[WebKit-https.git] / Source / WebCore / ChangeLog

2012-07-13  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        Refactor RenderTable to use the section's iteration functions.
        https://bugs.webkit.org/show_bug.cgi?id=89751

        Reviewed by Julien Chaffraix.

        Removing anti-pattern wherever possible from RenderTable code. Also, modifying
        RenderTable sections' iterations to use helper functions.

        No new tests required for this change since no change in behavior is expected.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addOverflowFromChildren):
        (WebCore::RenderTable::setCellLogicalWidths):
        (WebCore::RenderTable::outerBorderStart):
        (WebCore::RenderTable::outerBorderEnd):
        Removed anti-patterns involving iterations over RenderObjects.

        (WebCore::RenderTable::outerBorderAfter):
        Modified RenderTable sections' iteration to use helper functions.

2012-07-13  Enrica Casucci  <enrica@apple.com>

        Threadsafety issues in WebScriptObject
        https://bugs.webkit.org/show_bug.cgi?id=90849

        Reviewed by Geoff Garen.

        Updated fix for this bug. The JSC API lock needs to be acquired also in JSObject.

        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject JSObject]):

2012-07-13  Raymond Toy  <rtoy@google.com>

        DelayNode doesn't work if delayTime.value == delayTime.maxValue
        https://bugs.webkit.org/show_bug.cgi?id=90357

        Reviewed by Kenneth Russell.

        Increase delay buffer size slightly so that the read and write
        pointers don't become equal when the delay and the max delay are
        the same.
        
        Tests: webaudio/delaynode-max-default-delay.html
               webaudio/delaynode-max-nondefault-delay.html

        * Modules/webaudio/DelayDSPKernel.cpp:
        (WebCore): Moved SmoothingTimeConstant to WebCore namespace.
        (WebCore::DelayDSPKernel::DelayDSPKernel): Add some additional checks to prevent crashes; use bufferLengthForDelay to compute buffer length.
        (WebCore::DelayDSPKernel::bufferLengthForDelay): New function to compute buffer length.
        * Modules/webaudio/DelayDSPKernel.h:
        (DelayDSPKernel): Declare bufferLengthForDelay. 

2012-07-13  Benjamin Poulain  <bpoulain@apple.com>

        Always aggressively preload on iOS
        https://bugs.webkit.org/show_bug.cgi?id=91276

        Reviewed by Simon Fraser.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::preload):

2012-07-13  Vineet Chaudhary  <rgf748@motorola.com>

        Restructure V8Utilities::extractTransferables() with help of toV8Sequence()
        https://bugs.webkit.org/show_bug.cgi?id=91208

        Reviewed by Kentaro Hara.

        We can remove the specialised check for MessagePort from V8Utilities::extractTransferables()
        using toV8Sequence() as it validates the passed object for sequence type per WebIDL spec.

        No new test as just refactoring.
        Existing tests under fast/dom/Window/window-* fast/dom/events/*
        covers tests.

        * bindings/v8/V8Utilities.cpp:
        (WebCore::extractTransferables):

2012-07-13  Vincent Scheib  <scheib@chromium.org>

        Pointer Lock handles disconnected DOM elements
        https://bugs.webkit.org/show_bug.cgi?id=77029

        Reviewed by Adrienne Walker.

        Pointer Lock Controller now checks when elements or documents are
        removed, and unlocks if the target element is being removed.

        Tests: pointer-lock/locked-element-iframe-removed-from-dom.html
               pointer-lock/locked-element-removed-from-dom.html

        * dom/Document.cpp:
        (WebCore::Document::detach):
        * dom/Element.cpp:
        (WebCore::Element::removedFrom):
        (WebCore::Element::webkitRequestPointerLock):
        * page/PointerLockController.cpp:
        (WebCore::PointerLockController::requestPointerLock):
        (WebCore::PointerLockController::elementRemoved):
        (WebCore):
        (WebCore::PointerLockController::documentDetached):
        (WebCore::PointerLockController::didLosePointerLock):
        (WebCore::PointerLockController::enqueueEvent):
        * page/PointerLockController.h:
        (WebCore):
        (PointerLockController):

2012-07-13  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLCollection should use DynamicNodeList's invalidation model
        https://bugs.webkit.org/show_bug.cgi?id=90326

        Reviewed by Anders Carlsson.

        Make HTMLCollection invalidated upon attribute and children changes instead of invalidating it on demand
        by comparing DOM tree versions. Node that HTMLCollections owned by Document are invalidated with other
        document-rooted node lists in m_listsInvalidatedAtDocument for simplicity although this mechanism is
        normally used for node lists owned by a non-Document node that contains nodes outside of its subtree.
        ItemProperties and FormControls are more "traditional" users of the mechanism.

        Also, merged DynamicNodeList::invalidateCache and HTMLCollection::invalidateCache.

        * dom/Document.cpp:
        (WebCore::Document::registerNodeListCache): Renamed. No longer takes NodeListInvalidationType or
        NodeListRootType since they can be obtained from the cache base. Increment the node list counter for
        InvalidateOnIdNameAttrChange when a HTMLCollection is passed in since all HTMLCollections need to be
        invalidated on id or name content attribute changes due to named getters.
        (WebCore::Document::unregisterNodeListCache): Ditto.
        (WebCore::shouldInvalidateNodeListForType):
        (WebCore::Document::shouldInvalidateNodeListCaches):
        (WebCore::Document::clearNodeListCaches):
        * dom/Document.h:
        (WebCore): Added InvalidateOnIdNameAttrChange, InvalidateOnHRefAttrChange, and InvalidateOnAnyAttrChange.
        (Document):
        * dom/DynamicNodeList.cpp:
        (WebCore::DynamicNodeListCacheBase::invalidateCache): Added. Invalidates caches of both DynamicNodeList
        and HTMLCollection. We can't afford to use virtual function calls here because this function is called on
        all node lists and HTML collections owned by ancestors of an element under which a node is added, removed,
        or its attributes are changed.
        (WebCore):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): Initializes member variables directly
        instead of calling clearCache now that DynamicNodeListCacheBase::invalidateCache has become polymorphic.
        (DynamicNodeListCacheBase): Increased the number of bits for m_invalidationType since we now have 9
        invalidation types.
        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList):
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
        * dom/ElementRareData.h:
        (ElementRareData):
        (WebCore::ElementRareData::clearHTMLCollectionCaches): Added.
        (WebCore::ElementRareData::adoptTreeScope): Added; similar to NodeRareData::adoptTreeScope.
        * dom/Node.cpp:
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): Clears HTML collection caches as well as
        node list caches.
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Ditto.
        * dom/NodeRareData.h:
        (WebCore::NodeListsNodeData::adoptTreeScope):
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope): Calls ElementRareData's adoptTreeScope as well as
        NodeRareData's.
        * html/HTMLAllCollection.cpp:
        (WebCore::HTMLAllCollection::namedItemWithIndex):
        * html/HTMLCollection.cpp:
        (WebCore::rootTypeFromCollectionType): Added. As mentioned above, treat all Document-owned HTML collection
        as if rooted at document for convenience.
        (WebCore::invalidationTypeExcludingIdAndNameAttributes): Added. Since all HTML collection requires
        invalidation on id and name content attribute changes, which is taken care by the special logic in
        Document::registerNodeListCache, exclude those two attributes from consideration.
        (WebCore::HTMLCollection::HTMLCollection): Calls Document::registerNodeListCache.
        (WebCore::HTMLCollection::~HTMLCollection): Calls Document::unregisterNodeListCache.
        (WebCore::HTMLCollection::length):
        (WebCore::HTMLCollection::item):
        (WebCore::HTMLCollection::namedItem):
        (WebCore::HTMLCollection::updateNameCache):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (HTMLCollectionCacheBase): Removed m_cacheTreeVersion and clearCache since they're no longer used.
        (HTMLCollection):
        * html/HTMLFormCollection.cpp:
        (WebCore::HTMLFormCollection::namedItem):
        (WebCore::HTMLFormCollection::updateNameCache):
        * html/HTMLOptionsCollection.h:
        (HTMLOptionsCollection):
        * html/HTMLPropertiesCollection.cpp:
        (WebCore::HTMLPropertiesCollection::updateNameCache):
        * html/HTMLPropertiesCollection.h:
        (WebCore::HTMLPropertiesCollection::invalidateCache):

2012-07-13  Shawn Singh  <shawnsingh@chromium.org>

        [chromium] Remove incorrect debug assertion in LayerRendererChromium.cpp
        https://bugs.webkit.org/show_bug.cgi?id=91260

        Reviewed by Adrienne Walker.

        ASSERT(!clipped) was being triggered after skinny almost-degenerate
        quads went through anti-aliasing inflation, and then were being
        transformed back from device space to local space. It turns out
        this assertion is too aggressive, and we don't yet have an obvious
        need to change the behavior on the clipped==true case.

        No new tests needed, this patch fixes only comments and debug code.

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
           fixed a comment.

        (WebCore::LayerRendererChromium::drawTileQuad):
           fixed a similar comment, removed unnecessary assertion.

2012-07-13  Philip Rogers  <pdr@google.com>

        Remove assert in localCoordinateSpaceTransform()
        https://bugs.webkit.org/show_bug.cgi?id=91189

        Reviewed by Nikolas Zimmermann.

        The assert in localCoordinateSpaceTransform was added to catch subclasses forgetting
        to override the method but it is better to simply return the identity matrix.

        This scenario can occur when we break the SVG content model, such as asking for
        the CTM of a <g> element inside a <tspan>. This is undefined in the spec because
        tspan is not a subclass of SVGLocatable but both Firefox and Opera
        implement this by returning the identity matrix.

        Test: svg/custom/invalid-ctm.svg

        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::localCoordinateSpaceTransform):

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        [V8] String wrappers should be marked Independent
        https://bugs.webkit.org/show_bug.cgi?id=91251

        Reviewed by Adam Barth.

        Currently V8 String wrappers are not marked Independent.
        By marking them Independent, they can be reclaimed by the scavenger GC.

        I tried to find some cases where this change reduces memory usage,
        but couldn't due to sensitive behavior of GC.

        No tests. No change in behavior.

        * bindings/v8/V8Binding.cpp:
        (WebCore::StringCache::v8ExternalStringSlow):

2012-07-13  Peter Beverloo  <peter@chromium.org>

        [Chromium] Make the v8 i18n API dependency conditional for Android, disable strict aliasing
        https://bugs.webkit.org/show_bug.cgi?id=91240

        Reviewed by Adam Barth.

        Disable the v8 internationalization API for Chromium Android, as it's
        disabled and not always available in checkouts. Furthermore, disable
        strict aliasing for the webkit_remaining target, similar to what
        x11-based builds are doing (see the webcore_prerequisites target).

        * WebCore.gyp/WebCore.gyp:

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        [CallWith=XXX] arguments should be placed at the head of method arguments
        https://bugs.webkit.org/show_bug.cgi?id=91217

        Reviewed by Adam Barth.

        The EFL build with the ENABLE_FILE_SYSTEM flag caused a build error,
        because CodeGeneratorJS.pm assumes webkitEntries(ScriptExecutionContext*, HTMLInputElement*)
        but the actual signature is webkitEntries(HTMLInputElement*, ScriptExecutionContext*) (bug 91185).

        Per https://trac.webkit.org/wiki/WebKitIDL#CallWith, [CallWith=XXX] arguments should be placed
        at the head of the arguments. (i.e. the behavior of CodeGeneratorJS.pm is correct.)

        Thus the correct fix is (1) to change the signature of webkitEntries() and webkitGetAsEntry()
        so that ScriptExecutionContext* comes first and (2) to modify CodeGeneratorV8.pm to support the order.

        Test: bindings/scripts/test/TestObj.idl

        * Modules/filesystem/DataTransferItemFileSystem.h: Placed ScriptExecutionContext* at the head of arguments.
        (DataTransferItemFileSystem):
        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Ditto.
        (WebCore::HTMLInputElementFileSystem::webkitEntries):
        * Modules/filesystem/HTMLInputElementFileSystem.h: Ditto.
        (HTMLInputElementFileSystem):
        * Modules/filesystem/chromium/DataTransferItemFileSystemChromium.cpp: Ditto.
        (WebCore::DataTransferItemFileSystem::webkitGetAsEntry):

        * bindings/scripts/CodeGeneratorV8.pm: Modified to support the correct order.
        (GenerateNormalAttrGetter):
        (GenerateNormalAttrSetter):
        (GenerateFunctionCallString):

        * bindings/scripts/test/V8/V8TestInterface.cpp: Updated run-bindings-tests results.
        (WebCore::TestInterfaceV8Internal::supplementalMethod2Callback):

2012-07-13  Mary Wu  <mary.wu@torchmobile.com.cn>

        [BlackBerry] Some small changes in network code
        https://bugs.webkit.org/show_bug.cgi?id=90974

        Reviewed by Rob Buis.

        1. Set status in NetworkJob/SocketStreamHandleBlackBerry so that
        its wrapped stream can also query the stream result.
        2. pass download attribute to NetworkRequest.

        RIM PR# 171555
        Reviewed internally by Lyon Chen and Joe Mason.

        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::handleNotifyClose):
        * platform/network/blackberry/NetworkJob.h:
        (WebCore::NetworkJob::status):
        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
        (WebCore::platformTargetTypeForRequest):
        * platform/network/blackberry/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::status):
        (SocketStreamHandle):
        * platform/network/blackberry/SocketStreamHandleBlackBerry.cpp:
        (WebCore::SocketStreamHandle::notifyStatusReceived):
        (WebCore::SocketStreamHandle::notifyClose):

2012-07-13  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Remove uiSourceCode from Resource.
        https://bugs.webkit.org/show_bug.cgi?id=91201

        Reviewed by Pavel Feldman.

        Removed Resource._uiSourceCode field as it is not used anymore.

        * inspector/front-end/Resource.js:
        (WebInspector.Resource.prototype.isHidden):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode):

2012-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122450 and r122580.
        http://trac.webkit.org/changeset/122450
        http://trac.webkit.org/changeset/122580
        https://bugs.webkit.org/show_bug.cgi?id=91263

        Caused multiple regressions on ClusterFuzz (Requested by
        inferno-sec on #webkit).

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
        * css/StylePropertySet.cpp:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::attributes):
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::hasEquivalentAttributes):
        (WebCore::Element::createAttributeData):
        (WebCore):
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::normalizeAttributes):
        (WebCore::Element::cloneAttributesFromElement):
        * dom/Element.h:
        (WebCore::Element::attributeData):
        (Element):
        (WebCore::Element::reportMemoryUsage):
        (WebCore::Element::ensureAttributeData):
        (WebCore::Element::updatedAttributeData):
        (WebCore::Element::ensureUpdatedAttributeData):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::attrIfExists):
        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):
        (WebCore::ElementAttributeData::setClass):
        (WebCore):
        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
        (WebCore::ElementAttributeData::destroyInlineStyle):
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::isEquivalent):
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        (WebCore::ElementAttributeData::cloneDataFrom):
        (WebCore::ElementAttributeData::clearAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::create):
        (ElementAttributeData):
        (WebCore::ElementAttributeData::setIdForStyleResolution):
        (WebCore::ElementAttributeData::setAttributeStyle):
        (WebCore::ElementAttributeData::length):
        (WebCore::ElementAttributeData::isEmpty):
        (WebCore::ElementAttributeData::attributeItem):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::reportMemoryUsage):
        (WebCore::ElementAttributeData::ElementAttributeData):
        (WebCore::ElementAttributeData::attributeVector):
        (WebCore::ElementAttributeData::clonedAttributeVector):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::getAttributeItemIndex):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportInstrumentedPointer):
        (WebCore::MemoryObjectInfo::reportPointer):
        (WebCore::MemoryObjectInfo::reportInstrumentedObject):
        (WebCore::MemoryObjectInfo::reportObject):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore::MemoryObjectInfo::reportHashMap):
        (WebCore::MemoryObjectInfo::reportHashSet):
        (WebCore::MemoryObjectInfo::reportListHashSet):
        (WebCore::MemoryObjectInfo::reportVector):
        (WebCore::MemoryObjectInfo::reportString):
        (WebCore::MemoryObjectInfo::objectType):
        (WebCore::MemoryObjectInfo::objectSize):
        (WebCore::MemoryObjectInfo::memoryInstrumentation):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::classAttributeChanged):
        (WebCore::StyledElement::setInlineStyleProperty):
        (WebCore::StyledElement::removeInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        * dom/StyledElement.h:
        (WebCore::StyledElement::ensureInlineStyle):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):

2012-07-13  Huang Dongsung  <luxtella@company100.net>

        Remove down-casting to BitmapImage in GraphicsContext::drawImage.
        https://bugs.webkit.org/show_bug.cgi?id=90755

        Reviewed by Simon Fraser.

        Add a BitmapImage draw method which takes RespectImageOrientationEnum enum as
        the last argument for CG. Then we can remove the conditional down-casting in
        GraphicsContext::drawImage.

        This change is needed for parallel image decoders. Because parallel image
        decoders use a Bitmap image wrapper class which extends Image (not Bitmap), the
        down-casting above causes the loss of RespectImageOrientationEnum which must be
        passed to BitmapImage.

        No new tests, no behavior change.

        * platform/graphics/BitmapImage.cpp:
        * platform/graphics/BitmapImage.h:
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawImage):
        * platform/graphics/Image.cpp:
        (WebCore::Image::draw):
        (WebCore):
        * platform/graphics/Image.h:
        (Image):

2012-07-13  Lauro Neto  <lauro.neto@openbossa.org>

        Fix QtWebKit build with OpenGLES after GC3D/E3D refactor
        https://bugs.webkit.org/show_bug.cgi?id=91156

        Reviewed by Noam Rosenthal.

        Adds several build fixes.

        * platform/graphics/GraphicsContext3D.h:
            Use E3DOpenGLES instead of previously removed E3DQt.

        * platform/graphics/OpenGLESShims.h:
            Enable defines for Qt.

        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        (WebCore::Extensions3DOpenGLES::blitFramebuffer):
        (WebCore):
        (WebCore::Extensions3DOpenGLES::renderbufferStorageMultisample):
        (WebCore::Extensions3DOpenGLES::copyTextureCHROMIUM):
            Added pure virtual stubs.

        (WebCore::Extensions3DOpenGLES::supportsExtension):
            Remove PROC suffix. See bug #91130.

        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        (Extensions3DOpenGLES):
            Added pure virtual stubs.

        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::reshapeFBOs):
            Readded missing function after removed in r122250.

        (WebCore):
            Use PLATFORM(BLACKBERRY) guard around port-specific include.

        * platform/graphics/qt/GraphicsContext3DQt.cpp:
            Added USE(OPENGL_ES_2) guard instead of always loading the OpenGL extensions.


2012-07-13  Keishi Hattori  <keishi@webkit.org>

        Form of FormAssociatedElement is not updated when id target changes.
        https://bugs.webkit.org/show_bug.cgi?id=91042

        Reviewed by Kent Tamura.

        Test: fast/forms/update-form-attribute-element.html

        This patch introduces the IdTargetObserver and IdTargetObserverRegistry class.
        They can be used to be notified when the element that an id is pointing to (the id target)
        changes.

        * CMakeLists.txt: Added IdTargetObserverRegistry.{h,cpp} and IdTargetObserver.{h,cpp}
        * GNUmakefile.list.am: Ditto.
        * Target.pri: Ditto.
        * WebCore.gypi: Ditto.
        * WebCore.vcproj/WebCore.vcproj: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * dom/DOMAllInOne.cpp:
        * dom/IdTargetObserver.cpp: Added. When you want notified of changes to an id target, you should create a new class that inherits this.
        (WebCore):
        (WebCore::IdTargetObserver::IdTargetObserver):
        (WebCore::IdTargetObserver::~IdTargetObserver):
        * dom/IdTargetObserver.h: Added.
        (WebCore):
        (IdTargetObserver):
        * dom/IdTargetObserverRegistry.cpp: Added.
        (WebCore):
        (WebCore::IdTargetObserverRegistry::create):
        (WebCore::IdTargetObserverRegistry::addObserver): Register an IdTargetObserver to observe an id target.
        (WebCore::IdTargetObserverRegistry::removeObserver): Unregisters an IdTargetObserver from observing.
        (WebCore::IdTargetObserverRegistry::notifyObserversInternal):
        * dom/IdTargetObserverRegistry.h: Added.
        (WebCore):
        (IdTargetObserverRegistry):
        (WebCore::IdTargetObserverRegistry::IdTargetObserverRegistry):
        (WebCore::IdTargetObserverRegistry::notifyObservers): Calls idTargetChanged on all observers for an id. Inlining first part of function for performance.
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope):
        (WebCore::TreeScope::addElementById): Calls IdTargetObserverRegistry::notifyObservers because the id target might have changed.
        (WebCore::TreeScope::removeElementById): Ditto.
        * dom/TreeScope.h:
        (WebCore):
        (WebCore::TreeScope::idTargetObserverRegistry):
        (TreeScope):
        * html/FormAssociatedElement.cpp: Observer for id targets defined by the form attribute.
        (WebCore::FormAssociatedElement::didMoveToNewDocument):
        (WebCore::FormAssociatedElement::insertedInto):
        (WebCore::FormAssociatedElement::removedFrom):
        (WebCore::FormAssociatedElement::formAttributeChanged):
        (WebCore::FormAssociatedElement::resetFormAttributeTargetObserver): Creates and sets up a new FormAttributeTargetObserver.
        (WebCore):
        (WebCore::FormAssociatedElement::formAttributeTargetChanged):
        (WebCore::FormAttributeTargetObserver::create):
        (WebCore::FormAttributeTargetObserver::FormAttributeTargetObserver):
        (WebCore::FormAttributeTargetObserver::idTargetChanged):
        * html/FormAssociatedElement.h:
        (FormAssociatedElement):
        * html/FormController.cpp:
        * html/FormController.h:
        (FormController):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::removedFrom):
        (WebCore::HTMLFormElement::formElementIndexWithFormAttribute): Modified to take a range. It
        scans the range and returns the index to insert the element in m_associatedElement.
        (WebCore::HTMLFormElement::formElementIndex): Modified to only scan the elements in
        m_associatedElement that precede and follow the form element.
        * html/HTMLFormElement.h:
        (HTMLFormElement):

2012-07-13  Gabor Rapcsanyi  <rgabor@webkit.org>

        Optimizing blend filter to ARM-NEON with intrinsics
        https://bugs.webkit.org/show_bug.cgi?id=90949

        Reviewed by Zoltan Herczeg.

        The feBlend SVG filter modes can be greatly fasten up with ARM-NEON since
        we are able to calculate with 2 pixels (8 channels) at the same time.
        The code is written with NEON intrinsics and it doesn't affect the
        general - it has the same behaviour as the original algorithm.
        With this NEON optimization the calculation is ~4.5 times faster for each mode.

        Existing tests cover this issue.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/filters/FEBlend.cpp:
        (WebCore::FEBlend::platformApplyGeneric):
        (WebCore):
        (WebCore::FEBlend::platformApplySoftware):
        * platform/graphics/filters/FEBlend.h:
        (FEBlend):
        * platform/graphics/filters/arm/FEBlendNEON.h: Added.
        (WebCore):
        (FEBlendUtilitiesNEON):
        (WebCore::FEBlendUtilitiesNEON::div255): integer divison with 255
        (WebCore::FEBlendUtilitiesNEON::normal): calculate normal mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::multiply): calculate multiply mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::screen): calculate screen mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::darken): calculate darken mode blending for two pixels
        (WebCore::FEBlendUtilitiesNEON::lighten): calculate lighten mode blending for two pixels
        (WebCore::FEBlend::platformApplyNEON):

2012-07-13  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: native memory instrumentation: extract instrumentation methods into MemoryClassInfo
        https://bugs.webkit.org/show_bug.cgi?id=91227

        Reviewed by Pavel Feldman.

        void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
        {
            MemoryClassInfo<Node> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
            info.visitBaseClass<ScriptWrappable>(this);

            info.addMember(m_notInstrumentedPointer); // automatically detects poniter/reference
            info.addInstrumentedMember(m_next);
            info.addHashSet<MemoryInstrumentation::NonClass>(m_aHash);                // NonClass value_type (report only size of internal template structures)
            info.addHashSet<MemoryInstrumentation::NotInstrumentedClass>(m_aHashSet); // not instrumented value_type (use sizeof)
            info.addHashSet<MemoryInstrumentation::InstrumentedClass>(m_aHashSet);    // instrumented value_type (call visit)
        }

        The change is covered by existing tests for native memory snapshot.

        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptWrappable.h:
        (WebCore::ScriptWrappable::reportMemoryUsage):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8DOMMap.h:
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::reportMemoryUsage):
        * dom/CharacterData.cpp:
        (WebCore::CharacterData::reportMemoryUsage):
        * dom/ContainerNode.h:
        (WebCore::ContainerNode::reportMemoryUsage):
        * dom/Document.cpp:
        (WebCore::Document::reportMemoryUsage):
        * dom/Element.h:
        (WebCore::Element::reportMemoryUsage):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::reportMemoryUsage):
        * dom/MemoryInstrumentation.h:
        (MemoryInstrumentation):
        (WebCore::MemoryObjectInfo::objectType):
        (WebCore::MemoryObjectInfo::objectSize):
        (WebCore::MemoryObjectInfo::memoryInstrumentation):
        (MemoryObjectInfo):
        (WebCore::MemoryObjectInfo::reportObjectInfo):
        (WebCore):
        (MemoryClassInfo):
        (WebCore::MemoryClassInfo::MemoryClassInfo):
        (WebCore::MemoryClassInfo::visitBaseClass):
        (WebCore::MemoryClassInfo::reportInstrumentedPointer):
        (WebCore::MemoryClassInfo::reportInstrumentedObject):
        (WebCore::MemoryClassInfo::reportPointer):
        (WebCore::MemoryClassInfo::reportObject):
        (WebCore::MemoryClassInfo::reportHashMap):
        (WebCore::MemoryClassInfo::reportHashSet):
        (WebCore::MemoryClassInfo::reportListHashSet):
        (WebCore::MemoryClassInfo::reportVector):
        (WebCore::MemoryClassInfo::reportString):
        * dom/Node.cpp:
        (WebCore::Node::reportMemoryUsage):
        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
        (WebCore::QualifiedName::reportMemoryUsage):
        * platform/TreeShared.h:
        (WebCore::TreeShared::reportMemoryUsage):

2012-07-13  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: align scope filters
        https://bugs.webkit.org/show_bug.cgi?id=91213

        Reviewed by Vsevolod Vlasov.

        * inspector/front-end/elementsPanel.css:
        (.crumbs):
        * inspector/front-end/inspector.css:
        (.status-bar > div):
        (.scope-bar):
        (.scope-bar li):
        (.scope-bar li.all):
        * inspector/front-end/networkLogView.css:

2012-07-13  Peter Rybin  <peter.rybin@gmail.com>

        Web Inspector: too many hardcoded strings in InspectorBackendDispatcher.
        https://bugs.webkit.org/show_bug.cgi?id=89198

        Reviewed by Yury Semikhatsky.

        Instead of generating error message string on every call (mostly for nothing),
        error message is generated deeper inside the handler and only command name
        is passed every time.

        * inspector/CodeGeneratorInspector.py:
        (Generator.process_command):

2012-07-13  Joshua Netterfield  <jnetterfield@rim.com>

        [BlackBerry] Update about:* pages
        https://bugs.webkit.org/show_bug.cgi?id=91121

        Reviewed by Yong Li.

        Update the about:config pages, and improve the aesthetics of the about:build, about:version, about:credits, about:memory, about:config, and similar pages.

        No new tests, because there is no new funtionality.

        * platform/network/blackberry/NetworkJob.cpp: Update the aesthetics of about:* pages

2012-07-13  Olivier Blin  <olivier.blin@softathome.com>

        Fix checking for optional DeviceOrientationEvent.absolute in JSC bindings
        https://bugs.webkit.org/show_bug.cgi?id=91225

        Reviewed by Steve Block.

        This issue comes from r105036

        * bindings/js/JSDeviceOrientationEventCustom.cpp:
        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):

2012-07-13  Andrei Bucur  <abucur@adobe.com>
        [CSS Regions] Fix build for bug 89000
        https://bugs.webkit.org/show_bug.cgi?id=91215

        Reviewed by Kentaro Hara.

        Remove the unused variable m_state that was a leftover from a previous version of the patch.

        Tests: No new tests, build fix.

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):

2012-07-13  Kenichi Ishibashi  <bashi@chromium.org>

        [Chromium] Fix bugs in HarfBuzzShaper
        https://bugs.webkit.org/show_bug.cgi?id=90951

        Reviewed by Tony Chang.

        The current implementation has following problems:
        - Cannot render RTL text if the TextRun is divided into more than two
          HarfBuzzRun.
        - Script handling in TextRun partitioning is incorrect.
        - Inaccurate calculation of selection rect.
        - Wrong rendering position when the first glyph of the TextRun have
          non-zero offsets in terms of HarfBuzz.

        To fix these problems I rewrote HarfBuzzShaper class. Here is the summary:
        - Divide the whole range of TextRun first, then shape them in visual
          order.
        - Divide TextRun in the same way of old-harfbuzz's
          hb_utf16_script_run_next().
        - Prefer float than int when calculating selection.
        - Adjust the drawing point after shaping.

        Added tests covers the fix except for the last problem. The last problem will be covered
        by fast/text/international/complex-joining-using-gpos.html after chromium linux port switches
        to use HarfBuzzShaper.

        Tests: fast/text/shaping/shaping-script-order.html
               fast/text/shaping/shaping-selection-rect.html

        * platform/graphics/harfbuzz/FontHarfBuzz.cpp:
        (WebCore::Font::drawComplexText): Adjusts point after shaping.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::HarfBuzzRun::HarfBuzzRun):
        (WebCore):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::applyShapeResult): Added.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::setGlyphAndAdvance): Offsets are no longer needed.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::xPositionForOffset): Calculates character offset based on advance.
        (WebCore::normalizeCharacters): Added.
        (WebCore::HarfBuzzShaper::HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::~HarfBuzzShaper):
        (WebCore::HarfBuzzShaper::shape): Divides TextRun first, then shapes them.
        (WebCore::HarfBuzzShaper::adjustStartPoint): Added.
        (WebCore::HarfBuzzShaper::collectHarfBuzzRuns): Added.
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Added.
        (WebCore::HarfBuzzShaper::setGlyphPositionsForHarfBuzzRun): Followed other changes.
        (WebCore::HarfBuzzShaper::selectionRect): Use float for calculating selection.
        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h:
        (HarfBuzzShaper): Holds the start index of character. Removed unnecessary variables.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::create): Ditto.
        (HarfBuzzRun):
        (WebCore::HarfBuzzShaper::HarfBuzzRun::fontData): Added.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::startIndex): Ditto.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::glyphs): Ditto.
        (WebCore::HarfBuzzShaper::HarfBuzzRun::advances): Ditto.

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r122545.
        http://trac.webkit.org/changeset/122545
        https://bugs.webkit.org/show_bug.cgi?id=91185

        We found that this was a wrong fix

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-13  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r122553.
        http://trac.webkit.org/changeset/122553
        https://bugs.webkit.org/show_bug.cgi?id=91198

        We found that this was a wrong fix

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-13  Kent Tamura  <tkent@chromium.org>

        Change the timing of form state restore
        https://bugs.webkit.org/show_bug.cgi?id=89962

        Reviewed by Hajime Morita.

        For a preparation to fix a form identification problem (Bug 91209),
        restore controls states when the parsing of their owner forms is
        completed. For controls without owners, their states are restored when
        their parsing is completed as ever.

        No new tests. This doesn't change observable behavior.

        * html/FormController.cpp:
        (WebCore::ownerFormForState):
        Added. This code was used in formKey(), and restoreControlState*() use it.
        (WebCore::FormKeyGenerator::formKey): Use ownerFormForState(). No behavior change.
        (WebCore::FormController::restoreControlStateFor):
        Moved some code from HTMLFormControlElementWithState::finishParsingChildren().
        The difference is we don't resotre state if this control is owned by a form.
        (WebCore::FormController::restoreControlStateIn):
        Restore states of associated controls. This is called from
        finishParsingChildren() for <form>.
        * html/FormController.h:
        (FormController):
        - Declare restoreControlStateFor() and restoreControlStateIn().
        - Make takeStateForFormElement() private.

        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::isFormControlElementWithState):
        Added. The default implementation returns false.
        * html/FormAssociatedElement.h:
        (FormAssociatedElement):
        Added isFormControlElementWithState() for FormController::restoreControlStateIn().
        * html/HTMLFormControlElementWithState.cpp:
        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
        Some code was moved to FormController:restoreControlStateFor().
        (WebCore::HTMLFormControlElementWithState::isFormControlElementWithState):
        Added. Returns true.
        * html/HTMLFormControlElementWithState.h:
        (HTMLFormControlElementWithState): Declare isFormControlElementWithState().
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::finishParsingChildren):
        Added. Calls FormController::restoreControlStateIn().
        * html/HTMLFormElement.h:
        (HTMLFormElement): Declare finishParsingChildren().

2012-07-13  Kent Tamura  <tkent@chromium.org>

        Make calendar pickers testable
        https://bugs.webkit.org/show_bug.cgi?id=84827

        Reviewed by Hajime Morita.

        WebCore:
        - Add PagePopupDriver, an interface to open/close a PagePopup.
        - Add setPagePopupDriver() to ChromeClient in order to inject a
        PagePopupDriver for testing.

        Internals:
        Add MockPagePopupDriver, which creates a MockPagePopup, which creates a
        normal <iframe> in the top-level document, and load the popup content on
        it. MockPagePopupDriver is enabled by
        internals.settings.setEnableMockPagePopup(true).

        Test: fast/forms/date/calendar-picker-appearance.html

        * WebCore.gypi: Add new files.
        * WebCore.xcodeproj/project.pbxproj: Add files to make this buildable.
        * page/ChromeClient.h:
        (ChromeClient): Add function for PagePopupDriver.
        * loader/EmptyClients.h: Add empty implementations for PagePopupDriver functions.
        * page/PagePopupDriver.h: Added.
        (PagePopupDriver):
        (WebCore::PagePopupDriver::~PagePopupDriver):

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::restoreTo): Reset the mock PagePopupDriver.
        (WebCore::InternalSettings::setEnableMockPagePopup):
        Register MockPagePopupDriver to ChromeClient.
        * testing/InternalSettings.h:
        (InternalSettings): Declare setEnableMockPagePopup().
        * testing/InternalSettings.idl: ditto.
        * testing/MockPagePopupDriver.cpp: Added.
        (MockPagePopup): Pseudo PagePopup implementation with the standard <iframe>.
        (WebCore::MockPagePopupDriver::MockPagePopupDriver): Added.
        (WebCore::MockPagePopupDriver::create): Added.
        (WebCore::MockPagePopupDriver::~MockPagePopupDriver): Added.
        (WebCore::MockPagePopupDriver::openPagePopup):
        Added. An override of PagePopupDriver function. This creates a MockPagePopup.
        (WebCore::MockPagePopupDriver::closePagePopup):
        Added. An override of PagePopupDriver function. This deletes the MockPagePopup.
        * testing/MockPagePopupDriver.h:
        (MockPagePopupDriver): Added.

        * testing/v8/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectPagePopupController):
        Added. Production code uses per-Page context feature framework. However
        MockPagePopup uses the same page as the host page. So we can't use the
        framework and need to inject window.pagePopupController manually.
        * testing/v8/WebCoreTestSupport.h:
        (WebCoreTestSupport): Add injectPagePopupController().

2012-07-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: mute the native looks of the selects in the console.
        https://bugs.webkit.org/show_bug.cgi?id=91120

        Reviewed by Vsevolod Vlasov.

        This is necessary for Mac now that we don't use border images for select.

        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.get statusBarItems):
        (WebInspector.ConsoleView.prototype.addContext):
        (WebInspector.ConsoleView.prototype.removeContext):
        (WebInspector.ConsoleView.prototype._updateIsolatedWorldSelector):
        (WebInspector.ConsoleView.prototype._appendIsolatedContextOption):
        (WebInspector.ConsoleView.prototype._currentEvaluationContext):
        (WebInspector.ConsoleView.prototype._currentIsolatedContextId):
        * inspector/front-end/StatusBarButton.js:
        (WebInspector.StatusBarComboBox):
        (WebInspector.StatusBarComboBox.prototype.addOption):
        (WebInspector.StatusBarComboBox.prototype.removeOption):
        (WebInspector.StatusBarComboBox.prototype.removeOptions):
        (WebInspector.StatusBarComboBox.prototype.selectedOption):
        * inspector/front-end/inspector.css:
        (.status-bar-select-container):
        (select.status-bar-item):
        (.console-context):

2012-07-13  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Fix the lifecycle for the flow objects and their renderers
        https://bugs.webkit.org/show_bug.cgi?id=89000

        Reviewed by Eric Seidel.

        This patch adds the concept of a NamedFlowCollection, owned by the document, that keeps track of
        all the named flows that exist in the Document. This collection contains a ListHashSet of weak references to
        all the existing NamedFlows in the document. This is not a managed set because the CREATED flows are referenced from the renderer and
        the NULL flows are only cached, they should be destructible.
        Two named flows are considered to be equal if they have the same name.
        I've changed the NamedFlow state to depend on the existence of its renderer. A flow thread that has a renderer will also have a NamedFlow object.
        A flow thread without a renderer can have a NamedFlow object, but only in the NULL state. It's possible for a NamedFlow object to jump from the
        NULL state to the CREATED state if it was not destroyed (e.g. it was referenced from JS). Keeping track of the NULL state flows that have listeners will be important
        so when they go back to the CREATED state, the listeners would still be there.

        Link to spec: http://www.w3.org/TR/2012/WD-css3-regions-20120503/

        Tests: The old tests have been modified to take into account the new behavior

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/DOMAllInOne.cpp:
        * dom/Document.cpp:
        (WebCore::Document::~Document):
        (WebCore):
        (WebCore::Document::webkitGetFlowByName):
        (WebCore::Document::namedFlows):
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::~WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::create):
        (WebCore):
        (WebCore::WebKitNamedFlow::name):
        (WebCore::WebKitNamedFlow::overset):
        (WebCore::nodeInFlowThread):
        (WebCore::WebKitNamedFlow::getRegionsByContentNode):
        (WebCore::WebKitNamedFlow::getContent):
        (WebCore::WebKitNamedFlow::setRenderer):
        * dom/WebKitNamedFlow.h:
        (WebCore):
        (WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::getFlowState):
        (WebCore::WebKitNamedFlow::switchFlowState):
        * dom/WebKitNamedFlowCollection.cpp: Added.
        (WebCore):
        (WebCore::WebKitNamedFlowCollection::WebKitNamedFlowCollection):
        (WebCore::WebKitNamedFlowCollection::length): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::item): An O(N) operation
        (WebCore::WebKitNamedFlowCollection::flowByName): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::ensureNamedFlowInCreatedState): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::moveNamedFlowToNullState): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::discardNamedFlow): An O(1) operation
        (WebCore::WebKitNamedFlowCollection::documentDestroyed):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashFunctions::hash):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashFunctions::equal):
        (WebKitNamedFlowCollection::NamedFlowHashFunctions):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashTranslator::hash):
        (WebCore::WebKitNamedFlowCollection::NamedFlowHashTranslator::equal):
        * dom/WebKitNamedFlowCollection.h: Copied from Source/WebCore/dom/WebKitNamedFlow.h.
        (WebCore):
        (WebKitNamedFlowCollection):
        (WebCore::WebKitNamedFlowCollection::create):
        (WebCore::WebKitNamedFlowCollection::document):
        * rendering/FlowThreadController.cpp:
        (WebCore::FlowThreadController::ensureRenderFlowThreadWithName):
        (WebCore::FlowThreadController::removeFlowThread):
        (WebCore):
        * rendering/FlowThreadController.h:
        (FlowThreadController):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
        (WebCore):
        (WebCore::RenderNamedFlowThread::~RenderNamedFlowThread):
        (WebCore::RenderNamedFlowThread::removeRegionFromThread):
        (WebCore::RenderNamedFlowThread::unregisterNamedFlowContentNode):
        (WebCore::RenderNamedFlowThread::flowThreadName):
        (WebCore::RenderNamedFlowThread::willBeDestroyed):
        * rendering/RenderNamedFlowThread.h:
        (RenderNamedFlowThread):
        (WebCore::RenderNamedFlowThread::contentNodes):
        (WebCore::RenderNamedFlowThread::canBeDestroyed):

2012-07-13  Vineet Chaudhary  <rgf748@motorola.com>

        [V8Bindings] Implement generalised method to validates that the passed object is a sequence type.
        https://bugs.webkit.org/show_bug.cgi?id=91056

        Reviewed by Kentaro Hara.

        Currently the V8 implementation validates that the passed object is a sequence type only
        for MessagePort in V8Utilities::extractTransferables().
        There should be generalised method for other types too.
        Spec URL: http://www.w3.org/TR/2012/WD-WebIDL-20120207/#es-sequence

        No new test, Just refactoring. There should be no behavioral changes.

        * bindings/v8/V8Binding.h:
        (WebCore::toV8Sequence): Added implementation of toV8Sequence().

2012-07-13  Zeno Albisser  <zeno@webkit.org>

        [Qt][WK2] Implement GraphicsSurface for Linux/GLX.
        https://bugs.webkit.org/show_bug.cgi?id=90881

        Add a GLX based GraphicsSurface implementation for Linux.
        Native X windows are being used for exchanging textures
        with the UIProcess.

        Reviewed by Noam Rosenthal.

        * Target.pri:
        * WebCore.pri:
        * platform/graphics/surfaces/GraphicsSurface.cpp:
        (WebCore::GraphicsSurface::create):
            Move creating GraphicsSurface instance into
            platformCreate/platformImport functions to allow
            platform specific creation based on the provided flags.
        (WebCore::GraphicsSurface::GraphicsSurface):
        (WebCore::GraphicsSurface::~GraphicsSurface):
            Call platformDestroy when destroying a GraphicsSurface.
        (WebCore):
        * platform/graphics/surfaces/GraphicsSurface.h:
            Make platformCreate/platformImport functions static
            to be able to call these from the static create function.
            Add Destructor prototype and add GraphicsSurfacePrivate member.
        (WebCore):
        (GraphicsSurface):
        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
        (WebCore):
        (WebCore::GraphicsSurface::platformCreate):
        (WebCore::GraphicsSurface::platformImport):
            Insert creation of GraphicsSurface instance.
            This allows having a platform specific creation mechanism
            for GLX.
        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp: Added.
        (WebCore):
        (OffScreenRootWindow):
        (WebCore::OffScreenRootWindow::OffScreenRootWindow):
        (WebCore::OffScreenRootWindow::get):
        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
            Add an OffScreenRootWindow singelton that is being used
            as a parent for all native offscreen windows.
        (GraphicsSurfacePrivate):
            This class is used to manage all the X related resources
            such as opening a display or creating XPixmaps etc.
        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
            Open a connection to the X server and create a
            QOpenGLContext that can be used to resolve GL functions.
        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
            Properly cleanup and release all the X resources again.
        (WebCore::GraphicsSurfacePrivate::createSurface):
            Create a surface that is placed off screen and can be
            used as a rendering target by the WebProcess.
        (WebCore::GraphicsSurfacePrivate::createPixmap):
            Create a GLXPixmap from the XWindow that was previously
            redirected by the WebProcess. This GLXPixmap can then be
            bound to a texture and being painted on screen by the
            UIProcess.
        (WebCore::GraphicsSurfacePrivate::makeCurrent):
        (WebCore::GraphicsSurfacePrivate::swapBuffers):
        (WebCore::GraphicsSurfacePrivate::display):
        (WebCore::GraphicsSurfacePrivate::glxPixmap):
        (WebCore::GraphicsSurfacePrivate::size):
        (WebCore::GraphicsSurfacePrivate::glContext):
        (WebCore::resolveGLMethods):
            Initialize all the function pointers for the GL functions used.
        (WebCore::GraphicsSurface::platformExport):
        (WebCore::GraphicsSurface::platformGetTextureID):
            Bind the GLXPixmap to a texture.
        (WebCore::GraphicsSurface::platformCopyToGLTexture):
            Not beeing implemented for GLX.
        (WebCore::GraphicsSurface::platformCopyFromFramebuffer):
            Blit origin fbo onto the GraphicsSurface's backing.
        (WebCore::GraphicsSurface::platformCreate):
        (WebCore::GraphicsSurface::platformImport):
        (WebCore::GraphicsSurface::platformLock):
        (WebCore::GraphicsSurface::platformUnlock):
        (WebCore::GraphicsSurface::platformDestroy):

2012-07-13  Dongwoo Im  <dw.im@samsung.com>

        CodeGeneratorJS.pm : SetterExpression should use 'push' rather than 'unshift'
        https://bugs.webkit.org/show_bug.cgi?id=91198

        Reviewed by Kentaro Hara.

        'SetterExpression' should use 'push' to make arguments, rather than 'unshift'.

        No new tests. Covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-13  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r119948): [Forms] Spin button Up/Down actions make value to zero for input type "number" when step mismatched
        https://bugs.webkit.org/show_bug.cgi?id=91197

        Reviewed by Kent Tamura.

        This patch fixes implementation of Decimal::ceiling() and floor().
        They return wrong value for small fractional numbers.

        The bug is occurred when:
          - Step-able input type, e.g. number, date, datetime, and so on.
          - Current value is step mismatched
          - Current value is smaller than step
          - Step up/down by spin button
        because spin button up/down actions are implemented in InputType::setpUpFromRenderer
        which calls Decimal::ceiling() and floor() for step mismatched case.

        Tests: fast/forms/number/number-stepup-stepdown-from-renderer.html: Added test cases
               WebKit/chromium/tests/DecimalTest.cpp: Added test cases

        * platform/Decimal.cpp:
        (WebCore::Decimal::ceiling): Changed to return 1 for positive small fractional number.
        (WebCore::Decimal::floor): Changed to return -1 for negative small fractional number.

2012-07-13  Dominic Mazzoni  <dmazzoni@google.com>

        Should be possible to focus elements within canvas fallback content
        https://bugs.webkit.org/show_bug.cgi?id=87898

        Reviewed by Chris Fleizach.

        Patches isFocusable in dom/Node.cpp and html/HTMLFormControlElement.cpp
        to make elements focusable if they're a descendent of a canvas element
        if they would otherwise have been focusable but just didn't have
        a renderer. Adds a bit to ElementRareData to efficiently keep track
        of elements in a canvas subtree.

        Test: fast/canvas/fallback-content.html

        * dom/Element.cpp:
        (WebCore::Element::attach):
        (WebCore::Element::detach):
        (WebCore::Element::setIsInCanvasSubtree):
        (WebCore):
        (WebCore::Element::isInCanvasSubtree):
        * dom/Element.h:
        (Element):
        * dom/ElementRareData.h:
        (ElementRareData):
        (WebCore::ElementRareData::ElementRareData):
        * dom/Node.cpp:
        (WebCore::Node::isFocusable):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::attach):
        (WebCore):
        * html/HTMLCanvasElement.h:
        (HTMLCanvasElement):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::isFocusable):

2012-07-12  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Add API to get HTTPS status to WebKit2 GTK+
        https://bugs.webkit.org/show_bug.cgi?id=91100

        Reviewed by Martin Robinson.

        * platform/network/soup/ResourceResponse.h:
        (WebCore::ResourceResponse::soupMessageCertificate): Return the
        certificate.
        (WebCore::ResourceResponse::setSoupMessageCertificate): Set a
        certificate.
        (WebCore::ResourceResponse::soupMessageTLSErrors): Return the TLS
        errors.
        (WebCore::ResourceResponse::setSoupMessageTLSErrors): Set TLS
        errors.
        * platform/network/soup/ResourceResponseSoup.cpp:
        (WebCore::ResourceResponse::toSoupMessage): Set the certificate
        and TLS errors to the newly created SoupMessage.
        (WebCore::ResourceResponse::updateFromSoupMessage): Get the
        certificate and TLS errors from the SoupMessage.

2012-07-13  Ryosuke Niwa  <rniwa@webkit.org>

        RadioNodeList is not updated upon input type change
        https://bugs.webkit.org/show_bug.cgi?id=91178

        Reviewed by Alexey Proskuryakov.

        Invalidate the radio node lists when type content attribute changes since it excludes
        image type input elements.

        Test: fast/forms/radionodelist-image-type.html

        * dom/Document.cpp:
        (WebCore::shouldInvalidateNodeListForType):
        * dom/Document.h: Renamed InvalidateOnIdNameForAttrChange to InvalidateOnFormAttrChange
        since listing all attribute name isn't useful at this point.
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList):

2012-07-12  Dongwoo Im  <dw.im@samsung.com>

        CodeGeneratorJS.pm need to handle the attribute which has "CallWith=ScriptExecutionContext" option.
        https://bugs.webkit.org/show_bug.cgi?id=91185

        Reviewed by Kentaro Hara.

        When an attribute has "CallWith=ScriptExecutionContext" option, 'ScriptExecutionContext*' parameter should be the last parameter.

        No new tests. Covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2012-07-12  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r117738): [Forms] stepMismatch for input type "time" with large step value always return false.
        https://bugs.webkit.org/show_bug.cgi?id=91062

        Reviewed by Kent Tamura.

        This patch changes value of StepRange::acceptableError to zero for
        integer restricted step value.

        No new tests, existing test covers (fast/forms/time/ValidityState-stepMismatch-time.html) this change although they are listed in TestExpectation file.

        * html/StepRange.cpp:
        (WebCore::StepRange::acceptableError): Changed to return 0 if step value is restricted to be an integer.

2012-07-12  Dan Bernstein  <mitz@apple.com>

        Pass an option flag to CFStringGetHyphenationLocationBeforeIndex() that tells it to not
        terminate the search at the last word boundary before the given index.

        Reviewed by Adele Peterson.

        No test, because the current version of Core Foundation ignores the options parameter.

        * platform/text/cf/HyphenationCF.cpp:
        (WebCore::lastHyphenLocation): Changed the options parameter from 0 to 1.

2012-07-12  Eric Seidel  <eric@webkit.org>

        Incorrect behaviour calling Range setStart or setEnd with boundary in different document
        https://bugs.webkit.org/show_bug.cgi?id=42517

        Reviewed by Ojan Vafai.

        Added a new static inline "checkForDifferentRootContainer" to share some code
        and made setStart/setEnd do the right thing in the x-document case.  I removed
        the bogus checks in set*After/set*Before functions, and since they just call
        through to setStart/setEnd, they also now do the right thing.

        Test: fast/dom/Range/set-wrong-document-err.html

        * dom/Range.cpp:
        (WebCore::checkForDifferentRootContainer):
        (WebCore):
        (WebCore::Range::setStart):
        (WebCore::Range::setEnd):
        (WebCore::Range::setStartAfter):
        (WebCore::Range::setEndBefore):
        (WebCore::Range::setEndAfter):
        (WebCore::Range::setStartBefore):

2012-07-12  Erik Arvidsson  <arv@chromium.org>

        [V8] Simplify CodeGeneratorV8 since V8OnProto is only true for DOMWindow
        https://bugs.webkit.org/show_bug.cgi?id=91165

        Reviewed by Nate Chapin.

        The old code was dead code since V8OnProto only ever gets set to 1 for DOMWindow.

        No new tests. No change in functionality.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrSetter):

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Build fix. Initialize unused const member variables to make compilers happy.

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):

2012-07-12  Konrad Piascik  <kpiascik@rim.com>

        Web Inspector: Geolocation override
        https://bugs.webkit.org/show_bug.cgi?id=89365

        Reviewed by Pavel Feldman.

        Reverted original patch.
        Change has not been reviewed by the right people. It declares
        public protocol methods and is wrong in several ways.

        * Modules/geolocation/GeolocationController.cpp:
        (WebCore::GeolocationController::GeolocationController):
        (WebCore::GeolocationController::positionChanged):
        * Modules/geolocation/GeolocationController.h:
        (GeolocationController):
        * inspector/Inspector.json:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::InspectorPageAgent):
        * inspector/InspectorPageAgent.h:
        * inspector/front-end/Settings.js:
        * inspector/front-end/SettingsScreen.js:
        (WebInspector.UserAgentSettingsTab):
        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
        * inspector/front-end/UserAgentSupport.js:

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Move m_type and m_hasNameCache from HTMLCollectionCacheBase to DynamicNodeListCacheBase for better bit packing
        https://bugs.webkit.org/show_bug.cgi?id=91164

        Reviewed by Anders Carlsson.

        Moved m_type and m_hasNameCache from HTMLCollection and renamed them to m_collectionType and m_isNameCacheValid.

        Also renamed shouldIncludeChildren to shouldOnlyIncludeDirectChildren and negated the return value since
        all HTMLCollection include children in the collection and the function was meant to tell us whether the collection
        should include descendents that are not direct children of base().

        In addition, renamed nextNodeOrSibling to nextNode since "or sibling" doesn't seem to add any semantic clarity.

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
        (DynamicNodeListCacheBase):
        (WebCore::DynamicNodeListCacheBase::type):
        (WebCore::DynamicNodeListCacheBase::hasNameCache):
        (WebCore::DynamicNodeListCacheBase::setHasNameCache):
        (WebCore::DynamicNodeListCacheBase::clearCache):
        * html/HTMLCollection.cpp:
        (WebCore::shouldOnlyIncludeDirectChildren):
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore::HTMLCollection::isAcceptableElement):
        (WebCore::nextNode):
        (WebCore::HTMLCollection::itemAfter):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
        (HTMLCollectionCacheBase):
        (WebCore::HTMLCollectionCacheBase::clearCache):

2012-07-12  Shinya Kawanaka  <shinyak@chromium.org>

        Needs callback before AuthorShadowRoot is added.
        https://bugs.webkit.org/show_bug.cgi?id=91167

        Reviewed by Hajime Morita.

        This is a preliminary patch for adding multiple Shadow DOM support for media elements and form elements.
        They assume that UserAgentShadowRoot is the oldest, however currently a page author may try to add
        AuthorShadowRoot before adding UserAgentShadowRoot.

        This patch adds a callback before AuthorShadowRoot is being added, and allow us to add UserAgentShadowRoot
        for those elements. See also Bug 77936, Bug 77937, Bug 90532.

        * dom/Element.h:
        (WebCore::Element::willAddAuthorShadowRoot):
        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::addShadowRoot):
        * dom/ElementShadow.h:
        (ElementShadow):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::create):

2012-07-12  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove the RenderPass pointer from RenderPassDrawQuad
        https://bugs.webkit.org/show_bug.cgi?id=91023

        Reviewed by Adrienne Walker.

        Removes the RenderPass pointer and keeps only an integer id in the
        quad to refer back to the RenderPass the quad reads from.

        Covered by existing tests.

        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        (WebCore::findRenderPassById):
        (WebCore):
        (WebCore::removeRenderPassesRecursive):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::shouldRemoveRenderPass):
        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::shouldRemoveRenderPass):
        (WebCore::CCLayerTreeHostImpl::removeRenderPasses):
        (WebCore::CCLayerTreeHostImpl::prepareToDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (FrameData):
        (CullRenderPassesWithCachedTextures):
        (CullRenderPassesWithNoQuads):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCRenderPass.cpp:
        (WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (CCRenderSurface):

2012-07-12  Elliott Sprehn  <esprehn@gmail.com>

        Unneeded tree walking when adding or removing children due to RenderCounter / RenderQuote logic
        https://bugs.webkit.org/show_bug.cgi?id=89900

        Reviewed by Eric Seidel and Abhishek Arya.

        Previously we would walk the all children a renderer whenever adding
        or removing a child renderer from its RenderObjectChildList to look for 
        RenderQuote and RenderCounter instances to update. This patch introduces 
        a counter in RenderView for the number of RenderQuote and RenderCounter 
        instances in that document so we can avoid these traversals.

        No tests needed since this is just a short circuiting of logic and the existing
        tests should cover it.

        * rendering/RenderCounter.cpp:
        (WebCore::RenderCounter::RenderCounter): Increment instance counter.
        (WebCore::RenderCounter::willBeDestroyed): Decrement instance counter.
        (WebCore):
        (WebCore::RenderCounter::rendererRemovedFromTree): Short circuit when counter is zero.
        (WebCore::RenderCounter::rendererSubtreeAttached): Short circuit when counter is zero.
        * rendering/RenderCounter.h:
        (RenderCounter):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode): Short circuit calling into Counter and Quote code when the document is being destroyed.
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::RenderQuote):
        (WebCore::RenderQuote::willBeDestroyed):
        (WebCore):
        (WebCore::RenderQuote::rendererSubtreeAttached): Increment instance counter.
        (WebCore::RenderQuote::rendererRemovedFromTree): Decrement instance counter.
        * rendering/RenderQuote.h:
        (RenderQuote):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        * rendering/RenderView.h: Methods for managing the RenderQuote and RenderCounter counts.
        (RenderView):
        (WebCore::RenderView::addRenderQuote):
        (WebCore::RenderView::removeRenderQuote):
        (WebCore::RenderView::hasRenderQuotes):
        (WebCore::RenderView::addRenderCounter):
        (WebCore::RenderView::removeRenderCounter):
        (WebCore::RenderView::hasRenderCounters):

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge HTMLCollectionWithArrayStorage into HTMLCollection
        https://bugs.webkit.org/show_bug.cgi?id=91144

        Reviewed by Anders Carlsson.

        Merged HTMLCollectionWithArrayStorage::item into HTMLCollection::item and got rid of
        HTMLCollectionWithArrayStorage. Also de-virtualized HTMLCollection::item and HTMLCollection::length
        and merged itemInArrayAfter and itemAfter.

        In addition, improved the algorithm in HTMLCollection::length to take advantage of item cache.
        Instead of always computing the length from the beginning, we start the search from the cached item
        so that if we're near end of the collection, we avoid significant portion of the node traversal.

        Furthermore, made HTMLCollection always call setItemCache with a non-null item and HTMLCollection::item
        set the length cache when it reaches the end of the collection to avoid redundant length calculations.

        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::setItemCache): Add a FIXME.
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::itemAfter): Regular HTMLCollection doesn't have uses elements array so
        assert that offsetInArray is always 0.
        (WebCore): Removed calcLength.
        (WebCore::HTMLCollection::length): Rewritten. The algorithm is as follows:
        When there is no item cache, we look for the first item by calling item(0). If item(0) returns null,
        then it must have set the length cache so bail out. If the previous step didn't bail out, then
        the item cache is valid and not null (see above), so count the number of remaining items in collection
        starting at the cached item's offset + 1.
        (WebCore::HTMLCollection::item): Avoid calling setItemCache with null. When the first item is null,
        set the length cache instead.
        (WebCore::HTMLCollection::itemAfterCachedItem): Extracted from HTMLCollectionWithArrayStorage::item.
        (WebCore::HTMLCollection::namedItem): Pass in arrayOffset to itemAfter. Note this variable is never
        used since only HTMLFormCollection and HTMLPropertiesCollection use array offsets but they override
        this function.
        (WebCore::HTMLCollection::updateNameCache): Ditto.
        * html/HTMLCollection.h:
        (HTMLCollection):
        (WebCore):
        * html/HTMLFormCollection.cpp: Removed calcLength(). Even though this function didn't iterate over
        the collection directly, HTMLFormElement::length and HTMLFieldSetElement::length did so we're not
        regressing any performance here.
        (WebCore::HTMLFormCollection::HTMLFormCollection):
        (WebCore::HTMLFormCollection::itemAfter):
        * html/HTMLFormCollection.h:
        (HTMLFormCollection):
        * html/HTMLNameCollection.cpp:
        (WebCore::HTMLNameCollection::itemAfter):
        * html/HTMLNameCollection.h:
        (HTMLNameCollection):
        * html/HTMLPropertiesCollection.cpp: Removed calcLength().
        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
        (WebCore::HTMLPropertiesCollection::itemAfter):
        (WebCore):
        * html/HTMLPropertiesCollection.h:
        (HTMLPropertiesCollection):
        * html/HTMLTableRowsCollection.cpp:
        (WebCore::HTMLTableRowsCollection::itemAfter):
        * html/HTMLTableRowsCollection.h:
        (HTMLTableRowsCollection):

2012-07-12  Pravin D  <pravind.2k4@gmail.com>

        Row size/position is wrongly calculated when table having overlapping rowspan cell and colspan cell
        https://bugs.webkit.org/show_bug.cgi?id=16811

        Reviewed by Julien Chaffraix.

        The height of a row is calculated by taking the max height of the cells contained in it. When a row contains
        a rowSpan cell and if this row is not the last row of the cell, then its height is max height of other non
        rowSpan cells. If the row is the last row of the rowSpan cell, then using the contraint laid by CSS2.1 spec
        "For a rowSpan cell, the sum of the row heights involved must be great enough to encompass the cell spanning the rows",
        the last remaining height of the rowSpan(cell height minus heights of other involved rows) is taken into consideration
        while calculating the height of this row.
        Currently when calculating the height of the row we are only using the height of the primary cell at position (row, col).
        However when a row has colSpan cell and rowSpan, they might overlap. In such a sitution as only the primary cells height
        is considered, the height of the row will be calculated worngly if the other overlapping cell has greater height.
        Thus all the overlapping cell at position (row, col) must be considered while calculating the height of a row. 

        Test: fast/table/last-cell-of-rowspan-overlapping-colspan-cell.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcRowLogicalHeight):
        Fixed function to use all the overlapping cells at position(row, col) to calculate the height/position of rows.

2012-07-12  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: Enable IDBFactory.deleteDatabase() and webkitGetDatabaseNames() in Workers
        https://bugs.webkit.org/show_bug.cgi?id=90310

        Reviewed by Tony Chang.

        Simplify Document vs. Worker logic for IDBFactory::open() and hook up the
        other two IDBFactory methods for use by workers as well.

        Test: storage/indexeddb/factory-basics-workers.html

        * Modules/indexeddb/IDBFactory.cpp:
        (isContextValid): Helper function consolidating checks that context is usable.
        (getIndexedDBDatabasePath): Helper function for accessing group settings.
        (WebCore::IDBFactory::getDatabaseNames): Simplify - just pass context through to back end.
        (WebCore::IDBFactory::open): Ditto.
        (WebCore::IDBFactory::deleteDatabase): Ditto.
        (WebCore::IDBFactory::cmp): Whitespace.
        * Modules/indexeddb/IDBFactoryBackendImpl.cpp: Obsolete openFromWorker() removed.
        (WebCore::IDBFactoryBackendImpl::getDatabaseNames): Signature updated.
        (WebCore::IDBFactoryBackendImpl::deleteDatabase): Signature updated.
        (WebCore::IDBFactoryBackendImpl::open): Signature updated.
        * Modules/indexeddb/IDBFactoryBackendImpl.h:
        (IDBFactoryBackendImpl):
        * Modules/indexeddb/IDBFactoryBackendInterface.h: Interface methods now take both SecurityOrigin
        and ScriptExecutionContext, but not Frame. In the proxy, SecurityOrigin is redundant (can be
        accessed from context) but on the real back end the context is null (as Frame was previously).
        (IDBFactoryBackendInterface):
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNamesForFrame):
        (WebCore::InspectorIndexedDBAgent::requestDatabase):
        (WebCore::InspectorIndexedDBAgent::requestData):

2012-07-12  Dana Jansens  <danakj@chromium.org>

        [chromium] The root layer should not try create a second RenderSurface for itself
        https://bugs.webkit.org/show_bug.cgi?id=91124

        Reviewed by Adrienne Walker.

        Tests: CCLayerTreeHostImplTest.rootLayerDoesntCreateExtraSurface

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-07-12  Adam Barth  <abarth@webkit.org>

        Regression (r122359) Layout Test html5lib/runner.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=91047

        Reviewed by Tony Chang.

        This ASSERT is bogus because doctypes can be removed from the DOM and
        then re-added.

        Test: fast/viewport/viewport-legacy-xhtmlmp-remove-and-add.html

        * dom/Document.cpp:
        (WebCore::Document::setDocType):

2012-07-12  Ojan Vafai  <ojan@chromium.org>

        Implied minimum size of flex items is min-content
        https://bugs.webkit.org/show_bug.cgi?id=87546

        Reviewed by Tony Chang.

        http://dev.w3.org/csswg/css3-flexbox/#min-size-auto
        In the main axis direction, min-size of auto means min-content.

        Test: css3/flexbox/flex-item-min-size.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
        (WebCore::RenderBox::computeContentLogicalHeightUsing):
        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
        It turned out that these FIXMEs are all unnecessary with the changes to RenderFlexibleBox.

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):

2012-07-12  Eric Penner  <epenner@google.com>

        [chromium] Use CCTexture/TextureAllocator and remove TextureManager
        https://bugs.webkit.org/show_bug.cgi?id=91001

        Reviewed by Adrienne Walker.

        Use CCTexture to clean up CCPrioritizedTexture::Backing.
        Add TextureAllocator.h and remove remainder of TextureManager.h/cpp.
        Minor move/refactoring of link/unlink in CCPrioritizedTexture.
        Remove double initialization of the default memory limit.

        Covered by existing tests (refactoring).

        * WebCore.gypi:
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
        (WebCore):
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
        (WebCore):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::initialize):
        * platform/graphics/chromium/ManagedTexture.cpp: Removed.
        * platform/graphics/chromium/ManagedTexture.h: Removed.
        * platform/graphics/chromium/RenderSurfaceChromium.h:
        (WebCore):
        * platform/graphics/chromium/TextureAllocator.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.h.
        (WebCore):
        (TextureAllocator):
        (WebCore::TextureAllocator::~TextureAllocator):
        * platform/graphics/chromium/TextureManager.cpp: Removed.
        * platform/graphics/chromium/TextureManager.h: Removed.
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
        (WebCore::TrackingTextureAllocator::createTexture):
        (WebCore::TrackingTextureAllocator::deleteTexture):
        * platform/graphics/chromium/TrackingTextureAllocator.h:
        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::prioritizeTextures):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp:
        (WebCore::CCPrioritizedTexture::CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::setDimensions):
        (WebCore::CCPrioritizedTexture::textureId):
        (WebCore::CCPrioritizedTexture::bindTexture):
        (WebCore::CCPrioritizedTexture::framebufferTexture2D):
        (WebCore::CCPrioritizedTexture::link):
        (WebCore):
        (WebCore::CCPrioritizedTexture::unlink):
        * platform/graphics/chromium/cc/CCPrioritizedTexture.h:
        (WebCore):
        (WebCore::CCPrioritizedTexture::bytes):
        (CCPrioritizedTexture):
        (WebCore::CCPrioritizedTexture::haveBackingTexture):
        (WebCore::CCPrioritizedTexture::Backing::Backing):
        (WebCore::CCPrioritizedTexture::Backing::~Backing):
        (WebCore::CCPrioritizedTexture::Backing::owner):
        (Backing):
        (WebCore::CCPrioritizedTexture::backing):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
        (WebCore::CCPrioritizedTextureManager::requestLate):
        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
        (WebCore::CCPrioritizedTextureManager::reduceMemory):
        (WebCore::CCPrioritizedTextureManager::clearAllMemory):
        (WebCore::CCPrioritizedTextureManager::registerTexture):
        (WebCore::CCPrioritizedTextureManager::returnBackingTexture):
        (WebCore::CCPrioritizedTextureManager::createBacking):
        (WebCore::CCPrioritizedTextureManager::destroyBacking):
        (WebCore::CCPrioritizedTextureManager::assertInvariants):
        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
        (CCPrioritizedTextureManager):
        (WebCore::CCPrioritizedTextureManager::defaultMemoryAllocationLimit):
        (WebCore::CCPrioritizedTextureManager::compareBackings):
        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
        * platform/graphics/chromium/cc/CCScopedTexture.cpp:
        * platform/graphics/chromium/cc/CCScopedTexture.h:
        * platform/graphics/chromium/cc/CCTexture.h:
        (WebCore::CCTexture::CCTexture):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore):
        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:

2012-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        Let XCode have its own way.

        * WebCore.xcodeproj/project.pbxproj:

2012-07-12  Julien Chaffraix  <jchaffraix@webkit.org>

        ASSERT(genChild->isListMarker() || genChild->style()->styleType() == FIRST_LETTER) triggered on flex-box content
        https://bugs.webkit.org/show_bug.cgi?id=91003

        Reviewed by Abhishek Arya.

        Tests: fast/flexbox/assert-generated-deprecated-flexbox.html
               fast/flexbox/assert-generated-new-flexbox.html

        The issue was that findBeforeAfterParent didn't return the right parent for the flex-box case. This would
        make us update the wrong children (and not propagate the style updates properly).

        * rendering/RenderObjectChildList.cpp:
        (WebCore::findBeforeAfterParent):
        Added a check for flex boxes (both deprecated and new).

2012-07-12  Pravin D  <pravind.2k4@gmail.com>

        Percentage width replaced element in zero percent/fixed width container block incorrectly rendered.
        https://bugs.webkit.org/show_bug.cgi?id=9493

        Reviewed by Andy Estes.

        When the width of the container is zero percent/fixed value then the width of the replaced element must also be zero.

        Test: fast/css/percent-width-img-inside-zero-percent-and-fixed-container.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
          When the containing block's available width is zero there can be two cases.
          The containing block is floated/positioned in which case the width of the replaced child element must be its instrinsic width.
          On the other hand if the width of the container is specified to be either zero percent or fixed value then the width of the
          replaced elment must be zero.

2012-07-11  Ryosuke Niwa  <rniwa@webkit.org>

        invalidateNodeListsCacheAfterAttributeChanged should dynamically figure out which attribute needs invalidation
        https://bugs.webkit.org/show_bug.cgi?id=91046

        Reviewed by Anders Carlsson.

        Added an array of counters (m_nodeListCounts) for each set of attributes (NodeListInvalidationType) node lists care about
        to Document, and made DynamicSubtreeNodeList's constructor and destructor increment and decrement these counters via
        registerDynamicSubtreeNodeList and unregisterDynamicSubtreeNodeList respectively. shouldInvalidateDynamicSubtreeNodeList,
        which is called by invalidateNodeListsCacheAfterAttributeChanged, then use these counters to determine whether a given
        attribute change should result in node list invalidations.

        Also removed m_numNodeListCaches from TreeScope because this counter has now become redundant with m_nodeListCounts.

        * dom/ChildNodeList.cpp:
        (WebCore::ChildNodeList::ChildNodeList): Do not invalidate on attribute changes.
        * dom/ClassNodeList.cpp:
        (WebCore::ClassNodeList::ClassNodeList): Invalidate on class attribute changes.
        * dom/Document.cpp:
        (WebCore::Document::Document): Initialize m_nodeListCounts.
        (WebCore::Document::~Document): Add assertions to make sure m_listsInvalidatedAtDocument, m_nodeListCounts, and
        m_collections are all empty.
        (WebCore::Document::registerDynamicSubtreeNodeList): This function is now called for all DynamicSubtreeNodeLists supposed
        to just ones rooted at the document in order to increment the counter for each invalidation type.
        (WebCore::Document::unregisterDynamicSubtreeNodeList): Ditto.
        (WebCore::shouldInvalidateDynamicSubtreeNodeListForType): Checks the attribute name against NodeListInvalidationType.
        (WebCore::Document::shouldInvalidateDynamicSubtreeNodeList): Returns true if the given attribute name matches the invalidation
        type of the existing DynamicSubtreeNodeLists in the document. If the attribute name is not given (used when children change),
        then it checks for the existence of any DynamicSubtreeNodeLists. Conceptually, this function can be written as a list of
        "if" statements that checks values in m_nodeListCounts and the attribute name. We use "for" loop and switch statement instead
        to share logic and detect future addition of values to NodeListInvalidationType.
        * dom/Document.h:
        (Document): Moved RootType and InvalidationType from DynamicNodeListCacheBase and renamed them to NodeListRootType and
        NodeListInvalidationType respectively in order to reduce the possibility of future name collisions. Also the invalidation type
        now contains 6 values instead of 2.
        * dom/DynamicNodeList.cpp:
        (WebCore):
        * dom/DynamicNodeList.h:
        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): 
        (WebCore::DynamicNodeListCacheBase::shouldInvalidateOnAttributeChange):
        (WebCore::DynamicNodeListCacheBase::rootType): Added.
        (WebCore::DynamicNodeListCacheBase::invalidationType): Added.
        (DynamicNodeListCacheBase): Uses 3 bits to store invalidation type now that the number of values have increased from 2 to 6.
        (WebCore::DynamicNodeList::DynamicNodeList):
        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList): Call unregisterDynamicSubtreeNodeList.
        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList): Call registerDynamicSubtreeNodeList.
        * dom/MicroDataItemList.cpp:
        (WebCore::MicroDataItemList::MicroDataItemList): Invalidate on itemscope, itemprop, and itemtype content attribute changes.
        * dom/NameNodeList.cpp:
        (WebCore::NameNodeList::NameNodeList): Invalidate on name attribute changes.
        * dom/Node.cpp:
        (WebCore::Node::clearRareData):
        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): Replaced the hard coded check list of attributes, by a call
        to shouldInvalidateDynamicSubtreeNodeList.
        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Calls shouldInvalidateDynamicSubtreeNodeList.
        (WebCore::Node::getElementsByTagName):
        (WebCore::Node::getElementsByTagNameNS):
        (WebCore::Node::getElementsByName):
        (WebCore::Node::getElementsByClassName):
        (WebCore::Node::radioNodeList):
        (WebCore::NodeRareData::createNodeLists):
        * dom/NodeRareData.h:
        (WebCore::NodeListsNodeData::adoptTreeScope): Unregister and register node lists in m_tagNodeListCacheNS since all node lists
        need to be accounted in m_nodeListCounts.
        (WebCore::NodeRareData::ensureNodeLists):
        (NodeRareData):
        * dom/TagNodeList.cpp:
        (WebCore::TagNodeList::TagNodeList): Do not invalidate on any attribute changes.
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::TreeScope): No longer initializes m_numNodeListCaches since it has been removed.
        * dom/TreeScope.h:
        (TreeScope): Removed m_numNodeListCaches.
        * dom/TreeScopeAdopter.cpp:
        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase): Just pass in DoNotInvalidateOnAttributeChanges for now since
        it's never used in HTMLCollections.
        * html/LabelableElement.cpp:
        (WebCore::LabelableElement::labels):
        * html/LabelsNodeList.cpp:
        (WebCore::LabelsNodeList::LabelsNodeList): Invalidate on for content attribute changes.
        (WebCore::LabelsNodeList::~LabelsNodeList):
        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::RadioNodeList): Invalidate on id, name, and for content attribute changes.
        (WebCore::RadioNodeList::~RadioNodeList):

2012-07-12  Gavin Barraclough  <barraclough@apple.com>

        Threadsafety issues in WebScriptObject
        https://bugs.webkit.org/show_bug.cgi?id=90849

        Reviewed by Filip Pizlo & Oliver Hunt.

        Updated fix for this bug. Taking the JSC API lock from WebScriptObject::release
        may not be safe; better to just guard the JSWrapperCache with its own spinlock.

        * bindings/objc/WebScriptObject.mm:
        (WebCore::getJSWrapper):
            - Added spinlock; also retain/autorelease the returned wrapper - it is unsafe
              to wait for the caller to do so, due to a race condition vs release removing
              the wrapper from the map.
        (WebCore::addJSWrapper):
            - Take the spinlock guarding the cache.
        (WebCore::removeJSWrapper):
            - Take the spinlock guarding the cache.
        (WebCore::removeJSWrapperIfRetainCountOne):
            - Take the spinlock guarding the cache, remove the wrapper if retainCount is one.
        (WebCore::createJSWrapper):
            - Remove the API lock; this method no longer needs to retain/autorelease (this is
              done by getJSWrapper).
        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
            - Remove the API lock.
        (-[WebScriptObject release]):
            - Remove the API lock, retainCount check moved into removeJSWrapperIfRetainCountOne.

2012-07-11  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=91000
        REGRESSION (r122244): Overflow elements don't shrink as much as they should.

        Reviewed by Simon Fraser.

        This is a fix for a a regression from https://bugs.webkit.org/show_bug.cgi?id=90646.

        I incorrectly analyzed the issue with Robert Hogan's negative margin patch and fooled myself into putting back
        in an incorrect minimum width check from long ago.
        
        What should have happened in the test case I patched is that the overflow element should shrink to 0. The issue 
        with improving the logical top estimate in the previous patch is it made the clear delta become 0. This in turn
        exposed a bug in our clearing algorithm with Robert's changes where you could need a relayout even if you didn't
        actually move. This issue only occurs because the floats list is getting changed mid-layout because of negative margins.

        The patch changes getClearDelta to call setChildNeedsLayout(true) on children whose widths change even when their
        positions do not. In effect this dynamic addition of new floats after you have done a layout on the child already means
        that you can need to lay out again despite not actually having to move.
        
        To handle this, the code that does the relayout is now called if the child needs a relayout. This is done even if
        the logical top estimate matches the final position.
        
        No new tests required, since the test in fast/block/float is now correctly covering the issue.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlockChild):
        (WebCore::RenderBlock::getClearDelta):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):

2012-07-12  James Weatherall  <wez@chromium.org>

        storage tests are flaky (crashing) on windows
        https://bugs.webkit.org/show_bug.cgi?id=90469

        Reviewed by Kentaro Hara.

        Add a missing check that the underlying V8 object reference in a V8 NPObject is valid, and zero the NPObject's rootObject member when disposing it, to ensure that it won't be mistakenly touched after that point.

        This patch is intended to resolve flakiness in the storage tests including:
          storage/indexeddb/mozilla/indexes.html
          storage/indexeddb/mozilla/key-requirements-inline-and-passed.html
          storage/websql/multiple-databases-garbage-collection.html

        * bindings/v8/NPV8Object.cpp:
        (WebCore::disposeUnderlyingV8Object):
        Zero the NPObject's underlying rootObject.
        (_NPN_EvaluateHelper):
        Add check that the underlying V8 object reference is valid.

2012-07-12  No'am Rosenthal  <noam.rosenthal@nokia.com>

        Move TextureMapperAnimation and texmap/LayerTransform to platform/graphics
        https://bugs.webkit.org/show_bug.cgi?id=91111

        Reviewed by Kenneth Rohde Christiansen.

        TextureMapperAnimation and LayerTransform are not specific to TextureMapper, and we want
        to use them for other purposes as well. Moving them to platform/graphics would make that
        more explicit.

        No new tests, moving files around.

        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * platform/graphics/GraphicsLayerAnimation.cpp: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp.
        * platform/graphics/GraphicsLayerAnimation.h: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h.
        * platform/graphics/GraphicsLayerTransform.cpp: Renamed from Source/WebCore/platform/graphics/texmap/LayerTransform.cpp.
        * platform/graphics/GraphicsLayerTransform.h: Renamed from Source/WebCore/platform/graphics/texmap/LayerTransform.h.
        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
        (GraphicsLayerTextureMapper):
        * platform/graphics/texmap/TextureMapperLayer.h:
        (TextureMapperLayer):
        (WebCore::TextureMapperLayer::setAnimatedTransform):
        (WebCore::TextureMapperLayer::setAnimatedOpacity):

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Simplify UISourceCode code after moving revisions support inside it.
        https://bugs.webkit.org/show_bug.cgi?id=91118

        Reviewed by Pavel Feldman.

        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype._setContent):
        (WebInspector.UISourceCode.prototype.revertToOriginal):
        (WebInspector.UISourceCode.prototype.revertAndClearHistory):
        (WebInspector.UISourceCode.prototype.contentChanged):
        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
        (WebInspector.Revision.prototype.revertToThis):

2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        Unreviewed. Build fix for r122462.

        * platform/qt/MemoryUsageSupportQt.cpp:

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Remove resources panel edited resources search support.
        https://bugs.webkit.org/show_bug.cgi?id=91101

        Reviewed by Pavel Feldman.

        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.performSearch.callback):
        (WebInspector.ResourcesPanel.prototype.performSearch):

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed r122460 inspector closure compilation fix follow up.

        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView):

2012-07-12  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: fix native memory instrumentation code for the bindings instrumentation.
        https://bugs.webkit.org/show_bug.cgi?id=91096

        The instrumented class has to have instrumentation method which reports class size and type and
        the member objects and pointers.

        Sample:
        void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
        {
            memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM); // report object size and type.
            TreeShared<Node, ContainerNode>::reportMemoryUsage(memoryObjectInfo); // call base class instrumentation.
            ScriptWrappable::reportMemoryUsage(memoryObjectInfo); // call base class instrumentation.
            memoryObjectInfo->reportPointer(m_document, MemoryInstrumentation::DOM); // report uninstrumented pointer.
            memoryObjectInfo->reportInstrumentedPointer(m_next); // report instrumented pointer.
            memoryObjectInfo->reportInstrumentedObject(m_anObject); // report instrumented object.
        }

        Reviewed by Pavel Feldman.

        Existing tests for native memory instrumentation.

        * bindings/v8/DOMDataStore.cpp:
        (WebCore::DOMDataStore::reportMemoryUsage):
        * bindings/v8/DOMDataStore.h:
        (WebCore):
        (DOMDataStore):
        * bindings/v8/IntrusiveDOMWrapperMap.h:
        (WebCore::ChunkedTable::reportMemoryUsage):
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
        * bindings/v8/V8Binding.cpp:
        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
        (WebCore::StringCache::reportMemoryUsage):
        * bindings/v8/V8Binding.h:
        (WebCore):
        (StringCache):
        (V8BindingPerIsolateData):
        * bindings/v8/V8DOMMap.h:
        (WebCore):
        (AbstractWeakReferenceMap):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore):

2012-07-12  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: beautify find bar looks, simplify search update routines.
        https://bugs.webkit.org/show_bug.cgi?id=91087

        Reviewed by Vsevolod Vlasov.

        This change updates the looks to the one on the screenshots and simplifies match count update routines.

        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController.onMatchesMouseDown):
        (WebInspector.SearchController):
        (WebInspector.SearchController.prototype.activePanelChanged.performPanelSearch):
        (WebInspector.SearchController.prototype.activePanelChanged):
        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
        (WebInspector.SearchController.prototype._updateSearchMatchesCountAndCurrentMatchIndex):
        (WebInspector.SearchController.prototype._onKeyDown):
        (WebInspector.SearchController.prototype._onInput):
        (WebInspector.SearchController.prototype._onNextButtonSearch):
        (WebInspector.SearchController.prototype._onPrevButtonSearch):
        (WebInspector.SearchController.prototype._performSearch):
        * inspector/front-end/inspector.css:
        (#search):
        (#search:focus):
        (.toolbar-search-navigation-controls):
        (.toolbar-search-navigation):
        (.toolbar-search-navigation.enabled:hover):
        (.toolbar-search-navigation.enabled, .toolbar-search-navigation.enabled:active):
        (.toolbar-search):
        (.toolbar-search-control):
        (.search-results-matches):
        (.inspector-footer):

2012-07-12  Joshua Bell  <jsbell@chromium.org>

        IndexedDB: ASSERT hit calling open from callback in Worker
        https://bugs.webkit.org/show_bug.cgi?id=90832

        Reviewed by Kentaro Hara.

        GroupSettings are used to provide the backing store path in some
        ports. Accessing those settings from a Worker was added, but the
        access referenced thread startup data that is cleared before the
        run loop, so an IDBFactory.open() call executed asynchronously
        would dereference a null pointer. Plumb the settings startup
        data into the context itself, like all of the other properties.

        Test: storage/indexeddb/open-twice-workers.html

        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        * workers/DedicatedWorkerContext.cpp:
        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
        * workers/DedicatedWorkerContext.h:
        (WebCore::DedicatedWorkerContext::create):
        (DedicatedWorkerContext):
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::createWorkerContext):
        * workers/DedicatedWorkerThread.h:
        (DedicatedWorkerThread):
        * workers/SharedWorkerContext.cpp:
        (WebCore::SharedWorkerContext::SharedWorkerContext):
        * workers/SharedWorkerContext.h:
        (WebCore::SharedWorkerContext::create):
        (SharedWorkerContext):
        * workers/SharedWorkerThread.cpp:
        (WebCore::SharedWorkerThread::createWorkerContext):
        * workers/SharedWorkerThread.h:
        (SharedWorkerThread):
        * workers/WorkerContext.cpp:
        (WebCore::WorkerContext::WorkerContext):
        * workers/WorkerContext.h:
        (WebCore::WorkerContext::groupSettings):
        (WorkerContext):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::workerThread):
        * workers/WorkerThread.h:
        (WorkerThread):

2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] Implement MemoryUsageSupport
        https://bugs.webkit.org/show_bug.cgi?id=91094

        Reviewed by Adam Barth.

        Implements Qt versions of the memory-usage functions using the information we have available
        from the various memory systems used in WebKit.

        Also gets rid of a redundant indirection in V8GCController.

        * Target.pri:
        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::gcEpilogue):
        (WebCore::V8GCController::checkMemoryUsage):
        * platform/qt/MemoryUsageSupportQt.cpp: Added.
        (WebCore::mallocMemoryUsage):
        (WebCore::memoryUsageKB):
        (WebCore::actualMemoryUsageKB):
        (WebCore::MemoryUsageSupport::memoryUsageMB):
        (WebCore::MemoryUsageSupport::actualMemoryUsageMB):
        (WebCore::MemoryUsageSupport::lowMemoryUsageMB):
        (WebCore::MemoryUsageSupport::highMemoryUsageMB):
        (WebCore::MemoryUsageSupport::highUsageDeltaMB):
        (WebCore::MemoryUsageSupport::processMemorySizesInBytes):
        * platform/qt/PlatformSupport.h:
        (PlatformSupport):

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Revision history view should be updated when uiSourceCodes are removed or replaced.
        https://bugs.webkit.org/show_bug.cgi?id=91095

        Reviewed by Pavel Feldman.

        RevisionHistoryView is now reset in WorkspaceReset event handler.
        UISourceCodes are now removed from RevisionHistoryView when uiSourceCode is removed or replace.

        * inspector/front-end/RevisionHistoryView.js:
        (WebInspector.RevisionHistoryView):
        (WebInspector.RevisionHistoryView.prototype._clearHistory):
        (WebInspector.RevisionHistoryView.prototype._uiSourceCodeRemoved):
        (WebInspector.RevisionHistoryView.prototype._uiSourceCodeReplaced):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._reset):

2012-07-12  Dongwoo Im  <dw.im@samsung.com>

        InspectorFileSystemAgent.cpp have to include File.h explicitly
        https://bugs.webkit.org/show_bug.cgi?id=91078

        Reviewed by Vsevolod Vlasov.

        Make sure the InspectorFileSystemAgent.cpp include the File.h by including explicitly.

        No new tests. Covered by existing tests.

        * inspector/InspectorFileSystemAgent.cpp: Include File.h

2012-07-12  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: [Regression] Stale revisions should be removed on navigation.
        https://bugs.webkit.org/show_bug.cgi?id=91080

        Reviewed by Pavel Feldman.

        Moved all the code responsible for script mapping resetting to Workspace.
        Stale revisions are removed in Workspace._reset now.

        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.ScriptSnippetModel):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.StylesUISourceCodeProvider):
        (WebInspector.StylesUISourceCodeProvider.prototype._populate):
        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype._restoreRevisionHistory):
        * inspector/front-end/Workspace.js:
        (WebInspector.Workspace):
        (WebInspector.Workspace.prototype._reset):

2012-07-12  Andreas Kling  <kling@webkit.org>

        Make ElementAttributeData a variable-sized object to reduce memory use.
        <http://webkit.org/b/88240>

        Reviewed by Antti "Obi-Wan" Koivisto.

        Take advantage of the fact that we know at ElementAttributeData construction time how many attributes
        it needs to accomodate and allocate exactly as much space as needed instead of using a Vector.
        For elements that never have their attribute list mutated (the vast majority), this saves a lot of
        memory and removes the indirection to Vector<Attribute>'s heap-allocated storage.

        Introduced a mutability flag to ElementAttributeData and sprinkled assertions all over to make sure
        that nothing tries to mutate an element with a raw attribute array.

        When an Element's attribute(s) are mutated, we reconstruct the ElementAttributeData, this time using
        a Vector as backing instead. This is triggered when calling Element::mutableAttributeData().

        This reduces memory consumption by 3.2MB when viewing the full HTML5 spec at <http://whatwg.org/c/>.
        That is a ~35% reduction in DOM attribute memory use.

        Furthermore, that page ends up promoting 27% of the elements to mutable attribute storage due to dynamic
        adding of "class" attributes. For more static pages, savings are even greater.

        Also did away with ElementAttributeData::removeAttribute(name) and do separate index lookup where
        needed. Not a big deal but avoids double lookup of attributes when removing them.

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):

            Call ensureInlineStyle() on the element so we know we have a StylePropertySet to work with.
            May cause the creation (and replacement) of a new underlying StylePropertySet on the Element's
            attribute data.

        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::adoptCSSOMWrapperFrom):

            Added. Allows switching the underlying StylePropertySet object while retaining CSSOM wrapper
            identity (web facing behavior.)

        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttribute):
        (WebCore::Element::attributes):
        (WebCore::Element::setAttributeInternal):
        (WebCore::Element::parserSetAttributes):
        (WebCore::Element::hasEquivalentAttributes):
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::getAttributeNode):
        (WebCore::Element::getAttributeNodeNS):
        (WebCore::Element::hasAttribute):
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::normalizeAttributes):
        (WebCore::Element::cloneAttributesFromElement):
        (WebCore::Element::createMutableAttributeData):
        * dom/Element.h:
        (WebCore::Element::attributeData):
        (Element):
        (WebCore::Element::updatedAttributeData):
        (WebCore::Element::ensureAttributeData):
        (WebCore::Element::ensureUpdatedAttributeData):
        (WebCore::Element::mutableAttributeData):
        (WebCore):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::createImmutable):
        (WebCore):
        (WebCore::ElementAttributeData::ElementAttributeData):
        (WebCore::ElementAttributeData::~ElementAttributeData):
        (WebCore::ElementAttributeData::attrIfExists):
        (WebCore::ElementAttributeData::ensureAttr):
        (WebCore::ElementAttributeData::setAttr):
        (WebCore::ElementAttributeData::removeAttr):
        (WebCore::ElementAttributeData::ensureInlineStyle):
        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
        (WebCore::ElementAttributeData::destroyInlineStyle):
        (WebCore::ElementAttributeData::addAttribute):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::isEquivalent):
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
        (WebCore::ElementAttributeData::cloneDataFrom):
        (WebCore::ElementAttributeData::clearAttributes):
        (WebCore::ElementAttributeData::replaceAttribute):
        (WebCore::ElementAttributeData::getAttributeNode):
        * dom/ElementAttributeData.h:
        (WebCore::ElementAttributeData::create):
        (ElementAttributeData):
        (WebCore::ElementAttributeData::setClass):
        (WebCore::ElementAttributeData::setIdForStyleResolution):
        (WebCore::ElementAttributeData::inlineStyle):
        (WebCore::ElementAttributeData::setAttributeStyle):
        (WebCore::ElementAttributeData::reportMemoryUsage):
        (WebCore::ElementAttributeData::isMutable):
        (WebCore::ElementAttributeData::makeMutable):
        (WebCore::ElementAttributeData::length):
        (WebCore):
        (WebCore::ElementAttributeData::isEmpty):
        (WebCore::ElementAttributeData::array):
        (WebCore::ElementAttributeData::removeAttribute):
        (WebCore::ElementAttributeData::getAttributeItem):
        (WebCore::ElementAttributeData::getAttributeItemIndex):
        (WebCore::ElementAttributeData::attributeItem):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::classAttributeChanged):
        (WebCore::StyledElement::setInlineStyleProperty):
        (WebCore::StyledElement::removeInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        * dom/StyledElement.h:
        (WebCore::StyledElement::ensureInlineStyle):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::XMLDocumentParser):

2012-07-12  Florin Malita  <fmalita@chromium.org>

        Incorrect handling of chained pending resources in SVGUseElement
        https://bugs.webkit.org/show_bug.cgi?id=89686

        Reviewed by Nikolas Zimmermann.

        Currently SVGUseElement builds the shadow tree when the target first
        becomes available. This is normally OK, but if the target itself (or
        one of its children) is a <use> element with pending resources, then
        the shadow expansion only captures the current state of the tree and
        never gets updated when the pending resource becomes available.

        In order to support arbitrary <use>-on-<use> constructs, this patch
        tracks nested <use> dependencies and rebuilds the dependent trees
        whenever the target gets updated.


        Tests: svg/custom/use-nested-expected.svg
               svg/custom/use-nested.svg

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::removedFrom): removedFrom needs to be called up the inheritance chain
        before invoking removeAllElementReferencesForTarget. Otherwise we could end up finding the
        element being removed as a valid target in SVGUseElement::buildInstanceTree because its
        InDocument flag is not cleared yet.
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::~SVGUseElement):
        (WebCore::SVGUseElement::clearResourceReferences):
        (WebCore::SVGUseElement::buildPendingResource):
        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
        (WebCore::SVGUseElement::buildInstanceTree):
        * svg/SVGUseElement.h:
        (SVGUseElement):
        Track <use> -> <use> dependencies using SVGDocumentExtensions'
        m_elementDependencies framework and ensure dependent trees are rebuilt
        when the target itself gets rebuilt.

2012-07-12  MORITA Hajime  <morrita@google.com>

        Typo: ParentTranversalDetails should be ParentTraversalDetails
        https://bugs.webkit.org/show_bug.cgi?id=91059

        Reviewed by Andreas Kling.

        Did a bare rename from ParentTranversalDetails to ParentTraversalDetails

        No new tests, just a rename.

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::didTraverseInsertionPoint):
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::didTraverseShadowRoot):
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::didFindNode):
        (WebCore::ComposedShadowTreeWalker::findParent):
        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
        (WebCore::ComposedShadowTreeWalker::traverseParent):
        (WebCore::ComposedShadowTreeWalker::traverseParentInCurrentTree):
        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
        * dom/ComposedShadowTreeWalker.h:
        (WebCore::ComposedShadowTreeWalker::ParentTraversalDetails::ParentTraversalDetails):
        (ComposedShadowTreeWalker):
        * dom/NodeRenderingContext.h:
        (NodeRenderingContext):

2012-07-11  Antti Koivisto  <antti@apple.com>

        Failure to dispatch didFinishLoadForFrame if font load fails synchronously 
        https://bugs.webkit.org/show_bug.cgi?id=91018

        Reviewed by Enrica Casucci.

        New font loads may be triggered by layout after the document load is complete but before we have dispatched
        didFinishLoading for the frame. If the load fails synchronously we might fail to ever invoke 
        FrameLoader::checkLoadComplete and so fail to dispatch didFinishLoading.
        
        Make sure this doesn't happen by calling FrameLoader::checkLoadComplete explicitly after triggering font loads.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::beginLoadTimerFired):

2012-07-12  Gyuyoung Kim  <gyuyoung.kim@samsung.com>

        Register protocol handler files should be in Modules/protocolhandler
        https://bugs.webkit.org/show_bug.cgi?id=90766

        Reviewed by Hajime Morita.

        The register protocol handler files are now self-contained. This patch is moved to the Modules.

        No new tests. Covered by existing tests.

        * CMakeLists.txt:
        * GNUmakefile.am:
        * GNUmakefile.list.am:
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp: Renamed from Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp.
        (WebCore):
        (WebCore::initProtocolHandlerWhitelist):
        (WebCore::verifyCustomHandlerURL):
        (WebCore::isProtocolWhitelisted):
        (WebCore::verifyProtocolHandlerScheme):
        (WebCore::NavigatorRegisterProtocolHandler::NavigatorRegisterProtocolHandler):
        (WebCore::NavigatorRegisterProtocolHandler::~NavigatorRegisterProtocolHandler):
        (WebCore::NavigatorRegisterProtocolHandler::registerProtocolHandler):
        (WebCore::customHandlersStateString):
        (WebCore::NavigatorRegisterProtocolHandler::isProtocolHandlerRegistered):
        (WebCore::NavigatorRegisterProtocolHandler::unregisterProtocolHandler):
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.h: Renamed from Source/WebCore/page/NavigatorRegisterProtocolHandler.h.
        (WebCore):
        (NavigatorRegisterProtocolHandler):
        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl: Renamed from Source/WebCore/page/NavigatorRegisterProtocolHandler.idl.
        * Target.pri:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.gypi:
        * WebCore.pri:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcproj/WebCoreCommon.vsprops:
        * WebCore.vcproj/copyForwardingHeaders.cmd:
        * WebCore.xcodeproj/project.pbxproj:

2012-07-12  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>

        [BlackBerry] Cannot use digest proxy auth and NTLM auth at the same time
        https://bugs.webkit.org/show_bug.cgi?id=91054

        Reviewed by George Staikos.

        Added an interface function syncProxyCredential() in class
        PageClientBlackBerry, which is responsible to notify WebPageClient
        to synchronize proxy credential to the chrome process.

        Internally reviewed by Jason Liu <jason.liu@torchmobile.com.cn>

        No new tests since there's no functional change.

        * platform/blackberry/PageClientBlackBerry.h:
        * platform/network/blackberry/NetworkJob.cpp:
        (WebCore::NetworkJob::storeCredentials): Remember the accepted proxy
        credential and notify webpage client to synchronize it.

2012-07-12  Xingnan Wang  <xingnan.wang@intel.com>

        [IndexedDB] upperOpen set to true in lowerBound()/lowerOpen set to true in upperBound()
        https://bugs.webkit.org/show_bug.cgi?id=90867

        Reviewed by Tony Chang.

        In the latest W3C spec upperOpen/lowerOpen are set to true in lowerBound()/upperBound(), which
        we should keep aligned with.

        No new tests - updated storage/indexeddb/keyrange.html to match new behavior.

        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):

2012-07-12  MORITA Hajime  <morrita@google.com>

        [Shadow DOM] <video> with <shadow> crashes
        https://bugs.webkit.org/show_bug.cgi?id=91055

        Reviewed by Kent Tamura.

        This is similar to Bug 90480, where an undesired renderer is created by
        locating an insertion point on the shadow boundary.

        This change adds a guard for such case by cheking whether the
        source node of each to-be-created renderer comes from the UA shadow
        tree, which is allowed to have a renderer.

        Test: fast/dom/shadow/insertion-point-video-crash.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::childShouldCreateRenderer): Added a check.
        (WebCore::HTMLMediaElement::mediaControls): Added const.
        (WebCore::HTMLMediaElement::hasMediaControls): Added const.
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):

2012-07-12  Yoshifumi Inoue  <yosin@chromium.org>

        REGRESSION(r122184): LocaleMac::currentLocale should use current locale rather than newly create locale object. 
        https://bugs.webkit.org/show_bug.cgi?id=91057

        Reviewed by Kent Tamura.

        This patch changes NSLocale object of LocaleMac::m_locale variable to
        current NSLocale object rather than newly created NSLocale object from
        locale identifier.

        No new tests. We don't have way to change system preferences from
        test scripts and restoring them. To test this patch, we need to do so.

        * platform/text/mac/LocaleMac.h:
        (LocaleMac): Added a constructor which takes NSLocale object.
        * platform/text/mac/LocaleMac.mm:
        (WebCore::LocaleMac::LocaleMac): Added a constructor which takes NSLocale object.
        (WebCore::LocaleMac::currentLocale): Changed to construct LocaleMac object from NSLocale object rather than locale identifier.

2012-07-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Add webkit_cookie_manager_set_persistent_storage() to WebKit2 GTK+ API
        https://bugs.webkit.org/show_bug.cgi?id=83016

        Reviewed by Martin Robinson.

        * platform/network/soup/CookieStorageSoup.cpp:
        (WebCore::soupCookiesChanged): Do not notify about changes in
        other cookie jars than the current one.

2012-07-12  Philip Rogers  <pdr@google.com>

        Refactor RenderSVGShape bounding box code
        https://bugs.webkit.org/show_bug.cgi?id=90655

        Reviewed by Nikolas Zimmermann.

        RenderSVGShape::objectBoundingBox worked differently than RenderSVGShape::strokeBoundingBox by
        not caching the object bounding box and instead computing it on each call. For consistency and
        performance objectBoundingBox has been refactored to return a cached value.

        createShape has been renamed updateShapeFromElement for understandability. updateShapeFromElement
        now updates the internal state of the shape (bounding boxes, etc) from the associated element.
        RenderSVGShape::inflateWithStrokeAndMarkerBounds has been merged into
        RenderSVGShape::calculateStrokeBoundingBox which is called from updateShapeFromElement.

        After this change all bounding box computation is now handled in updateShapeFromElement. Because
        subclasses override updateShapeFromElement it will be easy for them to have custom bounding box
        code there (as will happen for RenderSVGPath in a followup patch).

        strokeBoundingBox and objectBoundingBox are now able to return their cached values immediately
        in RenderSVGRect and RenderSVGEllipse instead of checking their fallback state on each call.

        Additionally, to save space RenderSVGEllipse and RenderSVGRect now use the m_fillBoundingBox and
        m_strokeBoundingBox of RenderSVGShape instead of having their own.

        This patch also removes setStrokeAndMarkerBoundingBox that was previously dead code.

        No new tests, just a refactoring.

        * rendering/svg/RenderSVGEllipse.cpp:
        (WebCore::RenderSVGEllipse::updateShapeFromElement):
        (WebCore):
        (WebCore::RenderSVGEllipse::fillShape):
        (WebCore::RenderSVGEllipse::strokeShape):
        (WebCore::RenderSVGEllipse::shapeDependentStrokeContains):
        * rendering/svg/RenderSVGEllipse.h:
        (RenderSVGEllipse):
        (WebCore::RenderSVGEllipse::isEmpty):
        * rendering/svg/RenderSVGRect.cpp:
        (WebCore::RenderSVGRect::updateShapeFromElement):
        (WebCore):
        (WebCore::RenderSVGRect::fillShape):
        (WebCore::RenderSVGRect::strokeShape):
        (WebCore::RenderSVGRect::shapeDependentStrokeContains):
        (WebCore::RenderSVGRect::shapeDependentFillContains):
        * rendering/svg/RenderSVGRect.h:
        (RenderSVGRect):
        (WebCore::RenderSVGRect::isEmpty):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::updateShapeFromElement):
        (WebCore):
        (WebCore::RenderSVGShape::layout):
        (WebCore::RenderSVGShape::calculateObjectBoundingBox):
        (WebCore::RenderSVGShape::calculateStrokeBoundingBox):
        (WebCore::RenderSVGShape::updateRepaintBoundingBox):
        * rendering/svg/RenderSVGShape.h:
        (RenderSVGShape):
        (WebCore::RenderSVGShape::objectBoundingBox):
        (WebCore::RenderSVGShape::strokeBoundingBox):

2012-07-12  Kent Tamura  <tkent@chromium.org>

        Do not save the form state signature if nothing is saved
        https://bugs.webkit.org/show_bug.cgi?id=91050

        Reviewed by Hajime Morita.

        This change will reduce the size of HistoyItem.

        Test: fast/forms/state-restore-empty-state.html

        * html/FormController.cpp:
        (WebCore::FormController::formElementsState):
        If stateVector has only the signature string, clear it.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        <http://webkit.org/b/91051> Fix the Qt Mac build after r122400.

        Qt on Mac builds with a deployment target of OS X 10.5. However, it was not been setting
        BUILDING_ON_LEOPARD / TARGETING_LEOPARD and thus was falling down code paths in DisplaySleepDisabler.cpp
        that were specific to Snow Leopard and newer. After the removal of BUILDING_ON_LEOPARD
        and TARGETING_LEOPARD it ended up falling down the correct Leopard-compatible code path,
        which revealed that the code made assumptions about which headers had already been included.

        * platform/mac/DisplaySleepDisabler.cpp: Include CoreServices/CoreServices.h to pull in
        a declaration of UpdateSystemActivity when targeting Leopard.

2012-07-11  Matt Falkenhagen  <falken@chromium.org>

        Add dialog element feature toggle to InternalSettings
        https://bugs.webkit.org/show_bug.cgi?id=90934

        Reviewed by Hajime Morita.

        This enables layout tests to be written for dialog although the feature is disabled by default.

        Tests: fast/dom/HTMLDialogElement/dialog-disabled.html
               fast/dom/HTMLDialogElement/dialog-enabled.html

        * WebCore.exp.in: Added newly exported symbol.
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup): Backup dialog feature flag.
        (WebCore::InternalSettings::Backup::restoreTo): Restore dialog feature flag.
        (WebCore::InternalSettings::setDialogElementEnabled): Added.
        (WebCore):
        * testing/InternalSettings.h: Added support for dialog.
        (Backup):
        (InternalSettings):
        * testing/InternalSettings.idl: Added support for dialog.

2012-07-11  Kent Tamura  <tkent@chromium.org>

        Accessing width or height of a detached image input element causes crash
        https://bugs.webkit.org/show_bug.cgi?id=90885

        Reviewed by Kentaro Hara.

        Test: fast/forms/image/width-and-height-of-detached-input.html

        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height): Add null check for m_imageLoader.
        (WebCore::ImageInputType::width): ditto.

2012-07-11  Kent Tamura  <tkent@chromium.org>

        Do not save state of stateless form controls
        https://bugs.webkit.org/show_bug.cgi?id=90964

        Reviewed by Hajime Morita.

        By Bug 89409, we started to store unmodified form control
        state. However we don't need to make such state for the following
        types.
        - password
        - submit
        - reset
        - button
        - keygen

        Test: fast/forms/state-restore-skip-stateless.html

        * html/BaseButtonInputType.cpp:
        (WebCore::BaseButtonInputType::shouldSaveAndRestoreFormControlState):
        Added. Disable saving state for submit, reset, and button types.
        * html/BaseButtonInputType.h:
        (BaseButtonInputType): Add shouldSaveAndRestoreFormControlState.
        * html/HTMLFormControlElementWithState.h:
        (HTMLFormControlElementWithState): Make shouldSaveAndRestoreFormControlState virtual.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::shouldSaveAndRestoreFormControlState):
        Added. Checks InputType::shouldSaveAndRestoreFormControlState first.
        * html/HTMLInputElement.h:
        (HTMLInputElement): Override shouldSaveAndRestoreFormControlState.
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::shouldSaveAndRestoreFormControlState)
        Added. Disable saving state for <keygen>.:
        * html/HTMLKeygenElement.h: Override shouldSaveAndRestoreFormControlState.
        * html/InputType.cpp:
        (WebCore::InputType::shouldSaveAndRestoreFormControlState):
        Added. Enable saving state for all types by default.
        * html/InputType.h:
        (InputType): Add shouldSaveAndRestoreFormControlState.
        * html/PasswordInputType.cpp:
        (WebCore::PasswordInputType::shouldSaveAndRestoreFormControlState):
        Added. Disabled saving state.
        (WebCore::PasswordInputType::saveFormControlState):
        Because shouldSaveAndRestoreFormControlState() returns false,
        saveFormControlState should be never called.
        * html/PasswordInputType.h:
        (PasswordInputType): Override shouldSaveAndRestoreFormControlState.

2012-07-11  No'am Rosenthal  <noam.rosenthal@nokia.com>

        Compilation error with GLES2 when using gl2ext.h from ANGLE.
        https://bugs.webkit.org/show_bug.cgi?id=91030

        Reviewed by Kenneth Russell.

        gl2ext.h defines PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMG and not
        PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMGPROC. This is a bug in the original Khronos header,
        but we should work around it until fixed headers are integrated.


        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        (Extensions3DOpenGLES):
            Removed the "PROC" suffix to work around the header bug.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        Attempt to fix the Chromium Mac build after r122400.

        * platform/text/cf/HyphenationCF.cpp: Ensure that Chromium only compiles the body of this file if
        building for a new enough version of OS X.

2012-07-11  Kent Tamura  <tkent@chromium.org>

        [Mac] Sort project.pbxproj

        * WebCore.xcodeproj/project.pbxproj: Apply Tools/Scripts/sort-Xcode-project-file

2012-07-11  Dan Bernstein  <mitz@apple.com>

        When a table row height grows because of pagination, not all cells’ heights are adjusted
        https://bugs.webkit.org/show_bug.cgi?id=91043

        Reviewed by Sam Weinig.

        The fix for in bug <http://webkit.org/b/83595> in <http://trac.webkit.org/r113738> made table
        rows grow as necessary to fit cells that grow as a result of pagination. But it had two bad
        side effects: earlier cells on the row would not grow by the same amount, and later cells on
        the row would factor the existing growth into their intrinsic padding.

        Test: fast/multicol/table-row-height-increase.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows): Now when a cell becomes taller than the row height,
        the additional height needed is recorded, and the cell is shrunk back to row height. Then
        after finishing the row, all cells occurring on the row (including cells spanning it but not
        starting on it) are grown by the same amount.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.

        Reviewed by Dan Bernstein.

        The deployment target is already set to the version that we're targeting, and it's that setting
        which determines which functionality from the SDK is available to us.

        * Configurations/Base.xcconfig:

2012-07-11  Mark Rowe  <mrowe@apple.com>

        Switch a few cases that care about the SDK over to checking __MAC_OS_X_VERSION_MAX_ALLOWED so that things build.

        Part of <http://webkit.org/b/91015> Remove BUILDING_ON / TARGETING macros in favor of system availability macros

        Reviewed by Filip Pizlo.

        * platform/graphics/cg/GraphicsContextCG.cpp: The SDK we're building against determines whether the constant is available.
        * platform/mac/EmptyProtocolDefinitions.h:  The SDK we're building against determines whether the protocols are declared.
        * platform/mac/NSScrollerImpDetails.h: The SDK we're building against determines whether the constants and method are
        available.
        * platform/mac/SharedTimerMac.mm: The SDK we're building against determines whether the function has already been declared.

2012-07-11  Mark Rowe  <mrowe@apple.com>

        <http://webkit.org/b/91015> Remove BUILDING_ON / TARGETING macros in favor of system availability macros

        This removal was handled by a script that translates the relevant macros in to the equivalent checks
        using the system availability macros.

        Reviewed by Filip Pizlo.

        * WebCore.exp.in:
        * accessibility/AccessibilityList.h:
        * accessibility/AccessibilityTable.h:
        * accessibility/mac/AXObjectCacheMac.mm:
        * editing/mac/EditorMac.mm:
        * loader/MainResourceLoader.cpp:
        * loader/MainResourceLoader.h:
        * page/AlternativeTextClient.h:
        * page/ContextMenuController.cpp:
        * page/mac/SettingsMac.mm:
        * platform/LocalizedStrings.cpp:
        * platform/MemoryPressureHandler.cpp:
        * platform/audio/mac/AudioBusMac.mm:
        * platform/graphics/Gradient.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
        * platform/graphics/ca/mac/TileCache.mm:
        * platform/graphics/cg/GraphicsContextCG.cpp:
        * platform/graphics/cg/ImageBufferCG.cpp:
        * platform/graphics/cg/ImageBufferDataCG.cpp:
        * platform/graphics/cg/ImageBufferDataCG.h:
        * platform/graphics/cg/ImageCG.cpp:
        * platform/graphics/cg/ImageSourceCG.cpp:
        * platform/graphics/cg/PathCG.cpp:
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/mac/ComplexTextController.cpp:
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        * platform/graphics/mac/FontCacheMac.mm:
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        * platform/graphics/mac/FontMac.mm:
        * platform/graphics/mac/GraphicsContextMac.mm:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        * platform/graphics/mac/SimpleFontDataMac.mm:
        * platform/graphics/mac/WebLayer.h:
        * platform/graphics/mac/WebLayer.mm:
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        * platform/mac/CursorMac.mm:
        * platform/mac/DisplaySleepDisabler.cpp:
        * platform/mac/DisplaySleepDisabler.h:
        * platform/mac/EmptyProtocolDefinitions.h:
        * platform/mac/HTMLConverter.h:
        * platform/mac/HTMLConverter.mm:
        * platform/mac/MemoryPressureHandlerMac.mm:
        * platform/mac/NSScrollerImpDetails.h:
        * platform/mac/PlatformEventFactoryMac.mm:
        * platform/mac/PopupMenuMac.mm:
        * platform/mac/ScrollAnimatorMac.mm:
        * platform/mac/ScrollElasticityController.mm:
        * platform/mac/SharedTimerMac.mm:
        * platform/mac/SuddenTermination.mm:
        * platform/mac/WebCoreFullScreenWindow.mm:
        * platform/mac/WebCoreNSCellExtras.h:
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        * platform/mac/WebFontCache.mm:
        * platform/mac/WebVideoFullscreenController.mm:
        * platform/mac/WebVideoFullscreenHUDWindowController.mm:
        * platform/network/Credential.h:
        * platform/network/ResourceHandle.h:
        * platform/network/cf/DNSCFNet.cpp:
        * platform/network/cf/ProxyServerCFNet.cpp:
        * platform/network/cf/ResourceRequest.h:
        * platform/network/cf/ResourceRequestCFNet.cpp:
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        * platform/network/mac/AuthenticationMac.mm:
        * platform/network/mac/CookieStorageMac.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * platform/network/mac/ResourceRequestMac.mm:
        * platform/network/mac/WebCoreURLResponse.mm:
        * platform/text/TextChecking.h:
        * platform/text/cf/HyphenationCF.cpp:
        * platform/text/mac/HyphenationMac.mm:
        * rendering/RenderLayerBacking.cpp:
        * rendering/RenderLayerCompositor.cpp:
        * rendering/RenderThemeMac.mm:

2012-07-11  Robert Kroeger  <rjkroege@chromium.org>

        Suppress horizontal conversion of PlatformWheelEvents when hasPreciseScrollingDeltas is true
        https://bugs.webkit.org/show_bug.cgi?id=89580

        WebKit GTK and Chromium Linux force vertical wheel events to
        scroll horizontally when over horizontal scroll bars.  This is
        undesirable for touchpad scrolling with
        hasPreciseScrollingDeltas() == true. Modified shouldTurnVerticalTicksIntoHorizontal
        to not perform this conversion for PlatformWheelEvents with preciseScrollingDeltas.

        Reviewed by Adam Barth.

        Tests: fast/events/touch/gesture/touch-gesture-scroll-sideways.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal): 
        (WebCore::EventHandler::handleWheelEvent):
        * page/EventHandler.h:
        (EventHandler):
        * page/chromium/EventHandlerChromium.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
        * page/gtk/EventHandlerGtk.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):

2012-07-11  Hayato Ito  <hayato@chromium.org>

        Unreviewed gardening.
        Build fix for r122373.

        * platform/chromium/support/WebCompositorSharedQuadState.cpp:
        (WebKit::WebCompositorSharedQuadState::WebCompositorSharedQuadState):

2012-07-11  Shinya Kawanaka  <shinyak@chromium.org> 

        SVGUseElement should not use Element::ensureShadowRoot().
        https://bugs.webkit.org/show_bug.cgi?id=90938

        Reviewed by Hajime Morita.

        We would like to remove Element::ensureShadowRoot() because we would like to stabilize the lifecycle of Shadow DOM.
        This patch rewrites SVGUseElement::create() not to use Element::ensureShadowRoot(). Since our convention to create
        a shadow subtree is to create a method createShadowSubtree(), I obeyed it.

        No new tests. Simple refactoring.

        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::create):
        (WebCore::SVGUseElement::createShadowSubtree):
        (WebCore):
        * svg/SVGUseElement.h:
        (SVGUseElement):

2012-07-11  Alexandre Elias  <aelias@google.com>

        [chromium] Move compositor quads to Platform/chromium/public
        https://bugs.webkit.org/show_bug.cgi?id=90582

        Reviewed by Adrienne Walker.

        This moves CCSharedQuadState, CCDrawQuad, and all but two CC*DrawQuad
        classes to the WebKit namespace, as a first step to pushing them
        across the process boundary for the ubercompositor.

        - The intent is to serialize the class hierarchy using the same
        mechanism as WebInputEvent.  In order to do this, there are three
        requirements: pure POD data, a method returning size, and a packing
        pragma.

        - Private data members are fine with this kind of serializer, and a
        default constructor is not needed.  Because of that, we can maintain
        the same encapsulation and convenient APIs (behind
        WEBKIT_IMPLEMENTATION) as the original classes.  To ease the
        transition, the original WebCore headers still exist and typedef to
        the new classes.

        - However, SharedQuadState will be serialized using the normal
        IPC_STRUCT_TRAITS macro, so I made its members public.  A custom
        serializer (on quad lists) will maintain the pointers from quads to
        SharedQuadStates.

        - I converted the Material casting mechanism to materialCast() methods
        living in the derived classes.  That way, the WebCompositorQuad header
        doesn't need to know about all its derived classes.

        - Quad classes not yet transitioned can still be used in
        non-ubercompositor mode.  CCRenderPassDrawQuad and CCYUVVideoDrawQuad
        are currently non-POD and I left them in their original files.

        This approach is the best I've found so far, since it preserves all
        WebCore-facing APIs and avoids unnecessary code duplication (new quad
        types or members can be added by modifying only one place).  There
        also should not be an unreasonable amount of custom serializer code
        required.

        No new tests. (No-op refactoring.)

        * WebCore.gypi:
        * platform/chromium/support/WebCompositorQuad.cpp: Added.
        (WebKit):
        (WebKit::WebCompositorQuad::WebCompositorQuad):
        (WebKit::WebCompositorQuad::opaqueRect):
        (WebKit::WebCompositorQuad::setQuadVisibleRect):
        (WebKit::WebCompositorQuad::size):
        * platform/chromium/support/WebCompositorSharedQuadState.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp.
        (WebKit):
        (WebKit::WebCompositorSharedQuadState::WebCompositorSharedQuadState):
        (WebKit::WebCompositorSharedQuadState::create):
        (WebKit::WebCompositorSharedQuadState::isLayerAxisAlignedIntRect):
        * platform/chromium/support/WebCompositorSolidColorQuad.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp.
        (WebKit):
        (WebKit::WebCompositorSolidColorQuad::create):
        (WebKit::WebCompositorSolidColorQuad::WebCompositorSolidColorQuad):
        (WebKit::WebCompositorSolidColorQuad::materialCast):
        * platform/chromium/support/WebCompositorTextureQuad.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.cpp.
        (WebKit):
        (WebKit::WebCompositorTextureQuad::create):
        (WebKit::WebCompositorTextureQuad::WebCompositorTextureQuad):
        (WebKit::WebCompositorTextureQuad::setNeedsBlending):
        (WebKit::WebCompositorTextureQuad::materialCast):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawQuad):
        * platform/graphics/chromium/LayerRendererChromium.h:
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp:
        (WebCore::CCCheckerboardDrawQuad::create):
        (WebCore::CCCheckerboardDrawQuad::CCCheckerboardDrawQuad):
        (WebCore::CCCheckerboardDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h:
        (CCCheckerboardDrawQuad):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp:
        (WebCore::CCDebugBorderDrawQuad::create):
        (WebCore::CCDebugBorderDrawQuad::CCDebugBorderDrawQuad):
        (WebCore::CCDebugBorderDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
        (CCDebugBorderDrawQuad):
        * platform/graphics/chromium/cc/CCDrawQuad.cpp: Removed.
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp:
        (WebCore::CCIOSurfaceDrawQuad::create):
        (WebCore::CCIOSurfaceDrawQuad::CCIOSurfaceDrawQuad):
        (WebCore::CCIOSurfaceDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h:
        (CCIOSurfaceDrawQuad):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPass.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderSurface.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp:
        (WebCore::CCStreamVideoDrawQuad::create):
        (WebCore::CCStreamVideoDrawQuad::CCStreamVideoDrawQuad):
        (WebCore::CCStreamVideoDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h:
        (CCStreamVideoDrawQuad):
        * platform/graphics/chromium/cc/CCTextureDrawQuad.h:
        (WebCore):
        * platform/graphics/chromium/cc/CCTileDrawQuad.cpp:
        (WebCore::CCTileDrawQuad::create):
        (WebCore::CCTileDrawQuad::CCTileDrawQuad):
        (WebCore::CCTileDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCTileDrawQuad.h:
        (CCTileDrawQuad):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp:
        (WebCore::CCYUVVideoDrawQuad::create):
        (WebCore::CCYUVVideoDrawQuad::CCYUVVideoDrawQuad):
        (WebCore::CCYUVVideoDrawQuad::materialCast):
        (WebCore):
        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h:
        (CCYUVVideoDrawQuad):

2012-07-11  Robert Kroeger  <rjkroege@chromium.org>

        [chromium] [regression] Don't use ScrollByPrecisePixels on Chromium Mac.
        https://bugs.webkit.org/show_bug.cgi?id=91020

        Reviewed by Adam Barth.

        A change in https://bugs.webkit.org/show_bug.cgi?id=87535 to
        improve the operation of smooth scrolling incorrectly caused
        Chromium Mac to use the wrong scroll granularity on
        hasPreciseScrollingDeltas() == true wheelevent scrolls.
        Exclude the change on the Chromium Mac platform.

        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::handleWheelEvent): Adjusted #ifdef to exclude Chromium
        Mac from ScrollByPrecisePixels change.

2012-07-11  Jia Pu  <jpu@apple.com>

        On Mac, autocorrection sometimes fails to take place in Safari.
        https://bugs.webkit.org/show_bug.cgi?id=89982

        Reviewed by Ryosuke Niwa.

        We should check the value of shouldCheckForCorrection, not shouldShowCorrectionPanel, to determine if we should
        early return in markAndReplaceFor(). Also, since we don't want autocorrection to happen when we only change selection,
        not the content, so we shouldn't set TextCheckingTypeCorrection flag in markMisspellingsAndBadGrammar() as this function
        is triggered only by selection change.

        * editing/Editor.cpp:
        (WebCore::Editor::markAndReplaceFor):
        (WebCore::Editor::markMisspellingsAndBadGrammar):

2012-07-11  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r122361.
        http://trac.webkit.org/changeset/122361
        https://bugs.webkit.org/show_bug.cgi?id=91027

        Broke Windows build and fast/forms/state-restore-broken-
        state.html (Requested by rniwa on #webkit).

        * testing/Internals.idl:

2012-07-10  Simon Fraser  <simon.fraser@apple.com>

        Assertion ASSERTION FAILED: enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()) when compositing in paginated mode
        https://bugs.webkit.org/show_bug.cgi?id=90919

        Reviewed by Antti Koivisto.

        r121124 added a fast path for geometry mapping that goes via layers
        when possible. However, this broke paginated pages, which put
        the root (RenderView) layer into column mode, because it failed
        to check for columns on the ancestor layer.
        
        Rather than make a risky change to convertToLayerCoords(), add a local
        function canMapViaLayer(), which is like RenderLayer::canUseConvertToLayerCoords(),
        but doesn't check for compositing (compositing itself is not a reason
        to avoid convertToLayerCoords). Call canMapViaLayer() with the ancestorLayer
        to check whether the ancestor has columns, which fixes the bug.

        Test: compositing/columns/geometry-map-paginated-assert.html

        * rendering/RenderGeometryMap.cpp:
        (WebCore::canMapViaLayer):
        (WebCore::RenderGeometryMap::pushMappingsToAncestor):

2012-07-11  Dana Jansens  <danakj@chromium.org>

        [chromium] Rename layerRect to contentRect for rects that live in content space
        https://bugs.webkit.org/show_bug.cgi?id=90843

        Reviewed by Adrienne Walker.

        Dropped the layerTransform() from CCSharedQuadState, as nothing should be
        using it to draw with. RenderPasses need a weird drawTransform right now
        which was stored in layerTransform, so moved this to the RenderPass quad.

        No new tests. No change in behaviour.

        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
        (WebCore::CanvasLayerTextureUpdater::paintContents):
        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerChromium::update):
        (WebCore::ContentLayerChromium::needMoreUpdates):
        * platform/graphics/chromium/ImageLayerChromium.cpp:
        (WebCore::ImageLayerChromium::update):
        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::visibleContentOpaqueRegion):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::visibleContentRect):
        (WebCore::LayerChromium::setVisibleContentRect):
        (LayerChromium):
        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawRenderPassQuad):
        (WebCore::LayerRendererChromium::drawTileQuad):
        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
        (WebCore::LayerRendererChromium::drawIOSurfaceQuad):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::TiledLayerChromium::updateBounds):
        (WebCore::TiledLayerChromium::setNeedsDisplayRect):
        (WebCore::TiledLayerChromium::invalidateContentRect):
        (WebCore::TiledLayerChromium::updateTiles):
        (WebCore::TiledLayerChromium::setTexturePriorities):
        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
        (WebCore::TiledLayerChromium::visibleContentOpaqueRegion):
        (WebCore::TiledLayerChromium::updateContentRect):
        (WebCore::TiledLayerChromium::needsIdlePaint):
        (WebCore::TiledLayerChromium::idlePaintRect):
        * platform/graphics/chromium/TiledLayerChromium.h:
        (TiledLayerChromium):
        * platform/graphics/chromium/cc/CCDrawQuad.h:
        (WebCore::CCDrawQuad::visibleContentRect):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::createSharedQuadState):
        (WebCore::CCLayerImpl::appendDebugBorderQuad):
        (WebCore::CCLayerImpl::visibleContentOpaqueRegion):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::visibleContentRect):
        (WebCore::CCLayerImpl::setVisibleContentRect):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
        (WebCore::CCLayerTilingData::contentRectToTileIndices):
        (WebCore::CCLayerTilingData::opaqueRegionInContentRect):
        (WebCore::CCLayerTilingData::setBounds):
        * platform/graphics/chromium/cc/CCLayerTilingData.h:
        (CCLayerTilingData):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleContentRect):
        (WebCore::layerShouldBeSkipped):
        (WebCore):
        (WebCore::calculateVisibleAndScissorRectsInternal):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
        (WebCore::addOcclusionBehindLayer):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
        (WebCore::CCRenderPassDrawQuad::create):
        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
        (CCRenderPassDrawQuad):
        (WebCore::CCRenderPassDrawQuad::drawTransform):
        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
        (WebCore::CCRenderSurface::createSharedQuadState):
        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
        (WebCore::CCRenderSurface::appendQuads):
        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
        (WebCore::CCSharedQuadState::create):
        (WebCore::CCSharedQuadState::CCSharedQuadState):
        (WebCore::CCSharedQuadState::isLayerAxisAlignedIntRect):
        * platform/graphics/chromium/cc/CCSharedQuadState.h:
        (CCSharedQuadState):
        (WebCore::CCSharedQuadState::visibleContentRect):
        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
        (WebCore::CCTiledLayerImpl::appendQuads):
        (WebCore::CCTiledLayerImpl::visibleContentOpaqueRegion):

2012-07-11  Chris Fleizach  <cfleizach@apple.com>

        ARIA spinbutton role incorrectly mapped to ProgressIndicatorRole
        https://bugs.webkit.org/show_bug.cgi?id=77298

        Reviewed by Anders Carlsson.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::createARIARoleMap):

2012-07-11  Huang Dongsung  <luxtella@company100.net>

        BitmapImage::frameIsCompleteAtIndex() must return false if ImageDecoder is not initialized.
        https://bugs.webkit.org/show_bug.cgi?id=90757

        Reviewed by Simon Fraser.

        The current code fortunately has worked so far because only
        BitmapImage::startAnimation calls frameIsCompleteAtIndex, and startAnimation
        cannot call frameIsCompleteAtIndex if ImageDecoder is not yet initialized.
        startAnimation returns at the first line becase shouldAnimate() always return
        false in this case.

            if (m_frameTimer || !shouldAnimate() || frameCount() <= 1)
                return;

        This change is needed because parallel image decoders call
        BitmapImage::frameIsCompleteAtIndex in other places too.

        No new tests, manually tested whether the caller exists or not that
        calls BitmapImage::frameIsCompleteAtIndex() before ImageDecoder is
        initialized.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::frameIsCompleteAtIndex):

2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Update code to use the new constant name.
        
        * platform/wx/PasteboardWx.cpp:
        (WebCore::Pasteboard::documentFragment):

2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Ignore array and sequence types for attributes as well
        as functions since the CPP bindings do not yet support them.

        * bindings/scripts/CodeGeneratorCPP.pm:
        (SkipAttribute):

2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Use DOMStringList instead of DOMString[] for in / out type.

        * testing/Internals.idl:

2012-07-11  Dana Jansens  <danakj@chromium.org>

        [chromium] Minimum size used for occlusion tracking should be a setting on CCLayerTreeHost
        https://bugs.webkit.org/show_bug.cgi?id=90993

        Reviewed by Adrienne Walker.

        Move the default minimum size used for occlusion tracking from the
        CCOcclusionTracker class into CCLayerTreeSettings. This value is then
        used on both threads as the lower limit for any occlusion to be
        remembered.

        This allows us to use (0, 0) as the minimum size for tests, allowing all
        occlusion to be tracked.

        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::paintLayerContents):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
        (CCLayerTreeSettings):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
        * platform/graphics/chromium/cc/CCOcclusionTracker.h:

2012-07-11  Anders Carlsson  <andersca@apple.com>

        Add -Wtautological-compare and -Wsign-compare warning flags
        https://bugs.webkit.org/show_bug.cgi?id=90994

        Reviewed by Mark Rowe.

        * Configurations/Base.xcconfig:

2012-07-11  Dean Jackson  <dino@apple.com>

        TileCache layers have wrong border debug color
        https://bugs.webkit.org/show_bug.cgi?id=90922

        Reviewed by Simon Fraser.

        Commit r122152 updated the layer hierarchy when a tile