[HTMLTemplateElement] <template> should be able to be a foster parent

[WebKit-https.git] / Source / WebCore / ChangeLog

2013-03-28  Rafael Weinstein  <rafaelw@chromium.org>

        [HTMLTemplateElement] <template> should be able to be a foster parent
        https://bugs.webkit.org/show_bug.cgi?id=113541

        Reviewed by Eric Seidel

        This adds to the check in findFosterSite to include whether the parent is a DocumentFragment which is a template contents.

        Tests added to html5lib suite.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::findFosterSite):

2013-03-28  Xianzhu Wang  <wangxianzhu@chromium.org>

        [Chromium] Don't create SolidColorLayer for full transparent background
        https://bugs.webkit.org/show_bug.cgi?id=113524

        Reviewed by James Robinson.

        Test: GraphicsLayerChromiumTest.setContentsToSolidColor

        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
        (WebCore::GraphicsLayerChromium::setContentsToSolidColor):

2013-03-28  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        use XMLHttpRequestResponseType enumeration in XMLHttpRequest.idl
        https://bugs.webkit.org/show_bug.cgi?id=113518

        Reviewed by Kentaro Hara.

        Use enum XMLHttpRequestResponseType type instead of DOMString for
        XMLHttpRequest responseType.

        Argument validation now happens in the bindings. 
        XMLHttpRequest::setResponseType should then never receive invalid
        arguments. So, replace console message with ASSERT_NOT_REACHED();

        Test: fast/xmlhttprequest/xmlhttprequest-set-responsetype.html

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::setResponseType):
        * xml/XMLHttpRequest.idl:

2013-03-28  Lamarque V. Souza  <Lamarque.Souza@basyskom.com>

        [css3-text] Add platform support for "wavy" text decoration style
        https://bugs.webkit.org/show_bug.cgi?id=92868

        Reviewed by Benjamin Poulain.

        This patch uses GraphicsContext::strokePath() to implement
        wavy decoration for the CSS3 property "text-decoration-style".

        No new tests as this is covered with existing tests.

        * rendering/InlineTextBox.cpp:
        (WebCore::textDecorationStyleToStrokeStyle): Remove obsolete comment.
        (WebCore::adjustStepToDecorationLength): Add function to adjust
        variables used to calculate the lenght of Bezier curves.
        (WebCore::strokeWavyTextDecoration): Add function to stroke wavy
        decoration based on cubic Bezier curve.
        (WebCore::InlineTextBox::paintDecoration): Call
        strokeWavyTextDecoration when necessary.

2013-03-28  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        REGRESSION(r147149): breaks binding test on Mac. (Requested by mlam_ on #webkit).
        https://bugs.webkit.org/show_bug.cgi?id=113538

        Reviewed by Simon Fraser.

        Run run-bindings-tests --reset-results to fix broken tests after
        r147149.

        * bindings/scripts/test/V8/V8TestInterface.cpp:
        (WebCore::TestInterfaceV8Internal::supplementalNodeAttrSetter):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::shortAttrAttrSetter):
        (WebCore::TestObjV8Internal::unsignedShortAttrAttrSetter):
        (WebCore::TestObjV8Internal::longAttrAttrSetter):
        (WebCore::TestObjV8Internal::longLongAttrAttrSetter):
        (WebCore::TestObjV8Internal::unsignedLongLongAttrAttrSetter):
        (WebCore::TestObjV8Internal::testObjAttrAttrSetter):
        (WebCore::TestObjV8Internal::XMLObjAttrAttrSetter):
        (WebCore::TestObjV8Internal::createAttrSetter):
        (WebCore::TestObjV8Internal::reflectedIntegralAttrAttrSetter):
        (WebCore::TestObjV8Internal::reflectedUnsignedIntegralAttrAttrSetter):
        (WebCore::TestObjV8Internal::reflectedBooleanAttrAttrSetter):
        (WebCore::TestObjV8Internal::reflectedCustomIntegralAttrAttrSetter):
        (WebCore::TestObjV8Internal::reflectedCustomBooleanAttrAttrSetter):
        (WebCore::TestObjV8Internal::typedArrayAttrAttrSetter):
        (WebCore::TestObjV8Internal::attrWithGetterExceptionAttrSetter):
        (WebCore::TestObjV8Internal::attrWithSetterExceptionAttrSetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeAttrSetter):
        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter):
        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter):
        (WebCore::TestObjV8Internal::withScriptArgumentsAndCallStackAttributeAttrSetter):
        (WebCore::TestObjV8Internal::conditionalAttr1AttrSetter):
        (WebCore::TestObjV8Internal::conditionalAttr2AttrSetter):
        (WebCore::TestObjV8Internal::conditionalAttr3AttrSetter):
        (WebCore::TestObjV8Internal::anyAttributeAttrSetter):
        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr1AttrSetter):
        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr2AttrSetter):
        (WebCore::TestObjV8Internal::enabledPerContextAttr1AttrSetter):
        (WebCore::TestObjV8Internal::enabledPerContextAttr2AttrSetter):
        (WebCore::TestObjV8Internal::floatArrayAttrSetter):
        (WebCore::TestObjV8Internal::doubleArrayAttrSetter):
        (WebCore::TestObjV8Internal::mutablePointAttrSetter):
        (WebCore::TestObjV8Internal::immutablePointAttrSetter):
        (WebCore::TestObjV8Internal::strawberryAttrSetter):
        (WebCore::TestObjV8Internal::strictFloatAttrSetter):
        (WebCore::TestObjV8Internal::idAttrSetter):
        (WebCore::TestObjV8Internal::nullableLongSettableAttributeAttrSetter):
        (WebCore::TestObjV8Internal::nullableStringValueAttrSetter):
        (WebCore::TestObjV8Internal::perWorldAttributeAttrSetter):
        (WebCore::TestObjV8Internal::perWorldAttributeAttrSetterForMainWorld):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::valueAttrSetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrSetter):
        * bindings/scripts/test/V8/V8TestTypedefs.cpp:
        (WebCore::TestTypedefsV8Internal::unsignedLongLongAttrAttrSetter):
        (WebCore::TestTypedefsV8Internal::immutableSerializedScriptValueAttrSetter):
        (WebCore::TestTypedefsV8Internal::attrWithGetterExceptionAttrSetter):
        (WebCore::TestTypedefsV8Internal::attrWithSetterExceptionAttrSetter):

2013-03-28  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r147130.
        http://trac.webkit.org/changeset/147130
        https://bugs.webkit.org/show_bug.cgi?id=113539

        Not needed now that we do not sleep in preprocessor.pm
        (Requested by jamesr on #webkit).

        * WebCore.gyp/WebCore.gyp:
        * bindings/scripts/CodeGenerator.pm:
        (ParseInterface):
        * bindings/scripts/IDLParser.pm:
        (Parse):
        * bindings/scripts/generate-bindings.pl:
        * bindings/scripts/generate-preprocessed-idls.pl: Removed.
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):

2013-03-28  Nate Chapin  <japhet@chromium.org>

        Don't grant local content permissions for appcache loads.
        https://bugs.webkit.org/show_bug.cgi?id=112542

        Reviewed by Antti Koivisto.

        No new tests, fixing http/tests/appcache/local-content.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::DocumentLoader):
        (WebCore::DocumentLoader::commitData): Don't grant local load permissions
            to all SubstituteData loads, only give them to loads that were SubstituteData
            loads at the time of DocumentLoader construction. This constitutes all
            SubstituteData loads except those triggered by appcache.
        * loader/DocumentLoader.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::didBeginDocument): Move granting local load
            permissions for SubstituteData loads to DocumentLoader::commitData().

2013-03-28  Mike West  <mkwst@chromium.org>

        X-Frame-Options: Blocked resources should fire load events.
        https://bugs.webkit.org/show_bug.cgi?id=113192

        Reviewed by Nate Chapin.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::responseReceived):
            Fire a load event on the frame's owner element when denying access
            due to X-Frame-Options header content. This brings us in-line with
            Gecko and IE, which both trigger load events currently.

2013-03-28  Tien-Ren Chen  <trchen@chromium.org>

        Support bottom-right anchored fixed-position elements during a pinch gesture
        https://bugs.webkit.org/show_bug.cgi?id=111670

        Reviewed by James Robinson.

        This patch adds support to bottom-right fixed-position elements by
        introducing WebLayerPositionConstraint to WebLayer.

        No new tests. Can't test until chromium patch landed.

        * page/scrolling/ScrollingCoordinator.h:
        (WebCore::ScrollingCoordinator::updateLayerPositionConstraint):
        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
        (WebCore::clearPositionConstraintExceptForLayer):
        (WebCore):
        (WebCore::computePositionConstraint):
        (WebCore::ScrollingCoordinatorChromium::updateLayerPositionConstraint):
        * page/scrolling/chromium/ScrollingCoordinatorChromium.h:
        (ScrollingCoordinatorChromium):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::registerScrollingLayers):
        * rendering/RenderLayerBacking.h:
        (WebCore::RenderLayerBacking::contentsContainmentLayer):
        (RenderLayerBacking):
        * rendering/RenderLayerCompositor.cpp:
        * rendering/RenderLayerCompositor.h:

2013-03-28  James Robinson  <jamesr@chromium.org>

        Remove unnecessary 1 second sleep on windows from preprocessor.pm
        https://bugs.webkit.org/show_bug.cgi?id=113536

        Unreviewed, partial rollout of r146661.

        This rolls out one line of 146661 that slows down the windows build significantly.

        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):

2013-03-28  Levi Weintraub  <leviw@chromium.org>

        Enable font measurement optimization for Chromium-mac when there are no font-feature-settings.

        Enable measure-once optimization on Chromium-Mac
        https://bugs.webkit.org/show_bug.cgi?id=113243

        Reviewed by Eric Seidel.

        Bugs in Chromium-mac's -webkit-font-feature-settings support prevented us from enabling the
        optimization when it was enabled for all other platforms. This was believed to be related to
        kerning, but the bug shows up when there are any font-feature-settings specified. For now,
        optimizing the common case and only turning off the optimization when there are font-feature-
        settings in play.

        Updated test fast/text/shaping/shaping-selection-rect.html to avoid breaking due to
        https://bugs.webkit.org/show_bug.cgi?id=113418

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::setLogicalWidthForTextRun):

2013-03-28  Zoltan Horvath  <zoltan@webkit.org>

        [CSS Exclusions][CSS Regions] Block children do not layout inline content correctly in a region with shape-inside set
        https://bugs.webkit.org/show_bug.cgi?id=112177

        Reviewed by David Hyatt.

        When we had two multiple regions and a shape-inside was applied on the second region, but not on the first region and the content contained
        paragraphs, the content was pushed down almost to the bottom in the second region. In a flow thread this behavior caused by the lack of the 
        proper updating of absoluteLogicalTop in RenderBlock::layoutRunsAndFloatsInRange function.

        Tests: fast/regions/shape-inside/shape-inside-on-additional-regions.html
               fast/regions/shape-inside/shape-inside-on-regions.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutRunsAndFloatsInRange): Update the value of absoluteLogicalTop in every run when we are in a flow thread.

2013-03-28  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        exceptions are not checked after toInt32 calls in bindings.
        https://bugs.webkit.org/show_bug.cgi?id=113218

        Reviewed by Kentaro Hara.

        In attribute setter, wrap JSValue to native value conversion in a try
        catch block.

        Define a new macro binding: V8TRYCATCH_VOID

        No new tests: covered by fast/dom/exception-in-binding.html

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrSetter):
        * bindings/v8/V8BindingMacros.h:
        (WebCore):

2013-03-28  ChangSeok Oh  <changseok.oh@collabora.com>

        [GTK][AC] Use transform property of ClutterActor
        https://bugs.webkit.org/show_bug.cgi?id=113317

        Reviewed by Gustavo Noronha Silva.

        ClutterActor has a transform property to set transformation matrix directly
        since version 1.12. So we don't need to keep and use the matrix property of GraphicsLayerActor.

        No new tests because of no functionality change.

        * platform/graphics/clutter/GraphicsLayerActor.cpp:
        (_GraphicsLayerActorPrivate):
        (graphicsLayerActorDispose):
        (graphicsLayerActorApplyTransform):
        * platform/graphics/clutter/GraphicsLayerActor.h:
        * platform/graphics/clutter/GraphicsLayerClutter.cpp:
        (WebCore::GraphicsLayerClutter::updateTransform):
        * platform/graphics/clutter/PlatformClutterAnimation.cpp:
        (WebCore::PlatformClutterAnimation::addTransformTransition):

2013-03-28  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r143834.
        http://trac.webkit.org/changeset/143834
        https://bugs.webkit.org/show_bug.cgi?id=113530

        Multiple use-after-free regressions on ClusterFuzz (Requested
        by inferno-sec on #webkit).

        * dom/Attr.cpp:
        (WebCore::Attr::Attr):
        (WebCore::Attr::setValue):
        (WebCore::Attr::childrenChanged):
        * dom/Attr.h:
        (Attr):
        * dom/Element.cpp:
        (WebCore::Element::setAttributeInternal):
        * dom/Element.h:
        (Element):

2013-03-28  Julien Chaffraix  <jchaffraix@webkit.org>

        [CSS Grid Layout] Before / start paddings and borders are not accounted for when placing the grid items
        https://bugs.webkit.org/show_bug.cgi?id=113351

        Reviewed by Tony Chang.

        Tests: fast/css-grid-layout/grid-element-border-grid-item.html
               fast/css-grid-layout/grid-element-border-padding-grid-item.html
               fast/css-grid-layout/grid-element-padding-grid-item.html

        * rendering/RenderBoxModelObject.h:
        (WebCore::RenderBoxModelObject::borderAndPaddingBefore):
        Added this helper function (we do have borderAndPaddingStart but didn't have this
        one for some reason).

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::findChildLogicalPosition):
        Shifted |offset| by the paddings and borders before / start.

2013-03-28  Zan Dobersek  <zdobersek@igalia.com>

        [GTK] Build GTK-specific, non-layer-violating source code into WebCore-independent libPlatformGtk.la
        https://bugs.webkit.org/show_bug.cgi?id=112546

        Reviewed by Martin Robinson.

        No new tests - no new functionality.

        * GNUmakefile.am: Passing the DATA_DIR value through the cppflags is not required anymore as the affected source is now
        built into libPlatformGtk.la.
        * GNUmakefile.list.am: Build the GTK-specific source files that are already independent of WebCore into the
        libPlatformGtk.la by assigning the build targets listing to the platformgtk_sources variable.
        * platform/gtk/GtkVersioning.c: Renamed from Source/Platform/gtk/GtkVersioning.c.
        * platform/gtk/GtkVersioning.h: Renamed from Source/Platform/gtk/GtkVersioning.h.

2013-03-28  Matt Falkenhagen  <falken@chromium.org>

        Refactoring: Replace Element::disabled and isEnabledFormControl with isDisabledFormControl
        https://bugs.webkit.org/show_bug.cgi?id=113273

        Reviewed by Kent Tamura.

        Element::disabled is about form controls and Element::isEnabledFormControl
        is redundant with it, so replace them with a single function
        Element::isDisabledFormControl.

        No new tests, there should be no behavior change.

        * accessibility/AccessibilityListBox.cpp:
        (WebCore::AccessibilityListBox::canSetSelectedChildrenAttribute):
        * accessibility/AccessibilityListBoxOption.cpp:
        (WebCore::AccessibilityListBoxOption::canSetSelectedAttribute):
        * accessibility/AccessibilityMenuList.cpp:
        (WebCore::AccessibilityMenuList::canSetFocusAttribute):
        * accessibility/AccessibilityMenuListOption.cpp:
        (WebCore::AccessibilityMenuListOption::isEnabled):
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::isEnabled):
        (WebCore::AccessibilityNodeObject::actionElement):
        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::canShareStyleWithControl):
        * dom/Element.cpp:
        (WebCore::Element::isDisabledFormControl):
        * dom/Element.h:
        (Element):
        (WebCore::isDisabledFormControl): Add helper function for convenience.
        (WebCore):
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchSimulatedClick):
        * dom/GestureEvent.cpp:
        (WebCore::GestureEventDispatchMediator::dispatchEvent):
        * dom/MouseEvent.cpp:
        (WebCore::MouseEventDispatchMediator::dispatchEvent):
        * dom/Node.cpp:
        (WebCore::Node::handleLocalEvents):
        (WebCore::Node::willRespondToMouseMoveEvents):
        (WebCore::Node::willRespondToMouseClickEvents):
        (WebCore::Node::willRespondToTouchEvents):
        * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
        (WebCore::BaseMultipleFieldsDateAndTimeInputType::isEditControlOwnerDisabled):
        * html/DOMFormData.cpp:
        (WebCore::DOMFormData::DOMFormData):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::handleDOMActivateEvent):
        (WebCore::FileInputType::disabledAttributeChanged):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::defaultEventHandler):
        (WebCore::HTMLButtonElement::willRespondToMouseClickEvents):
        (WebCore::HTMLButtonElement::isSuccessfulSubmitButton):
        * html/HTMLCollection.cpp:
        (WebCore::isMatchingElement):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::updateAncestorDisabledState):
        (WebCore::HTMLFormControlElement::isDisabledFormControl):
        (WebCore::HTMLFormControlElement::supportsFocus):
        * html/HTMLFormControlElement.h:
        (HTMLFormControlElement):
        (WebCore::HTMLFormControlElement::isDisabledOrReadOnly):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isSuccessfulSubmitButton):
        (WebCore::HTMLInputElement::willRespondToMouseClickEvents):
        * html/HTMLOptGroupElement.cpp:
        (WebCore::HTMLOptGroupElement::isDisabledFormControl):
        * html/HTMLOptGroupElement.h:
        (HTMLOptGroupElement):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::isDisabledFormControl):
        * html/HTMLOptionElement.h:
        (HTMLOptionElement):
        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::willRespondToMouseClickEvents):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::nextValidIndex):
        (WebCore::HTMLSelectElement::updateListBoxSelection):
        (WebCore::HTMLSelectElement::recalcListItems):
        (WebCore::HTMLSelectElement::appendFormData):
        (WebCore::HTMLSelectElement::updateSelectedState):
        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
        (WebCore::HTMLSelectElement::defaultEventHandler):
        (WebCore::HTMLSelectElement::optionAtIndex):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::handleDOMActivateEvent):
        * html/ResetInputType.cpp:
        (WebCore::ResetInputType::handleDOMActivateEvent):
        * html/SubmitInputType.cpp:
        (WebCore::SubmitInputType::handleDOMActivateEvent):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::isDisabledFormControl):
        (WebCore::SliderThumbElement::defaultEventHandler):
        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents):
        (WebCore::SliderThumbElement::willRespondToMouseClickEvents):
        * html/shadow/SliderThumbElement.h:
        (SliderThumbElement):
        * html/shadow/SpinButtonElement.h:
        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::TextFieldDecorationElement::updateImage):
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create):
        * page/DragController.cpp:
        (WebCore::DragController::tryDocumentDrag):
        (WebCore::DragController::concludeEditDrag):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::addFocusRingRects):
        (WebCore::RenderListBox::paintItemForeground):
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::itemIsEnabled):
        * rendering/RenderTextControl.cpp:
        (WebCore::updateUserModifyProperty):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::isEnabled):
        * rendering/RenderThemeMac.mm:
        (WebCore::getMediaUIPartStateFlags):
        * rendering/RenderThemeMacShared.mm:
        (WebCore::RenderThemeMacShared::adjustMenuListStyle):
        (WebCore::RenderThemeMacShared::paintSearchFieldCancelButton):
        * rendering/RenderThemeSafari.cpp:
        (WebCore::RenderThemeSafari::adjustMenuListStyle):

2013-03-28  Brady Eidson  <beidson@apple.com>

        Remove workaround for <rdar://problem/5321972>.
        <rdar://problem/12022862> and https://bugs.webkit.org/show_bug.cgi?id=113516

        Reviewed by Sam Weinig.

        No new tests (No point in testing the removal of bizarre behavior).

        * platform/network/mac/WebCoreURLResponse.mm:
        (WebCore::adjustMIMETypeIfNecessary): This workaround isn't needed on Lion+

2013-03-28  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        use CanvasWindingRule enumeration in CanvasRenderingContext2D.idl
        https://bugs.webkit.org/show_bug.cgi?id=113456

        Reviewed by Kentaro Hara.

        Use enum CanvasWindingRule type instead of DOMString for winding
        arguments when needed. Changed methods are: fill, stroke and isPointInPath.

        Test: fast/canvas/winding-enumeration.html

        * html/canvas/CanvasRenderingContext2D.idl:

2013-03-28  Scott Graham  <scottmg@chromium.org>

        Move preprocessing of idl to pre-pass for gyp
        https://bugs.webkit.org/show_bug.cgi?id=113448

        Reviewed by Tony Chang.

        Moves the preprocessor invocations when parsing IDL files to a
        pre-pass to avoid reinvocations when IDLs are referenced from others.
        This reduces the number of invocations of the preprocessor from 20071
        to 633, which reduces the runtime from 12m30 to 1m (on a Windows box).

        No new tests, this is a build time improvement, and shouldn't have any
        visible effect.

        * WebCore.gyp/WebCore.gyp:
        * bindings/scripts/CodeGenerator.pm:
        (ParseInterface):
        * bindings/scripts/IDLParser.pm:
        (Parse):
        * bindings/scripts/generate-bindings.pl:
        * bindings/scripts/generate-preprocessed-idls.pl: Added.
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):

2013-03-28  Alok Priyadarshi  <alokp@chromium.org>

        RenderBox::backgroundIsKnownToBeOpaqueInRect may be wrong for theme-painted elements
        https://bugs.webkit.org/show_bug.cgi?id=113419

        Reviewed by Simon Fraser.

        Do not consider control elements as opaque. They are typically theme painted, and we cannot assume opaqueness on the behalf of theme. It can be improved by asking the theme if it paints opaque.

        Test: compositing/contents-opaque/control-layer.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::backgroundIsKnownToBeOpaqueInRect):

2013-03-28  ChangSeok Oh  <changseok.oh@collabora.com>

        [GTK][AC] Animating layer disappears while running with clutter backend
        https://bugs.webkit.org/show_bug.cgi?id=110470

        Reviewed by Gustavo Noronha Silva.

        The reason of this issue is that clutter_actor_remove_child leads to stopping animations
        of child actor. ClutterActor's animation could be defined only when it has a parent actor.
        So we should avoid the case calling the api as much as we can. At least we don't
        need to reset a actor's parent at all if the current parent is same with new one.
        If we can't avoid invoking clutter_actor_remove_child for an animating actor, we may apply
        a more complicated way to keep the animation. But I haven't faced such a case yet.

        Covered by existing animation tests.

        * platform/graphics/clutter/GraphicsLayerActor.cpp:
        (graphicsLayerActorSetSublayers):
        * platform/graphics/clutter/GraphicsLayerClutter.cpp:
        (WebCore::GraphicsLayerClutter::recursiveCommitChanges):
        (WebCore::GraphicsLayerClutter::updateSublayerList):

2013-03-28  Xianzhu Wang  <wangxianzhu@chromium.org>

        Non-painting fixed elements should not cause repaints on scroll
        https://bugs.webkit.org/show_bug.cgi?id=110430

        Reviewed by Simon Fraser.

        Test: compositing/repaint/scroll-fixed-layer-no-content.html
        Test: compositing/repaint/scroll-fixed-layer-out-of-view.html

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsFastPath): Check for no-content and out-of-view flag set by RLC.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition): Moved the check for no-content above out-of-view because it's faster.

2013-03-28  Alexander Pavlov  <apavlov@chromium.org>

        Unreviewed, revert accidentally added line committed in r147117.

        * inspector/front-end/ElementsTreeOutline.js:

2013-03-28  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Elements] Syntax-highlight the "Edit as HTML" editor
        https://bugs.webkit.org/show_bug.cgi?id=113306

        Reviewed by Vsevolod Vlasov.

        Use CodeMirror as the raw HTML editor for the "Edit as HTML" menu item
        (and all multiline editors for WebInspector.startEditing()).
        Drive-by fix for handling the editing when the editor has been invoked on the closing tag.

        * inspector/front-end/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement.prototype.commit):
        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML):
        * inspector/front-end/UIUtils.js:
        (WebInspector.EditingConfig.prototype.setMultiline):
        (WebInspector.startEditing):
        (WebInspector.CodeMirrorCSSLoadView): A bogus view to load-unload CodeMirror-related CSS on demand.
        * inspector/front-end/elementsPanel.css:
        (#elements-content .CodeMirror):
        (#elements-content .CodeMirror pre):
        (#elements-content .CodeMirror-lines):
        * inspector/front-end/elementsPanel.css: CodeMirror styles for the "Edit as HTML" editor.
        * inspector/front-end/externs.js: Declare CodeMirror type with some members, as it is third-party code.
        * inspector/front-end/inspector.html: Fix script order (UIUtils.js requires View.js).

2013-03-28  Hajime Morrita  <morrita@google.com>

        Custom Elements: should support non-HTML namespaces.
        https://bugs.webkit.org/show_bug.cgi?id=111693

        Reviewed by Dimitri Glazkov.

        Some existing code assumes that the element extends HTMLElements.
        This change allow it to extend from Element. Note that the
        namespace URI of a custom element is determined by given element
        prototype: An element will have XHTML namespace if its prototype
        chain includes HTMLElements, SVGElement leads SVG namespace and
        null otherwise, respectively.

        Test: fast/dom/custom/document-register-namespace.html

        * bindings/v8/CustomElementHelpers.cpp:
        (WebCore::hasValidPrototypeChainFor): Factored out from isValidPrototypeParameter()
        (WebCore::CustomElementHelpers::isValidPrototypeParameter): Extend to support non HTMLElement prototype
        (WebCore::CustomElementHelpers::findLocalName): Support non-HTML element names.
        * bindings/v8/CustomElementHelpers.h:
        (CustomElementHelpers):
        * dom/CustomElementConstructor.cpp:
        (WebCore::CustomElementConstructor::createElementInternal):
        * dom/CustomElementRegistry.cpp:
        (WebCore::CustomElementRegistry::registerElement): No longer hard-codes namespace and picks one based on the prototype value.
        * dom/CustomElementRegistry.h:
        (CustomElementRegistry):

2013-03-28  Hans Muller  <hmuller@adobe.com>

        [CSS Exclusions] Add support for the simple case of padding a polygonal shape-inside
        https://bugs.webkit.org/show_bug.cgi?id=112592

        Reviewed by Dirk Schulze.

        First pass at computing the padded or inset boundary of a polygon.  This version does not handle
        self-intersecting polygons, or values of shape-padding large enough to change the shape of the
        original polygon. The implementation computes an offset edge for each polgon edge, where the offset
        edge is parallel to the original edge and separated by shape-padding. The padded polygon's vertices
        are the intersections of each pair of adjacent offset edges. When adjacent offset edges do not intersect,
        because they share a reflex vertex in the original polygon, an approximation to a circular arc
        connects the offset edges.

        Tests: fast/exclusions/shape-inside/shape-inside-polygon-padding-001.html
               fast/exclusions/shape-inside/shape-inside-polygon-padding-002.html
               fast/exclusions/shape-inside/shape-inside-polygon-padding-003.html

        * rendering/ExclusionPolygon.cpp:
        (WebCore::isReflexVertex): Just moved this function earlier in the file.
        (WebCore::inwardEdgeNormal): Unit vector that's perpindicular to the edge and that points inwards.
        (WebCore::outwardEdgeNormal): Unit vector that's perpindicular to the edge and that points outwards.
        (WebCore::appendArc): Append a linear approximation to a circular arc to a vector of vertices.
        (WebCore::computeShapePaddingBounds): Return a polygon whose edges are all inset by shape-padding from m_polygon.
        (WebCore::computeShapeMarginBounds): Just a stub, see bug 112917.
        (WebCore::ExclusionPolygon::shapePaddingBounds): Lazily use computeShapePaddingBounds() to initialize m_paddingBounds.
        (WebCore::ExclusionPolygon::shapeMarginBounds): Lazily use computeShapeMarginBounds() to initialize m_marginBounds.
        (WebCore::ExclusionPolygon::getIncludedIntervals): Now based on the value of shapePaddingBounds().
        (WebCore::ExclusionPolygon::firstIncludedIntervalLogicalTop): Now based on the value of shapePaddingBounds().
        * rendering/ExclusionPolygon.h:
        (WebCore::ExclusionPolygon::ExclusionPolygon):

2013-03-28  Chris Hutten-Czapski  <chutten@blackberry.com>

        [BlackBerry] Handle EXIF orientation for ImageDocuments
        https://bugs.webkit.org/show_bug.cgi?id=113423

        Internal Bug: PR 293648
        Informally Reviewed by Jeff Rogers
        Reviewed by Rob Buis.

        Support image orientation in our image draw calls, and advertise
        the capability to the calling code. This allows us to respect EXIF
        orientation data.

        * platform/graphics/BitmapImage.h:
        * platform/graphics/blackberry/ImageBlackBerry.cpp:
        (WebCore::BitmapImage::draw):
        (WebCore):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::shouldRespectImageOrientation):

2013-03-28  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: name timeline overview controls consistently
        https://bugs.webkit.org/show_bug.cgi?id=113503

        Reviewed by Yury Semikhatsky.

        Refactoring, covered by existing tests.

        - rename HeapGraph to TimelineMemoryOverview;
        - rename TimelineCategoryStrips to TimelineEventOvrview.

        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewPane):
        (WebInspector.TimelineOverviewPane.prototype.setMode):
        (WebInspector.TimelineOverviewPane.prototype._setFrameMode):
        (WebInspector.TimelineOverviewPane.prototype._onCategoryVisibilityChanged):
        (WebInspector.TimelineOverviewPane.prototype._update):
        (WebInspector.TimelineOverviewPane.prototype.setMinimumRecordDuration):
        (WebInspector.TimelineMemoryOverview):
        (WebInspector.TimelineEventOverview):
        (WebInspector.TimelineEventOverview.prototype._renderBar):

2013-03-28  Eli Fidler  <efidler@blackberry.com>

        [BlackBerry] Correct glyph contour winding direction when fake-bolding
        https://bugs.webkit.org/show_bug.cgi?id=113411

        Reviewed by Rob Buis.

        * platform/graphics/blackberry/FontPlatformDataBlackBerry.cpp:
        (WebCore::FontPlatformData::applyState):

2013-03-28  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Make JavaScriptSourceFrame work correctly with breakpoints when uiSourceCode does not have a scriptFile.
        https://bugs.webkit.org/show_bug.cgi?id=113500

        Reviewed by Pavel Feldman.

        JavaScriptSourceFrame now listens for uiSourceCode working copy related events and supports muting breakpoints without script file.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype._workingCopyChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._workingCopyCommitted):
        (WebInspector.JavaScriptSourceFrame.prototype._updateScriptFile):
        (WebInspector.JavaScriptSourceFrame.prototype.dispose):

2013-03-22  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: factor out node search controller from inspector.js
        https://bugs.webkit.org/show_bug.cgi?id=112689

        Reviewed by Pavel Feldman.

        This just extracts the existing logic of toggling node search
        from inspector.js into a class of its own, InspectElementModeController.
        Drive-by: add CtrlOrMeta+Shift+C to help screen.

        * English.lproj/localizedStrings.js:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * inspector/compile-front-end.py:
        * inspector/front-end/InspectElementModeController.js: Added.
        (WebInspector.InspectElementModeController):
        (WebInspector.InspectElementModeController.createShortcut):
        (WebInspector.InspectElementModeController.prototype.enabled):
        (WebInspector.InspectElementModeController.prototype.disable):
        (WebInspector.InspectElementModeController.prototype.toggleSearch.callback):
        (WebInspector.InspectElementModeController.prototype.toggleSearch):
        (WebInspector.InspectElementModeController.prototype.handleShortcut):
        * inspector/front-end/InspectorFrontendAPI.js:
        (InspectorFrontendAPI.enterInspectElementMode):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:
        * inspector/front-end/inspector.js:
        (WebInspector._createGlobalStatusBarItems):
        (WebInspector._registerShortcuts):
        (WebInspector.documentKeyDown):
        (WebInspector._updateFocusedNode):

2013-03-28  Eugene Klyuchnikov  <eustas@chromium.org>

        Web Inspector: [Settings] "previouslyViewedFiles" exceeds local storage quota.
        https://bugs.webkit.org/show_bug.cgi?id=113375

        Reviewed by Pavel Feldman.

        Serialized "previouslyViewedFiles" may make local storage overflow.
        Two fixed applied:
        - limit number of history log items
        - limit length of URIs that get serialized;
          this would affect only data-url URIs.

        * inspector/front-end/TabbedEditorContainer.js:
        (WebInspector.TabbedEditorContainer.HistoryItem.prototype.serializeToObject):
        Added length check.
        (WebInspector.TabbedEditorContainer.History.prototype.set _serializeToObject):
        Added output array length limit.

2013-03-28  Alexei Filippov  <alph@chromium.org>

        Web Inspector: Heap snapshots retained size falls out of the grid if column is too narrow
        https://bugs.webkit.org/show_bug.cgi?id=113497

        Reviewed by Pavel Feldman.

        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode.prototype._createValueCell):
        * inspector/front-end/heapProfiler.css:
        (.heap-snapshot-view .data-grid div.heap-snapshot-multiple-values):

2013-03-28  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: ResourceScriptFile should check if resource content really matches VM script when determining hasDiverged state.
        https://bugs.webkit.org/show_bug.cgi?id=113488

        Reviewed by Pavel Feldman.

        Enabled support for checking that file content matches VM script in ResourceScriptFile (For script resources only).
        This check is never done before content is loaded in corresponding editor to avoid regressing performance.
        File - script content matching is done bearing in mind sourceURLs. 
        Live edit keeps sourceURL in script content now even if it is not present in file's content.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype._updateScriptFile):
        (WebInspector.JavaScriptSourceFrame.prototype.onTextEditorContentLoaded):
        * inspector/front-end/LiveEditSupport.js:
        (WebInspector.LiveEditScriptFile.prototype.checkMapping):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype._bindUISourceCodeToScripts):
        (WebInspector.ScriptFile.prototype.checkMapping):
        (WebInspector.ResourceScriptFile):
        (WebInspector.ResourceScriptFile.prototype._workingCopyCommitted):
        (WebInspector.ResourceScriptFile.prototype._isDiverged):
        (WebInspector.ResourceScriptFile.prototype._sourceMatchesScriptSource):
        (WebInspector.ResourceScriptFile.prototype._sourceEndsWithSourceURL):
        (WebInspector.ResourceScriptFile.prototype.checkMapping.callback):
        (WebInspector.ResourceScriptFile.prototype.checkMapping):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.SnippetScriptFile.prototype.checkMapping):

2013-03-28  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Simplify ResourceScriptFile so that it stores hasDiverged state in it.
        https://bugs.webkit.org/show_bug.cgi?id=113489

        Reviewed by Pavel Feldman.

        ResourceScriptFile._hasDiverged is the one flag that shows whether we have diverged from VM.
        It's values is based both on dirty flag on uiSourceCode and information about live edit failures stored in _lastLiveEditFailed field.
        Removed willMerge/Diverge events from ScriptFile.
        JavaScriptSourceFrame now uses isMergingToVM/DivergingFromVM methods on ScriptFile.
        to determine whether breakpointAdded/Removed events should be ignored.
        Introduced muted state on JavaScriptSourceFrame to determine whether it should ignore user attempts to set/remove breakpoints.

        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame):
        (WebInspector.JavaScriptSourceFrame.prototype._didMergeToVM):
        (WebInspector.JavaScriptSourceFrame.prototype._didDivergeFromVM):
        (WebInspector.JavaScriptSourceFrame.prototype._muteBreakpointsWhileEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._restoreBreakpointsAfterEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
        (WebInspector.JavaScriptSourceFrame.prototype._shouldIgnoreExternalBreakpointEvents):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointAdded):
        (WebInspector.JavaScriptSourceFrame.prototype._breakpointRemoved):
        (WebInspector.JavaScriptSourceFrame.prototype._updateScriptFile):
        (WebInspector.JavaScriptSourceFrame.prototype.onTextEditorContentLoaded):
        * inspector/front-end/LiveEditSupport.js:
        (WebInspector.LiveEditScriptFile.prototype.isMergingToVM):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.rawLocationToUILocation):
        (WebInspector.ScriptFile.prototype.isMergingToVM):
        (WebInspector.ResourceScriptFile):
        (WebInspector.ResourceScriptFile.prototype._workingCopyCommitted):
        (WebInspector.ResourceScriptFile.prototype._isDiverged):
        (WebInspector.ResourceScriptFile.prototype._workingCopyChanged):
        (WebInspector.ResourceScriptFile.prototype._update):
        (WebInspector.ResourceScriptFile.prototype._divergeFromVM):
        (WebInspector.ResourceScriptFile.prototype._mergeToVM):
        (WebInspector.ResourceScriptFile.prototype.hasDivergedFromVM):
        (WebInspector.ResourceScriptFile.prototype.isMergingToVM):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.SnippetScriptFile.prototype.isMergingToVM):

2013-03-25  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: DOMContentLoaded event divider is not shown on Timeline's main view
        https://bugs.webkit.org/show_bug.cgi?id=113196

        Reviewed by Pavel Feldman.

        - keep event divider records in TimelinePresentationModel, not in TimelinePanel;
        - process event divider records on every level, not just on top.

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._updateEventDividers):
        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.checkVisible):
        (WebInspector.TimelinePanel.prototype._resetPanel):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.prototype.reset):
        (WebInspector.TimelinePresentationModel.prototype._innerAddRecord):
        (WebInspector.TimelinePresentationModel.prototype.eventDividerRecords):

2013-03-28  Vsevolod Vlasov  <vsevik@chromium.org>

        Unreviewed inspector front-end closure compilation fix.

        * inspector/front-end/CookiesTable.js:

2013-03-28  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: [DTE] Paint overlay highlight over line background color
        https://bugs.webkit.org/show_bug.cgi?id=113346

        Reviewed by Pavel Feldman.

        No new tests: no change in behaviour.

        - Append spans instead of text nodes to lineRows.
        - Set positioning of all spans inside of webkit-line-content as
        relative
        - Set z-index property so that overlay highlight is above line
        background but under text.

        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.TextEditorMainPanel.prototype._measureHighlightDescriptor):
        (WebInspector.TextEditorMainPanel.prototype._measureSpans):
        (WebInspector.TextEditorMainPanel.prototype._renderRanges):
        (WebInspector.TextEditorMainPanel.prototype._insertSpanBefore):
        * inspector/front-end/textEditor.css:
        (.webkit-line-content > .text-editor-overlay-highlight):
        (.webkit-line-content > *):

2013-03-28  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [REGRESSION] [Styles] Pasting a property in the "name" field is broken
        https://bugs.webkit.org/show_bug.cgi?id=113491

        Reviewed by Pavel Feldman.

        Update the CSSProperty name and value upon pasting properties into the Styles pane.
        Drive-by: start editing the next/new property name after pasting.

        Test: inspector/styles/paste-property.html

        * inspector/front-end/StylesSidebarPane.js:
        (.selectElement):
        (.moveDirection.alreadyNew):

2013-03-28  Alexei Filippov  <alph@chromium.org>

        Web Inspector: Auto expand retaining path until there are more than one retainer.
        https://bugs.webkit.org/show_bug.cgi?id=112596

        Reviewed by Yury Semikhatsky.

        When retainers view gets opened automatically expand retaining path
        for objects having just a single retainer.

        Test: inspector/profiler/heap-snapshot-summary-retainers.html

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotRetainmentDataGrid.prototype.populateComplete):
        (WebInspector.HeapSnapshotRetainmentDataGrid.prototype.setDataSource):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode.prototype.childrenRetrieved):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren):

2013-03-28  Vladislav Kaznacheev  <kaznacheev@chromium.org>

        Web Inspector: Fixed property text indentation in Styles sidebar.
        https://bugs.webkit.org/show_bug.cgi?id=113409

        Reviewed by Alexander Pavlov.

        When the sidebar is too narrow and the property text wraps around it breaks the indentation.
        This was introduced in r143207 which spuriously modified DOM elements order.

        * inspector/front-end/StylesSidebarPane.js:

2013-03-28  Arpita Bahuguna  <a.bah@samsung.com>

        Regression: Crash when selecting Hebrew and numbers in a list
        https://bugs.webkit.org/show_bug.cgi?id=111894

        Reviewed by Ryosuke Niwa.

        There is a crash when trying to click/select an anonymous
        renderer.

        This is a regression due to r143313 which tries to add border/padding
        to the computed caret rect in RenderBox::localCaretRect().
        The patch calls on the node() method for the corresponding
        renderer. For an anonymous renderer though, node() returns
        null. Since no check had been added for this, a crash occurs when
        caret rect for an anonymous renderer is being computed.

        Test: editing/selection/click-on-anonymous-content-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::localCaretRect):
        Added a check for validating the return from the node() call.

2013-03-28  Mike West  <mkwst@chromium.org>

        X-Frame-Options: Multiple headers are ignored completely.
        https://bugs.webkit.org/show_bug.cgi?id=113387

        Reviewed by Nate Chapin.

        If a server sends multiple 'X-Frame-Options' headers, we end up with a
        value like 'SAMEORIGIN, SAMEORIGIN'. Currently, we're treating that as
        invalid, and ignoring the header. It would be safer to follow Gecko's
        lead[1] by:

        - Folding duplicated entries into their common value (that is:
          'sameorigin, sameorigin' -> 'sameorigin').

        - Failing closed in the case of conflicts (that is:
          'sameorigin, allowall' -> 'deny').

        [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=761655

        Tests: http/tests/security/XFrameOptions/x-frame-options-multiple-headers-conflict.html
               http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-allow.html
               http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions):
            Call out to parseXFrameOptionsHeader to get the header's disposition
            and deal with each case in a switch statement for clarity. Add a new
            console warning for the conflict case described above.
        * platform/network/HTTPParsers.cpp:
        (WebCore::parseXFrameOptionsHeader):
        * platform/network/HTTPParsers.h:
            Move X-Frame-Options parsing out into HTTPParsers, as it's getting
            more and more complicated. To do this, the patch defines a new enum
            to pass around the header's disposition.

2013-03-28  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Consolidate use of RenderRegion::isValid
        https://bugs.webkit.org/show_bug.cgi?id=113154

        Reviewed by David Hyatt.

        After https://bugs.webkit.org/show_bug.cgi?id=98752, the list of invalid regions is kept separately than the list of valid regions.
        A valid region has always a valid flow thread attached. We can use isValid() throughout the RenderRegion code
        instead of testing for both isValid() and m_flowThread.

        No new tests since there is no change is functionality, just code refactoring.

        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::addRegionToNamedFlowThread): Added a new function to keep the code
        used in addRegionToThread and checkInvalidRegions.
        (WebCore::RenderNamedFlowThread::addRegionToThread):
        (WebCore::RenderNamedFlowThread::checkInvalidRegions):
        * rendering/RenderNamedFlowThread.h:
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
        (WebCore::RenderRegion::isFirstRegion):
        (WebCore::RenderRegion::isLastRegion):
        (WebCore::RenderRegion::paintObject):
        (WebCore::RenderRegion::nodeAtPoint):
        (WebCore::RenderRegion::incrementAutoLogicalHeightCount):
        (WebCore::RenderRegion::decrementAutoLogicalHeightCount):
        (WebCore::RenderRegion::layoutBlock):
        (WebCore::RenderRegion::repaintFlowThreadContentRectangle):
        (WebCore::RenderRegion::attachRegion):
        (WebCore::RenderRegion::renderBoxRegionInfo):
        (WebCore::RenderRegion::setRenderBoxRegionInfo):
        (WebCore::RenderRegion::logicalTopOfFlowThreadContentRect):
        (WebCore::RenderRegion::logicalBottomOfFlowThreadContentRect):
        (WebCore::RenderRegion::computePreferredLogicalWidths):

2013-03-27  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: Timeline. Refresh is slow when user drags the overview window.
        https://bugs.webkit.org/show_bug.cgi?id=113371

        Reviewed by Pavel Feldman.

        The root of problem is the 300ms delay in scheduleRefresh method.
        It was introduced for the case when we add a huge number of records per second.
        The scheduleRefresh was written such a way that refresh happened immediately
        only for the scrolling operations. Actually we would like to see fast
        refresh every time when it is forced by an user action.

        In this patch additional flag newRecordWasAdded was added to the
        _invalidateAndScheduleRefresh. I made it mandatory because the function
        is also used as a callback for an event and it is easy to make a mistake and
        interpret the event as the flag.

        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._onCategoryCheckboxClicked):
        (WebInspector.TimelinePanel.prototype._durationFilterChanged):
        (WebInspector.TimelinePanel.prototype._repopulateRecords):
        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
        (WebInspector.TimelinePanel.prototype._onRecordsCleared):
        (WebInspector.TimelinePanel.prototype._invalidateAndScheduleRefresh):
        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
        (WebInspector.TimelinePanel.prototype._revealRecord):
        (WebInspector.TimelinePanel.prototype._refreshRecords):
        (WebInspector.TimelinePanel.prototype.performFilter):

2013-03-27  Keishi Hattori  <keishi@webkit.org>

        Dragging to edge should always snap to min/max.
        https://bugs.webkit.org/show_bug.cgi?id=113477

        Reviewed by Kent Tamura.

        Dragging to the edge of a slider should always snap to the min/max.

        Test: fast/forms/range/range-slow-drag-to-edge.html

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::setPositionFromPoint):

2013-03-27  Simon Fraser  <simon.fraser@apple.com>

        Add a way to update GraphicsLayerCA visibleRects without having to do a flush
        https://bugs.webkit.org/show_bug.cgi?id=113459

        Reviewed by Tim Horton.
        
        Some platforms need to update TiledBacking visible rects from
        outside of WebKit, for example if they use delegated scrolling.
        They want to avoid forcing layout to be up-to-date when doing this.
        
        Currently, updating the visibleRect happens when the GraphicsLayerCA
        layer are being flushed, but that makes some assumptions about
        layout being up-to-date.
        
        To fix this, add a light-weight pass over the layer tree that
        uses TransformState to compute the visibleRect for each
        layer, and only if the visibleRect would cause a change in the
        tiles in a TiledBacking trigger a layer flush.

        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::recomputeVisibleRects):
        * platform/graphics/TiledBacking.h:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::recursiveComputeVisibleRect):
        (WebCore::GraphicsLayerCA::recomputeVisibleRects):
        (WebCore::GraphicsLayerCA::computeVisibleRect):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/ca/mac/TileController.h:
        * platform/graphics/ca/mac/TileController.mm:
        (WebCore::TileController::tilesWouldChangeForVisibleRect):
        (WebCore::TileController::computeTileCoverageRect):
        (WebCore::TileController::revalidateTiles):

2013-03-27  Philip Rogers  <pdr@google.com>

        Rename toScriptElement -> toScriptElementIfPossible
        https://bugs.webkit.org/show_bug.cgi?id=113473

        Reviewed by Ryosuke Niwa.

        Rename ScriptElement::toScriptElement to ScriptElement::toScriptElementIfPossible to
        differentiate this function from other to*Element functions, and to better describe the
        function's behavior. Other to*Element functions do not return null if the cast fails,
        whereas toScriptElementIfPossible does.

        No new tests as this is just a refactoring.

        * dom/ScriptElement.cpp:
        (WebCore::toScriptElementIfPossible):
        * dom/ScriptElement.h:
        (WebCore):
        * dom/ScriptRunner.cpp:
        (WebCore::ScriptRunner::timerFired):

            This is the only unchecked return value but there isn't a security issue here.

        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::collectOptionInnerText):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::attachLater):
        (WebCore::HTMLConstructionSite::insertForeignElement):
        * html/parser/HTMLScriptRunner.cpp:
        (WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent):
        (WebCore::HTMLScriptRunner::requestPendingScript):
        (WebCore::HTMLScriptRunner::runScript):
        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::notifyFinished):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::startElementNs):
        (WebCore::XMLDocumentParser::endElementNs):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::parseStartElement):
        (WebCore::XMLDocumentParser::parseEndElement):

2013-03-27  Ryosuke Niwa  <rniwa@webkit.org>

        Debug test fix after r147018.

        toElement() asserts. What we want here is isElementNode().

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::attachLater):

2013-03-27  Noel Gordon  <noel.gordon@gmail.com>

        Add webp image color profile support
        https://bugs.webkit.org/show_bug.cgi?id=113184

        Reviewed by Eric Seidel.

        Requires libwebp version 0.3.0 (decoder ABI version 0x201). For images
        with an ICC color profile chunk, poll the incremental decoder for the
        current decoded height with the WebPIDecGetRGB() API and color correct
        any newly decoded rows in-situ in the frame buffer.

        Note: the ICC chunk appears before the encoded image frame in the webp
        encoding (RIFF container) format. When the incremental decoder outputs
        decoded pixels, enough encoded data has arrived to read the entire ICC
        color profile data chunk.

        Tests: fast/images/webp-color-profile-lossless.html
               fast/images/webp-color-profile-lossy-alpha.html
               fast/images/webp-color-profile-lossy.html

        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
        (WebCore::WEBPImageDecoder::WEBPImageDecoder):
        (WebCore::WEBPImageDecoder::~WEBPImageDecoder): Call clear().
        (WebCore):
        (WebCore::WEBPImageDecoder::clear):
        Added. Helper to clean up the webp decoder and color transform members.
        (WebCore::WEBPImageDecoder::createColorTransform):
        Create m_transform using the supplied profile memory data. Note that
        the |deviceProfile| is not owned, but the |inputProfile| temporary is
        so release it here with qcms_release_profile().
        (WebCore::WEBPImageDecoder::readColorProfile):
        Called once only when the decoder begins to output decoded rows of an
        image containing an ICC chunk, to read the ICC color profile data from
        the encoded data stream, verify it, and use it to create m_transform.
        (WebCore::WEBPImageDecoder::applyColorProfile):
        Since there is no row callback in libwebp, poll for the decoded height
        of the image so far. If new rows are decoded, color correct the pixels
        of those new rows and re-write them back into the frame buffer using
        buffer.setRGBA() to 1) alpha pre-multiply the pixels if needed, and 2)
        shuffle the pixel bytes into the platform's RGBA pixel endian-ness.
        (WebCore::WEBPImageDecoder::decode):
        If the container format indicates the image has an ICC color profile,
        decode the image to RGBA format for subsequent input to the QCMS color
        correction library in applyColorProfile().
        * platform/image-decoders/webp/WEBPImageDecoder.h:
        (WEBPImageDecoder):
        (WebCore::WEBPImageDecoder::colorTransform): m_transform getter.

2013-03-27  Jun Jiang  <jun.a.jiang@intel.com>

        Refactor validation checks for texture uploads
        https://bugs.webkit.org/show_bug.cgi?id=111012

        Reviewed by Kenneth Russell.

        Move the validation checks to the entry level of tex{Sub}Image2D, return early for invalid parameters and avoid duplicated checks.
        Moreover, turn all the validation checks at the bottom level - tex{Sub}Image2DBase into assertions.

        Already covered by current tests.

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::copyTexSubImage2D):
        (WebCore::WebGLRenderingContext::texImage2DBase):
        (WebCore::WebGLRenderingContext::texImage2DImpl):
        (WebCore::WebGLRenderingContext::validateTexFunc): A helper function for tex{Sub}Image2D to check input parameters.
        (WebCore::WebGLRenderingContext::texImage2D):
        (WebCore::WebGLRenderingContext::texSubImage2DBase):
        (WebCore::WebGLRenderingContext::texSubImage2DImpl):
        (WebCore::WebGLRenderingContext::texSubImage2D):
        (WebCore::WebGLRenderingContext::validateHTMLImageElement):
        (WebCore::WebGLRenderingContext::validateHTMLCanvasElement):
        (WebCore::WebGLRenderingContext::validateHTMLVideoElement):
        * html/canvas/WebGLRenderingContext.h:

2013-03-27  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        remove parentsOnly variable in codeGenerator.pm
        https://bugs.webkit.org/show_bug.cgi?id=113457

        Reviewed by Kentaro Hara.

        Remove unused variable parentsOnly.

        No new tests: no change in behaviour.

        * bindings/scripts/CodeGenerator.pm:
        (ForAllParents):
        (AddMethodsConstantsAndAttributesFromParentInterfaces):
        (ParseInterface):
        (InheritsInterface):
        (InheritsExtendedAttribute):
        * bindings/scripts/CodeGeneratorV8.pm:
        (BaseInterfaceName):

2013-03-27  Beth Dakin  <bdakin@apple.com>

        Need WK2 API to give a WebView a header and footer
        https://bugs.webkit.org/show_bug.cgi?id=113352
        -and corresponding-
        <rdar://problem/13383835>

        Reviewed by Simon Fraser.

        This API will require RenderLayerCompositor to keep layers for the header and 
        footer when the exist. It also requires the scrolling machinery to know that the 
        size of the scrollable area will differ from the contentsSize when there is a 
        header or footer.

        setWantsLayerForHeader() and setWantsLayerForFooter() return GraphicsLayers to 
        WK2. setHeaderHeight() and setFooterHeight() set the header and footer heights
        respectively.
        * WebCore.exp.in:
        * page/FrameView.h:
        (FrameView):
        * page/FrameView.cpp:
        (WebCore::FrameView::FrameView):
        (WebCore::FrameView::setWantsLayerForHeader):
        (WebCore::FrameView::setWantsLayerForFooter):
        (WebCore::FrameView::setHeaderHeight):
        (WebCore::FrameView::setFooterHeight):

        Should use totalContentsSize() instead of contentsSize().
        (WebCore::FrameView::windowClipRect):
        (WebCore::FrameView::isScrollable):
        * page/SpatialNavigation.cpp:
        (WebCore::canScrollInDirection):

        This should also use totalContentsSize() instead of contentsSize(), and while 
        we're at it, re-name the variable and function names in the scrolling tree code 
        from contentsSize to totalContentsSize.
        * page/scrolling/ScrollingStateScrollingNode.cpp:
        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
        (WebCore::ScrollingStateScrollingNode::setTotalContentsSize):
        (WebCore::ScrollingStateScrollingNode::dumpProperties):
        * page/scrolling/ScrollingStateScrollingNode.h:
        (WebCore::ScrollingStateScrollingNode::totalContentsSize):
        (ScrollingStateScrollingNode):
        * page/scrolling/ScrollingTreeScrollingNode.cpp:
        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
        * page/scrolling/ScrollingTreeScrollingNode.h:
        (WebCore::ScrollingTreeScrollingNode::totalContentsSize):
        (ScrollingTreeScrollingNode):
        * page/scrolling/mac/ScrollingCoordinatorMac.h:
        (ScrollParameters):
        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
        (WebCore::ScrollingCoordinatorMac::frameViewLayoutUpdated):
        (WebCore::ScrollingCoordinatorMac::setScrollParametersForNode):
        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
        (WebCore::ScrollingTreeScrollingNodeMac::updateAfterChildren):
        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
        (WebCore::ScrollingTreeScrollingNodeMac::maximumScrollPosition):

        Use totalContentsSize() instead of contentsSize().
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::maximumScrollPosition):
        (WebCore::ScrollView::setScrollOffset):
        (WebCore::ScrollView::overhangAmount):
        (WebCore::ScrollView::updateScrollbars):
        (WebCore::ScrollView::calculateOverhangAreasForPainting):

        scrollOffset() represents the offset within the totalContentsSize, but that is 
        not what we need here. So subtract out the headerHeight() for the appropriate 
        value.
        (WebCore::ScrollView::windowToContents):
        (WebCore::ScrollView::contentsToWindow):

        Use totalContentsSize() instead of contentsSize().
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::maximumScrollPosition):
        (WebCore):
        (WebCore::ScrollableArea::totalContentsSize):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::headerHeight):
        (WebCore::ScrollableArea::footerHeight):
        (ScrollableArea):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::adjustScrollPositionIfNecessary):
        (WebCore::ScrollAnimatorMac::pinnedInDirection):
        * platform/mac/ThemeMac.mm:
        (WebCore::ThemeMac::ensuredView):

        The rootContentLayer needs to be offset by the headerHeight().
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateRootLayerPosition):

        New member variables m_layerForHeader and m_layerForFooter. This code properly 
        creates and manages them.
        (WebCore::RenderLayerCompositor::updateLayerForBottomOverhangArea):
        (WebCore::RenderLayerCompositor::updateLayerForHeader):
        (WebCore):
        (WebCore::RenderLayerCompositor::updateLayerForFooter):
        (WebCore::RenderLayerCompositor::computeFixedViewportConstraints):
        (WebCore::RenderLayerCompositor::reportMemoryUsage):
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):

        Test infrastructure. 
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setHeaderHeight):
        (WebCore):
        (WebCore::Internals::setFooterHeight):
        * testing/Internals.h:
        * testing/Internals.idl:

2013-03-27  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        javascriptcore bindings do not check exception after calling valueToStringWithNullCheck
        https://bugs.webkit.org/show_bug.cgi?id=113219

        Reviewed by Kentaro Hara.

        When converting JSValue to native value in attribute setter, store the
        native value in a temporary variable. After this variable assignment,
        always check if an exception has been raised.

        Update binding tests.

        Test: fast/dom/exception-in-binding.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GetNativeType):
        (JSValueToNative):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::setJSTestInterfaceSupplementalStr2):
        (WebCore::setJSTestInterfaceSupplementalNode):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjConstructorStaticStringAttr):
        (WebCore::setJSTestObjEnumAttr):
        (WebCore::setJSTestObjShortAttr):
        (WebCore::setJSTestObjUnsignedShortAttr):
        (WebCore::setJSTestObjLongAttr):
        (WebCore::setJSTestObjLongLongAttr):
        (WebCore::setJSTestObjUnsignedLongLongAttr):
        (WebCore::setJSTestObjStringAttr):
        (WebCore::setJSTestObjTestObjAttr):
        (WebCore::setJSTestObjXMLObjAttr):
        (WebCore::setJSTestObjCreate):
        (WebCore::setJSTestObjReflectedStringAttr):
        (WebCore::setJSTestObjReflectedIntegralAttr):
        (WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
        (WebCore::setJSTestObjReflectedBooleanAttr):
        (WebCore::setJSTestObjReflectedURLAttr):
        (WebCore::setJSTestObjReflectedCustomIntegralAttr):
        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
        (WebCore::setJSTestObjReflectedCustomURLAttr):
        (WebCore::setJSTestObjTypedArrayAttr):
        (WebCore::setJSTestObjAttrWithGetterException):
        (WebCore::setJSTestObjAttrWithSetterException):
        (WebCore::setJSTestObjStringAttrWithGetterException):
        (WebCore::setJSTestObjStringAttrWithSetterException):
        (WebCore::setJSTestObjWithScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
        (WebCore::setJSTestObjWithScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
        (WebCore::setJSTestObjConditionalAttr1):
        (WebCore::setJSTestObjConditionalAttr2):
        (WebCore::setJSTestObjConditionalAttr3):
        (WebCore::setJSTestObjAnyAttribute):
        (WebCore::setJSTestObjMutablePoint):
        (WebCore::setJSTestObjImmutablePoint):
        (WebCore::setJSTestObjStrawberry):
        (WebCore::setJSTestObjStrictFloat):
        (WebCore::setJSTestObjId):
        (WebCore::setJSTestObjNullableLongSettableAttribute):
        (WebCore::setJSTestObjNullableStringValue):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::setJSTestSerializedScriptValueInterfaceValue):
        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
        (WebCore::setJSTestTypedefsAttrWithGetterException):
        (WebCore::setJSTestTypedefsAttrWithSetterException):
        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
        (WebCore::setJSTestTypedefsStringAttrWithSetterException):

2013-03-27  Arnaud Renevier  <a.renevier@sisa.samsung.com>

        cache parsed interfaces in CodeGenerator.pm
        https://bugs.webkit.org/show_bug.cgi?id=113446

        Reviewed by Kentaro Hara.

        When generating binding for an interface, informations about parent
        interfaces are sometimes needed several times. This patch caches
        those the parsed interface. When generating all WebCore bindings, this
        results in a speedup of about 40% for JavaScriptCore and about 80% for
        V8.

        No new tests: no change in behaviour.

        * bindings/scripts/CodeGenerator.pm:
        (ParseInterface):

2013-03-27  KyungTae Kim <ktf.kim@samsung.com> and Yongjun Zhang  <yongjun_zhang@apple.com>

        Add a settings to disallow initializing background-size if background shorthand doesn't include it.
        https://bugs.webkit.org/show_bug.cgi?id=113363

        Reviewed by David Kilzer.

        This is based on KyungTae Kim's patch in https://bugs.webkit.org/show_bug.cgi?id=97761.  Many legacy sites set
        background-size first and then set background for setting background-image.  For backward-compatibility
        in some WebKit based clients, if 'background' shorthand have no 'background-size' attribute, we could add
        a settings to let the css parser not initialize 'background-size'.

        Test: fast/backgrounds/background-shorthand-after-set-backgroundSize.html

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext): initialize useLegacyBackgroundSizeShorthandBehavior.
        (WebCore::operator==):
        (WebCore::CSSParser::useLegacyBackgroundSizeShorthandBehavior): add a method to return if we want background-size
            to be initialized by background shorthand.
        (WebCore):
        (WebCore::CSSParser::parseFillShorthand): don't initialize background-size in background shorthand if we have
            useLegacyBackgroundSizeShorthandBehavior set to true.
        * css/CSSParser.h:
        (CSSParser):
        * css/CSSParserMode.h: add member useLegacyBackgroundSizeShorthandBehavior to CSSParserContext.
        (CSSParserContext):
        * page/Settings.in: initialize useLegacyBackgroundSizeShorthandBehavior to false.
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup): add the new settings useLegacyBackgroundSizeShorthandBehavior to Backup.
        (WebCore::InternalSettings::Backup::restoreTo): restore useLegacyBackgroundSizeShorthandBehavior from Backup.
        (WebCore::InternalSettings::setUseLegacyBackgroundSizeShorthandBehavior):
        (WebCore):
        * testing/InternalSettings.h:
        (Backup):
        (InternalSettings):
        * testing/InternalSettings.idl: add a JS testing API setUseLegacyBackgroundSizeShorthandBehavior to turn on/off
            the new settings.

2013-03-27  Florin Malita  <fmalita@chromium.org>

        Remove unused RenderLayer::renderBox{X,Y} methods
        https://bugs.webkit.org/show_bug.cgi?id=113408

        Reviewed by Simon Fraser.

        Minor cleanup - renderBoxX() and renderBox() are no longer used.

        No new tests: no functional changes.

        * rendering/RenderLayer.h:

2013-03-27  PhistucK  <phistuck@chromium.org>

        Web Inspector: Plumb and expose cookie clearing options throughout the Resources Cookies tree and views
        https://bugs.webkit.org/show_bug.cgi?id=87140

        Reviewed by Vsevolod Vlasov.

        Added cookie clearing buttons and context menu options
        throughout the tree and views.
        Drive by -
        - Made sure the delete button is only visible
        when a cookie is selected.
        - Fixed a wrong JSDoc comment.

        * inspector/front-end/CookieItemsView.js:
        (WebInspector.CookieItemsView):
        (WebInspector.CookieItemsView.prototype.statusBarItems):
        (WebInspector.CookieItemsView.prototype._updateWithCookies):
        (WebInspector.CookieItemsView.prototype.clear):
        Added. Clears the entire cookie view.
        (WebInspector.CookieItemsView.prototype._clearButtonClicked):
        Added. Ditto (when clicking on the button).
        (WebInspector.CookieItemsView.prototype._showDeleteButton):
        Added. Shows the delete button when selecting a cookie row.
        * inspector/CookiesTable.js:
        (WebInspector.CookiesTable):
        (WebInspector.CookiesTable.prototype._clearAndRefresh):
        Added. Clears the cookies of the current table and updates it.
        (WebInspector.CookiesTable.prototype._handleContextMenuEvent):
        Added. Manages the context menu within the table.
        (WebInspector.CookiesTable.prototype.clear):
        Added. Clears the cookies of the current table.
        (WebInspector.CookiesTable.prototype.setCookies):
         Fixed a wrong JSDoc comment structure.
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.clearCookies):
        Added. Clears the cookies of the given domain view.
        (WebInspector.CookieTreeElement.prototype.onattach):
        Added. Adds a contextmenu handler.
        (WebInspector.CookieTreeElement.prototype._handleContextMenuEvent):
        Added. Manages the context menu within cookie tree.
        (WebInspector.CookieTreeElement.prototype._clearCookies):
        Added. Clears the cookies of the view of the tree item.
        * inspector/front-end/treeoutline.js:
        (TreeOutline): Fixed a wrong JSDoc comment.

        * English.lproj/localizedStrings.js:
        Added strings for the context menu options.

2013-03-27  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: [DTE] implement "tokenAtTextPosition" method
        https://bugs.webkit.org/show_bug.cgi?id=113390

        Reviewed by Pavel Feldman.

        Test: inspector/editor/text-editor-token-at-position.html

        - Add TextEditor.tokenAtTextPosition method
        - Implement tokenAtTextPosition method in DefaultTextEditor

        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.DefaultTextEditor.prototype.tokenAtTextPosition):
        (WebInspector.TextEditorMainPanel.prototype.compare):
        (WebInspector.TextEditorMainPanel.prototype.tokenAtTextPosition):
        (WebInspector.TextEditorMainPanel.prototype._tokenAtUnhighlightedLine):
        (WebInspector.TextEditorMainPanel.prototype.set mimeType):
        (WebInspector.TextEditorMainPanel.prototype.get mimeType):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.tokenAtTextPosition):
        * inspector/front-end/TextEditorHighlighter.js:
        (WebInspector.TextEditorHighlighter):
        (WebInspector.TextEditorHighlighter.prototype.get mimeType):
        (WebInspector.TextEditorHighlighter.prototype.set mimeType):

2013-03-27  Charles Wei  <charles.wei@torchmobile.com.cn>

        Remove build warning for unused function parameters in indexeddb.
        https://bugs.webkit.org/show_bug.cgi?id=113043

        Reviewed by Tony Chang.

        No new tests, just remove build warning.

        * Modules/indexeddb/IDBCallbacks.h:
        (WebCore::IDBCallbacks::onBlocked):
        (WebCore::IDBCallbacks::onUpgradeNeeded):
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::stringToDirection):
        * Modules/indexeddb/IDBCursor.h:
        (IDBCursor):
        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::prefetchReset):
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::transaction):
        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::setIndexesReady):
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::openKeyCursor):
        * Modules/indexeddb/IDBLevelDBCoding.cpp:
        (IDBLevelDBCoding):
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore):
        (WebCore::IDBObjectStore::openCursor):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::stringToMode):
        * Modules/indexeddb/IDBTransaction.h:
        (IDBTransaction):
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore):

2013-03-27  Sergey Ryazanov  <serya@chromium.org>

        REGRESSION (r146588): Cannot correctly display Chinese SNS Renren
        https://bugs.webkit.org/show_bug.cgi?id=113142

        Reviewed by Pavel Feldman.

        Changed CSS grammar to be equivalent to pre-r146588.
        CSS error reporting disabled to prevent message overflow.

        * css/CSSGrammar.y.in:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::isLoggingErrors):

2013-03-27  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: enhance Popover.js to rely on hover element coordinates
        https://bugs.webkit.org/show_bug.cgi?id=113340

        Reviewed by Pavel Feldman.

        No new tests: no change in behaviour.

        Introduce a coordinates-based method that checks if mouse is inside hover
        element and use it in PopoverHelper instead of DOM hierarchy.

        * inspector/front-end/Popover.js:
        (WebInspector.PopoverHelper.prototype._eventInHoverElement): Added.
        (WebInspector.PopoverHelper.prototype._mouseDown):
        (WebInspector.PopoverHelper.prototype._mouseMove):
        (WebInspector.PopoverHelper.prototype._mouseOut):

2013-03-27  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: [CodeMirror] fix webinspector-css theme for CodeMirror
        https://bugs.webkit.org/show_bug.cgi?id=113399

        Reviewed by Alexander Pavlov.

        Add style rule to highlight css properties for CodeMirror
        webinspector-css theme.

        No new tests: no change in behaviour.

        * inspector/front-end/cm/cmdevtools.css:
        (.cm-s-web-inspector-css span.cm-property):

2013-03-27  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: [DTE] paint overlay highlight for unhighlighted lines
        https://bugs.webkit.org/show_bug.cgi?id=113344

        Reviewed by Pavel Feldman.

        No new tests.

        Remove fast-return condition from paintLine method that checked for
        highlight existence.

        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.TextEditorMainPanel.prototype._paintLine):

2013-03-27  Ryosuke Niwa  <rniwa@webkit.org>

        Shift clicking on an element with -webkit-user-select: all doesn't extend selection
        https://bugs.webkit.org/show_bug.cgi?id=113270

        Reviewed by Enrica Casucci.

        The bug was caused by updateSelectionForMouseDownDispatchingSelectStart always replacing selection whenever
        the target node was inside an element with -webkit-suer-select even when we were attemping to extend selection
        in handleMousePressEventSingleClick.

        Fixed the bug by extracting this logic as a separate function (expandSelectionToRespectUserSelectAll) and deploying
        it in handleMousePressEventSingleClick to extend selection as needed.

        Test: editing/selection/user-select-all-with-shift.html

        * page/EventHandler.cpp:
        (WebCore::expandSelectionToRespectUserSelectAll): Extracted from updateSelectionForMouseDownDispatchingSelectStart.
        (WebCore::EventHandler::updateSelectionForMouseDownDispatchingSelectStart):
        (WebCore::EventHandler::selectClosestWordFromHitTestResult):
        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
        (WebCore::EventHandler::handleMousePressEventTripleClick):
        (WebCore::EventHandler::handleMousePressEventSingleClick): Adjust "pos" as needed when extending selection.
        Also use shouldConsiderSelectionAsDirectional() instead of manually peeking editingBehaviorType while we're at it.

2013-03-27  Zalan Bujtas  <zalan@apple.com>

        REGRESSION(r143102): iframe with percentage height within table with anonymous cell fails.
        https://bugs.webkit.org/show_bug.cgi?id=113077

        Reviewed by Antti Koivisto.
        
        http://www.w3.org/TR/CSS21/visuren.html#anonymous-block-level
        "Anonymous block boxes are ignored when resolving percentage values that would refer to it:
        the closest non-anonymous ancestor box is used instead."
        When figuring out whether auto height needs to be applied on the current box, ignore anonymous
        ancestors until the first non-anonymous containing block is found. This matches both
        Firefox and Opera behaviour.
        
        Test: fast/replaced/iframe-with-percentage-height-within-table-with-anonymous-table-cell.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::hasAutoHeightOrContainingBlockWithAutoHeight): Switch from
        isAnonymousBlock() to isAnonymous() to make sure all anonymous boxes are ignored.
        Remove isTableCell() check which is a noop as table cell isn't an anonymous block.
        
2013-03-27  Pierre Rossi  <pierre.rossi@gmail.com>

        [Qt] Add WOFF support when using zlib
        https://bugs.webkit.org/show_bug.cgi?id=112805

        Reviewed by Allan Sandfeld Jensen.

        Covered by existing test:
        fast/css/font-face-woff.html

        * Target.pri: Conditional inclusion of WOFFFileFormat
        * platform/graphics/qt/FontCustomPlatformDataQt.cpp:
        (WebCore::createFontCustomPlatformData): Try to unpack WOFF data, otherwise spit out a warning and bail.
        (WebCore::FontCustomPlatformData::supportsFormat): accept WOFF webfonts if USE(ZLIB).

2013-03-27  Robert Hogan  <robert@webkit.org>

        Growing a position:absolute element in a position:relative one in a table does not update scrollHeight
        https://bugs.webkit.org/show_bug.cgi?id=111977

        Reviewed by David Hyatt.

        During simplified layout tables still need to know about overflow from positioned objects in any of
        their cells.

        Test: fast/table/cell-overflow-simplified-layout.html

        * rendering/RenderBlock.h:
        (RenderBlock):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::simplifiedNormalFlowLayout):
        (WebCore):
        * rendering/RenderTable.h:
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        (WebCore):
        (WebCore::RenderTableSection::computeOverflowFromCells):
        * rendering/RenderTableSection.h:
        (RenderTableSection):

2013-03-22  Geoffrey Garen  <ggaren@apple.com>

        Honor the setting for whether JavaScript markup is enabled
        https://bugs.webkit.org/show_bug.cgi?id=113122

        Reviewed by Ryosuke Niwa.

        * dom/ScriptableDocumentParser.cpp:
        (WebCore::ScriptableDocumentParser::ScriptableDocumentParser): Applied the
        setting here, so all document parsing would be covered. This is similar
        to what we do for plug-in stripping.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertForeignElement): Fixed a bug where
        we would insert an SVG script element into the document even in script
        markup disabled mode.

        (This bug has existed for copy/paste for a long time, but other bugs and
        quirks in SVG copy/paste papered over it. It's a serious issue now
        that non-paste clients will rely on this mode.)

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processTokenInForeignContent): Fixed the same
        bug -- this time in the part of the parser that executes scripts as they
        parse.

        I adopted the toScriptElement() convention for testing for a script
        element to match the XML parser.

2013-03-27  Dean Jackson  <dino@apple.com>

        Chromium Mac fails to build after r146995 because the new NSFont category
        may conflict with the system. Add the WebCoreTheme category to the whitelist.

        Unreviewed.

        * WebCore.gyp/WebCore.gyp:

2013-03-27  Ryosuke Niwa  <rniwa@webkit.org>

        Selection code spends a lot of time in InlineTextBox::localSelectionRect
        https://bugs.webkit.org/show_bug.cgi?id=113364

        Reviewed by Enrica Casucci.

        Avoid computing the font width when we're selecting the entire line box.

        This appears to be 25-26% improvement on Interactive/SelectAll:Time.

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::localSelectionRect):

2013-03-26  Timothy Hatcher  <timothy@apple.com>

        Add support for dock-to-right of the Web Inspector in the Mac port.

        Unfortunately this requires Safari changes, so it is disabled in the nightly builds.

        https://webkit.org/b/113341
        rdar://problem/10368152

        Reviewed by Joseph Pecoraro.

        * WebCore.exp.in:
        * inspector/InspectorFrontendClient.h:
        (InspectorFrontendClient):
        * inspector/InspectorFrontendClientLocal.cpp:
        (WebCore):
        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
        (WebCore::InspectorFrontendClientLocal::requestSetDockSide):
        (WebCore::InspectorFrontendClientLocal::canAttachWindow):
        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowWidth):
        (WebCore::InspectorFrontendClientLocal::setAttachedWindow):
        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowWidth):
        * inspector/InspectorFrontendClientLocal.h:
        (InspectorFrontendClientLocal):
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::setAttachedWindowWidth):
        (WebCore):
        * inspector/InspectorFrontendHost.h:
        (InspectorFrontendHost):
        * inspector/InspectorFrontendHost.idl:
        * inspector/front-end/InspectorFrontendHostStub.js:
        (.WebInspector.InspectorFrontendHostStub.prototype.setAttachedWindowWidth):
        * inspector/front-end/externs.js:
        (InspectorFrontendHostAPI.prototype.setAttachedWindowWidth):
        * testing/Internals.cpp:

2013-03-27  Eric Carlson  <eric.carlson@apple.com>

        [Mac] webkitClosedCaptionsVisible doesn't work
        https://bugs.webkit.org/show_bug.cgi?id=113417

        Reviewed by Jer Noble.

        Test: media/track/track-in-band-legacy-api.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Delete m_disableCaptions, it is no longer used.
        (WebCore::HTMLMediaElement::configureTextTrackGroup): Pass this to textTrackSelectionScore.
        (WebCore::HTMLMediaElement::setClosedCaptionsVisible):  Delete m_disableCaptions, it is no longer used.
        * html/HTMLMediaElement.h: Ditto.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::textTrackSelectionScore): Add an HTMLMediaElement parameter.
        * page/CaptionUserPreferences.h:

        * page/CaptionUserPreferencesMac.h:
        * page/CaptionUserPreferencesMac.mm:
        (WebCore::CaptionUserPreferencesMac::textTrackSelectionScore): Return a score if the media element
            is showing captions, even if the preference says captions are disabled.

2013-03-27  Eric Carlson  <eric.carlson@apple.com>

        [Mac] Text track menu items sometimes labeled incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=113406

        Reviewed by Jer Noble.

        media/video-controls-captions-trackmenu-localized.html was updated to test this.

        * page/CaptionUserPreferencesMac.mm:
        (WebCore::trackDisplayName): Use the 'label' attribute for the menu text when necessary.

2013-03-27  Sergio Villar Senin  <svillar@igalia.com>

        Inserting a blank (" ") at the end of a line does not insert anything in Overtype mode
        https://bugs.webkit.org/show_bug.cgi?id=113413

        Reviewed by Ryosuke Niwa.

        Perform a "normal" insert instead of a replace when there is
        nothing to replace (like at the end of a line) as this case is not
        supported by the replacing code path. This will allow us to
        properly rebalance whitespaces in those cases.

        Updated the editing/execCommand/overtype.html test to check also
        this use case.

        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::setEndingSelectionWithoutValidation):
        (WebCore::InsertTextCommand::performTrivialReplace):
        (WebCore::InsertTextCommand::performOverwrite):
        (WebCore::InsertTextCommand::doApply): use the recently added
        setEndingSelectionWithoutValidation() to avoid code duplication.
        * editing/InsertTextCommand.h:
        (InsertTextCommand):

2013-03-27  Dean Jackson  <dino@apple.com>

        [Mac] Use fontName rather than familyName for internal fonts
        https://bugs.webkit.org/show_bug.cgi?id=113392
        <rdar://problem/13474743>

        Reviewed by Enrica Casucci.

        Some internal fonts on OS X have a family name that
        isn't listed in availableFontFamilies. In this case
        we should use the font name rather than the family
        name when looking for a match.

        * platform/mac/ThemeMac.h: NSFont category to provide a web-friendly family name.
        * platform/mac/ThemeMac.mm:
        (-[NSFont webCoreFamilyName]): Returns the font name for internal fonts, otherwise the family name.
        (WebCore::ThemeMac::controlFont):
        * rendering/RenderThemeMacShared.mm: Use the webCoreFamilyName.
        (WebCore::RenderThemeMacShared::systemFont): Ditto.
        (WebCore::RenderThemeMacShared::setFontFromControlSize): Ditto.

2013-03-26  Jer Noble  <jer.noble@apple.com>

        Mac: Media Controls always hide time display elements
        https://bugs.webkit.org/show_bug.cgi?id=113355

        Reviewed by Eric Carlson.

        No new tests; rebaselined existing tests against correct behavior.

        A prior commit set the "min-width:0" property on the time display elements, which, combined
        with the "-webkit-flex-box:0 0" setting, caused the flex-box container to collapse the width
        of the elements to zero. To achieve the desired effect of hiding the time display elements,
        first set the elements' min-width to the desired width, as the new flex-box spec treats the
        default value of "min-width:auto" as the intrinsic width, and will collapse the text display
        elements to the intrinsic width of its contained text node.

        The above allows the timeline container to collapse beyond the sum of its childrens'
        intrinsic width. Create a custom renderer that detects when this happens, and hide the time
        display controls.

        * css/mediaControls.css:
        * css/mediaControlsQuickTime.css:
        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
            Set the "min-width:" property to equal the "width:" property.
        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
            Ditto.
        * css/mediaControlsChromium.css:
        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
            Chromium assumes the time display controls are flex-boxes, so make that explicit.
        * html/shadow/MediaControlElementTypes.cpp: Removed MediaControlTimeDisplayElement::createRenderer().
        * html/shadow/MediaControlElementTypes.h:
        (MediaControlTimeDisplayElement): Ditto.
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTimelineContainerElement::setTimeDisplaysHidden): Added, walks through the 
            container's children and shows or hides time display elements.
        (WebCore::MediaControlTimelineContainerElement::createRenderer): Added, creates a RenderMediaControlTimelineContainer.
        (WebCore::getMediaControlTimeRemainingDisplayElementShadowPseudoId): Added, allow setTimeDisplaysHidden to
            query against children's shadowPseudoId().
        (WebCore::MediaControlTimeRemainingDisplayElement::shadowPseudoId): Moved contents to getMediaControlTimeRemainingDisplayElementShadowPseudoId.
        (WebCore::getMediaControlCurrentTimeDisplayElementShadowPseudoId): Added, allow setTimeDisplaysHidden to
            query against children's shadowPseudoId().
        (WebCore::MediaControlCurrentTimeDisplayElement::shadowPseudoId): Moved contents to getMediaControlCurrentTimeDisplayElementShadowPseudoId.
        * html/shadow/MediaControlElements.h:
        (MediaControlTimelineContainerElement):
        * rendering/RenderMediaControlElements.cpp:
        (WebCore::RenderMediaControlTimelineContainer::RenderMediaControlTimelineContainer): Added, simple constructor.
        (WebCore::RenderMediaControlTimelineContainer::layout): Detect when the controller's width is greater than
            a certain value, and show or hide the time display elements in response.
        * rendering/RenderMediaControlElements.h:
        (RenderMediaControlTimelineContainer):

2013-03-27  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: CPU profiler. Swap FlameChart with Data Grid.
        https://bugs.webkit.org/show_bug.cgi?id=113395

        Reviewed by Pavel Feldman.

        Looks like FlameChart is more powerful and flexible instrument
        than plain old ProfileTree in DataGrid. The same action like
        'look for the most expensive function in a frame' could be easily
        done with FlameChart and need number of clicks in DataGrid.
        So in an offline discussion we decided to place FlameChart on top of DataGrid.

        * inspector/front-end/CPUProfileView.js:

2013-03-27  Chris Fleizach  <cfleizach@apple.com>

        Regression in tests due to https://bugs.webkit.org/show_bug.cgi?id=113339
        https://bugs.webkit.org/show_bug.cgi?id=113361

        Fix the red bots. No review.

        Ensure only pop-up buttons get the AXRequired attribute instead of all buttons.        

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):

2013-03-27  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Breakpoint manager should restore breakpoints when uiSourceCode is added.
        https://bugs.webkit.org/show_bug.cgi?id=113381

        Reviewed by Pavel Feldman.

        Breakpoint manager now restores breakpoints on UISourceCodeAdded event.
        Breakpoint manager now only resets breakpoints in debugger when source mapping is changed to/from non identity one.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.prototype._uiSourceCodeAdded):
        (WebInspector.BreakpointManager.prototype._resetBreakpoints):
        (WebInspector.BreakpointManager.prototype._uiSourceCodeMappingChanged):
        * inspector/front-end/CompilerScriptMapping.js:
        (WebInspector.CompilerScriptMapping.prototype.get isIdentity):
        * inspector/front-end/DefaultScriptMapping.js:
        (WebInspector.DefaultScriptMapping.prototype.isIdentity):
        * inspector/front-end/ResourceScriptMapping.js:
        (WebInspector.ResourceScriptMapping.prototype.isIdentity):
        * inspector/front-end/SASSSourceMapping.js:
        (WebInspector.SASSSourceMapping.prototype.isIdentity):
        * inspector/front-end/ScriptSnippetModel.js:
        (WebInspector.SnippetScriptMapping.prototype.isIdentity):
        * inspector/front-end/SourceMapping.js:
        (WebInspector.SourceMapping.prototype.isIdentity):
        * inspector/front-end/StylesSourceMapping.js:
        (WebInspector.StylesSourceMapping.prototype.isIdentity):
        * inspector/front-end/UISourceCode.js:
        (WebInspector.UISourceCode.prototype.setSourceMapping):

2013-03-27  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: update Timeline.TimelineEvent definition to include DOM counters and native memory stats
        https://bugs.webkit.org/show_bug.cgi?id=113376

        Reviewed by Vsevolod Vlasov.

        Fixed assertion failure in debug mode after r146975.

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline):

2013-03-27  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: FlameChart. Provide 15px padding left for the chart so developers will see the first divider with '0' title.
        https://bugs.webkit.org/show_bug.cgi?id=113404

        Reviewed by Pavel Feldman.

        15px paddingLeft was added to the code for the chart.

        * inspector/front-end/FlameChart.js:
        (WebInspector.FlameChart):
        (WebInspector.FlameChart.Calculator.prototype._updateBoundaries):
        (WebInspector.FlameChart.Calculator.prototype.computePosition):
        (WebInspector.FlameChart.prototype.draw):

2013-03-27  Kent Tamura  <tkent@chromium.org>

        Rename HTMLFormControlElement::readOnly to isReadOnly
        https://bugs.webkit.org/show_bug.cgi?id=113297

        Reviewed by Alexey Proskuryakov.

        HTMLFormControlElement::readOnly is not an implementation of
        'readOnly' IDL attribute. It's confusing and we don't need to
        violate our naming convention.

        No new tests. Just a refactoring.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::isReadOnly):
        * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
        (WebCore::BaseMultipleFieldsDateAndTimeInputType::isEditControlOwnerReadOnly):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
        (WebCore::HTMLFormControlElement::parseAttribute):
        * html/HTMLFormControlElement.h:
        (WebCore::HTMLFormControlElement::isReadOnly):
        (WebCore::HTMLFormControlElement::isDisabledOrReadOnly):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::matchesReadOnlyPseudoClass):
        (WebCore::HTMLInputElement::matchesReadWritePseudoClass):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::matchesReadOnlyPseudoClass):
        (WebCore::HTMLTextAreaElement::matchesReadWritePseudoClass):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::defaultEventHandler):
        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents):
        (WebCore::SliderThumbElement::willRespondToMouseClickEvents):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents):
        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::TextFieldDecorationElement::updateImage):
        * rendering/RenderTextControl.cpp:
        (WebCore::updateUserModifyProperty):
        * rendering/RenderThemeMacShared.mm:
        (WebCore::RenderThemeMacShared::paintSearchFieldCancelButton):

2013-03-27  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: update Timeline.TimelineEvent definition to include DOM counters and native memory stats
        https://bugs.webkit.org/show_bug.cgi?id=113376

        Reviewed by Vsevolod Vlasov.

        Added missing fields to Timeline.TimelineEvent type definition in Inspector.json

        * inspector/Inspector.json:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline):
        (WebCore::InspectorTimelineAgent::setDOMCounters):
        Switched InspectorTimelineAgent to the new typed event builders.
        (WebCore::InspectorTimelineAgent::setNativeHeapStatistics):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):

2013-03-27  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Follow-up to r146898: test that uiSourceCodes are not leaking in breakpoint manager.
        https://bugs.webkit.org/show_bug.cgi?id=113368

        Reviewed by Pavel Feldman.

        Added a missed line and a test.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.prototype._projectWillReset):

2013-03-27  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: [CodeMirror] CodeMirrorTextEditor.highlightRange has bugs
        https://bugs.webkit.org/show_bug.cgi?id=113348

        Reviewed by Vsevolod Vlasov.

        No new tests.

        - Append additional "<class>-start" class to the first highlighted span
        and "<class>-end" class to the last highlighted span to provide a way
        to set up a css classes with borders.
        - Increment end column of the markup range to simulate inclusive range.

        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor.prototype.highlightRange):

2013-03-27  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: Add isClean/markClean method pair to textEditor.js
        https://bugs.webkit.org/show_bug.cgi?id=112815

        Reviewed by Vsevolod Vlasov.

        No new tests: no change in behaviour.

        - Add TextEditor.isClean and TextEditor.markClean methods
        - Implement these methods in DefaultTextEditor
        - Implement these methods in CodeMirrorTextEditor

        * inspector/front-end/CodeMirrorTextEditor.js:
        (WebInspector.CodeMirrorTextEditor.prototype.isClean):
        (WebInspector.CodeMirrorTextEditor.prototype.markClean):
        * inspector/front-end/DefaultTextEditor.js:
        (WebInspector.DefaultTextEditor.prototype.isClean):
        (WebInspector.DefaultTextEditor.prototype.markClean):
        * inspector/front-end/TextEditor.js:
        (WebInspector.TextEditor.prototype.isClean):
        (WebInspector.TextEditor.prototype.markClean):
        * inspector/front-end/TextEditorModel.js:
        (WebInspector.TextEditorModel.endsWithBracketRegex.):

2013-03-27  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed. Web Inspector. rename method Timeline.Calculator.grandMinimumBoundary to Timeline.Calculator.zeroTime

        No changes in behaviour.

        * inspector/front-end/FlameChart.js:
        (WebInspector.FlameChart.Calculator.prototype.zeroTime):
        (WebInspector.FlameChart.OverviewCalculator.prototype.zeroTime):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkBaseCalculator.prototype.zeroTime):
        * inspector/front-end/TimelineGrid.js:
        (WebInspector.TimelineGrid.prototype.updateDividers):
        (WebInspector.TimelineGrid.Calculator.prototype.zeroTime):
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewCalculator.prototype.zeroTime):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelineCalculator.prototype.zeroTime):

2013-03-26  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: Timeline. Scroll dividers with the underlying events.
        https://bugs.webkit.org/show_bug.cgi?id=113315

        Reviewed by Pavel Feldman.

        Now when TimelineGrid is able to draw dividers with any offset
        we could cut away paddingLeft member of Timeline.Calculator
        and clear the code of TimelineGrid.

        * inspector/front-end/TimelineGrid.js:
        (WebInspector.TimelineGrid.prototype.updateDividers):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelinePanel.prototype._refresh):
        (WebInspector.TimelineCalculator.prototype.computePosition):
        (WebInspector.TimelineCalculator.prototype.setDisplayWindow):
        (WebInspector.TimelineCalculator.prototype.grandMinimumBoundary):
        * inspector/front-end/inspectorCommon.css:
        (.resources-dividers-label-bar):

2013-03-27  Kondapally Kalyan  <kalyan.kondapally@intel.com>

        [CoordGfx] Support to share GraphicsSurface flags with client.
        https://bugs.webkit.org/show_bug.cgi?id=112982

        Reviewed by Noam Rosenthal.

        Covered by existing WebGL tests.

        This patch adds support to pass GraphicsSurface flags during it's client creation.
        This would be helpful to determine cases when blending can be disabled on client
        side i.e When AlphaSupport is disabled during Graphics Surface creation.
        With GLX, we rely on Window to provide us with necessary information on client side.
        This might not be the case on other platforms or when not using Window on X.
        This patch doesn't change original behaviour of creating GraphicsSurface client
        with default flags GraphicsSurface::SupportsTextureTarget and GraphicsSurface::SupportsSharing.

        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
        (WebCore::TextureMapperPlatformLayer::graphicsSurfaceFlags):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::createCanvasIfNeeded):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
        (WebCore::CoordinatedGraphicsScene::createCanvasIfNeeded):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsState.h:
        (CoordinatedGraphicsLayerState):
        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
        (WebCore):
        (WebCore::GraphicsContext3DPrivate::graphicsSurfaceFlags):
        * platform/graphics/efl/GraphicsContext3DPrivate.h:
        (GraphicsContext3DPrivate):
        * platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
        (WebCore::GraphicsSurfacePrivate::initializeClient):

2013-03-26  Takashi Sakamoto  <tasak@google.com>

        [shadow] styleForText should consider the case where parent node has no style
        https://bugs.webkit.org/show_bug.cgi?id=113275

        If a text node is distributed, its parent node for rendering and
        styling might have no style. In the case, styleForText should return
        default style.

        Reviewed by Hajime Morrita.

        Test: fast/dom/shadow/text-node-distributed-crash.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForText):
        Check whether a parent node has any style or not. If not, return
        default style. This is the same behavior as styleForElement.

2013-03-26  Takeshi Yoshino  <tyoshino@chromium.org>

        Make SocketStreamHandle (Chromium port) fully use IPC window in send()
        https://bugs.webkit.org/show_bug.cgi?id=113304

        Reviewed by Kent Tamura.

        socket_stream of Chromium buffers send data up to 32KiB (exact) bytes.

        However, SocketStreamHandleInternal::send() method now keeps in-flight
        send data not greater than m_maxPendingSendAllowed - 1 that is
        32KiB - 1. This means that SocketStreamHandleInternal consumes the
        buffered data in SocketStreamHandleBase by 32KiB - 1. It makes memory
        copy operations unaligned unnecessarily. It should just use the
        allowed size fully.

        * platform/network/chromium/SocketStreamHandle.cpp:
        (WebCore::SocketStreamHandleInternal::send):
        (WebCore):

2013-03-26  Hayato Ito  <hayato@chromium.org>

        Allow ShadowContents in HitTests by default.
        https://bugs.webkit.org/show_bug.cgi?id=113171

        Reviewed by Dimitri Glazkov.

        HitTestRequest is widely used in WebCore, but AllowShadowContents
        flag is not turned on by default.  In most places, we can set the
        flag on.

        This change makes HitTests allow shadow contents by default.

        To track all existing HitTests which do not allow shadow contents,
        and discourage such a HitTest in the future, I've introduced
        disallowShadowContenet flag so that callers must turn on this flag
        explicitly if they want to disallow shadow contents in their HitTests.

        This change should be refactoring and should not include any
        behavior changes.  After this change, we'll investigate each place
        where disallowShadowContents is used step by step and get rid of
        the flag if it is okay to remove.

        No new tests, no behavior change.

        * dom/Document.h:
        (Document):
        * dom/TreeScope.cpp:
        (WebCore::nodeFromPoint):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::contains):
        * page/DragController.cpp:
        (WebCore::elementUnderMouse):
        (WebCore::DragController::canProcessDrag):
        (WebCore::DragController::startDrag):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseDraggedEvent):
        (WebCore::EventHandler::eventMayStartDrag):
        (WebCore::EventHandler::updateSelectionForMouseDrag):
        (WebCore::EventHandler::hitTestResultAtPoint):
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::EventHandler::handleMouseDoubleClickEvent):
        (WebCore::EventHandler::handleMouseMoveEvent):
        (WebCore::EventHandler::handleMouseReleaseEvent):
        (WebCore::EventHandler::updateDragAndDrop):
        (WebCore::EventHandler::isInsideScrollbar):
        (WebCore::EventHandler::handleWheelEvent):
        (WebCore::EventHandler::handleGestureEvent):
        (WebCore::EventHandler::handleGestureLongPress):
        (WebCore::EventHandler::handleGestureScrollBegin):
        (WebCore::EventHandler::bestClickableNodeForTouchPoint):
        (WebCore::EventHandler::bestContextMenuNodeForTouchPoint):
        (WebCore::EventHandler::bestZoomableAreaForTouchPoint):
        (WebCore::EventHandler::sendContextMenuEvent):
        (WebCore::EventHandler::sendContextMenuEventForKey):
        (WebCore::EventHandler::hoverTimerFired):
        (WebCore::EventHandler::dragSourceEndedAt):
        (WebCore::EventHandler::handleDrag):
        (WebCore::EventHandler::handleTouchEvent):
        (WebCore::EventHandler::dispatchSyntheticTouchEventIfEnabled):
        * page/EventHandler.h:
        (EventHandler):
        * page/FocusController.cpp:
        (WebCore::updateFocusCandidateIfNeeded):
        * page/Frame.cpp:
        (WebCore::Frame::visiblePositionForPoint):
        * page/TouchDisambiguation.cpp:
        (WebCore::findGoodTouchTargets):
        * rendering/HitTestRequest.h:
        (WebCore::HitTestRequest::disallowsShadowContent):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::hitTestFlowThreadPortionInRegion):
        * rendering/svg/RenderSVGResourceClipper.cpp:
        (WebCore::RenderSVGResourceClipper::hitTestClipContent):
        * testing/Internals.cpp:
        (WebCore::Internals::nodesFromRect):

2013-03-26  Tim Horton  <timothy_horton@apple.com>

        [ca] Tell CA to clean up unused resources if a given WebProcess won't be drawing
        https://bugs.webkit.org/show_bug.cgi?id=107539
        <rdar://problem/13032692>

        Reviewed by Simon Fraser.

        Update WebCoreSystemInterface.

        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:

2013-03-26  Antti Koivisto  <antti@apple.com>

        Test if non-immediate descendants obscure background
        https://bugs.webkit.org/show_bug.cgi?id=113137

        Reviewed by Simon Fraser.

        The current obscuration test only covers immediate children. We can find more cases by looking deeper into descendants.
        
        The patch makes the test sufficiently smart to stop a heavy fully obscured gif animation on micrsoft.com.

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::animationAdvanced):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):
        
            Invalidate parents to max test depth.

        (WebCore::RenderBox::backgroundPaintedExtent):
        
            Background painting is pixel snapped.

        (WebCore::isCandidateForOpaquenessTest):
        (WebCore::RenderBox::foregroundIsKnownToBeOpaqueInRect):
        
            Separate foreground testing and make it recursive.
            Add fast bailout for common static positioned case.
            Remove maximum child count, the fast bailouts should prevent long tests.
            Add maximum depth so we know how deep we need to invalidate in styleDidChange.

        (WebCore::RenderBox::computeBackgroundIsKnownToBeObscured):
        (WebCore):
        * rendering/RenderBox.h:
        (RenderBox):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::foregroundIsKnownToBeOpaqueInRect):
        (WebCore):
        (WebCore::RenderImage::computeBackgroundIsKnownToBeObscured):
        
        * rendering/RenderImage.h:
        (RenderImage):

2013-03-26  Benjamin Poulain  <bpoulain@apple.com>

        Regression (r145601): out-of-bounds read in line breaking / new width cache
        https://bugs.webkit.org/show_bug.cgi?id=113347

        Reviewed by Geoffrey Garen.

        The values zero and 0xffff have special values with the default HashTraits. Those values
        are also valid values for UChar.

        To avoid any table inconsitency, switch from UChar to uint32_t as the key type for
        the WidthCache's single char map. The traits is also changed to allow zero as a normal
        value.

        This makes no space or time change over the previous code because:
        -The struct KeyValuePair was already 64bits due to the ABI alignment restrictions on floats.
        -The two hashes take the same number of instructions.

        * platform/graphics/WidthCache.h:
        (WidthCache):

2013-03-26  Kent Tamura  <tkent@chromium.org>

        Make HTMLProgressElement::isDeterminate private
        https://bugs.webkit.org/show_bug.cgi?id=113299

        Reviewed by Kentaro Hara.

        The only callsite of isDeterminate outside of HTMLProgressElement
        is in StyleResolver::sharingCandidateHasIdenticalStyleAffectingAttributes,
        and we can replace it with Element::shouldAppearIndeterminate.

        No new tests. Just a refactoring.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::sharingCandidateHasIdenticalStyleAffectingAttributes):
        Use Element::shouldAppearIndeterminate.
        * html/HTMLProgressElement.h:
        (HTMLProgressElement): Make isDeterminate private.

2013-03-26  David Grogan  <dgrogan@chromium.org>

        IndexedDB: Histogram cause of LevelDB write errors
        https://bugs.webkit.org/show_bug.cgi?id=113350

        Reviewed by Tony Chang.

        Add histogram for source of LevelDB errors on Write in addition to
        Open.

        No new tests - no good way to test histogram code.

        * platform/leveldb/LevelDBDatabase.cpp:
        (WebCore::histogramLevelDBError):
        (WebCore):
        (WebCore::LevelDBDatabase::open):
        (WebCore::LevelDBDatabase::write):

2013-03-26  Chris Fleizach  <cfleizach@apple.com>

        WebKit does not expose @required or @aria-required as AXRequired on select elements
        https://bugs.webkit.org/show_bug.cgi?id=113339

        Reviewed by Tim Horton.

        Make sure button types can return the AXRequired attribute.

        Tests: platform/mac/accessibility/aria-required-popup-button.html

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):

2013-03-26  Dean Jackson  <dino@apple.com>

        When a primary plugin is restarted, also start similar plugins
        https://bugs.webkit.org/show_bug.cgi?id=113265

        Reviewed by Tim Horton.

        If we detect a primary plugin that is snapshotted, we immediately restart it.
        When this happens, we should also restart any other plugins that
        match the same origin and type. This allows sites with a lot of
        (geometrically) nearby plugins to behave as if they are a single big plugin.

        Tests: plugins/snapshotting/autoplay-similar-to-dominant-after-delay.html
               plugins/snapshotting/autoplay-similar-to-dominant.html

        * WebCore.exp.in: Export mimeTypeFromURL.
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::addPlugInsFromNodeListMatchingPlugInOrigin): Use loadedMimeType helper.
        (WebCore::HTMLPlugInImageElement::restartSimilarPlugIns): New method, which copied the
            existing code from userDidClickSnapshot.
        (WebCore::HTMLPlugInImageElement::userDidClickSnapshot): Move the similar plugin detection
            out into another function and call it.
        (WebCore::HTMLPlugInImageElement::setIsPrimarySnapshottedPlugIn): Call restartSimilarPlugIns.
        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Use loadedMimeType helper.
        * html/HTMLPlugInImageElement.h: Declaration of restartSimilarPlugIns.
        (WebCore::HTMLPlugInImageElement::loadedMimeType): New helper method since this
            code was being often duplicated.

2013-03-26  Brent Fulgham  <bfulgham@webkit.org>

        [Windows, WinCairo] Scroll offset being applied to plugins during print operations.
        https://bugs.webkit.org/show_bug.cgi?id=39889

        Reviewed by Anders Carlsson.

        This must be tested manually. See the issue for details.

        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginView::paintWindowedPluginIntoContext):
        Revise the Windows implementation of the PluginView class
        paintWindowedPluginIntoContext to use the containing window
        position when computing the plugin's position for printing.

2013-03-26  Xianzhu Wang  <wangxianzhu@chromium.org>

        Non-paintsContent fixed position layer should not cause slow scrolling
        https://bugs.webkit.org/show_bug.cgi?id=113238

        Reviewed by James Robinson.

        Added NotCompositedForNoVisibleContent in ViewportConstrainedNotCompositedReason and set it in RLC.

        Test: compositing/layer-creation/fixed-position-no-content-scroll-reason.html

        * rendering/RenderLayer.h: Add NotCompositedForNoVisibleContent.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition): Set NotCompositedForNoVisibleContent reason when the fixed position layer has no visible content.

2013-03-26  Zoltan Horvath  <zoltan@webkit.org>

        [CSS Exclusions] The radius of a circle should be computed based on the shorter available dimension
        https://bugs.webkit.org/show_bug.cgi?id=113255

        Reviewed by Julien Chaffraix.

        When we decide what should be the radius of a circle, we should choose the smallest available space. For instance when the
        width or height is not resolvable for the circle we should not have a radius for it. This change modifies the behavior to
        use the smaller available space, so we won't render unnecessary circle shapes.

        Test: fast/exclusions/shape-inside/shape-inside-on-nested-container-with-unresolved-height.html

        * rendering/ExclusionShape.cpp:
        (WebCore::ExclusionShape::createExclusionShape):

2013-03-26  Timothy Hatcher  <timothy@apple.com>

        Make the Web Inspector console work in strict mode with JavaScriptCore.

        https://webkit.org/b/65829
        rdar://problem/11271238

        Reviewed by Joseph Pecoraro.

        * inspector/InjectedScriptSource.js:
        (InjectedScript.prototype._evaluateOn): Don't use 'eval' parameter (it isn't
        allowed in strict mode). Swap window.eval with our known eval instead.

2013-03-26  Ryosuke Niwa  <rniwa@webkit.org>

        Heap-use-after-free regression
        https://bugs.webkit.org/show_bug.cgi?id=113337

        Reviewed by Abhishek Arya and Alexey Proskuryakov.

        Use RefPtr instead of raw pointer in m_associatedFormControls.

        * dom/Document.cpp:
        (WebCore::Document::didAssociateFormControlsTimerFired):
        * dom/Document.h:
        (Document):
        * loader/EmptyClients.h:
        (WebCore::EmptyChromeClient::didAssociateFormControls):
        * page/ChromeClient.h:
        (WebCore::ChromeClient::didAssociateFormControls):

2013-03-26  Alexey Proskuryakov  <ap@apple.com>

        <rdar://problem/13194263> Crashes in NetworkProcess due to threading issues
        https://bugs.webkit.org/show_bug.cgi?id=113256

        Reviewed by Brady Eidson.

        Added a new code path in ResourceHandle/ResourceHandleClient that doesn't need
        blocking calls. Implemented it for NSURLConnection by changing NSOperationQueue
        version to forward calls to main thread.

        * WebCore.exp.in: Export new methods.
        * WebCore.xcodeproj/project.pbxproj: Added WebCoreResourceHandleAsOperationQueueDelegate.

        * platform/network/CredentialStorage.cpp: Assert that unprotected global map operations
        happen on main thread.

        * platform/network/ResourceHandle.cpp: Added default implementations of functions
        that handle async responses.

        * platform/network/chromium/ResourceHandle.cpp: Ditto.

        * platform/network/ResourceHandle.h: Added functions that are called in response
        to new async functions in ResourceHandleClient. Changed Mac delegate type to id,
        ast can now be either WebCoreResourceHandleAsDelegate or WebCoreResourceHandleAsOperationQueueDelegate.

        * platform/network/ResourceHandleClient.cpp:
        (WebCore::ResourceHandleClient::willSendRequestAsync):
        (WebCore::ResourceHandleClient::shouldUseCredentialStorageAsync):
        (WebCore::ResourceHandleClient::canAuthenticateAgainstProtectionSpaceAsync):
        (WebCore::ResourceHandleClient::willCacheResponseAsync):
        Default implementations of async client functions. These match default behavior of
        sync versions.

        * platform/network/ResourceHandleClient.h: Added async functions. A ResourceHandle
        should use these when the client returns true from usesAsyncCallbacks().

        * platform/network/ResourceHandleInternal.h: Changed to use id for delegate type
        here, too.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::delegate): Create an appropriate delegate for the client.
        (WebCore::ResourceHandle::willSendRequest): Since this function has a lot of common
        behavior in sync and async cases, implement the new code path as a branch inside
        it, not as a new function.
        (WebCore::ResourceHandle::continueWillSendRequest): Unblock the connection when
        response is known.
        (WebCore::ResourceHandle::shouldUseCredentialStorage): Branched here too, for consistency.
        Perhaps we'll want to break this into separate functions though.
        (WebCore::ResourceHandle::continueShouldUseCredentialStorage): Unblock the connection.
        (WebCore::ResourceHandle::canAuthenticateAgainstProtectionSpace): Same change as above.
        (WebCore::ResourceHandle::continueCanAuthenticateAgainstProtectionSpace): Ditto.
        (WebCore::ResourceHandle::continueWillCacheResponse): Ditto. Currently, delegate
        calls the client directly, so we only have a "continue" function, and no "willCacheResponse".

        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]): Removed some
        nonsense code.

        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.h: Copied from Source/WebCore/platform/network/mac/WebCoreResourceHandleAsDelegate.h.
        This delegate is responsible for forwarding calls to main thread. Unfortunately,
        this adds some code duplication, which I tried to rectify somewhat in previous patches
        by moving more logic to ResourceHandle.

        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm: Copied from Source/WebCore/platform/network/mac/WebCoreResourceHandleAsDelegate.mm.
        (-[WebCoreResourceHandleAsOperationQueueDelegate detachHandle]): Unblock waiting
        threads if we don't expect a response any more.
        (-[WebCoreResourceHandleAsOperationQueueDelegate dealloc]): Release the semaphore.
        (-[WebCoreResourceHandleAsOperationQueueDelegate continueWillSendRequest:]): Unblock
        a waiting thread with a response.
        (-[WebCoreResourceHandleAsOperationQueueDelegate continueShouldUseCredentialStorage:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate continueCanAuthenticateAgainstProtectionSpace:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate continueWillCacheResponse:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:willSendRequest:redirectResponse:]):
        Run code that uses WebCore objects on main thread.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connectionShouldUseCredentialStorage:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveAuthenticationChallenge:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didCancelAuthenticationChallenge:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:canAuthenticateAgainstProtectionSpace:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveDataArray:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveData:lengthReceived:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:willStopBufferingData:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connectionDidFinishLoading:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didFailWithError:]): Ditto.
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:willCacheResponse:]): Ditto.

2013-03-26  Tony Chang  <tony@chromium.org>

        Autogenerate the scrollAnimatorEnabled setting in Settings.in
        https://bugs.webkit.org/show_bug.cgi?id=113253

        Reviewed by James Robinson.

        Convert scrollAnimatorEnabled into an autogenerated setting. This involves renaming
        the setter from setEnableScrollAnimator(bool) to setScrollAnimatorEnabled(bool) and
        updating the callers. I didn't change any WebKit API methods.

        Also remove the code in InternalSettings since it's never used and will now be
        autogenerated with proper resetting code.

        No new tests, this is a refactor and should compile.

        * page/Settings.cpp:
        (WebCore::Settings::Settings): Remove code that is now autogenerated.
        * page/Settings.h:
        (Settings): Remove code that is now autogenerated.
        * page/Settings.in: Add entry for scrollAnimatorEnabled.
        * testing/InternalSettings.cpp: Remove unused code.
        * testing/InternalSettings.h: Remove unused code.
        * testing/InternalSettings.idl: Remove unused code.

2013-03-26  Joe Mason  <jmason@blackberry.com>

        [BlackBerry] In RSSFilterStream, don't swallow headers when there's no body
        https://bugs.webkit.org/show_bug.cgi?id=113334

        Reviewed by Rob Buis.

        RIM PR 316345

        When receiving an HTTP response that has a Content-Type header such as text/xml, but no
        body, RSSFilterStream::notifyHeadersReceived reads the Content-Type as "potential RSS", and
        calls saveHeaders. It expects to sniff the body in notifyDataReceived to see if it's RSS,
        and then call sendSavedHeaders to pass on the headers. But since there is no body,
        notifyDataReceived is never called. So call sendSavedHeaders in notifyClose too (it will not
        send them again if they were already sent.)

        * platform/network/blackberry/rss/RSSFilterStream.cpp:
        (WebCore::RSSFilterStream::notifyClose):

2013-03-26  Dmitry Zvorygin  <zvorygin@chromium.org>

        Web Inspector: Faster drawer animation.
        https://bugs.webkit.org/show_bug.cgi?id=113330

        250ms -> 100ms

        Reviewed by Pavel Feldman.

        * inspector/front-end/inspector.css:
        (.animate #main):
        (.animate #floating-status-bar-container):
        (.animate #drawer):
        (.animate #bottom-status-bar-container > *):

2013-03-26  Brent Fulgham  <bfulgham@webkit.org>

        [WinCairo] Unreviewed Build fix.

        * platform/graphics/win/FontCustomPlatformDataCairo.h:
        (FontCustomPlatformData): Correct signature in header to match
        required implementation.

2013-03-26  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Scrolling up and down can cause the screen to flash black
        https://bugs.webkit.org/show_bug.cgi?id=113269

        Reviewed by Rob Buis.

        PR 296106

        The LayerRenderer should never clear before drawing the layers, from
        now on that's the responsibility of the caller.

        Only manually testable.

        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::LayerRenderer::setViewport):
        * platform/graphics/blackberry/LayerRendererClient.h:
        (LayerRendererClient):

2013-03-26  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        [Qt] editing/pasteboard/can-read-in-dragstart-event.html and /can-read-in-copy-and-cut-events.html are crashing
        https://bugs.webkit.org/show_bug.cgi?id=113126

        Reviewed by Jocelyn Turcotte.

        Make it possible to read from a writable Clipboard.

        Test: editing/pasteboard/can-read-in-copy-and-cut-events.html

        * platform/qt/ClipboardQt.cpp:
        (WebCore::ClipboardQt::getData):
        (WebCore::ClipboardQt::types):
        (WebCore::ClipboardQt::files):
        (WebCore::ClipboardQt::readClipboardData):
        (WebCore::ClipboardQt::hasData):
        (WebCore::ClipboardQt::items):
        * platform/qt/ClipboardQt.h:
        (ClipboardQt):

2013-03-26  Brent Fulgham  <bfulgham@webkit.org>

        [WinCairo] Unreviewed build correction.

        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData): Update
        method signature to match CG variant.

2013-03-26  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Code duplication between HTTPParsers and HTTPValidation
        https://bugs.webkit.org/show_bug.cgi?id=113283

        Reviewed by Alexey Proskuryakov.

        Merged isValidHTTPToken() from HTTPValidation.h and isRFC2616Token() from
        HTTPParsers.h. They were doing exactly the same thing and their
        implementation was almost the same.

        Removed HTTPValidation.* and moved remaining code to HTTPParsers.* as this
        seems like the proper place and it seems odd to keep HTTPValidation for
        just one function.

        No new tests, no behavior change for layout tests.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/network/HTTPParsers.cpp:
        (WebCore::isValidHTTPHeaderValue):
        (WebCore):
        (WebCore::isValidHTTPToken): Implementation is slightly simplified based on
        isValidHTTPToken() from HTTPValidation.cpp. (c >= 0x80 || c == 0x7F) is
        replaced by (c >= 0x7F). (c <= 0x1F ||  c == ' ' || c == '\t') is replaced
        by (c <= 0x20). Those expressions are shorter but equivalent.
        (WebCore::contentDispositionType):
        * platform/network/HTTPParsers.h:
        * platform/network/HTTPValidation.cpp: Removed.
        * platform/network/HTTPValidation.h: Removed.
        * xml/XMLHttpRequest.cpp: Stop including HTTPValidation.h.

2013-03-26  Sergio Villar Senin  <svillar@igalia.com>

        Implement overtype mode for editable content
        https://bugs.webkit.org/show_bug.cgi?id=112126

        Reviewed by Ryosuke Niwa.

        Tests: editing/execCommand/overtype-support.html
               editing/execCommand/overtype.html

        Add a new Overwrite command to the editor. This command will
        perform overtype operations when enabled instead of "normal" text
        insertions. As IE does, we maintain a single toggle state in the
        editor (enabled/disabled) for all the editable content in the
        page.

        This new command will be only available for richly editable
        content via keybindings or the context menu. For testing purposes
        it is also accessible via internals.

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::replaceTextInNode): Use RefPtr for
        local variables.
        * editing/Editor.cpp:
        (WebCore::Editor::Editor):
        * editing/Editor.h:
        (WebCore::Editor::isOverwriteModeEnabled):
        (WebCore::Editor::toggleOverwriteModeEnabled):
        (Editor): Added two new functions and a new attribute.
        * editing/EditorCommand.cpp:
        (WebCore::executeToggleOverwrite): Enables/disables overwrite mode.
        (WebCore):
        (WebCore::createCommandMap): New OverWrite command.
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::setEndingSelectionWithoutValidation):
        Refactored from performTrivialReplace(), shared by
        performOverwrite().
        (WebCore):
        (WebCore::InsertTextCommand::performTrivialReplace):
        (WebCore::InsertTextCommand::performOverwrite):
        (WebCore::InsertTextCommand::doApply): Perform overwrite if enabled.
        * editing/InsertTextCommand.h:
        (InsertTextCommand):
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState): Reset OverWrite mode
        to false.
        (WebCore::Internals::isOverwriteModeEnabled):
        (WebCore):
        (WebCore::Internals::toggleOverwriteModeEnabled): Provide access
        to overwrite functionality in Editor for testing purposes.
        * testing/Internals.h:
        (Internals):
        * testing/Internals.idl:

2013-03-26  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] WebOverlay::pixelViewportRect() should return pixel viewport coordinates
        https://bugs.webkit.org/show_bug.cgi?id=113263

        Reviewed by Rob Buis.

        PR 312404

        Fix WebOverlay::pixelViewportRect() to return the pixel viewport rect
        instead of the window rect. These are different if the web page is
        rendered starting at a window coordinate other than 0,0. The clip rect
        encodes the position we're rendered at, and can be used to translate
        the rect expressed in window coordinates to the pixel viewport
        coordinate system.

        Also perform some cleanup of related code.

        Only manually testable.

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::getTransformedHolePunchRect):
        (WebCore::LayerCompositingThread::drawTextures):
        * platform/graphics/blackberry/LayerRenderer.cpp:
        (WebCore::toPixelCoordinates):
        (WebCore):
        (WebCore::LayerRenderer::toWindowCoordinates):
        (WebCore::LayerRenderer::toPixelViewportCoordinates):
        (WebCore::LayerRenderer::toDocumentViewportCoordinates):
        (WebCore::LayerRenderer::updateLayersRecursive):
        * platform/graphics/blackberry/LayerRenderer.h:
        (LayerRenderer):

2013-03-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r146901.
        http://trac.webkit.org/changeset/146901
        https://bugs.webkit.org/show_bug.cgi?id=113321

        Was landed to soon (Requested by pfeldman on #webkit).

        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.):
        (WebInspector.ConsoleView.prototype.filter):
        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView.scrollIntoView):
        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView):
        (WebInspector.ConsoleView.prototype._consoleMessageAdded):
        (WebInspector.ConsoleView.prototype._appendConsoleMessage):
        (WebInspector.ConsoleView.prototype._consoleCleared):
        (WebInspector.ConsoleView.prototype._handleContextMenuEvent.monitoringXHRItemAction):
        (WebInspector.ConsoleView.prototype._handleContextMenuEvent.get preserveLogItemAction):
        (WebInspector.ConsoleView.prototype._shouldBeVisible):
        (WebInspector.ConsoleView.prototype._updateMessageList):
        (WebInspector.ConsoleView.prototype._promptKeyDown):
        (WebInspector.ConsoleView.prototype._printResult):
        (WebInspector.ConsoleCommand.prototype.highlightSearchResults):
        * inspector/front-end/inspector.css:
        (.console-warning-level, .console-error-level, .console-log-level, .console-debug-level):
        (.filter-all .console-debug-level, .filter-debug .console-debug-level):
        (.filter-all .console-debug-level.repeated-message, .filter-debug .console-debug-level.repeated-message):

2013-03-26  Rafael Weinstein  <rafaelw@chromium.org>

        HTMLStackItem should include <template> as a special tag
        https://bugs.webkit.org/show_bug.cgi?id=113016

        Reviewed by Eric Seidel.

        New test added to html5lib suite.

        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::isSpecialNode):

2013-03-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: Distinguish breakpoints and breakpoint locations in BreakpointManager API
        https://bugs.webkit.org/show_bug.cgi?id=113311

        Reviewed by Pavel Feldman.

        Made independent handling of breakpoints and breakpoint location in breakpoint manager consistent.
        JavaScriptSourceFrame now removes breakpoints originally set in it based on primary UI location.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.prototype.breakpointsForUISourceCode):
        (WebInspector.BreakpointManager.prototype.allBreakpoints):
        (WebInspector.BreakpointManager.prototype.breakpointLocationsForUISourceCode):
        (WebInspector.BreakpointManager.prototype.allBreakpointLocations):
        (WebInspector.BreakpointManager.prototype._projectWillReset.get for):
        (WebInspector.BreakpointManager.prototype._projectWillReset):
        * inspector/front-end/JavaScriptSourceFrame.js:
        (WebInspector.JavaScriptSourceFrame.prototype.onUISourceCodeContentChanged):
        (WebInspector.JavaScriptSourceFrame.prototype._restoreBreakpointsAfterEditing):
        (WebInspector.JavaScriptSourceFrame.prototype._removeAllBreakpoints):

2013-03-26  Dmitry Zvorygin  <zvorygin@chromium.org>

        Web Inspector: Remove remainings of CSS-based console message filtering.
        https://bugs.webkit.org/show_bug.cgi?id=112710

        Reviewed by Pavel Feldman.

        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.get this):
        (WebInspector.ConsoleView.prototype.):
        (WebInspector.ConsoleView.prototype.filter):
        (WebInspector.ConsoleView.prototype._consoleMessageAdded):
        (WebInspector.ConsoleView.prototype._appendConsoleMessage):
        (WebInspector.ConsoleView.prototype._consoleCleared):
        (WebInspector.ConsoleView.prototype._shouldBeVisible):
        (WebInspector.ConsoleView.prototype._updateMessageList):
        (WebInspector.ConsoleView.prototype._promptKeyDown):
        (WebInspector.ConsoleView.prototype._printResult):
        (WebInspector.ConsoleCommand.prototype.highlightSearchResults):
        * inspector/front-end/inspector.css:
        (.console-debug-level.repeated-message):

2013-03-26  Peter Rybin  <prybin@chromium.org>

        Web Inspector: refactor code duplication: WebInspector.ObjectPropertyTreeElement.wrapPropertyAsElements
        https://bugs.webkit.org/show_bug.cgi?id=113211

        Reviewed by Yury Semikhatsky.

        A new method WebInspector.ObjectPropertyTreeElement.wrapPropertyAsElements is added and used
        from 2 sites.

        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
        (WebInspector.ObjectPropertiesSection.prototype.update):
        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
        (.callback):
        (WebInspector.ObjectPropertyTreeElement.populate):
        (WebInspector.ObjectPropertyTreeElement.wrapPropertyAsElements):
        * inspector/front-end/WatchExpressionsSidebarPane.js:
        (WebInspector.WatchExpressionsSection.prototype.update.appendResult):
        (WebInspector.WatchExpressionsSection.prototype.update):

2013-03-26  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        HTTPHeaderMap::copyData() could call uncheckedAppend()
        https://bugs.webkit.org/show_bug.cgi?id=113279

        Reviewed by Alexey Proskuryakov.

        HTTPHeaderMap::copyData() calls reserveInitialCapacity() on the Vector
        but then appends items using append() function. Since we already know
        the capacity is sufficient, it is more efficient to call uncheckedAppend()
        instead to bypass capacity checks.

        No new tests, no behavior change for layout tests.

        * platform/network/HTTPHeaderMap.cpp:
        (WebCore::HTTPHeaderMap::copyData):

2013-03-26  Vsevolod Vlasov  <vsevik@chromium.org>

        Web Inspector: UISourceCodes are leaking on reload sometimes.
        https://bugs.webkit.org/show_bug.cgi?id=113310

        Reviewed by Pavel Feldman.

        * inspector/front-end/BreakpointManager.js:
        (WebInspector.BreakpointManager.prototype._projectWillReset.get for):
        (WebInspector.BreakpointManager.prototype._projectWillReset):
        * inspector/front-end/ConsoleModel.js:
        (WebInspector.ConsoleModel.prototype.clearMessages):

2013-03-26  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: [Elements] Unable to "Edit as HTML" XHTML/SVG documents.
        https://bugs.webkit.org/show_bug.cgi?id=113290

        Reviewed by Pavel Feldman.

        DOMPatchSupport has been slightly augmented to handle XML (XHTML and SVG) documents.

        Test: inspector/elements/set-outer-html-for-xhtml.xhtml

        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchDocument):
        (WebCore::DOMPatchSupport::patchNode):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setOuterHTML): Let HTML, XHTML, and SVG documents through.

2013-03-26  Hajime Morrita  <morrita@google.com>

        https://bugs.webkit.org/show_bug.cgi?id=113164
        Custom Elements: readyCallback should be called for outerHTML and insertAdjecentHTML

        These APIs also create new elements thus should have V8DeliverCustomElementCallbacks attribute.

        Reviewed by Dimitri Glazkov.

        Test: Updated lifecycle-ready-creation-api.html.

        * html/HTMLElement.idl:

2013-03-26  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed. WebInspector: remove unnecessary method.

        * inspector/front-end/OverviewGrid.js:
        (WebInspector.OverviewGrid.Window):

2013-03-22  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: Flame Chart. Scroll dividers together with underlying chart.
        http://bugs.webkit.org/show_bug.cgi?id=113080

        Reviewed by Pavel Feldman.

        * inspector/front-end/FlameChart.js:
        (WebInspector.FlameChart.Calculator.prototype.grandMinimumBoundary):
        (WebInspector.FlameChart.prototype._canvasDragging):
        * inspector/front-end/TimelineGrid.js:
        (WebInspector.TimelineGrid.prototype.updateDividers):

2013-03-26  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: Flame Chart. Scroll dividers together with underlying chart.
        http://bugs.webkit.org/show_bug.cgi?id=113080

        Reviewed by Pavel Feldman.

        The only thing we need to do for this feature is to automatically adjust
        the initial offset for the dividers. I measured the speed of scrolling and found
        no difference. The speed is about 16ms so we have 60fps on dragging.

        * inspector/front-end/FlameChart.js:
        (WebInspector.FlameChart.Calculator.prototype.grandMinimumBoundary):
        (WebInspector.FlameChart.OverviewCalculator.prototype.grandMinimumBoundary):
        (WebInspector.FlameChart.prototype._canvasDragging):
        * inspector/front-end/NetworkPanel.js:
        (WebInspector.NetworkBaseCalculator.prototype.grandMinimumBoundary):
        * inspector/front-end/TimelineGrid.js:
        (WebInspector.TimelineGrid.prototype.updateDividers):
        (WebInspector.TimelineGrid.Calculator.prototype.grandMinimumBoundary):
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineOverviewCalculator.prototype.grandMinimumBoundary):
        * inspector/front-end/TimelinePanel.js:
        (WebInspector.TimelineCalculator.prototype.grandMinimumBoundary):

2013-03-26  Mike West  <mkwst@chromium.org>

        CSP 1.1: Experiment with 'base-uri' directive.
        https://bugs.webkit.org/show_bug.cgi?id=113307

        Reviewed by Jochen Eisinger.

        The 'base-uri' directive was introduced[1] as an experimental directive
        in CSP 1.1 after a bit of discussion[2][3]. The exact semantics will
        likely change, but it would be good for us to get some implementation
        experience with the API as currently specified, and to allow folks to
        play with the implementation to determine whether it meets the
        requirements the way we think it might.

        This patch is a first pass at that implementation: it will have no
        effect on ports that haven't enabled the CSP_NEXT flag.

        [1]: https://dvcs.w3.org/hg/content-security-policy/rev/4b89c246ea16
        [2]: http://lists.w3.org/Archives/Public/public-webappsec/2012Oct/0022.html
        [3]: http://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0074.html

        Tests: http/tests/security/contentSecurityPolicy/1.1/base-uri-allow.html
               http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html

        * dom/Document.cpp:
        (WebCore::Document::processBaseElement):
            Check that the new base URI is allowed by CSP before using it as
            the document's base URI.
        * page/ContentSecurityPolicy.cpp:
            Add a constant for the new directive name (and, as a drive-by, split
            the list into CSP 1.0 and CSP 1.1 for clarity).
        (CSPDirectiveList):
            Add a property to hold the base URI policy directive value.
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
            Customize the error message iff we're dealing with 'base-uri'.
        (WebCore::CSPDirectiveList::allowBaseURI):
            Check the given URI against the 'base-uri' directive's value,
            exactly as we do for every other source-list type of directive.
        (WebCore::CSPDirectiveList::addDirective):
            Accept 'base-uri' as a valid directive iff CSP_NEXT is set, and
            the embedder has opted-in via the runtime flag.
        (WebCore::ContentSecurityPolicy::allowBaseURI):
            Expose an API method on ContentSecurityPolicy to check URIs against
            the 'base-uri' directive's value.

2013-03-26  Arvid Nilsson  <anilsson@rim.com>

        [BlackBerry] Main frame fixed divs not positioned correctly
        https://bugs.webkit.org/show_bug.cgi?id=112889

        Reviewed by Carlos Garcia Campos.

        PR 283363

        This was a regression from bug #112806. It caused main frame fixed
        handling to enter the iframe/scrollable div code path in LayerRenderer.

        Fixed by not setting the container for fixed flag on the main frame,
        the LayerRenderer expects this flag to be set only on non-mainframe
        containers.

        Only manually testable.

        * page/scrolling/blackberry/ScrollingCoordinatorBlackBerry.cpp:
        (WebCore::scrollLayerForFrame):
        (WebCore):
        (WebCore::ScrollingCoordinatorBlackBerry::setLayerIsContainerForFixedPositionLayers):
        (WebCore::ScrollingCoordinatorBlackBerry::setLayerIsFixedToContainerLayer):

2013-03-26  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        FormData::deepCopy() could use Vector::uncheckedAppend()
        https://bugs.webkit.org/show_bug.cgi?id=113309

        Reviewed by Kenneth Rohde Christiansen.

        FormData::deepCopy() calls reserveInitialCapacity() on the Vector but then uses the
        regular append() method. This patch switches to using uncheckedAppend() method
        instead to bypass capacity checks as we already know it is sufficient.

        No new tests, no behavior change.

        * platform/network/FormData.cpp:
        (WebCore::FormData::deepCopy):

2013-03-26  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r146879.
        http://trac.webkit.org/changeset/146879
        https://bugs.webkit.org/show_bug.cgi?id=113312

        Multiple layout test crashes in
        WebCore::RenderListItem::updateListMarkerNumbers (Requested by
        yurys on #webkit).

        * dom/Node.cpp:
        * dom/Node.h:
        (Node):
        * dom/NodeTraversal.cpp:
        * dom/NodeTraversal.h:
        (ElementTraversal):
        (NodeTraversal):
        * html/HTMLLIElement.cpp:
        (WebCore::HTMLLIElement::attach):
        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::updateItemValues):
        (WebCore::HTMLOListElement::recalculateItemCount):
        * rendering/RenderCounter.cpp:
        (WebCore::previousInPreOrder):
        (WebCore::previousSiblingOrParent):
        (WebCore::parentElement):
        (WebCore::nextInPreOrder):
        * rendering/RenderListItem.cpp:
        (WebCore::enclosingList):
        (WebCore::RenderListItem::nextListItem):
        (WebCore::previousListItem):
        (WebCore::RenderListItem::calcValue):
        (WebCore::RenderListItem::explicitValueChanged):
        (WebCore::previousOrNextItem):
        (WebCore::RenderListItem::updateListMarkerNumbers):
        * rendering/RenderListItem.h:
        (RenderListItem):

2013-03-26  Hajime Morrita  <morrita@google.com>

        remoeveAllEventListeners() should be called to shadow trees
        https://bugs.webkit.org/show_bug.cgi?id=113037

        Reviewed by Dimitri Glazkov.

        Document::removeAllEventListeners() doesn't traverse shadow tree, but we should.
        This change override Element::removeAllEventListeners() so that it cleans its shadow trees up.

        Test: fast/dom/shadow/shadow-tree-listener-clearance.html

        * dom/Element.cpp:
        (WebCore::Element::removeAllEventListeners):
        (WebCore):
        * dom/Element.h:
        (Element):
        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::removeAllEventListeners): Added.
        (WebCore):
        * dom/ElementShadow.h:
        (ElementShadow):

2013-03-26  Andrei Bucur  <abucur@adobe.com>

        Use DOM ordering for list counts
        https://bugs.webkit.org/show_bug.cgi?id=110352

        Reviewed by Elliott Sprehn.

        Currently the list items ordering is made by traversing the render tree. This gives bad results for:
        - list items flown inside regions because they are not rendered as descendants of their DOM list ancestors.
        - list items matched to insertion points inside a shadow tree. The insertion point may be a child of a
        list so the numbering gets broken.

        To implement correct DOM ordering I've taken into account the fact that pseudo-elements can have display: list-item
        so they should be included when traversing the DOM tree. I've added helper methods on the NodeTraversal
        namespace that should allow easily traversing the tree including the pseudo-elements (e.g. firstChildWithPseudo
        for an element with pseudo-before will return the before PseudoElement). Using these helper methods I've implemented
        pre-order traversal methods aware of the pseudo-elements.
        An effect of this change is how the list items inside shadow tree update their counting. With the patch, if there's
        no <ol> or <ul> element on the ancestor chain of a <li> element to the shadow root, the list node will be considered the
        first parent of the <li> or the shadow root if there is no ancestor.
        The RenderListItem class now makes use of this new method of traversal, replacing the one based on the render tree.
        To simplify the CSS counters implementation, I've changed the traversal functions inside RenderCounter to also make use
        of this method. The CSS counters and the list items now have the same traversal algorithm.

        In later patches I'll add tests that should cover the regions and shadow DOM use cases.
        Tests bug for shadow DOM: https://bugs.webkit.org/show_bug.cgi?id=113193
        Tests bug for regions: https://bugs.webkit.org/show_bug.cgi?id=103975

        Tests: no new tests is this patch; added the correct expectations for fast/lists/positioned-count-crash.html
        and fast/dom/shadow/shadow-and-list-elements.html

        * dom/Node.cpp:
        (WebCore::Node::pseudoAwarePreviousSibling):
        (WebCore):
        (WebCore::Node::pseudoAwareNextSibling):
        (WebCore::Node::pseudoAwareFirstChild):
        (WebCore::Node::pseudoAwareLastChild):
        * dom/Node.h:
        (Node):
        * dom/NodeTraversal.cpp:
        (WebCore):
        (WebCore::NodeTraversal::previousIncludingPseudo):
        (NodeTraversal):
        (WebCore::NodeTraversal::nextIncludingPseudo):
        (WebCore::NodeTraversal::nextIncludingPseudoSkippingChildren):
        * dom/NodeTraversal.h:
        (ElementTraversal):
        (NodeTraversal):
        (WebCore::ElementTraversal::previousIncludingPseudo):
        (WebCore::ElementTraversal::nextIncludingPseudo):
        (WebCore::ElementTraversal::nextIncludingPseudoSkippingChildren):
        (WebCore::ElementTraversal::pseudoAwarePreviousSibling):
        * html/HTMLLIElement.cpp:
        (WebCore::HTMLLIElement::attach):
        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::updateItemValues):
        (WebCore::HTMLOListElement::recalculateItemCount):
        * rendering/RenderCounter.cpp:
        (WebCore::previousInPreOrder):
        (WebCore::previousSiblingOrParent):
        (WebCore::parentElement):
        (WebCore::nextInPreOrder):
        * rendering/RenderListItem.cpp:
        (WebCore):
        (WebCore::enclosingList):
        (WebCore::RenderListItem::nextListItem):
        (WebCore::previousListItem):
        (WebCore::RenderListItem::calcValue):
        (WebCore::RenderListItem::explicitValueChanged):
        (WebCore::previousOrNextItem):
        (WebCore::RenderListItem::updateListMarkerNumbers):
        * rendering/RenderListItem.h:
        (RenderListItem):

2013-03-26  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        [Qt] Poor rounding in GraphicsContext::drawLineForText
        https://bugs.webkit.org/show_bug.cgi?id=113301

        Reviewed by Jocelyn Turcotte.

        Round the position of the line decoration, so lines on subpixel
        coordinates are not always rounded up.

        * platform/graphics/qt/GraphicsContextQt.cpp: