non-standard [IsIndex] WebKit IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=149122
        <rdar://problem/22547139>

        Reviewed by Darin Adler.

        Drop non-standard [IsIndex] WebKit IDL extended attribute. This attribute
        causes us to throw an IndexSizeError if the input value is negative. Web
        IDL supports no such thing. Instead Web IDL supports:
        1. Default behavior: the input value wraps around if it does not fit.
        2. [EnforceRange]: A TypeError is thrown if the input value does not fit [1].
        3. [Clamp]: The input value will be clamped if it does not fit [2].

        Our bindings generator supports all three. We don't need the non-standard
        [IsIndex].

        We previously used [IsIndex] in places where we're supposed to wrap around
        as per Web IDL. Therefore, we threw for negative values but other browsers
        don't. For e.g., CharacterData.substringData(offset, -1) is supposed to
        return the substring from offset to the end of the string. It does so in
        Firefox and Chrome. However, WebKit was throwing an Exception.

        This change impacts the CharacterData and the SVGTextContentElement
        API. The compatibility risk is low because we were throwing an exception
        for negative values and we now wrap the value around instead, as other
        browsers do.

        No new tests, already covered by existing tests.

        [1] https://heycam.github.io/webidl/#EnforceRange
        [2] https://heycam.github.io/webidl/#Clamp

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck): Deleted.
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetPrototypeFunctionItem):
        * bindings/scripts/test/TestEventTarget.idl:
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::deleteData):
        (WebCore::CharacterData::replaceData):
        * dom/CharacterData.idl:
        * dom/ClientRectList.idl:
        * svg/SVGTextContentElement.cpp:
        (WebCore::SVGTextContentElement::getSubStringLength):
        (WebCore::SVGTextContentElement::selectSubString):
        * svg/SVGTextContentElement.idl:

2015-09-14  Chris Dumez  <cdumez@apple.com>

        Document.createNodeIterator(null) / Document.createTreeWalker(null) should throw a TypeError
        https://bugs.webkit.org/show_bug.cgi?id=149126
        <rdar://problem/22564891>

        Reviewed by Ryosuke Niwa.

        Document.createNodeIterator(null) / Document.createTreeWalker(null)
        should throw a TypeError:
        https://dom.spec.whatwg.org/#interface-document

        This is because the parameter is not nullable and Web IDL says we
        should throw a TypeError in this case.

        Firefox and Chrome throw an exception in this case. This patch
        aligns our behavior with the specification and other major browsers.

        No new tests, already covered by existing W3C test.

        * dom/Document.cpp:
        (WebCore::Document::createNodeIterator):
        (WebCore::Document::createTreeWalker):
        * dom/Document.h:
        * dom/Document.idl:
        * dom/NodeIterator.cpp:
        (WebCore::NodeIterator::NodeIterator):
        * dom/NodeIterator.h:
        (WebCore::NodeIterator::create):
        * dom/Traversal.cpp:
        (WebCore::NodeIteratorBase::NodeIteratorBase):
        * dom/Traversal.h:
        * dom/TreeWalker.cpp:
        (WebCore::TreeWalker::TreeWalker):
        * dom/TreeWalker.h:
        (WebCore::TreeWalker::create):

2015-09-14  Alex Christensen  <achristensen@webkit.org>

        Fix Windows clean build after r189746

        * WebCore.vcxproj/copyForwardingHeaders.cmd:
        Copy headers from new legacy directory.

2015-09-14  Chris Dumez  <cdumez@apple.com>

        window.HTMLDetailsElement should exist
        https://bugs.webkit.org/show_bug.cgi?id=149139

        Reviewed by Ryosuke Niwa.

        window.HTMLDetailsElement should exist:
        https://html.spec.whatwg.org/multipage/forms.html#the-details-element

        Drop the [NoInterfaceObject] IDL extended attribute in WebKit to
        address the problem.

        No new tests, already covered by existing tests.

        * html/HTMLDetailsElement.idl:

2015-09-14  Alex Christensen  <achristensen@webkit.org>

        Fix AppleWin CMake build
        https://bugs.webkit.org/show_bug.cgi?id=149137

        Reviewed by Brent Fulgham.

        * PlatformAppleWin.cmake:
        Spell Inband correctly.
        * css/makegrammar.pl:
        Add quotes so bison can be in a directory with spaces in it.        

2015-09-14  Alex Christensen  <achristensen@webkit.org>

        [Win] Unreviewed build fix after r189746

        * WebCore.vcxproj/WebCoreIncludeCommon.props:
        Include new legacy directory.

2015-09-14  Alex Christensen  <achristensen@webkit.org>

        Progress towards CMake on Mac.
        https://bugs.webkit.org/show_bug.cgi?id=149123

        Reviewed by Chris Dumez.

        * CMakeLists.txt:
        Added some more files.
        * PlatformMac.cmake:
        Added more files and listed the strange ObjC bindings.
        * contentextensions/DFACombiner.cpp:
        * contentextensions/DFACombiner.h:
        Added preprocessor protection.
        * platform/FileSystem.h:
        Include utility.  It's needed to compile the different configurations.
        * platform/ScrollAnimator.cpp:
        ScrollAnimator is an abstract class on Mac.  Don't compile it.
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        FontAntialiasingStateSaver.h is only used on iOS.
        * rendering/RenderThemeMac.mm:
        config.h needs to be outside the #if !PLATFORM(IOS) to compile correctly without precompiled headers.

2015-09-14  Brady Eidson  <beidson@apple.com>

        Rename current concrete IDB implementation to "Legacy".
        https://bugs.webkit.org/show_bug.cgi?id=149118

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        This patch makes IDL bindings abstract.
        It then renames the current concrete implementations of the bindings from "IDB" to "Legacy".
        Finally it moves those files and their support classes to a "legacy" subfolder.

        * CMakeLists.txt:
        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        * Modules/indexeddb/IDBAny.cpp:
        * Modules/indexeddb/IDBAny.h:
        * Modules/indexeddb/IDBCursor.cpp:
        * Modules/indexeddb/IDBCursor.h:
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.cpp:
        * Modules/indexeddb/IDBCursorWithValue.h:
        * Modules/indexeddb/IDBCursorWithValue.idl:
        * Modules/indexeddb/IDBDatabase.cpp:
        * Modules/indexeddb/IDBDatabase.h:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBFactory.cpp:
        * Modules/indexeddb/IDBFactory.h:
        * Modules/indexeddb/IDBFactory.idl:
        * Modules/indexeddb/IDBIndex.cpp:
        * Modules/indexeddb/IDBIndex.h:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        * Modules/indexeddb/IDBObjectStore.h:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        * Modules/indexeddb/IDBOpenDBRequest.h:
        * Modules/indexeddb/IDBOpenDBRequest.idl:
        * Modules/indexeddb/IDBRequest.cpp:
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.cpp:
        * Modules/indexeddb/IDBTransaction.h:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/indexeddb/IDBVersionChangeEvent.cpp:
        * Modules/indexeddb/IDBVersionChangeEvent.h:
        * Modules/indexeddb/legacy/IDBCallbacks.h: Renamed from Source/WebCore/Modules/indexeddb/IDBCallbacks.h.
        * Modules/indexeddb/legacy/IDBCursorBackend.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBCursorBackend.cpp.
        * Modules/indexeddb/legacy/IDBCursorBackend.h: Renamed from Source/WebCore/Modules/indexeddb/IDBCursorBackend.h.
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBCursorBackendOperations.cpp.
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.h: Renamed from Source/WebCore/Modules/indexeddb/IDBCursorBackendOperations.h.
        * Modules/indexeddb/legacy/IDBDatabaseBackend.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBDatabaseBackend.cpp.
        * Modules/indexeddb/legacy/IDBDatabaseBackend.h: Renamed from Source/WebCore/Modules/indexeddb/IDBDatabaseBackend.h.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacks.h: Renamed from Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.h: Renamed from Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h.
        * Modules/indexeddb/legacy/IDBFactoryBackendInterface.h: Renamed from Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.h.
        * Modules/indexeddb/legacy/IDBPendingDeleteCall.h: Renamed from Source/WebCore/Modules/indexeddb/IDBPendingDeleteCall.h.
        * Modules/indexeddb/legacy/IDBPendingOpenCall.h: Renamed from Source/WebCore/Modules/indexeddb/IDBPendingOpenCall.h.
        * Modules/indexeddb/legacy/IDBPendingTransactionMonitor.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp.
        * Modules/indexeddb/legacy/IDBPendingTransactionMonitor.h: Renamed from Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h.
        * Modules/indexeddb/legacy/IDBTransactionBackend.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBTransactionBackend.cpp.
        * Modules/indexeddb/legacy/IDBTransactionBackend.h: Renamed from Source/WebCore/Modules/indexeddb/IDBTransactionBackend.h.
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBTransactionBackendOperations.cpp.
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.h: Renamed from Source/WebCore/Modules/indexeddb/IDBTransactionBackendOperations.h.
        * Modules/indexeddb/legacy/IDBTransactionCoordinator.cpp: Renamed from Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.cpp.
        * Modules/indexeddb/legacy/IDBTransactionCoordinator.h: Renamed from Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h.
        * Modules/indexeddb/legacy/LegacyAny.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBAny.cpp.
        * Modules/indexeddb/legacy/LegacyAny.h: Added.
        * Modules/indexeddb/legacy/LegacyCursor.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBCursor.cpp.
        * Modules/indexeddb/legacy/LegacyCursor.h: Copied from Source/WebCore/Modules/indexeddb/IDBCursor.h.
        * Modules/indexeddb/legacy/LegacyCursorWithValue.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp.
        * Modules/indexeddb/legacy/LegacyCursorWithValue.h: Copied from Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h.
        * Modules/indexeddb/legacy/LegacyDatabase.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBDatabase.cpp.
        * Modules/indexeddb/legacy/LegacyDatabase.h: Copied from Source/WebCore/Modules/indexeddb/IDBDatabase.h.
        * Modules/indexeddb/legacy/LegacyFactory.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBFactory.cpp.
        * Modules/indexeddb/legacy/LegacyFactory.h: Copied from Source/WebCore/Modules/indexeddb/IDBFactory.h.
        * Modules/indexeddb/legacy/LegacyIndex.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBIndex.cpp.
        * Modules/indexeddb/legacy/LegacyIndex.h: Added.
        * Modules/indexeddb/legacy/LegacyObjectStore.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp.
        * Modules/indexeddb/legacy/LegacyObjectStore.h: Copied from Source/WebCore/Modules/indexeddb/IDBObjectStore.h.
        * Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp.
        * Modules/indexeddb/legacy/LegacyOpenDBRequest.h: Copied from Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.h.
        * Modules/indexeddb/legacy/LegacyRequest.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBRequest.cpp.
        * Modules/indexeddb/legacy/LegacyRequest.h: Copied from Source/WebCore/Modules/indexeddb/IDBRequest.h.
        * Modules/indexeddb/legacy/LegacyTransaction.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBTransaction.cpp.
        * Modules/indexeddb/legacy/LegacyTransaction.h: Copied from Source/WebCore/Modules/indexeddb/IDBTransaction.h.
        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp: Copied from Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.cpp.
        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Copied from Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.h.
        * WebCore.xcodeproj/project.pbxproj:
        * WebCore.vcxproj/WebCore.vcxproj:

2015-09-14  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        [EFL] Remove create() factory function in EvasGLContext and EvasGLSurface
        https://bugs.webkit.org/show_bug.cgi?id=149110

        Reviewed by Csaba Osztrogonác.

        It is not good implementation we support both create() factory function and public constructor.
        In EvasGLContext and EvasGLSurface cases, those have supported both. However create() factory is only
        used by EwkView. Thus let's remove the create() function, then EwkView creates EvasGLContext using
        std::make_unique<> directly.

        * platform/graphics/efl/EvasGLContext.h:
        (WebCore::EvasGLContext::create): Deleted.
        * platform/graphics/efl/EvasGLSurface.h:
        (WebCore::EvasGLSurface::create): Deleted.

2015-09-09  Sergio Villar Senin  <svillar@igalia.com>

        min-width/height should default to auto for grid items
        https://bugs.webkit.org/show_bug.cgi?id=146021

        Reviewed by Darin Adler.

        Based on Blink's r194408, r194863 and r194887 by <rego@igalia.com>.

        From the spec (http://dev.w3.org/csswg/css-grid/#grid-items):
        "The auto value of min-width and min-height behaves on grid
        items in the relevant axis analogously to its behavior on flex
        items in the main axis."

        From now on the default value for min-width and min-height for
        grid items is auto, meaning that in general, grid items won't
        shrink bellow their content.

        The change is not exactly the same as the one in Blink because
        this one takes into account vertical writting modes, something
        that was not well handled in the original one.

        Tests: fast/css-grid-layout/min-width-height-auto-overflow.html
               fast/css-grid-layout/min-width-height-auto.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        (WebCore::RenderBox::computeLogicalHeight):

2015-09-14  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Percentage columns should remove scrollbar's width
        https://bugs.webkit.org/show_bug.cgi?id=149116

        Reviewed by Sergio Villar Senin.

        Currently the calculation of percentage columns was not subtracting the
        scrollbar's size.
        Fixed RenderGrid::computeUsedBreadthOfSpecifiedLength()
        to avoid this problem.

        Test: fast/css-grid-layout/grid-percent-track-scrollbar.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfSpecifiedLength):

2015-09-13  Chris Dumez  <cdumez@apple.com>

        Improve Node pre-insertion validation when the parent is a Document
        https://bugs.webkit.org/show_bug.cgi?id=149109
        <rdar://problem/22560436>

        Reviewed by Ryosuke Niwa.

        Improve Node pre-insertion validation when the parent is a Document to
        match the specification:
        https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity
        https://dom.spec.whatwg.org/#concept-node-replace

        This affects the following API: Node.insertBefore(), Node.appendChild(),
        Node.replaceChild().

        WebKit current fails to do the following checks whenever the parent is a
        Document from pre-insertion validation:
        1. If the inserted Node is a DocumentFragment, we should make sure it
          contains only one Element.
        -> This is because a Document can have only one child that is an
           Element [1].
        2.a. If an Element is inserted, we should make sure it is not inserted
             before a DocumentType.
        2.b. If a DocumentType is inserted, we should make sure it is not
             inserted after an Element.
        -> This is because the DocType must come before the optional Element
           child [1].

        Firefox and Chrome already match the specification here. This patch
        aligns WebKit's behavior with those browsers and the specification.

        [1] https://dom.spec.whatwg.org/#node-trees

        No new tests, already covered by existing W3C tests.

        * dom/ContainerNode.cpp:
        (WebCore::checkAcceptChild):
        (WebCore::checkAddChild):
        (WebCore::checkReplaceChild):
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::appendChild):
        (WebCore::containsConsideringHostElements): Deleted.
        (WebCore::checkAcceptChildGuaranteedNodeTypes): Deleted.
        * dom/Document.cpp:
        (WebCore::Document::canAcceptChild):
        (WebCore::Document::cloneNodeInternal): Deleted.
        * dom/Document.h:

2015-09-13  Chris Dumez  <cdumez@apple.com>

        Document.adoptNode() should be able to explicitly adopt a DocumentType node
        https://bugs.webkit.org/show_bug.cgi?id=149097
        <rdar://problem/22549345>

        Reviewed by Ryosuke Niwa.

        Document.adoptNode() should be able to explicitly adopt a DocumentType
        node as per the latest DOM specification:
        https://dom.spec.whatwg.org/#dom-document-adoptnode

        Chrome and Firefox match the specidicaiton but WebKit was throwing a
        NotSupportedError.

        No new tests, already covered by existing test.

        * dom/Document.cpp:
        (WebCore::Document::adoptNode): Deleted.

2015-09-13  Chris Dumez  <cdumez@apple.com>

        Document.title does not behave according to specification
        https://bugs.webkit.org/show_bug.cgi?id=149098

        Reviewed by Ryosuke Niwa.

        Update Document.title to behave according to the latest DOM specification:
        https://html.spec.whatwg.org/multipage/dom.html#document.title

        In particular, the following Web-Exposed changes were made:
        1. The title Element should be the first title element in the document
           (in tree order) [1]. Previously, WebKit would use the first title
           Element *added* to the Document. Document.title returns the text
           content of the title Element so this change is web-exposed.
        2. If the title Element is replaced after the title has been set by the
           JS (via the document.title setter), we should update the value
           returned by the document.title getter. Previously, WebKit would set
           a flag if the title was explicitly set by JS via document.title
           setter and later title element changes would not override the title
           set by the JS. This behavior isn't specified and does not match the
           behavior of other browsers.

        The new behavior is also consistent with the behavior of Firefox and
        Chrome.

        Some refactoring was made for the sake of clarity now that our
        implementation has changed. See details below.

        [1] https://html.spec.whatwg.org/multipage/dom.html#the-title-element-2

        No new tests, already covered by existing tests.

        * dom/Document.cpp:
        (WebCore::Document::updateTitleFromTitleElement):
        New convenience method that calls updateTitle() with the text of the
        document's current title Element. If there is no title Element, it
        clears the title.

        (WebCore::Document::updateTitleElement):
        Method which updates the Document's title Element whenever a title
        Element is added or removed from the Document. Once the title Element
        is updated, it takes care of calling updateTitleFromTitleElement() to
        update the Document's title.

        (WebCore::Document::titleElementAdded):
        (WebCore::Document::titleElementRemoved):
        (WebCore::Document::titleElementTextChanged):
        New Document public API called by HTMLTitleElement / SVGTitleElement
        whenever a title Element is added / removed from the Document or
        whenever the title element's text has changed. These methods will
        take care of calling updateTitleElement() / updateTitleFromTitleElement()
        as necessary.
        Previously, we would only have 2 methods:
        - setTitleElement() which would be called whenever a title Element was
          added to the document or when its text had changed. The name was
          confusing because it would not necessarily set the document's title
          Element and it would be used both for title element update and a
          simple title update. This method has been split into 2:
          titleElementAdded() and titleElementTextChanged().
        - removeTitle() which would be called whenever a title Element was
          removed. The naming was confusing because it would not necessarily
          remove the Document's title Element. This is now called
          titleElementRemoved().

        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::insertedInto):
        Call the new titleElementAdded() instead of setTitleElement().

        (WebCore::HTMLTitleElement::removedFrom):
        Call the new titleElementRemoved() instead of removeTitle().

        (WebCore::HTMLTitleElement::childrenChanged):
        Call the new titleElementTextChanged() instead of
        setTitleElement() / removeTitle() as we don't really want
        to remove or add a title Element. We merely want to notify
        the document that the title element text has changed in
        case it is the current title Element of the Document.

        (WebCore::HTMLTitleElement::computedTextWithDirection):
        Rename textWithDirection() to computedTextWithDirection() to
        make it clear it is not a simple getter and make it private
        as it is only used to set the m_title member which caches the
        computed text.

        * html/HTMLTitleElement.h:
        Add new textWithDirection() getter which returns m_title. This
        is needed so that Document can query the title of the Element.
        Previously, HTMLTitleElement would pass directly m_title to
        the Document when calling Document::setTitleElement().

        * svg/SVGTitleElement.cpp:
        (WebCore::SVGTitleElement::insertedInto):
        Call the new titleElementAdded() instead of setTitleElement().

        (WebCore::SVGTitleElement::removedFrom):
        Call the new titleElementRemoved() instead of removeTitle().

        (WebCore::SVGTitleElement::childrenChanged):
        Call the new titleElementTextChanged() instead of
        setTitleElement().

2015-09-13  Chris Dumez  <cdumez@apple.com>

        document.lastModified should use the user's local time zone
        https://bugs.webkit.org/show_bug.cgi?id=149092
        <rdar://problem/22567705>

        Reviewed by Ryosuke Niwa.

        document.lastModified should use the user's local time zone:
        https://html.spec.whatwg.org/multipage/dom.html#dom-document-lastmodified

        Chrome and Firefox comply with the specification but WebKit was using
        UTC. This patch aligns WebKit's behavior with the specification and
        other browsers.

        No new tests, already covered by existing tests.

        * dom/Document.cpp:
        (WebCore::Document::lastModified):
        (WebCore::Document::setCookieURL): Deleted.

2015-09-13  Chris Dumez  <cdumez@apple.com>

        Node.baseURI should not return null for detached nodes
        https://bugs.webkit.org/show_bug.cgi?id=149104
        <rdar://problem/22559535>

        Reviewed by Sam Weinig.

        Node.baseURI should not return null for detached nodes. It should return
        the node document's base URL. The node document is set when the node is
        created so it is valid even if the node is detached [1]:
        https://dom.spec.whatwg.org/#dom-node-baseuri

        WebKit was traversing the ancestors to find the base URL, which only
        works if the node is attached. Also, WebKit was taking into account
        the xml:base attribute when computing the baseURI.

        Both Chrome and Firefox already dropped support for xml:base:
        https://code.google.com/p/chromium/issues/detail?id=341854
        https://bugzilla.mozilla.org/show_bug.cgi?id=903372

        Firefox complies with the specification. Chrome's baseURI still only
        works for attached Nodes as their implementation still traverses the
        DOM tree, despite dropping support for xml:base.

        This patch drops support xml:base when computing Node.baseURI, as
        Firefox, Chrome and the latest DOM specification do. It also makes
        Node.baseURI work for detached Nodes by returning the base URL of the
        node Document. This means we no longer have to traverse the Node's
        ancestors in the DOM tree. This is consistent with the behavior of
        Firefox and the latest DOM specification.

        This patch does not drop the SVGElement.xmlbase attribute yet. However,
        we should probably consider making this change as well given that:
        - The SVG2 specification dropped it
        - Chrome dropped it.
        - It no longers impacts Node.baseURI

        [1] https://www.w3.org/Bugs/Public/show_bug.cgi?id=20976

        No new tests, already covered by existing test.

        * dom/Document.cpp:
        (WebCore::Document::setContent): Deleted.
        * dom/Document.h:
        (WebCore::Document::inputCursor): Deleted.
        * dom/DocumentType.cpp:
        (WebCore::DocumentType::nodeName): Deleted.
        * dom/DocumentType.h:
        * dom/Element.cpp:
        (WebCore::Element::imageSourceURL): Deleted.
        (WebCore::Element::rendererIsNeeded): Deleted.
        (WebCore::Element::createElementRenderer): Deleted.
        (WebCore::Element::insertedInto): Deleted.
        * dom/Element.h:
        * dom/Node.cpp:
        (WebCore::Node::baseURI):
        * dom/Node.h:
        * svg/SVGElement.idl:

2015-09-13  Chris Dumez  <cdumez@apple.com>

        CharacterData API parameters should not be optional
        https://bugs.webkit.org/show_bug.cgi?id=149101
        <rdar://problem/22546954>

        Reviewed by Sam Weinig.

        CharacterData API parameters should not be optional as per the DOM
        specification:
        https://dom.spec.whatwg.org/#characterdata

        The parameters are also mandatory in Firefox and Chrome. However,
        those parameters are optional in WebKit. When DOMString parameters
        were omitted, we would use the "undefined" string instead. When
        unsigned long parameters were omitted, we would use 0 instead.
        This patch aligns our behavior with the specification and other
        major browsers.

        No new tests, already covered by existing tests.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::appendData):
        * dom/CharacterData.h:
        * dom/CharacterData.idl:
        * dom/Element.cpp:
        (WebCore::Element::mergeWithNextTextNode):
        * dom/Node.cpp:
        (WebCore::Node::normalize):
        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::exitText):

2015-09-13  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove all uses of PassRefPtr in crypto, storage, and history
        https://bugs.webkit.org/show_bug.cgi?id=149091

        Reviewed by Andreas Kling.

        * crypto/CryptoKeyPair.cpp:
        (WebCore::CryptoKeyPair::CryptoKeyPair):
        * crypto/CryptoKeyPair.h:
        (WebCore::CryptoKeyPair::create):
        * crypto/SubtleCrypto.h:
        (WebCore::SubtleCrypto::create):
        * crypto/gnutls/CryptoKeyRSAGnuTLS.cpp:
        (WebCore::CryptoKeyRSA::create):
        * crypto/keys/CryptoKeyAES.cpp:
        (WebCore::CryptoKeyAES::generate):
        * crypto/keys/CryptoKeyAES.h:
        * crypto/keys/CryptoKeyHMAC.cpp:
        (WebCore::CryptoKeyHMAC::generate):
        * crypto/keys/CryptoKeyHMAC.h:
        * crypto/keys/CryptoKeyRSA.h:
        * crypto/mac/CryptoKeyRSAMac.cpp:
        (WebCore::CryptoKeyRSA::create):
        * history/BackForwardController.cpp:
        (WebCore::BackForwardController::BackForwardController):
        * history/BackForwardController.h:
        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::setStateObject):
        (WebCore::HistoryItem::setFormData):
        * history/HistoryItem.h:
        (WebCore::HistoryItem::stateObject):
        * loader/EmptyClients.cpp:
        * page/Page.cpp:
        (WebCore::Page::Page):
        * storage/Storage.cpp:
        (WebCore::Storage::create):
        (WebCore::Storage::Storage):
        * storage/Storage.h:
        * storage/StorageArea.h:
        * storage/StorageMap.cpp:
        (WebCore::StorageMap::copy):
        (WebCore::StorageMap::setItem):
        (WebCore::StorageMap::setItemIgnoringQuota):
        (WebCore::StorageMap::removeItem):
        * storage/StorageMap.h:
        * storage/StorageNamespace.h:

2015-09-12  Chris Dumez  <cdumez@apple.com>

        window.EventTarget should exist
        https://bugs.webkit.org/show_bug.cgi?id=149085
        <rdar://problem/22546774>

        Reviewed by Sam Weinig.

        Drop [NoInterfaceObject] for the EventTarget interface to match Chrome,
        Firefox and the specification:
        https://dom.spec.whatwg.org/#interface-eventtarget

        No new tests, already covered by existing tests.

        * dom/EventTarget.idl:

2015-09-12  Brian Burg  <bburg@apple.com>

        Web Inspector: disambiguate inspected/frontend controllers and pages in backend code
        https://bugs.webkit.org/show_bug.cgi?id=149071

        Reviewed by Joseph Pecoraro.

        Be consistent about prefixing pages, inspector controllers, and window controllers
        with either "frontend" or "inspected", as appropriate. This change makes obvious some bugs
        in the frontend connection code, which are tracked by https://webkit.org/b/149006.

        No new tests, no behavior change.

        * WebCore.order:
        * inspector/InspectorClient.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::inspectedPageDestroyed):
        (WebCore::InspectorController::show):
        (WebCore::InspectorController::close):
        * inspector/InspectorFrontendClientLocal.cpp:
        (WebCore::InspectorFrontendClientLocal::InspectorFrontendClientLocal):
        (WebCore::InspectorFrontendClientLocal::~InspectorFrontendClientLocal):
        (WebCore::InspectorFrontendClientLocal::canAttachWindow):
        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowHeight):
        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowWidth):
        (WebCore::InspectorFrontendClientLocal::openInNewTab):
        (WebCore::InspectorFrontendClientLocal::restoreAttachedWindowHeight):
        (WebCore::InspectorFrontendClientLocal::showMainResourceForFrame):
        (WebCore::InspectorFrontendClientLocal::isUnderTest):
        * inspector/InspectorFrontendClientLocal.h:
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::freePage):
        * loader/EmptyClients.h:

2015-09-12  Chris Dumez  <cdumez@apple.com>

        ChildNode.replaceWith() without argument should replace the node with an empty DocumentFragment
        https://bugs.webkit.org/show_bug.cgi?id=149073
        <rdar://problem/22547801>

        Reviewed by Ryosuke Niwa.

        ChildNode.replaceWith() without argument should replace the node with 
        an empty DocumentFragment, as per the specification:
        https://dom.spec.whatwg.org/#dom-childnode-replacewith
        https://dom.spec.whatwg.org/#converting-nodes-into-a-node

        Previously, WebKit did not do anything in this case. This patch fixes
        it.

        No new tests, already covered by existing test.

        * dom/Node.cpp:
        (WebCore::Node::replaceWith):

2015-09-12  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove all uses of PassRefPtr in WebCore/plugins
        https://bugs.webkit.org/show_bug.cgi?id=149055

        Reviewed by Darin Adler.

        * plugins/DOMMimeType.cpp:
        (WebCore::DOMMimeType::DOMMimeType):
        (WebCore::DOMMimeType::enabledPlugin):
        * plugins/DOMMimeType.h:
        (WebCore::DOMMimeType::create):
        * plugins/DOMMimeTypeArray.cpp:
        (WebCore::DOMMimeTypeArray::item):
        * plugins/DOMMimeTypeArray.h:
        * plugins/DOMPlugin.cpp:
        (WebCore::DOMPlugin::item):
        * plugins/DOMPlugin.h:
        * plugins/DOMPluginArray.cpp:
        (WebCore::DOMPluginArray::item):
        * plugins/DOMPluginArray.h:
        * plugins/PluginViewBase.h:
        (WebCore::PluginViewBase::bindingInstance):

2015-09-12  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove all uses of PassRefPtr in WebCore/accessibility and WebCore/fileapi
        https://bugs.webkit.org/show_bug.cgi?id=149059

        Reviewed by Darin Adler.

        * accessibility/AXObjectCache.cpp:
        * accessibility/AccessibilityObject.cpp:
        (WebCore::rangeClosestToRange):
        (WebCore::AccessibilityObject::rangeOfStringClosestToRangeInDirection):
        (WebCore::AccessibilityObject::selectionRange):
        (WebCore::AccessibilityObject::selectText):
        * accessibility/AccessibilityObject.h:
        * accessibility/ios/AXObjectCacheIOS.mm:
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper _convertToDOMRange:]):
        (-[WebAccessibilityObjectWrapper textMarkerForPosition:]):
        * accessibility/mac/AXObjectCacheMac.mm:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper _textMarkerForIndex:]):
        * fileapi/FileList.h:
        (WebCore::FileList::append):
        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::BlobBuilder::append):
        * fileapi/WebKitBlobBuilder.h:

2015-09-11  Said Abou-Hallawa  <sabouhallawa@apple.com>

        SVGColor custom text format is different from the CSS color custom text format
        https://bugs.webkit.org/show_bug.cgi?id=148879

        Reviewed by Daniel Bates.

        Implement the serialization of a CSS color value as it is described in
        <https://drafts.csswg.org/cssom/#serializing-css-values>. Add the new
        function Color::cssText() which is refactored from the existing function
        Color::serialized(). Use the new function for serializing the SVGColor
        always and also for Color but only when the alpha component is not 1.

        Test: svg/css/computed-style-rgb-color.html

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::formatNumberForCustomCSSText): Move the code
        for serializing the color from this function to Color::cssText().
        
        * platform/graphics/Color.cpp:
        (WebCore::Color::serialized): Call Color::cssText() if the alpha component
        is not 1 and delete the repeated code. 
        
        (WebCore::Color::cssText):
        * platform/graphics/Color.h: Add the new function to the header file.
        
        * svg/SVGColor.cpp:
        (WebCore::SVGColor::customCSSText): Call Color::cssText() always instead
        of calling Color::serialized() for serializing the SVGColor.

2015-09-11  Nan Wang  <n_wang@apple.com>

        AX: ARIA 1.1 @aria-current
        https://bugs.webkit.org/show_bug.cgi?id=146012

        Reviewed by Chris Fleizach.

        Tests: accessibility/aria-current.html
               inspector/dom/getAccessibilityPropertiesForNode_ariaCurrent.html

        Added support for ARIA 1.1 aria-current.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::invalidStatus):
        (WebCore::AccessibilityObject::ariaCurrentState):
        (WebCore::AccessibilityObject::hasTagName):
        * accessibility/AccessibilityObject.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
        * html/HTMLAttributeNames.in:
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):

2015-09-11  Chris Dumez  <cdumez@apple.com>

        DOMTokenList update steps for classList don't follow the spec
        https://bugs.webkit.org/show_bug.cgi?id=148589
        <rdar://problem/22547443>

        Reviewed by Ryosuke Niwa and Darin Adler.

        Update our DOMTokenList implementation to behave according to
        the latest DOM specification:
        https://dom.spec.whatwg.org/#interface-domtokenlist

        In particular, the following changes were made:
        - The stringifier now returns the result of the ordered set serializer
          for tokens. This means that we drop duplicate spaces and extra spaces
          [1][2][3].
        - DOMSettableTokenList.value now returns the result of the ordered set
          serializer for tokens [4] as well.
        - When the DOMTokenList's tokens are updated and there is an associated
          Element attribute, we set the attribute value to be the the ordered
          set serializer for tokens. This is according to the DOMTokenList
          update steps in the specification [6]. Chrome does not match the
          specification either.

        Edge browser behaves according to the specification already. Firefox was
        implementing this via [7] but no recent progress. This makes the JS API
        nicer to use and interest was shown by jQuery Team.

        The following refactoring was done:
        - Merge ClassList / RelList into a single AttributeDOMTokenList class
          as their code is mostly duplicated and the only thing that changes
          is which attribute is associated (class vs rel). AttributeDOMTokenList
          now keeps the attribute name as a member so it could be used for any
          attribute. AttributeDOMTokenList overrides DOMTokenList's
          updateAfterTokenChange() to do update the attribute's value as per
          [6].
        - We no longer use a SpaceSplitString for the internal representation
          as we need to sanitize the tokens (drop duplicates and extra spaces).
          DOMTokenList now has an internal Vector<AtomicString> containing the
          tokens that is constructed from the algorithm in [2]. As a result,
          most of the logic is now in DOMTokenList instead of its subclasses
          which means that most methods are no longer virtual. We only have
          one virtual function named updateAfterTokenChange() to do the update
          steps as AttributeDOMTokenList needs to update the associated
          attribute.

        This change does not seem to impact Dromaeo.

        [1] https://dom.spec.whatwg.org/#concept-ordered-set-serializer
        [2] https://dom.spec.whatwg.org/#ordered%20sets
        [3] https://dom.spec.whatwg.org/#stringification-behavior
        [4] https://dom.spec.whatwg.org/#dom-domsettabletokenlist-value
        [5] https://dom.spec.whatwg.org/#dom-domtokenlist-contains (step 2)
        [6] https://dom.spec.whatwg.org/#concept-DTL-update
        [7] https://bugzilla.mozilla.org/show_bug.cgi?id=869788

        No new tests, already covered by existing tests.

        * dom/Element.cpp:
        (WebCore::Element::classAttributeChanged):
        When the class attribute changes, make sure to update the associated
        classList if there is one. We could do this lazily if it turns out
        to be a performance problem. However, chances are this is not as
        classList is rarely used and we only need to update the classList if
        it was ever accessed by JS for this Element.

        (WebCore::Element::insertedInto):
        Drop call to clearClassListValueForQuirksMode() as we no longer need
        to maintain a separate SpaceSplitString for classes when in quirks
        mode. This is because AttributeDOMTokenList now has its own Vector
        of classes in their original cases. It therefore no longer relies on
        Element::classNames() which has its case folded when in quirks mode.

        (WebCore::Element::classList):
        Return a AttributeDOMTokenList instead of a ClassList.

        * html/AttributeDOMTokenList.h: Added.
        * html/AttributeDOMTokenList.cpp: Added.
        (WebCore::AttributeDOMTokenList::AttributeDOMTokenList):
        Call DOMTokenList::setValue() using the attribute's value so that
        DOMTokenList can initialize its token Vector.

        (WebCore::AttributeDOMTokenList::attributeValueChanged):
        If the attribute value was changed by somebody else that the
        AttributeDOMTokenList, call DOMTokenList::setValue() so that it
        can update its token Vector.

        (WebCore::AttributeDOMTokenList::updateAfterTokenChange):
        This is called whenever the token Vector is changed via JS. In
        this case, we update the associated attribute's value.

        * html/ClassList.cpp: Removed.
        * html/ClassList.h: Removed.
        Now merged into AttributeDOMTokenList.

        * html/DOMSettableTokenList.cpp:
        * html/DOMSettableTokenList.h:
        Get rid of most of the code as most of the logic is now in
        DOMTokenList parent class.

        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::validateToken):
        Use a String parameter instead of an AtomicString as this method does
        not need the input the be an AtomicString. This avoid atomizing
        String unnecessarily.

        (WebCore::DOMTokenList::validateTokens):
        Use a modern loop.

        (WebCore::DOMTokenList::contains):
        No longer use containsInternal() virtual function. We can now check
        the internal token Vector.

        (WebCore::DOMTokenList::add):
        Now update the internal Vector. Use a modern loop and try to minimize
        Vector capacity reallocation.

        (WebCore::DOMTokenList::remove):
        Now update the internal Vector.

        (WebCore::DOMTokenList::toggle):
        Now update the internal Vector and refactor the code so that it is
        structured exactly as the algorithm in the specification for
        clarity.

        (WebCore::DOMTokenList::value):
        Now return the result of the ordered set serializer for tokens. This
        method is used for:
        - The DOMSettableTokenList.value() getter
        - The DOMTokenList stringifier
        - As attribute value when updating the associated attribute in
          AttributeDOMTokenList.

        (WebCore::DOMTokenList::setValue):
        Update the internal Vector using the algorithm in [2].

        * html/DOMTokenList.h:
        (WebCore::DOMTokenList::length):
        No longer virtual, now returns the size of the internal token Vector.

        (WebCore::DOMTokenList::item):
        No longer virtual, now returns the token at the given index in the
        internal Vector.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::relList):
        Now return a AttributeDOMTokenList.

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::relList):
        Now return a AttributeDOMTokenList.

        * html/RelList.cpp: Removed.
        * html/RelList.h: Removed.
        Now merged into AttributeDOMTokenList.

2015-09-11  Chris Dumez  <cdumez@apple.com>

        Element.tagName should be upper-case for HTML elements in HTML documents
        https://bugs.webkit.org/show_bug.cgi?id=148843
        <rdar://problem/22559081>

        Reviewed by Ryosuke Niwa.

        Element.tagName should be upper-case for HTML elements in HTML documents,
        as per the DOM specification:
        https://dom.spec.whatwg.org/#dom-element-tagname

        Previously, WebKit would fail to upper-case the tagname if the element's
        tag had a prefix. This patch corrects this. This aligns our behavior with
        Firefox, Chrome and IE.

        No new tests, already covered by existing tests.

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::nodeName):

2015-09-11  Chris Dumez  <cdumez@apple.com>

        document.body = "text" should throw a TypeError, not a HierarchyRequestError
        https://bugs.webkit.org/show_bug.cgi?id=149057
        <rdar://problem/22567157>

        Reviewed by Ryosuke Niwa.

        document.body = "text" should throw a TypeError, not a
        HierarchyRequestError:
        https://html.spec.whatwg.org/multipage/dom.html#dom-document-body

        This is because "text" is a DOMString and it cannot be converted into an
        HTMLElement?. Therefore, the WebIDL specification says we should throw a
        TypeError in this case.

        Chrome and Firefox throw the right exception.

        No new tests, already covered by existing test.

        * dom/Document.idl:

2015-09-11  Andreas Kling  <akling@apple.com>

        [JSC] Weak should only accept cell pointees.
        <https://webkit.org/b/148955>

        Reviewed by Geoffrey Garen.

        Update WebCore bindings for the new Weak and Weak-related signatures.

        * bindings/js/JSCSSRuleListCustom.cpp:
        (WebCore::JSCSSRuleListOwner::isReachableFromOpaqueRoots):
        * bindings/js/JSCSSValueCustom.cpp:
        (WebCore::JSCSSValueOwner::isReachableFromOpaqueRoots):
        (WebCore::JSCSSValueOwner::finalize):
        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackDataWeak::WeakOwner::isReachableFromOpaqueRoots):
        * bindings/js/JSCallbackData.h:
        * bindings/js/JSMutationObserverCustom.cpp:
        (WebCore::JSMutationObserverOwner::isReachableFromOpaqueRoots):
        * bindings/js/JSNodeCustom.cpp:
        (WebCore::isReachableFromDOM):
        (WebCore::JSNodeOwner::isReachableFromOpaqueRoots):
        * bindings/js/JSNodeListCustom.cpp:
        (WebCore::JSNodeListOwner::isReachableFromOpaqueRoots):
        * bindings/js/JSTextTrackCueCustom.cpp:
        (WebCore::JSTextTrackCueOwner::isReachableFromOpaqueRoots):
        * bindings/js/WebCoreTypedArrayController.cpp:
        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots):
        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::finalize):
        * bindings/js/WebCoreTypedArrayController.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObjectOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestActiveDOMObjectOwner::finalize):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectOwner::finalize):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetterOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestCustomNamedGetterOwner::finalize):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestEventConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTargetOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestEventTargetOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestExceptionOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestExceptionOwner::finalize):
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::JSTestGenerateIsReachableOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestGenerateIsReachableOwner::finalize):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestInterfaceOwner::finalize):
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListenerOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestMediaQueryListListenerOwner::finalize):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestNamedConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::JSTestNondeterministicOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestNondeterministicOwner::finalize):
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestObjOwner::finalize):
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::JSTestOverloadedConstructorsOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestOverloadedConstructorsOwner::finalize):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltinsOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestOverrideBuiltinsOwner::finalize):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterfaceOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestSerializedScriptValueInterfaceOwner::finalize):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestTypedefsOwner::finalize):
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::JSattributeOwner::isReachableFromOpaqueRoots):
        (WebCore::JSattributeOwner::finalize):
        * bindings/scripts/test/JS/JSattribute.h:
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::JSreadonlyOwner::isReachableFromOpaqueRoots):
        (WebCore::JSreadonlyOwner::finalize):
        * bindings/scripts/test/JS/JSreadonly.h:
        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::finalize):
        * bridge/runtime_root.h:

2015-09-10  Chris Fleizach  <cfleizach@apple.com>

        AX: Mavericks: Text cursor does not move along with VoiceOver cursor for text fields
        https://bugs.webkit.org/show_bug.cgi?id=148891

        Reviewed by Alexey Proskuryakov.

        Asychronous focus setting DOES work on Yosemite, just not Mavericks.

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
        (-[WebAccessibilityObjectWrapper _accessibilitySetValue:forAttribute:]):

2015-09-10  David Hyatt  <hyatt@apple.com>

        [New Block-Inside-Inline Model] Self-collapsing block check needs to account for anonymous inline blocks
        https://bugs.webkit.org/show_bug.cgi?id=149042

        Reviewed by Dean Jackson.

        Added new tests in fast/block/inside-inlines/

        * rendering/InlineFlowBox.cpp:
        * rendering/InlineFlowBox.h:
        (WebCore::InlineFlowBox::anonymousInlineBlock):
        Add a new accessor to get the anonymousInlineBlock() for lines that wrap them.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::childrenPreventSelfCollapsing):
        (WebCore::RenderBlock::isSelfCollapsingBlock):
        isSelfCollapsingBlock() now calls a virtual method that checks lines/children called childrenPreventSelfCollapsing.
        This lets us farm out the lines check to the derived RenderBlockFlow class.

        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::childrenPreventSelfCollapsing):
        Added new virtual method for checking children.

        * rendering/RenderBlockFlow.cpp:
        * rendering/RenderBlockFlow.h:
        (WebCore::RenderBlockFlow::childrenPreventSelfCollapsing):
        Overridden to ensure that blocks can still be self-collapsing if they only contain anonymous inline-block lines that