Move ImageBuffer:clip() into GraphicsContextCG
[WebKit-https.git] / Source / WebCore / ChangeLog
index 621eb70..5eeeac3 100644 (file)
+2015-10-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Move ImageBuffer:clip() into GraphicsContextCG
+        https://bugs.webkit.org/show_bug.cgi?id=150140
+
+        Reviewed by Zalan Bujtas.
+
+        Move the guts of CG's ImageBuffer:clip() into GraphicsContextCG.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::clipToNativeImage):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::clip):
+
+2015-10-14  Brady Eidson  <beidson@apple.com>
+
+        Modern IDB: Add basic transaction committing.
+        https://bugs.webkit.org/show_bug.cgi?id=150147
+
+        Reviewed by Alex Christensen.
+
+        Test: storage/indexeddb/modern/opendatabase-versions.html
+
+        * Modules/indexeddb/IDBTransaction.h:
+
+        * Modules/indexeddb/IndexedDB.h:
+
+        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
+        (WebCore::IDBClient::IDBConnectionToServer::commitTransaction):
+        (WebCore::IDBClient::IDBConnectionToServer::didCommitTransaction):
+        * Modules/indexeddb/client/IDBConnectionToServer.h:
+        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:
+
+        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
+        (WebCore::IDBClient::IDBDatabase::startVersionChangeTransaction):
+        (WebCore::IDBClient::IDBDatabase::commitTransaction):
+        (WebCore::IDBClient::IDBDatabase::didCommitTransaction):
+        (WebCore::IDBClient::IDBDatabase::didAbortTransaction):
+        (WebCore::IDBClient::IDBDatabase::didCommitOrAbortTransaction):
+        * Modules/indexeddb/client/IDBDatabaseImpl.h:
+
+        * Modules/indexeddb/client/IDBFactoryImpl.cpp:
+        (WebCore::IDBClient::IDBFactory::open):
+
+        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
+        (WebCore::IDBClient::IDBOpenDBRequest::onSuccess):
+        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
+
+        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
+        (WebCore::IDBClient::IDBTransaction::IDBTransaction):
+        (WebCore::IDBClient::IDBTransaction::db):
+        (WebCore::IDBClient::IDBTransaction::hasPendingActivity):
+        (WebCore::IDBClient::IDBTransaction::isActive):
+        (WebCore::IDBClient::IDBTransaction::scheduleOperationTimer):
+        (WebCore::IDBClient::IDBTransaction::operationTimerFired):
+        (WebCore::IDBClient::IDBTransaction::commit):
+        (WebCore::IDBClient::IDBTransaction::didCommit):
+        (WebCore::IDBClient::IDBTransaction::fireOnComplete):
+        (WebCore::IDBClient::IDBTransaction::fireOnAbort):
+        (WebCore::IDBClient::IDBTransaction::enqueueEvent):
+        (WebCore::IDBClient::IDBTransaction::dispatchEvent):
+        * Modules/indexeddb/client/IDBTransactionImpl.h:
+        (WebCore::IDBClient::IDBTransaction::database):
+        
+        * Modules/indexeddb/legacy/LegacyTransaction.cpp:
+        (WebCore::LegacyTransaction::db):
+        * Modules/indexeddb/legacy/LegacyTransaction.h:
+        
+        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
+        (WebCore::IDBServer::IDBConnectionToClient::didCommitTransaction):
+        * Modules/indexeddb/server/IDBConnectionToClient.h:
+        * Modules/indexeddb/server/IDBConnectionToClientDelegate.h:
+        
+        * Modules/indexeddb/server/IDBServer.cpp:
+        (WebCore::IDBServer::IDBServer::registerTransaction):
+        (WebCore::IDBServer::IDBServer::unregisterTransaction):
+        (WebCore::IDBServer::IDBServer::commitTransaction):
+        * Modules/indexeddb/server/IDBServer.h:
+        
+        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
+        (WebCore::IDBServer::generateUniqueCallbackIdentifier):
+        (WebCore::IDBServer::UniqueIDBDatabase::storeCallback):
+        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
+        (WebCore::IDBServer::UniqueIDBDatabase::performCommitTransaction):
+        (WebCore::IDBServer::UniqueIDBDatabase::didPerformCommitTransaction):
+        (WebCore::IDBServer::UniqueIDBDatabase::performErrorCallback):
+        (WebCore::IDBServer::UniqueIDBDatabase::startVersionChangeTransaction): Deleted.
+        * Modules/indexeddb/server/UniqueIDBDatabase.h:
+        (WebCore::IDBServer::UniqueIDBDatabase::server):
+        
+        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::createVersionChangeTransaction):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::didCommitTransaction):
+        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:
+        
+        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
+        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::UniqueIDBDatabaseTransaction):
+        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::~UniqueIDBDatabaseTransaction):
+        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::commit):
+        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h:
+        
+        * Modules/indexeddb/shared/IDBDatabaseInfo.h:
+        (WebCore::IDBDatabaseInfo::setVersion):
+        
+        * Modules/indexeddb/shared/IDBError.cpp:
+        (WebCore::IDBError::isolatedCopy):
+        * Modules/indexeddb/shared/IDBError.h:
+
+        * Modules/indexeddb/shared/IDBRequestData.h:
+
+        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
+        (WebCore::IDBResourceIdentifier::isolatedCopy):
+        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
+
+        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
+        (WebCore::InProcessIDBServer::didCommitTransaction):
+        (WebCore::InProcessIDBServer::commitTransaction):
+        * Modules/indexeddb/shared/InProcessIDBServer.h:
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::IDBResourceIdentifier>::copy):
+        (WebCore::IDBError>::copy):
+        * platform/CrossThreadCopier.h:
+
+2015-10-15  Daniel Bates  <dabates@apple.com>
+
+        [iOS] DOM click event may not be dispatched when page has :active style and <input type="search">
+        https://bugs.webkit.org/show_bug.cgi?id=144451
+        <rdar://problem/23099482>
+
+        Reviewed by Simon Fraser.
+
+        Fixes an issue where a DOM click event is not dispatched to an element in a subframe on a page
+        that has a <input type="search"> and defines a CSS :active pseudo-class for the HTML body element.
+
+        On iOS we only dispatch a DOM click event if the content does not change as part
+        of dispatching a DOM mousemove event at the tapped element. In particular, we do not
+        dispatch a DOM click event if there is a visibility change to some element on the page
+        as part of dispatching a mousemove event at the tapped element. For a web page
+        that specifies CSS :active pseudo-class and contains a search field, applying/unapplying
+        this pseudo-class as part of dispatching a DOM mousemove event may cause the
+        visibility of the search field cancel button to change; => a DOM click event will not
+        be dispatched to the tapped element.
+
+        Tests: fast/events/can-click-element-on-page-with-active-pseudo-class-and-search-field.html
+               fast/forms/search/search-cancel-button-visible-when-input-becomes-disabled.html
+               fast/forms/search/search-cancel-button-visible-when-input-becomes-readonly.html
+               fast/forms/search/search-cancel-in-formerly-invisible-element.html
+               fast/forms/search/search-cancel-toggle-visibility-initially-hidden.html
+               fast/forms/search/search-cancel-toggle-visibility-initially-visible.html
+
+        * rendering/RenderSearchField.cpp:
+        (WebCore::RenderSearchField::updateCancelButtonVisibility): Write logic for determining
+        whether the visibility of the cancel button changed in terms of m_isCancelButtonVisible
+        instead of querying for the current style data as the latter is overwritten on a full
+        style recalculation.
+        (WebCore::RenderSearchField::RenderSearchField): Deleted.
+        (WebCore::RenderSearchField::visibilityForCancelButton): Deleted.
+        * rendering/RenderSearchField.h: Define instance variable m_isCancelButtonVisible to
+        store the visibility state of the cancel button.
+
+2015-10-15  Antti Koivisto  <antti@apple.com>
+
+        Implement iterator for traversing composed ancestors
+        https://bugs.webkit.org/show_bug.cgi?id=150162
+
+        Reviewed by Andreas Kling.
+
+        The existing general purpose ComposedTreeIterator can traverse parent chain but not efficiently
+        (since it builds stack). Add a separate stackless iterator for ancestor chain traversal.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ComposedTreeAncestorIterator.h: Added.
+        (WebCore::ComposedTreeAncestorIterator::operator*):
+        (WebCore::ComposedTreeAncestorIterator::operator->):
+        (WebCore::ComposedTreeAncestorIterator::operator==):
+        (WebCore::ComposedTreeAncestorIterator::operator!=):
+        (WebCore::ComposedTreeAncestorIterator::operator++):
+        (WebCore::ComposedTreeAncestorIterator::get):
+        (WebCore::ComposedTreeAncestorIterator::ComposedTreeAncestorIterator):
+        (WebCore::ComposedTreeAncestorIterator::traverseParent):
+        (WebCore::ComposedTreeAncestorAdapter::ComposedTreeAncestorAdapter):
+        (WebCore::ComposedTreeAncestorAdapter::begin):
+        (WebCore::ComposedTreeAncestorAdapter::end):
+        (WebCore::ComposedTreeAncestorAdapter::first):
+        (WebCore::composedTreeAncestors):
+        * dom/ComposedTreeIterator.h:
+        * dom/ContainerNode.h:
+        (WebCore::Node::highestAncestor):
+        (WebCore::Node::isTreeScope):
+        (WebCore::Node::needsNodeRenderingTraversalSlowPath): Deleted.
+
+            With NodeRenderingTraversal::parent removed this bit is no longer used.
+
+        * dom/Element.cpp:
+        (WebCore::Element::shadowRoot):
+        (WebCore::Element::addShadowRoot):
+        (WebCore::shouldUseNodeRenderingTraversalSlowPath): Deleted.
+        (WebCore::Element::resetNeedsNodeRenderingTraversalSlowPath): Deleted.
+        * dom/Element.h:
+        (WebCore::Element::didAddUserAgentShadowRoot):
+        (WebCore::Element::alwaysCreateUserAgentShadowRoot):
+        * dom/Node.cpp:
+        (WebCore::Node::derefEventTarget):
+        (WebCore::Node::updateAncestorsForStyleRecalc):
+        (WebCore::traverseStyleParent): Deleted.
+        (WebCore::traverseFirstStyleParent): Deleted.
+
+            Switch to iterator interface.
+
+        * dom/Node.h:
+        (WebCore::Node::isDocumentFragment):
+        (WebCore::Node::isShadowRoot):
+        (WebCore::Node::isNamedFlowContentNode):
+        (WebCore::Node::hasCustomStyleResolveCallbacks):
+        (WebCore::Node::setHasCustomStyleResolveCallbacks):
+        (WebCore::Node::setTreeScope):
+        (WebCore::Node::setStyleChange):
+        (WebCore::Node::setNeedsNodeRenderingTraversalSlowPath): Deleted.
+        * dom/NodeRenderingTraversal.cpp:
+        (WebCore::NodeRenderingTraversal::traverseParent):
+        (WebCore::NodeRenderingTraversal::traverseFirstChild):
+        (WebCore::NodeRenderingTraversal::traverseLastChild):
+        (WebCore::NodeRenderingTraversal::traversePreviousSibling):
+        (WebCore::NodeRenderingTraversal::nextInScope):
+        (WebCore::NodeRenderingTraversal::previousInScope):
+        (WebCore::NodeRenderingTraversal::parentInScope):
+        (WebCore::NodeRenderingTraversal::lastChildInScope):
+        (WebCore::NodeRenderingTraversal::parentSlow): Deleted.
+        * dom/NodeRenderingTraversal.h:
+        (WebCore::NodeRenderingTraversal::parent): Deleted.
+
+            No longer used.
+
+        * html/HTMLSummaryElement.cpp:
+        * rendering/RenderNamedFlowThread.cpp:
+        (WebCore::RenderNamedFlowThread::isChildAllowed):
+
+            Switch to iterator interface.
+
+        * style/RenderTreePosition.cpp:
+        * style/StyleResolveTree.cpp:
+        (WebCore::Style::updateTextRendererAfterContentChange):
+
+            Switch to iterator interface.
+
+2015-10-14  Zhuo Li  <zachli@apple.com>
+
+        Augment <input type=search>’s recent search history with the time each entry was added,
+        in order to allow time-based clearing of search history.
+        https://bugs.webkit.org/show_bug.cgi?id=148388.
+
+        Reviewed by Darin Adler.
+
+        Replace Vector<String> with Vector<RecentSearch>, where RecentSearch is a struct
+        that consists search string and time, for recent searches in order to store additional time
+        information.
+
+        * WebCore.xcodeproj/project.pbxproj: Added SearchPopupMenuCocoa.h and SearchPopupMenuCocoa.mm
+        and sort the project file.
+        * loader/EmptyClients.cpp:
+        (WebCore::EmptySearchPopupMenu::saveRecentSearches):
+        (WebCore::EmptySearchPopupMenu::loadRecentSearches):
+        * platform/SearchPopupMenu.h:
+        * platform/cocoa/SearchPopupMenuCocoa.h: Added methods for SeachPopupMenuMac in WebKit
+        and WebPageProxyCocoa in WebKit2 to call.
+        * platform/cocoa/SearchPopupMenuCocoa.mm: Added.
+        (WebCore::searchFieldRecentSearchesStorageDirectory): Recent searches with the new structure
+        are stored in a new location.
+        (WebCore::searchFieldRecentSearchesPlistPath): Get the path for the plist of the recent
+        searches entries.
+        (WebCore::RetainPtr<NSMutableDictionary> readSearchFieldRecentSearchesPlist): Return the
+        recent searches plist as NSMutableDictionary.
+        (WebCore::fromNSDatetoSystemClockTime): Convert from NSDate to system_clock::time_point.
+        (WebCore::fromSystemClockTimetoNSDate): Convert from system_clock::time_point to NSDate.
+        (WebCore::SearchPopupMenuCocoa::saveRecentSearches): Add a dictionary where it has two pairs
+        that the first one is the search string and the second one is the time.
+        (WebCore::SearchPopupMenuCocoa::loadRecentSearches): We expect the recent search item in the
+        plist to be a two-pair dictionary, and convert the dictionary to the struct RecentSearch.
+        * platform/win/SearchPopupMenuWin.cpp:
+        (WebCore::SearchPopupMenuWin::saveRecentSearches): Only save the RecentSearch's search
+        string on Windows platform, which is what we used to do.
+        (WebCore::SearchPopupMenuWin::loadRecentSearches): Since we need to construct a
+        RecentSearch, we get the string from the app's preferences, and set the time to be
+        std::chrono::system_clock::time_point::min().
+        * platform/win/SearchPopupMenuWin.h:
+        * rendering/RenderSearchField.cpp: Now that m_recentSearches are Vector<RecentSearch>,
+        we cannot use -removeAll with a search string. Use -removeAllMatching instead to remove the
+        item that has its member search string equal to the search string user inputs.
+        (WebCore::RenderSearchField::addSearchResult):
+        (WebCore::RenderSearchField::itemText):
+
+2015-10-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Use RefPtr<Image> return type for StyleImage::image()
+        https://bugs.webkit.org/show_bug.cgi?id=150112
+
+        Reviewed by Andreas Kling.
+        
+        Change StyleImage::image() and subclasses to return RefPtr<Image>
+        instead of a PassRefPtr<Image>.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderImageResource.cpp:
+        (WebCore::RenderImageResource::image):
+        * rendering/RenderImageResource.h:
+        * rendering/RenderImageResourceStyleImage.cpp:
+        (WebCore::RenderImageResourceStyleImage::image):
+        * rendering/RenderImageResourceStyleImage.h:
+        * rendering/style/StyleCachedImage.cpp:
+        (WebCore::StyleCachedImage::image):
+        * rendering/style/StyleCachedImage.h:
+        * rendering/style/StyleCachedImageSet.cpp:
+        (WebCore::StyleCachedImageSet::image):
+        * rendering/style/StyleCachedImageSet.h:
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::image):
+        * rendering/style/StyleGeneratedImage.h:
+        * rendering/style/StyleImage.h:
+        * rendering/style/StylePendingImage.h:
+
+2015-10-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Give subclasses of CSSImageGeneratorValue a consistent image() return type
+        https://bugs.webkit.org/show_bug.cgi?id=150111
+
+        Reviewed by Andreas Kling.
+        
+        CSSImageGeneratorValue and subclasses had signatures of the non-virtual image() function
+        with mistmatched return types; some returned RefPtr<Image>, and others PassRefPtr<Image>. Make
+        them all the same.
+
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::image):
+        * css/CSSImageGeneratorValue.h:
+        * css/CSSNamedImageValue.cpp:
+        (WebCore::CSSNamedImageValue::image):
+        * css/CSSNamedImageValue.h:
+
+2015-10-14  Tim Horton  <timothy_horton@apple.com>
+
+        Move some EventHandler initialization to the header
+        https://bugs.webkit.org/show_bug.cgi?id=150139
+
+        Reviewed by Andreas Kling.
+
+        No new tests, just cleanup.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Deleted.
+        * page/EventHandler.h:
+        Also found one member which was unused, and a few that were uninitialized.
+        It's likely the uninitialized ones didn't actually cause any trouble because
+        they are reset in lots of places, but this seems better.
+
+2015-10-14  Alex Christensen  <achristensen@webkit.org>
+
+        [Content Extensions] Make blocked async XHR call onerror
+        https://bugs.webkit.org/show_bug.cgi?id=146706
+
+        Reviewed by Brady Eidson.
+
+        Test: http/tests/contentextensions/async-xhr-onerror.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::networkError):
+        (WebCore::XMLHttpRequest::networkErrorTimerFired):
+        (WebCore::XMLHttpRequest::abortError):
+        * xml/XMLHttpRequest.h:
+        Make a timer that calls networkError in 0 time if a content blocker blocks the asynchronous load.
+        It is necessary to call setPendingActivity and dropProtection (which calls unsetPendingActivity)
+        to keep a reference to the XMLHttpRequest alive.
+
+2015-10-14  Andy Estes  <aestes@apple.com>
+
+        [iOS] QuickLook documents loaded over https do not load their subresources
+        https://bugs.webkit.org/show_bug.cgi?id=150145
+        <rdar://problem/22884521>
+
+        Reviewed by Alexey Proskuryakov.
+
+        When QuickLook generates an HTML preview of a document, subresources are referenced using the x-apple-ql-id scheme,
+        for which QuickLook installs an NSURLProtocol. If a document is loaded over https, then this scheme needs to be
+        considered secure in order to avoid mixed content errors.
+
+        Test: http/tests/quicklook/secure-document-with-subresources.html
+
+        * platform/SchemeRegistry.cpp:
+        (WebCore::secureSchemes): Registered QLPreviewProtocol() as a secure scheme.
+
+2015-10-14  Jiewen Tan  <jiewen_tan@apple.com>
+
+        Postpone mutation events before invoke Editor::Command command(Document*, const String&, bool).
+        https://bugs.webkit.org/show_bug.cgi?id=149299
+        <rdar://problem/22746995>
+
+        Reviewed by Andreas Kling.
+
+        Test: editing/inserting/insert-with-mutation-event.html
+
+        This is a merge of a part of Blink r166294:
+        https://codereview.chromium.org/141103006
+
+        * dom/Document.cpp:
+        (WebCore::Document::execCommand):
+
+2015-10-14  Dean Jackson  <dino@apple.com>
+
+        Implement CanvasRenderingContext2D::commit
+        https://bugs.webkit.org/show_bug.cgi?id=150110
+        <rdar://problem/23057398>
+
+        Reviewed by Anders Carlsson.
+
+        As part of getting as close as possible to the HTML5 specification,
+        implement the commit() method on 2d canvas, even though it doesn't
+        do anything.
+
+        Test: fast/canvas/commit.html
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::commit): Intercept it here to
+        avoid adding a method to the actual implementation.
+        * html/canvas/CanvasRenderingContext2D.idl: Add commit.
+
+2015-10-14  Alex Christensen  <achristensen@webkit.org>
+
+        Add SPI for reloading without content blockers
+        https://bugs.webkit.org/show_bug.cgi?id=150058
+        rdar://problem/22742222
+
+        Reviewed by Sam Weinig.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reloadWithOverrideEncoding):
+        (WebCore::FrameLoader::reload):
+        * loader/FrameLoader.h:
+        * page/Page.h:
+        (WebCore::Page::userContentController):
+        (WebCore::Page::userContentExtensionsEnabled): Deleted.
+        (WebCore::Page::setUserContentExtensionsEnabled): Deleted.
+        * replay/UserInputBridge.cpp:
+        (WebCore::UserInputBridge::loadRequest):
+        (WebCore::UserInputBridge::reloadFrame):
+        (WebCore::UserInputBridge::stopLoadingFrame):
+        * replay/UserInputBridge.h:
+        Pass a bool from the reloadWithoutContentBlockers call to the DocumentLoader, 
+        which stores the state of whether the content blockers are enabled or not.
+        Remove the state from the Page and copying the state from the Page to the DocumentLoader
+        because that caused issues with the content blockers being re-enabled at the wrong time.
+
+2015-10-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Rename JSDOMWrapper to JSDOMObject and JSDOMWrapperWithImplementation to JSDOMWrapper
+        https://bugs.webkit.org/show_bug.cgi?id=150120
+
+        Reviewed by Sam Weinig.
+
+        No change in behavior.
+
+        * bindings/js/DOMWrapperWorld.h:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::getInlineCachedWrapper):
+        (WebCore::setInlineCachedWrapper):
+        (WebCore::clearInlineCachedWrapper):
+        (WebCore::createWrapper):
+        (WebCore::getStaticValueSlotEntryWithoutCaching<JSDOMObject>):
+        * bindings/js/JSDOMWrapper.cpp:
+        * bindings/js/JSDOMWrapper.h:
+        (WebCore::JSDOMObject::JSDOMObject):
+        (WebCore::JSDOMWrapper::~JSDOMWrapper):
+        (WebCore::JSDOMWrapper::JSDOMWrapper):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/js/ScriptWrappable.h:
+        * bindings/js/ScriptWrappableInlines.h:
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetParentClassName):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::JSTestActiveDOMObject::JSTestActiveDOMObject):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::JSTestCustomConstructorWithNoInterfaceObject):
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore::JSTestCustomNamedGetter::JSTestCustomNamedGetter):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructor::JSTestEventConstructor):
+        * bindings/scripts/test/JS/JSTestEventConstructor.h:
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTarget::JSTestEventTarget):
+        * bindings/scripts/test/JS/JSTestEventTarget.h:
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::JSTestException::JSTestException):
+        * bindings/scripts/test/JS/JSTestException.h:
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
+        (WebCore::JSTestGenerateIsReachable::JSTestGenerateIsReachable):
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterface::JSTestInterface):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
+        (WebCore::JSTestJSBuiltinConstructor::JSTestJSBuiltinConstructor):
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::JSTestMediaQueryListListener::JSTestMediaQueryListListener):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructor::JSTestNamedConstructor):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
+        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
+        (WebCore::JSTestNondeterministic::JSTestNondeterministic):
+        * bindings/scripts/test/JS/JSTestNondeterministic.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObj::JSTestObj):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::JSTestOverloadedConstructors::JSTestOverloadedConstructors):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
+        (WebCore::JSTestOverrideBuiltins::JSTestOverrideBuiltins):
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefs::JSTestTypedefs):
+        * bindings/scripts/test/JS/JSTestTypedefs.h:
+        * bindings/scripts/test/JS/JSattribute.cpp:
+        (WebCore::JSattribute::JSattribute):
+        * bindings/scripts/test/JS/JSattribute.h:
+        * bindings/scripts/test/JS/JSreadonly.cpp:
+        (WebCore::JSreadonly::JSreadonly):
+        * bindings/scripts/test/JS/JSreadonly.h:
+        * dom/make_names.pl:
+        (printWrapperFunctions):
+        (printWrapperFactoryCppFile):
+        (printWrapperFactoryHeaderFile):
+
+2015-10-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Change GraphicsContext image-drawing functions to take references
+        https://bugs.webkit.org/show_bug.cgi?id=150108
+
+        Reviewed by Tim Horton and Sam Weinig.
+
+        Change GraphicsContext::drawImage(), drawTiledImage(), drawImageBuffer(), clipToImageBuffer()
+        and isCompatibleWithBuffer() to take references, and adjust calling code, adding
+        null-checks where necessary.
+
+        * css/CSSCrossfadeValue.cpp:
+        (WebCore::CSSCrossfadeValue::image):
+        * css/CSSFilterImageValue.cpp:
+        (WebCore::CSSFilterImageValue::image):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::compositeBuffer):
+        (WebCore::drawImageToContext):
+        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedDrawImage):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/WebGL2RenderingContext.cpp:
+        (WebCore::WebGL2RenderingContext::texSubImage2D):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLRenderingContextBase.cpp:
+        (WebCore::WebGLRenderingContextBase::drawImageIntoBuffer):
+        (WebCore::WebGLRenderingContextBase::texImage2D):
+        * html/canvas/WebGLRenderingContextBase.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paintPanScrollIcon):
+        * platform/graphics/CrossfadeGeneratedImage.cpp:
+        (WebCore::CrossfadeGeneratedImage::CrossfadeGeneratedImage):
+        (WebCore::drawCrossfadeSubimage):
+        (WebCore::CrossfadeGeneratedImage::drawCrossfade):
+        * platform/graphics/CrossfadeGeneratedImage.h:
+        * platform/graphics/GradientImage.cpp:
+        (WebCore::GradientImage::drawPattern):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawTiledImage):
+        (WebCore::GraphicsContext::drawImageBuffer):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::isCompatibleWithBuffer):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::drawShadowBuffer):
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling):
+        (WebCore::ShadowBlur::drawInsetShadowWithoutTiling):
+        (WebCore::ShadowBlur::drawInsetShadowWithTiling):
+        (WebCore::ShadowBlur::drawRectShadowWithTiling):
+        (WebCore::ShadowBlur::drawLayerPieces):
+        (WebCore::ShadowBlur::endShadowLayer):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::draw):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::draw):
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::platformApplySoftware):
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::platformApplySoftware):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::platformApplySoftware):
+        * platform/graphics/filters/FEDropShadow.cpp:
+        (WebCore::FEDropShadow::platformApplySoftware):
+        * platform/graphics/filters/FEMerge.cpp:
+        (WebCore::FEMerge::platformApplySoftware):
+        * platform/graphics/filters/FEOffset.cpp:
+        (WebCore::FEOffset::platformApplySoftware):
+        * platform/graphics/filters/FETile.cpp:
+        (WebCore::FETile::platformApplySoftware):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::platformApplySoftware):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::platformApplySoftware):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::paint):
+        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
+        (WebCore::ImageBackingSurfaceClient::ImageBackingSurfaceClient):
+        (WebCore::CoordinatedImageBacking::update):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRendererHelper::applyFilterEffect):
+        * rendering/ImageQualityController.cpp:
+        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
+        * rendering/ImageQualityController.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::shouldPaintAtLowQuality):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::paintSnapshotImage):
+        (WebCore::RenderEmbeddedObject::paintContents):
+        * rendering/RenderEmbeddedObject.h:
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::paintIntoRect):
+        * rendering/RenderImageResourceStyleImage.cpp:
+        (WebCore::RenderImageResourceStyleImage::shutdown):
+        (WebCore::RenderImageResourceStyleImage::image):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::drawPlatformResizerImage):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderSnapshottedPlugIn.cpp:
+        (WebCore::RenderSnapshottedPlugIn::paintSnapshot):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintProgressBar):
+        (WebCore::RenderThemeMac::paintSnapshottedPluginOverlay):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecorationPart):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+        * rendering/shapes/Shape.cpp:
+        (WebCore::Shape::createRasterShape):
+        * rendering/shapes/ShapeOutsideInfo.cpp:
+        (WebCore::ShapeOutsideInfo::createShapeForImage): Deleted.
+        * rendering/style/NinePieceImage.cpp:
+        (WebCore::NinePieceImage::paint):
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paintForeground):
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::postApplyResource):
+        * rendering/svg/SVGRenderingContext.cpp:
+        (WebCore::SVGRenderingContext::clipToImageBuffer):
+        (WebCore::SVGRenderingContext::bufferForeground):
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::platformApplySoftware):
+
+2015-10-14  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        REGRESSION(r53318): background-repeat: space with gradients doesn't render correctly
+        https://bugs.webkit.org/show_bug.cgi?id=150068
+
+        Reviewed by Simon Fraser.
+
+        This is a regression of r53318 in which we were trying to make the pattern
+        of the gradient image as small as possible: 1-pixel wide or tall. But this
+        broke the rendering of the background image when container element has the
+        style background-repeat: space. The reason for this is tiling the gradient
+        image is done completely by CG. To do the tiling, we start by creating a
+        CGPattern by calling CGPatternCreate() which takes the rect of the pattern
+        and the step. If the width or the height of the pattern image is adjusted
+        to be 1-pixel wide or tall, that will force CG to leave a space after every
+        it draws the pattern image which is 1-pixel wide or tall which is wrong.
+        
+        The fix is to disable this optimization altogether if the container element
+        has the style background-repeat: space.
+
+        Test: fast/gradients/background-image-repeat-space.html
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::adjustParametersForTiledDrawing):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GradientImage.cpp:
+        (WebCore::GradientImage::drawPattern):
+
+2015-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Add helper funtion for checking pointer equivalency and use it
+        https://bugs.webkit.org/show_bug.cgi?id=150022
+
+        Reviewed by Darin Adler.
+
+        A common pattern in WebCore code is to check for equivalency of two pointers,
+        either both null, or both non-null and with equal values. This was written in
+        several different ways in different places.
+        
+        Add arePointingToEqualData() to standardize this pattern.
+
+        This obviates the need for StyleImage::imagesEquivalent(), counterDataEquivalent()
+        etc.
+        
+        Also change some comparisons of DataRef<> which checked the pointer and then the
+        values to use DataRef<>::operator== which does the same thing. Comparisons of
+        m_grid and m_gridItem only checked pointer equality, so this is probably a bug fix there.
+
+        * page/animation/CSSPropertyAnimation.cpp: if ((!a && !b) || a == b) is redundant so fix,
+        and add checks for a and b RenderStyle* first.
+        (WebCore::PropertyWrapperGetter::equals):
+        (WebCore::StyleImagePropertyWrapper::equals):
+        (WebCore::PropertyWrapperShadow::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::FillLayerPropertyWrapperGetter::equals):
+        (WebCore::FillLayerStyleImagePropertyWrapper::equals):
+        (WebCore::FillLayersPropertyWrapper::equals):
+        (WebCore::ShorthandPropertyWrapper::equals):
+        (WebCore::PropertyWrapperFlex::equals):
+        (WebCore::PropertyWrapperSVGPaint::equals):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::equalIgnoringHeaderFields):
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::operator==):
+        * rendering/style/NinePieceImage.cpp:
+        (WebCore::NinePieceImageData::operator==):
+        * rendering/style/RenderStyle.cpp: Some nullptr cleanup.
+        (WebCore::RenderStyle::getCachedPseudoStyle):
+        (WebCore::RenderStyle::addCachedPseudoStyle):
+        (WebCore::RenderStyle::changeAffectsVisualOverflow):
+        (WebCore::RenderStyle::changeRequiresLayout):
+        (WebCore::RenderStyle::changeRequiresLayerRepaint):
+        (WebCore::RenderStyle::setWillChange):
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        (WebCore::StyleShadowSVGData::operator==):
+        * rendering/style/ShadowData.cpp:
+        (WebCore::ShadowData::operator==):
+        * rendering/style/StyleImage.h:
+        (WebCore::StyleImage::imagesEquivalent): Deleted.
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::operator==):
+        (WebCore::cursorDataEquivalent): Deleted.
+        (WebCore::quotesDataEquivalent): Deleted.
+        (WebCore::StyleRareInheritedData::shadowDataEquivalent): Deleted.
+        * rendering/style/StyleRareInheritedData.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::operator==):
+        (WebCore::StyleRareNonInheritedData::counterDataEquivalent): Deleted.
+        (WebCore::StyleRareNonInheritedData::shadowDataEquivalent): Deleted.
+        (WebCore::StyleRareNonInheritedData::willChangeDataEquivalent): Deleted.
+        (WebCore::StyleRareNonInheritedData::reflectionDataEquivalent): Deleted.
+        (WebCore::StyleRareNonInheritedData::animationDataEquivalent): Deleted.
+        (WebCore::StyleRareNonInheritedData::transitionDataEquivalent): Deleted.
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2015-10-13  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Split TypesettingFeatures into kerning and ligatures bools
+        https://bugs.webkit.org/show_bug.cgi?id=150074
+
+        Reviewed by Simon Fraser.
+
+        Our TypesettingFeatures type represents whether kerning or ligatures are enabled
+        when laying out text. However, now that I have implemented font-feature-settings
+        and font-variant-*, this type is wildly inadequate. There are now multiple kinds
+        of ligatures, and many other features which are neither kerning nor ligatures.
+        Adding tons of information to this type doesn't make sense because 1) We already
+        have a FontVariantSettings struct which contains this information, and 2) None
+        of the users of TypesettingFeatures care about most of these new features.
+
+        In this new world of font features, the font-kerning property isn't changing.
+        Therefore, all the code which relies only on the Kerning value in
+        TypesettingFeatures doesn't need to change. The places which rely on Ligatures,
+        however, need to be updated to understand that there are many different kinds
+        of ligatures.
+
+        Indeed, after inspection, all of the places which inspect ligatures are more
+        interested in a high-level concept of whether or not we can trust some simple
+        computation. Therefore, we really have two things we care about: Kerning, and
+        this high-level concept.
+
+        This patch is the second step to update our view of the world to include
+        font-feature-settings and font-variant-*. In particular, this patch simply
+        splits TypesettingFeatures into two Booleans, one for Kerning, and one for
+        Ligatures (which has no behavior change). Then, once they are separated, I can
+        migrate the Ligatures Boolean to take on its new meaning.
+
+        This change is purely mechanical.
+
+        No new tests because there is no behavior change.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator FontCascadeDescription::Kerning):
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::applyTransforms):
+        * platform/graphics/Font.h:
+        * platform/graphics/FontCascade.cpp:
+        (WebCore::FontCascade::FontCascade):
+        (WebCore::FontCascade::operator=):
+        (WebCore::FontCascade::update):
+        (WebCore::FontCascade::drawText):
+        (WebCore::FontCascade::drawEmphasisMarks):
+        (WebCore::FontCascade::width):
+        (WebCore::FontCascade::adjustSelectionRectForText):
+        (WebCore::FontCascade::offsetForPosition):
+        (WebCore::FontCascade::setDefaultKerning):
+        (WebCore::FontCascade::setDefaultLigatures):
+        (WebCore::FontCascade::codePath):
+        (WebCore::FontCascade::floatWidthForSimpleText):
+        (WebCore::FontCascade::setDefaultTypesettingFeatures): Deleted.
+        (WebCore::FontCascade::defaultTypesettingFeatures): Deleted.
+        * platform/graphics/FontCascade.h:
+        (WebCore::FontCascade::enableKerning):
+        (WebCore::FontCascade::enableLigatures):
+        (WebCore::FontCascade::computeEnableKerning):
+        (WebCore::FontCascade::computeEnableLigatures):
+        (WebCore::FontCascade::typesettingFeatures): Deleted.
+        (WebCore::FontCascade::computeTypesettingFeatures): Deleted.
+        * platform/graphics/FontDescription.cpp:
+        (WebCore::FontCascadeDescription::FontCascadeDescription):
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontCascadeDescription::setKerning):
+        (WebCore::FontCascadeDescription::initialKerning):
+        * platform/graphics/TypesettingFeatures.h: Removed.
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator):
+        (WebCore::WidthIterator::applyFontTransforms):
+        (WebCore::WidthIterator::advanceInternal):
+        * platform/graphics/WidthIterator.h:
+        * platform/graphics/cocoa/FontCocoa.mm:
+        (WebCore::Font::canRenderCombiningCharacterSequence):
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
+        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
+        (WebCore::Font::getCFStringAttributes):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::setLogicalWidthForTextRun):
+        * rendering/line/BreakingContext.h:
+        (WebCore::WordTrailingSpace::width):
+        * svg/SVGFontData.h:
+
+2015-10-13  Zalan Bujtas  <zalan@apple.com>
+
+        Anonymous table objects: inline parent box requires inline-table child.
+        https://bugs.webkit.org/show_bug.cgi?id=150090
+
+        Reviewed by David Hyatt.
+
+        According to the CSS2.1 specification, if a child needs anonymous table wrapper
+        and the child's parent is an inline box, the generated table needs to be inline-table.
+        (inline-block and block parents generate non-inline table) 
+
+        Import W3C CSS2.1 anonymous table tests.
+
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::childRequiresTable):
+        (WebCore::RenderElement::addChild):
+        * rendering/RenderElement.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::newChildIsInline):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::addChildToContinuation):
+        * rendering/RenderInline.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::createAnonymousWithParentRenderer):
+
+2015-10-13  Dean Jackson  <dino@apple.com>
+
+        Device motion and orientation should only be visible from the main frame's security origin
+        https://bugs.webkit.org/show_bug.cgi?id=150072
+        <rdar://problem/23082036>
+
+        Reviewed by Brent Fulgham.
+
+        There are reports that gyroscope and accelerometer information can
+        be used to detect keyboard entry. One initial step to reduce the
+        risk is to forbid device motion and orientation events from
+        being fired in frames that are a different security origin from the main page.
+
+        Manual test: deviceorientation-main-frame-only.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::isSameSecurityOriginAsMainFrame): New helper function.
+        (WebCore::DOMWindow::addEventListener): Check if we are the main frame, or the
+        same security origin as the main frame. If not, don't add the event
+        listeners.
+
+2015-10-12  Dean Jackson  <dino@apple.com>
+
+        ASSERT(m_motionManager) on emgn.com page
+        https://bugs.webkit.org/show_bug.cgi?id=150070
+        <rdar://problem/18383732>
+
+        Reviewed by Simon Fraser.
+
+        In the WebCoreMotionManager init method, we call
+        into another setup method on the main thread.
+        However, if a listener was attached before that
+        ran, we'd ASSERT. This wasn't actually causing a bug
+        because the main thread initialization would
+        check the listeners once it got a chance to run.
+
+        The fix is to only check status when we've
+        actually initialized.
+
+        * platform/ios/WebCoreMotionManager.h: New m_initialized boolean.
+        * platform/ios/WebCoreMotionManager.mm: Check m_initialized before doing real work.
+        (-[WebCoreMotionManager init]):
+        (-[WebCoreMotionManager addMotionClient:]):
+        (-[WebCoreMotionManager removeMotionClient:]):
+        (-[WebCoreMotionManager addOrientationClient:]):
+        (-[WebCoreMotionManager removeOrientationClient:]):
+        (-[WebCoreMotionManager initializeOnMainThread]):
+
+2015-10-13  Chris Dumez  <cdumez@apple.com>
+
+        Avoid useless copies in range-loops that are using 'auto'
+        https://bugs.webkit.org/show_bug.cgi?id=150091
+
+        Reviewed by Sam Weinig.
+
+        Avoid useless copies in range-loops that are using 'auto'. Also use
+        'auto*' instead of 'auto' when range values are pointers for clarity.
+
+2015-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Move Image::drawPattern for CG into GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=150077
+
+        Reviewed by Myles C. Maxfield.
+
+        In order to consolidate code that calls into Core Graphics inside
+        GraphicsContext, move the body of Image::drawPattern() into
+        GraphicsContextCG.cpp, and do the same for Cairo.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawPattern):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::drawPatternCallback):
+        (WebCore::patternReleaseCallback):
+        (WebCore::GraphicsContext::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::drawPatternCallback): Deleted.
+        (WebCore::patternReleaseCallback): Deleted.
+
+2015-10-13  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Unprefix font-kerning
+        https://bugs.webkit.org/show_bug.cgi?id=150080
+
+        Reviewed by Sam Weinig.
+
+        This is the last property in CSS3 Fonts which is prefixed.
+
+        Test: fast/text/font-kerning.html
+
+        * css/CSSPropertyNames.in:
+
+2015-10-13  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Add debug settings for using giant tiles (4096x4096)
+        https://bugs.webkit.org/show_bug.cgi?id=149977
+        <rdar://problem/23017093>
+
+        Reviewed by Tim Horton.
+
+        Instead of creating the GraphicsLayer with a fixed size 512x512, we need
+        to read the useGiantTiles setting. If its value is true, we set the layer
+        tileSize to 4096x4096.
+
+        * page/Settings.in:
+        Define the name of the setting and its default value.
+        
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::GraphicsLayerClient::tileSize):
+        Define tileSize() in the base class GraphicsLayerClient. This is going to
+        be overridden RenderLayerBacking.
+        
+        * platform/graphics/TiledBacking.h:
+        (WebCore::defaultTileSize):
+        Define the default tileSize which will depend on the useGiantTiles
+        setting.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::platformCALayerTileSize):
+        Implement the virtual function GraphicsLayerCA::platformCALayerTileSize().
+        It passes the call to client GraphicsLayerClient which can be RenderLayerBacking
+        in our case.
+
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        Override base class function PlatformCALayerClient::PlatformCALayerClient().
+
+        * platform/graphics/ca/PlatformCALayerClient.h:
+        (WebCore::PlatformCALayerClient::platformCALayerTileSize):
+        Define platformCALayerTileSize() in the base class PlatformCALayerClient.
+        This is going to be overridden GraphicsLayerCA.
+
+        * platform/graphics/ca/TileController.cpp:
+        (WebCore::TileController::TileController):
+        No need for the member m_tileSize.
+        
+        (WebCore::TileController::computeTileCoverageRect):
+        Use the function tileSize() instead of using the static values.
+        
+        (WebCore::TileController::tileSize):
+        The tileSize will be retrieved from the owning graphics layer.
+        
+        * platform/graphics/ca/TileController.h:
+        No need for the member m_tileSize. The tileSize will be retrieved from the owning graphics layer.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::setTiledBackingHasMargins):
+        Use the function tileSize() instead of using the static values.
+        
+        (WebCore::RenderLayerBacking::tileSize):
+        Override base class function GraphicsLayerClient::tileSize().
+        
+        * rendering/RenderLayerBacking.h:
+        Define the concrete method RenderLayerBacking::tilSize().
+
+2015-10-13  Antti Koivisto  <antti@apple.com>
+
+        Try to fix ENABLE(DETAILS_ELEMENT) with SHADOW_DOM disabled.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        * dom/Node.cpp:
+        (WebCore::traverseStyleParent):
+
+2015-10-13  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Fix license and copyrights of WebCore js binding builtin files
+        https://bugs.webkit.org/show_bug.cgi?id=150027
+
+        Reviewed by Darin Adler.
+
+        Fixing copyright on all three files.
+        Moving to BSD-like license as they should have been in the first place.
+        Ordering lexicographically the builtin names in WebCoreBuiltinNames.h.
+
+        No change in behaviour.
+
+        * bindings/js/WebCoreBuiltinNames.h:
+        * bindings/js/WebCoreJSBuiltins.cpp:
+        * bindings/js/WebCoreJSBuiltins.h:
+        * bindings/js/WebCoreJSBuiltinInternals.h:
+
+2015-10-12  Antti Koivisto  <antti@apple.com>
+
+        Implement iterator for traversing composed DOM
+        https://bugs.webkit.org/show_bug.cgi?id=149997
+
+        Reviewed by Ryosuke Niwa.
+
+        ComposedTreeIterator traverses the DOM in composed tree order. This means it enters
+        shadow trees and follows slots created by Shadow DOM API correctly.
+
+        auto children = composedTreeChildren(containerNode);
+        for (auto& composedChild : children)
+            ...
+
+        auto descendants = composedTreeDescendants(containerNode);
+        for (auto& composedDescendant : descendants)
+            ...
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ComposedTreeIterator.cpp: Added.
+        (WebCore::ComposedTreeIterator::initializeShadowStack):
+        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+        (WebCore::ComposedTreeIterator::traverseNextSiblingSlot):
+        (WebCore::ComposedTreeIterator::traversePreviousSiblingSlot):
+        (WebCore::ComposedTreeIterator::traverseParentInShadowTree):
+        * dom/ComposedTreeIterator.h: Added.
+        (WebCore::ComposedTreeIterator::operator*):
+        (WebCore::ComposedTreeIterator::operator->):
+        (WebCore::ComposedTreeIterator::operator==):
+        (WebCore::ComposedTreeIterator::operator!=):
+        (WebCore::ComposedTreeIterator::ShadowContext::ShadowContext):
+        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
+        (WebCore::ComposedTreeIterator::traverseNext):
+        (WebCore::ComposedTreeIterator::traverseNextSibling):
+        (WebCore::ComposedTreeIterator::traversePreviousSibling):
+        (WebCore::ComposedTreeIterator::traverseParent):
+        (WebCore::ComposedTreeChildAdapter::Iterator::Iterator):
+        (WebCore::ComposedTreeChildAdapter::Iterator::operator++):
+        (WebCore::ComposedTreeChildAdapter::Iterator::operator--):
+        (WebCore::ComposedTreeChildAdapter::ComposedTreeChildAdapter):
+        (WebCore::ComposedTreeChildAdapter::begin):
+        (WebCore::ComposedTreeChildAdapter::end):
+        (WebCore::ComposedTreeChildAdapter::at):
+        (WebCore::composedTreeChildren):
+        * dom/NodeRenderingTraversal.cpp:
+        (WebCore::NodeRenderingTraversal::parentSlow):
+        (WebCore::NodeRenderingTraversal::nextInScope):
+        (WebCore::NodeRenderingTraversal::firstChildSlow): Deleted.
+        (WebCore::NodeRenderingTraversal::nextSiblingSlow): Deleted.
+        (WebCore::NodeRenderingTraversal::previousSiblingSlow): Deleted.
+        * dom/NodeRenderingTraversal.h:
+        (WebCore::NodeRenderingTraversal::parent):
+        (WebCore::NodeRenderingTraversal::firstChild): Deleted.
+        (WebCore::NodeRenderingTraversal::nextSibling): Deleted.
+        (WebCore::NodeRenderingTraversal::previousSibling): Deleted.
+        * style/RenderTreePosition.cpp:
+        (WebCore::RenderTreePosition::computeNextSibling):
+
+            Restore the full assert.
+
+        (WebCore::RenderTreePosition::invalidateNextSibling):
+        (WebCore::RenderTreePosition::previousSiblingRenderer):
+        (WebCore::RenderTreePosition::nextSiblingRenderer):
+
+            Make these member functions.
+            Use the iterator. This is fixes some bugs and allows enabling a test case.
+
+        * style/RenderTreePosition.h:
+        * style/StyleResolveTree.cpp:
+        (WebCore::Style::textRendererIsNeeded):
+
+2015-10-13  ChangSeok Oh  <changseok.oh@collabora.com>
+
+        [GTK] Use GUniquePtr for GtkIconInfo
+        https://bugs.webkit.org/show_bug.cgi?id=150082
+
+        Reviewed by Carlos Garcia Campos.
+
+        GtkIconInfo cab be wrapped by a smart pointer, GUniqueptr.
+
+        No new test required since no functionality changed.
+
+        * rendering/RenderThemeGtk.cpp:
+        (WebCore::getStockSymbolicIconForWidgetType):
+
+2015-10-12  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Unreviewed, fix debug build warning.
+
+        %llu needs 'long long unsigned int'.
+
+        Type casting unit64_t to long long unsigned int.
+
+        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
+        (WebCore::IDBClient::IDBOpenDBRequest::onUpgradeNeeded):
+        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
+        (WebCore::IDBServer::UniqueIDBDatabase::notifyConnectionsOfVersionChange):
+
+2015-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Speculative Cairo build fixes after r190910.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::drawPattern):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2015-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix iOS and Efl builds.
+
+        * platform/graphics/NamedImageGeneratedImage.cpp:
+        (WebCore::NamedImageGeneratedImage::drawPattern):
+
+2015-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Remove Image::spaceSize() and ImageBuffer::spaceSize()
+        https://bugs.webkit.org/show_bug.cgi?id=150064
+
+        Reviewed by Tim Horton.
+
+        Image spacing when tiled should not be a property of the image; but a description
+        of how it's drawn, like tile size. So remove spacing from Image and ImageBuffer,
+        and pass it in as an argument.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/CrossfadeGeneratedImage.cpp:
+        (WebCore::CrossfadeGeneratedImage::drawPattern):
+        * platform/graphics/CrossfadeGeneratedImage.h:
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/GradientImage.cpp:
+        (WebCore::GradientImage::drawPattern):
+        * platform/graphics/GradientImage.h:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        (WebCore::Image::spaceSize): Deleted.
+        (WebCore::Image::setSpaceSize): Deleted.
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::spaceSize): Deleted.
+        (WebCore::ImageBuffer::setSpaceSize): Deleted.
+        * platform/graphics/NamedImageGeneratedImage.cpp:
+        (WebCore::NamedImageGeneratedImage::drawPattern):
+        * platform/graphics/NamedImageGeneratedImage.h:
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::copyImage):
+        (WebCore::ImageBuffer::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::drawPatternForContainer):
+        * svg/graphics/SVGImage.h:
+        * svg/graphics/SVGImageForContainer.cpp:
+        (WebCore::SVGImageForContainer::drawPattern):
+        * svg/graphics/SVGImageForContainer.h:
+
+2015-10-12  Andreas Kling  <akling@apple.com>
+
+        Have TransformState::mappedSecondaryQuad() return an Optional<FloatQuad>.
+        <https://webkit.org/b/150057>
+
+        Reviewed by Simon Fraser.
+
+        Using Optional instead of std::unique_ptr allows us to signal the absence of a
+        secondary quad without incurring a heap allocation in cases where one is present.
+
+        This dodges ~132000 malloc/free pairs on loading thelocal.se
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::computeVisibleAndCoverageRect):
+        * platform/graphics/transforms/TransformState.cpp:
+        (WebCore::TransformState::mappedSecondaryQuad):
+        * platform/graphics/transforms/TransformState.h:
+
+2015-10-12  Brady Eidson  <beidson@apple.com>
+
+        Followup to:
+        Modern IDB: Start version change transaction for connections to new database.
+        https://bugs.webkit.org/show_bug.cgi?id=150033
+
+        Reviewed by NOBODY (Fixing existing test flakiness)
+
+        No new tests (Covered by existing tests)
+
+        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
+        (WebCore::IDBServer::UniqueIDBDatabase::handleOpenDatabaseOperations): Early return if a version change transaction
+          is already in progress.
+
+2015-10-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [Font Features] Tiny cleanup regarding FontCascade::typesettingFeatures()
+        https://bugs.webkit.org/show_bug.cgi?id=150051
+
+        Reviewed by Simon Fraser.
+
+        There are no typesetting features which aren't kerning nor ligatures.
+
+        No new tests because there is no behavior difference.
+
+        * platform/graphics/FontCascade.cpp:
+        (WebCore::FontCascade::codePath):
+        * platform/graphics/WidthIterator.h:
+        (WebCore::WidthIterator::supportsTypesettingFeatures): Deleted.
+
+2015-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Add a CGContextStateSaver and use it
+        https://bugs.webkit.org/show_bug.cgi?id=150049
+
+        Reviewed by Tim Horton.
+
+        Add a stack-based graphics state save/restore class for CGContext,
+        like the one we have for GraphicsContext, and use it in GraphicsContextCG.
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawNativeImage):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawJoinedLines):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::platformFillRoundedRect):
+        (WebCore::GraphicsContext::fillRectWithRoundedHole):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/cg/GraphicsContextCG.h:
+        (WebCore::CGContextStateSaver::CGContextStateSaver):
+        (WebCore::CGContextStateSaver::~CGContextStateSaver):
+        (WebCore::CGContextStateSaver::save):
+        (WebCore::CGContextStateSaver::restore):
+
+2015-10-12  Zalan Bujtas  <zalan@apple.com>
+
+        display: table-cell; bug when resizing window
+        https://bugs.webkit.org/show_bug.cgi?id=138167
+
+        Reviewed by David Hyatt.
+
+        Clean up anonymous table wrappers all the way up to RenderTable.
+        This patch ensures that we don't keep the generated RenderTable/RenderSection/RenderCaption/RenderRow
+        objects around in the tree anymore when the last child is destroyed.
+
+        Import W3C CSS2.1 anonymous table tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):
+
+2015-10-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        REGRESSION(r182192): Ligatures do not interact correctly with SHY in some fonts
+        https://bugs.webkit.org/show_bug.cgi?id=150006
+
+        Reviewed by Simon Fraser.
+
+        When performing font transforms and we encounter kCGFontIndexInvalid, we filter it out of the
+        GlyphBuffer. However, this filter was only interacting with part of the GlyphBuffer instead
+        of the whole thing. This causes glyph IDs from one font to be rendered with other fonts,
+        thereby showing garbage glyphs.
+
+        However, now that <rdar://problem/20230073> is fixed, we don't need to perform this filter in
+        the first place.
+
+        Test: fast/text/undefined-glyph-with-ligature.html
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::copyItem):
+        (WebCore::GlyphBuffer::swap):
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::applyFontTransforms):
+
+2015-10-12  Antoine Quint  <graouts@apple.com>
+
+        [SVG] Handle endEvent for svg animations
+        https://bugs.webkit.org/show_bug.cgi?id=121587
+
+        Reviewed by Dean Jackson.
+
+        Add support for the "endEvent" SVG event triggered when an animation completes, as
+        specified in http://www.w3.org/TR/SMIL3/smil-timing.html#q135. This event doesn't
+        bubble and can't be canceled. Added test coverage for the event through the DOM
+        Events API as well as the declarative SMIL Animation syntax.
+
+        Adapted from a Chromium patch by pavan.e@samsung.com
+        https://chromium.googlesource.com/chromium/blink/+/4d415ca0268231aa80e3552fe21bf3480a6978f8
+
+        Tests: svg/animations/end-event-declarative-expected.svg
+               svg/animations/end-event-declarative.svg
+               svg/animations/end-event-script-expected.svg
+               svg/animations/end-event-script.svg
+
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::smilEndEventSender):
+        (WebCore::SVGSMILElement::~SVGSMILElement):
+        (WebCore::SVGSMILElement::progress):
+        (WebCore::SVGSMILElement::dispatchPendingEvent):
+        * svg/animation/SVGSMILElement.h:
+        (WebCore::SVGSMILElement::hasConditionsConnected):
+
+2015-10-12  Per Arne Vollan  <peavo@outlook.com>
+
+        [Curl] Increase limit of parallel network requests.
+        https://bugs.webkit.org/show_bug.cgi?id=150035
+
+        Reviewed by Alex Christensen.
+
+        If the limit is too low, other network requests will often be blocked until
+        active requests finishes. This can affect performance in a negative way.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+
+2015-10-12  Brady Eidson  <beidson@apple.com>
+
+        Modern IDB: Start version change transaction for connections to new database.
+        https://bugs.webkit.org/show_bug.cgi?id=150033
+
+        Reviewed by Alex Christensen.
+
+        No new tests (Covered by changes to existing tests).
+
+        * CMakeLists.txt:
+        * Modules/indexeddb/IDBDatabase.h:
+        
+        * Modules/indexeddb/client/IDBAnyImpl.cpp:
+        (WebCore::IDBClient::IDBAny::IDBAny):
+        (WebCore::IDBClient::IDBAny::~IDBAny):
+        (WebCore::IDBClient::IDBAny::idbDatabase):
+        (WebCore::IDBClient::IDBAny::domStringList):
+        (WebCore::IDBClient::IDBAny::idbCursor):
+        (WebCore::IDBClient::IDBAny::idbCursorWithValue):
+        (WebCore::IDBClient::IDBAny::idbFactory):
+        (WebCore::IDBClient::IDBAny::idbIndex):
+        (WebCore::IDBClient::IDBAny::idbObjectStore):
+        (WebCore::IDBClient::IDBAny::idbTransaction):
+        (WebCore::IDBClient::IDBAny::scriptValue):
+        (WebCore::IDBClient::IDBAny::integer):
+        (WebCore::IDBClient::IDBAny::string):
+        (WebCore::IDBClient::IDBAny::keyPath):
+        * Modules/indexeddb/client/IDBAnyImpl.h:
+        (WebCore::IDBClient::IDBAny::create):
+        
+        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
+        (WebCore::IDBClient::IDBConnectionToServer::fireVersionChangeEvent):
+        (WebCore::IDBClient::IDBConnectionToServer::registerDatabaseConnection):
+        (WebCore::IDBClient::IDBConnectionToServer::unregisterDatabaseConnection):
+        * Modules/indexeddb/client/IDBConnectionToServer.h:
+        
+        * Modules/indexeddb/client/IDBDatabaseImpl.cpp: Added.
+        (WebCore::IDBClient::IDBDatabase::create):
+        (WebCore::IDBClient::IDBDatabase::IDBDatabase):
+        (WebCore::IDBClient::IDBDatabase::~IDBDatabase):
+        (WebCore::IDBClient::IDBDatabase::name):
+        (WebCore::IDBClient::IDBDatabase::version):
+        (WebCore::IDBClient::IDBDatabase::objectStoreNames):
+        (WebCore::IDBClient::IDBDatabase::createObjectStore):
+        (WebCore::IDBClient::IDBDatabase::transaction):
+        (WebCore::IDBClient::IDBDatabase::deleteObjectStore):
+        (WebCore::IDBClient::IDBDatabase::close):
+        (WebCore::IDBClient::IDBDatabase::activeDOMObjectName):
+        (WebCore::IDBClient::IDBDatabase::canSuspendForPageCache):
+        (WebCore::IDBClient::IDBDatabase::startVersionChangeTransaction):
+        * Modules/indexeddb/client/IDBDatabaseImpl.h: Added.
+        (WebCore::IDBClient::IDBDatabase::info):
+        
+        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
+        (WebCore::IDBClient::IDBOpenDBRequest::onError):
+        (WebCore::IDBClient::IDBOpenDBRequest::onSuccess):
+        (WebCore::IDBClient::IDBOpenDBRequest::onUpgradeNeeded):
+        (WebCore::IDBClient::IDBOpenDBRequest::requestCompleted):
+        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
+        
+        * Modules/indexeddb/client/IDBRequestImpl.cpp:
+        (WebCore::IDBClient::IDBRequest::IDBRequest):
+        (WebCore::IDBClient::IDBRequest::result):
+        (WebCore::IDBClient::IDBRequest::source):
+        (WebCore::IDBClient::IDBRequest::transaction):
+        * Modules/indexeddb/client/IDBRequestImpl.h:
+        (WebCore::IDBClient::IDBRequest::connection):
+        
+        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
+        (WebCore::IDBClient::IDBTransaction::create):
+        (WebCore::IDBClient::IDBTransaction::IDBTransaction):
+        (WebCore::IDBClient::IDBTransaction::~IDBTransaction):
+        (WebCore::IDBClient::IDBTransaction::mode):
+        (WebCore::IDBClient::IDBTransaction::db):
+        (WebCore::IDBClient::IDBTransaction::error):
+        (WebCore::IDBClient::IDBTransaction::objectStore):
+        (WebCore::IDBClient::IDBTransaction::abort):
+        (WebCore::IDBClient::IDBTransaction::activeDOMObjectName):
+        (WebCore::IDBClient::IDBTransaction::canSuspendForPageCache):
+        * Modules/indexeddb/client/IDBTransactionImpl.h:
+        (WebCore::IDBClient::IDBTransaction::info):
+        
+        * Modules/indexeddb/client/IDBVersionChangeEventImpl.cpp:
+        (WebCore::IDBClient::IDBVersionChangeEvent::IDBVersionChangeEvent):
+        (WebCore::IDBClient::IDBVersionChangeEvent::eventInterface):
+        * Modules/indexeddb/client/IDBVersionChangeEventImpl.h:
+        (WebCore::IDBClient::IDBVersionChangeEvent::create):
+        
+        * Modules/indexeddb/legacy/LegacyDatabase.h:
+        
+        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
+        (WebCore::IDBServer::IDBConnectionToClient::fireVersionChangeEvent):
+        * Modules/indexeddb/server/IDBConnectionToClient.h:
+        * Modules/indexeddb/server/IDBConnectionToClientDelegate.h:
+        
+        * Modules/indexeddb/server/IDBServer.cpp:
+        (WebCore::IDBServer::IDBServer::registerDatabaseConnection):
+        (WebCore::IDBServer::IDBServer::unregisterDatabaseConnection):
+        (WebCore::IDBServer::IDBServer::deleteDatabase):
+        * Modules/indexeddb/server/IDBServer.h:
+        
+        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
+        (WebCore::IDBServer::UniqueIDBDatabase::info):
+        (WebCore::IDBServer::UniqueIDBDatabase::handleOpenDatabaseOperations):
+        (WebCore::IDBServer::UniqueIDBDatabase::hasAnyOpenConnections):
+        (WebCore::IDBServer::UniqueIDBDatabase::startVersionChangeTransaction):
+        (WebCore::IDBServer::UniqueIDBDatabase::notifyConnectionsOfVersionChange):
+        (WebCore::IDBServer::UniqueIDBDatabase::addOpenDatabaseConnection):
+        * Modules/indexeddb/server/UniqueIDBDatabase.h:
+        
+        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp: 
+        (WebCore::IDBServer::nextDatabaseConnectionIdentifier):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::create):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::UniqueIDBDatabaseConnection):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::fireVersionChangeEvent):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::createVersionChangeTransaction):
+
+        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::identifier):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::database):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::connectionToClient):
+        (WebCore::IDBServer::UniqueIDBDatabaseConnection::closePending):
+        
+        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
+        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::create):
+        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::UniqueIDBDatabaseTransaction):
+        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h:
+        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::databaseConnection):
+        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::info):
+        
+        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
+        (WebCore::IDBDatabaseInfo::IDBDatabaseInfo):
+        * Modules/indexeddb/shared/IDBDatabaseInfo.h:
+        (WebCore::IDBDatabaseInfo::name):
+        (WebCore::IDBDatabaseInfo::version):
+        (WebCore::IDBDatabaseInfo::IDBDatabaseInfo): Deleted.
+        
+        * Modules/indexeddb/shared/IDBError.h:
+        
+        * Modules/indexeddb/shared/IDBRequestData.cpp:
+        (WebCore::IDBRequestData::IDBRequestData):
+        (WebCore::IDBRequestData::requestedVersion):
+        * Modules/indexeddb/shared/IDBRequestData.h:
+        
+        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
+        (WebCore::nextClientResourceNumber):
+        (WebCore::nextServerResourceNumber):
+        (WebCore::IDBResourceIdentifier::IDBResourceIdentifier):
+        (WebCore::IDBResourceIdentifier::emptyValue):
+        (WebCore::IDBResourceIdentifier::deletedValue):
+        (WebCore::nextResourceNumber): Deleted.
+        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
+        
+        * Modules/indexeddb/shared/IDBResultData.cpp:
+        (WebCore::IDBResultData::IDBResultData):
+        (WebCore::IDBResultData::error):
+        (WebCore::IDBResultData::openDatabaseSuccess):
+        (WebCore::IDBResultData::openDatabaseUpgradeNeeded):
+        (WebCore::IDBResultData::databaseInfo):
+        (WebCore::IDBResultData::transactionInfo):
+        * Modules/indexeddb/shared/IDBResultData.h:
+        (WebCore::IDBResultData::type):
+        (WebCore::IDBResultData::databaseConnectionIdentifier):
+        
+        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
+        (WebCore::IDBTransactionInfo::IDBTransactionInfo):
+        (WebCore::IDBTransactionInfo::versionChange):
+        (WebCore::IDBTransactionInfo::isolatedCopy):
+        * Modules/indexeddb/shared/IDBTransactionInfo.h:
+        (WebCore::IDBTransactionInfo::identifier):
+        (WebCore::IDBTransactionInfo::mode):
+        (WebCore::IDBTransactionInfo::newVersion):
+        
+        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
+        (WebCore::InProcessIDBServer::fireVersionChangeEvent):
+        * Modules/indexeddb/shared/InProcessIDBServer.h:
+        
+        * WebCore.xcodeproj/project.pbxproj:
+        
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::IDBTransactionInfo>::copy):
+        * platform/CrossThreadCopier.h:
+
+2015-10-12  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        REGRESSION(r184895): border-image should always slice the SVG image to nine pieces when drawing it in the container element
+        https://bugs.webkit.org/show_bug.cgi?id=149901
+        <rdar://problem/21995596>
+
+        Reviewed by Darin Adler.
+
+        The nine-pieces algorithm should be applied to the border-image regardless
+        whether the image has an intrinsic size or not. It is not guaranteed to have
+        a meaningful border-image in all the cases of non-intrinsic size images. But
+        it should work as expected in most of the cases. 
+
+        * rendering/RenderBoxModelObject.cpp:
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions):
+        Revert the changes which were added to return whether the image has
+        intrinsic size or not.
+        
+        (WebCore::RenderBoxModelObject::calculateFillTileSize):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        Size of the image is now the return value of calculateImageIntrinsicDimensions().
+        
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::updateContent):
+        * rendering/shapes/ShapeOutsideInfo.cpp:
+        (WebCore::ShapeOutsideInfo::createShapeForImage):
+        Size of the image is now the return value of calculateImageIntrinsicDimensions().
+        
+        * rendering/style/NinePieceImage.cpp:
+        * rendering/style/NinePieceImage.h:
+        (WebCore::NinePieceImage::paint):
+        Delete the logic for the non-intrinsic case. Both intrinsic and non-intrinsic
+        cases will be treated the same.
+
+        (WebCore::NinePieceImage::computeNineRects):
+        (WebCore::NinePieceImage::computeSideTileScale):
+        (WebCore::NinePieceImage::computeMiddleTileScale):
+        (WebCore::NinePieceImage::computeTileScales):
+        (WebCore::NinePieceImage::computeIntrinsicRects): Deleted.
+        (WebCore::NinePieceImage::computeIntrinsicSideTileScale): Deleted.
+        (WebCore::NinePieceImage::computeIntrinsicMiddleTileScale): Deleted.
+        (WebCore::NinePieceImage::computeIntrinsicTileScales): Deleted.
+        Remove *Intrinsic* from the name of the functions.
+
+        (WebCore::NinePieceImage::computeNonIntrinsicRects): Deleted.
+        (WebCore::NinePieceImage::computeNonIntrinsicTileScales): Deleted.
+        Delete the *NonIntrinsic* functions.
+
+2015-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Clip-path transitions sometimes trigger endless animation timers
+        https://bugs.webkit.org/show_bug.cgi?id=150018
+
+        Reviewed by Tim Horton.
+        
+        Transitioning -webkit-clip-path could trigger endless animation
+        timers, because when CompositeAnimation::updateTransitions() calls
+        isTargetPropertyEqual(), a false negative answer triggers canceling the
+        current transition and starting a new one over and over.
+        
+        This happened because StyleRareNonInheritedData simply tested pointer
+        equality for m_clipPath and m_shapeOutside. Both of these need to do deep
+        equality testing, requiring the implementation of operator== in BasicShapes
+        classes.
+        
+        In addition, the PropertyWrappers in CSSPropertyAnimation need equals()
+        implementations that also do more than pointer equality testing.
+
+        Tests: transitions/clip-path-transitions.html
+               transitions/shape-outside-transitions.html
+
+        * page/animation/CSSPropertyAnimation.cpp:
+        (WebCore::PropertyWrapperClipPath::equals):
+        (WebCore::PropertyWrapperShape::equals):
+        * rendering/ClipPathOperation.h:
+        * rendering/style/BasicShapes.cpp:
+        (WebCore::BasicShapeCircle::operator==):
+        (WebCore::BasicShapeEllipse::operator==):
+        (WebCore::BasicShapePolygon::operator==):
+        (WebCore::BasicShapeInset::operator==):
+        * rendering/style/BasicShapes.h:
+        (WebCore::BasicShapeCenterCoordinate::operator==):
+        (WebCore::BasicShapeRadius::operator==):
+        * rendering/style/ShapeValue.cpp:
+        (WebCore::pointersOrValuesEqual):
+        (WebCore::ShapeValue::operator==):
+        * rendering/style/ShapeValue.h:
+        (WebCore::ShapeValue::operator!=):
+        (WebCore::ShapeValue::operator==): Deleted.
+        (WebCore::ShapeValue::ShapeValue): Deleted.
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::operator==):
+        (WebCore::StyleRareNonInheritedData::clipPathOperationsEquivalent):
+        (WebCore::StyleRareNonInheritedData::shapeOutsideDataEquivalent):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2015-10-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Test font-variant-* and font-feature-settings on Yosemite and Mavericks
+        https://bugs.webkit.org/show_bug.cgi?id=149778
+
+        Reviewed by Simon Fraser.
+
+        We can simply call the function which enables features on Yosemite and Mavericks.
+
+        * platform/graphics/cocoa/FontCacheCoreText.cpp:
+        (WebCore::platformFontLookupWithFamily):
+        (WebCore::fontWithFamily):
+
+2015-10-09  Anders Carlsson  <andersca@apple.com>
+
+        Don't allow plug-ins to override image types for <embed> elements
+        https://bugs.webkit.org/show_bug.cgi?id=149979
+
+        Reviewed by Tim Horton.
+
+        Stop allowing plug-ins to take over image types for <embed> elements. We already do this
+        for <object> elements, but had to make <embed> elements exempt because of webkit.org/b/49016.
+        The QuickTime plug-in hasn't supported image types since Lion, so there's no point in keeping this code around.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::HTMLAppletElement):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::HTMLEmbedElement):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::HTMLObjectElement):
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::isImageType):
+        (WebCore::HTMLPlugInImageElement::wouldLoadAsNetscapePlugin):
+        * html/HTMLPlugInImageElement.h:
+        (WebCore::HTMLPlugInImageElement::shouldPreferPlugInsForImages): Deleted.
+        * loader/EmptyClients.h:
+        * loader/FrameLoaderClient.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::resourceWillUsePlugin):
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::shouldUsePlugin):
+        * loader/SubframeLoader.h:
+
+2015-10-12  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed, fixing debug builds with Clang on Linux
+        by including the stdio.h header where it's required
+        under a debug configuration.
+
+        * page/scrolling/ScrollingStateTree.cpp:
+        (WebCore::ScrollingStateTree::ScrollingStateTree):
+        * rendering/SimpleLineLayoutFunctions.cpp:
+
+2015-10-12  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed, followup to r190643.
+
+        Inline the std::function<> constructor wrappings around lambdas
+        into a single line, instead of spanning it across four lines.
+
+        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:
+        (WebCore::InbandTextTrackPrivateGStreamer::handleSample):
+        (WebCore::InbandTextTrackPrivateGStreamer::streamChanged):
+        (WebCore::InbandTextTrackPrivateGStreamer::notifyTrackOfSample):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::videoChanged):
+        (WebCore::MediaPlayerPrivateGStreamer::videoCapsChanged):
+        (WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfVideo):
+        (WebCore::MediaPlayerPrivateGStreamer::audioChanged):
+        (WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfAudio):
+        (WebCore::MediaPlayerPrivateGStreamer::textChanged):
+        (WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfText):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::volumeChanged):
+        (WebCore::MediaPlayerPrivateGStreamerBase::networkState):
+        (WebCore::MediaPlayerPrivateGStreamerBase::muteChanged):
+        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
+        (WebCore::TrackPrivateBaseGStreamer::activeChanged):
+        (WebCore::TrackPrivateBaseGStreamer::tagsChanged):
+        (WebCore::TrackPrivateBaseGStreamer::notifyTrackOfActiveChanged):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkitVideoSinkRender):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcChangeState):
+        (webKitWebSrcNeedDataCb):
+        (webKitWebSrcEnoughDataMainCb):
+        (webKitWebSrcEnoughDataCb):
+        (webKitWebSrcSeekMainCb):
+        (webKitWebSrcSeekDataCb):
+
+2015-10-11  Brian Burg  <bburg@apple.com>
+
+        Add missing builtins files to the Xcode projects
+        https://bugs.webkit.org/show_bug.cgi?id=150015
+
+        Reviewed by Yusuke Suzuki.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2015-10-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Cleanup and simplification of SVG path-related classes
+        https://bugs.webkit.org/show_bug.cgi?id=150011
+
+        Reviewed by Zalan Bujtas.
+
+        Many SVG path-related subclasses were stateful, but only because code in
+        SVGPathUtilities kept global copies around for no reason. A microbenchmark
+        showed that there was no benefit to keeping global singletons of SVGPathBuilder,
+        SVGPathSegListBuilder, SVGPathByteStreamBuilder, SVGPathStringBuilder,
+        SVGPathTraversalStateBuilder, SVGPathParser and SVGPathBlender.
+        
+        Making these classes not be re-usable makes the code much simpler, allowing
+        their SVGPathSources, SVGPathConsumers, SVGPathByteStream etc. to be stored
+        by reference, and eliminating the cleanup() function which created annoying
+        ordering issues.
+        
+        Code that uses SVGPathParser and SVGPathBlender is further simplified by having
+        these classes expose only static functions, hiding any internal statefulness.
+
+        * svg/SVGPathBlender.cpp: Remove the m_progress member variable and instead
+        pass progress to the various blend functions, as we do for other blend functions.
+        Expose two only static functions. Pointers to references.
+        (WebCore::SVGPathBlender::addAnimatedPath):
+        (WebCore::SVGPathBlender::blendAnimatedPath):
+        (WebCore::SVGPathBlender::SVGPathBlender):
+        (WebCore::SVGPathBlender::blendAnimatedDimensonalFloat):
+        (WebCore::SVGPathBlender::blendAnimatedFloatPoint):
+        (WebCore::SVGPathBlender::blendMoveToSegment):
+        (WebCore::SVGPathBlender::blendLineToSegment):
+        (WebCore::SVGPathBlender::blendLineToHorizontalSegment):
+        (WebCore::SVGPathBlender::blendLineToVerticalSegment):
+        (WebCore::SVGPathBlender::blendCurveToCubicSegment):
+        (WebCore::SVGPathBlender::blendCurveToCubicSmoothSegment):
+        (WebCore::SVGPathBlender::blendCurveToQuadraticSegment):
+        (WebCore::SVGPathBlender::blendCurveToQuadraticSmoothSegment):
+        (WebCore::SVGPathBlender::blendArcToSegment):
+        (WebCore::SVGPathBlender::cleanup): Deleted.
+        * svg/SVGPathBlender.h: Make the constructor take a ref to the destination Path,
+        which is stored by reference.
+        * svg/SVGPathBuilder.cpp:
+        (WebCore::SVGPathBuilder::SVGPathBuilder):
+        (WebCore::SVGPathBuilder::moveTo):
+        (WebCore::SVGPathBuilder::lineTo):
+        (WebCore::SVGPathBuilder::curveToCubic):
+        (WebCore::SVGPathBuilder::closePath):
+        * svg/SVGPathBuilder.h:
+        (WebCore::SVGPathBuilder::setCurrentPath): Deleted.
+        * svg/SVGPathByteStreamBuilder.cpp: References, assertions removed.
+        (WebCore::SVGPathByteStreamBuilder::SVGPathByteStreamBuilder):
+        * svg/SVGPathByteStreamBuilder.h:
+        (WebCore::SVGPathByteStreamBuilder::writeType):
+        (WebCore::SVGPathByteStreamBuilder::setCurrentByteStream): Deleted.
+        * svg/SVGPathConsumer.h:
+        * svg/SVGPathElement.cpp:
+        * svg/SVGPathParser.cpp: Expose some static helper functions for parsing
+        to byte streams and strings. References.
+        (WebCore::SVGPathParser::parse):
+        (WebCore::SVGPathParser::parseToByteStream):
+        (WebCore::SVGPathParser::parseToString):
+        (WebCore::SVGPathParser::SVGPathParser):
+        (WebCore::SVGPathParser::parseClosePathSegment):
+        (WebCore::SVGPathParser::parseMoveToSegment):
+        (WebCore::SVGPathParser::parseLineToSegment):
+        (WebCore::SVGPathParser::parseLineToHorizontalSegment):
+        (WebCore::SVGPathParser::parseLineToVerticalSegment):
+        (WebCore::SVGPathParser::parseCurveToCubicSegment):
+        (WebCore::SVGPathParser::parseCurveToCubicSmoothSegment):
+        (WebCore::SVGPathParser::parseCurveToQuadraticSegment):
+        (WebCore::SVGPathParser::parseCurveToQuadraticSmoothSegment):
+        (WebCore::SVGPathParser::parseArcToSegment):
+        (WebCore::SVGPathParser::parsePathData):
+        (WebCore::SVGPathParser::decomposeArcToCubic):
+        (WebCore::SVGPathParser::parsePathDataFromSource): Deleted.
+        (WebCore::SVGPathParser::cleanup): Deleted.
+        * svg/SVGPathParser.h:
+        (WebCore::SVGPathParser::setCurrentConsumer): Deleted.
+        (WebCore::SVGPathParser::setCurrentSource): Deleted.
+        * svg/SVGPathSegListBuilder.cpp:
+        (WebCore::SVGPathSegListBuilder::SVGPathSegListBuilder):
+        (WebCore::SVGPathSegListBuilder::moveTo):
+        (WebCore::SVGPathSegListBuilder::lineTo):
+        (WebCore::SVGPathSegListBuilder::lineToHorizontal):
+        (WebCore::SVGPathSegListBuilder::lineToVertical):
+        (WebCore::SVGPathSegListBuilder::curveToCubic):
+        (WebCore::SVGPathSegListBuilder::curveToCubicSmooth):
+        (WebCore::SVGPathSegListBuilder::curveToQuadratic):
+        (WebCore::SVGPathSegListBuilder::curveToQuadraticSmooth):
+        (WebCore::SVGPathSegListBuilder::arcTo):
+        (WebCore::SVGPathSegListBuilder::closePath):
+        * svg/SVGPathSegListBuilder.h:
+        (WebCore::SVGPathSegListBuilder::setCurrentSVGPathElement): Deleted.
+        (WebCore::SVGPathSegListBuilder::setCurrentSVGPathSegList): Deleted.
+        (WebCore::SVGPathSegListBuilder::setCurrentSVGPathSegRole): Deleted.
+        * svg/SVGPathStringBuilder.cpp:
+        (WebCore::SVGPathStringBuilder::cleanup): Deleted.
+        * svg/SVGPathStringBuilder.h:
+        * svg/SVGPathTraversalStateBuilder.cpp:
+        (WebCore::SVGPathTraversalStateBuilder::SVGPathTraversalStateBuilder):
+        (WebCore::SVGPathTraversalStateBuilder::moveTo):
+        (WebCore::SVGPathTraversalStateBuilder::lineTo):
+        (WebCore::SVGPathTraversalStateBuilder::curveToCubic):
+        (WebCore::SVGPathTraversalStateBuilder::closePath):
+        (WebCore::SVGPathTraversalStateBuilder::continueConsuming):
+        (WebCore::SVGPathTraversalStateBuilder::totalLength):
+        (WebCore::SVGPathTraversalStateBuilder::currentPoint):
+        (WebCore::SVGPathTraversalStateBuilder::setDesiredLength): Deleted.
+        * svg/SVGPathTraversalStateBuilder.h:
+        (WebCore::SVGPathTraversalStateBuilder::pathSegmentIndex):
+        (WebCore::SVGPathTraversalStateBuilder::setCurrentTraversalState): Deleted.
+        * svg/SVGPathUtilities.cpp: Remove globals accessors, making things on the stack
+        instead. Use SVGPathParser helper functions where possible.
+        (WebCore::buildPathFromString):
+        (WebCore::buildSVGPathByteStreamFromSVGPathSegList):
+        (WebCore::appendSVGPathByteStreamFromSVGPathSeg):
+        (WebCore::buildPathFromByteStream):
+        (WebCore::buildSVGPathSegListFromByteStream):
+        (WebCore::buildStringFromByteStream):
+        (WebCore::buildStringFromSVGPathSegList):
+        (WebCore::buildSVGPathByteStreamFromString):
+        (WebCore::buildAnimatedSVGPathByteStream):
+        (WebCore::addToSVGPathByteStream):
+        (WebCore::getSVGPathSegAtLengthFromSVGPathByteStream):
+        (WebCore::getTotalLengthOfSVGPathByteStream):
+        (WebCore::getPointAtLengthOfSVGPathByteStream):
+        (WebCore::buildStringFromPath):
+        (WebCore::globalSVGPathBuilder): Deleted.
+        (WebCore::globalSVGPathSegListBuilder): Deleted.
+        (WebCore::globalSVGPathByteStreamBuilder): Deleted.
+        (WebCore::globalSVGPathStringBuilder): Deleted.
+        (WebCore::globalSVGPathTraversalStateBuilder): Deleted.
+        (WebCore::globalSVGPathParser): Deleted.
+        (WebCore::globalSVGPathBlender): Deleted.
+        * svg/SVGPathUtilities.h:
+        * svg/SVGToOTFFontConversion.cpp: CFFBuilder no longer inherits from SVGPathBuilder.
+        It did nothing with the Path, re-implemented all the functions, and only made use of
+        the m_current member var, so just make it inherit from SVGPathConsumer, and have
+        its own m_current.
+        (WebCore::SVGToOTFFontConverter::transcodeGlyphPaths):
+
+2015-10-10  Antti Koivisto  <antti@apple.com>
+
+        Remove InsertionPoint and ContentDistributor
+        https://bugs.webkit.org/show_bug.cgi?id=150004
+
+        Rubber-stamped by Sam Weinig.
+
+        Now that <details> is on top of the modern Shadow DOM remove the last vestiges of the V0 Shadow DOM API.
+
+        * CMakeLists.txt:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/SelectorChecker.cpp:
+        * css/StyleResolver.cpp:
+        * dom/ContainerNode.cpp:
+        * dom/Element.cpp:
+        (WebCore::shouldUseNodeRenderingTraversalSlowPath):
+        (WebCore::Element::resetNeedsNodeRenderingTraversalSlowPath):
+        * dom/Node.cpp:
+        (WebCore::Node::parentOrShadowHostElement):
+        (WebCore::Node::insertedInto):
+        (WebCore::Node::insertionParentForBinding): Deleted.
+        * dom/Node.h:
+        (WebCore::Node::isCharacterDataNode):
+        (WebCore::Node::isFrameOwnerElement):
+        (WebCore::Node::isPluginElement):
+        (WebCore::Node::isImageControlsRootElement):
+        (WebCore::Node::isImageControlsButtonElement):
+        (WebCore::Node::isDocumentFragment):
+        (WebCore::Node::isShadowRoot):
+        (WebCore::Node::isInsertionPointNode): Deleted.
+        (WebCore::Node::isInsertionPoint): Deleted.
+        * dom/NodeRenderingTraversal.cpp:
+        (WebCore::NodeRenderingTraversal::traverseParent):
+        (WebCore::NodeRenderingTraversal::traverseFirstChild):
+        (WebCore::NodeRenderingTraversal::traverseLastChild):
+        (WebCore::NodeRenderingTraversal::traverseNextSibling):
+        (WebCore::NodeRenderingTraversal::traversePreviousSibling):
+        (WebCore::NodeRenderingTraversal::parentSlow):
+        (WebCore::NodeRenderingTraversal::nextInScope):
+        (WebCore::NodeRenderingTraversal::previousInScope):
+        (WebCore::NodeRenderingTraversal::parentInScope):
+        (WebCore::NodeRenderingTraversal::lastChildInScope):
+        (WebCore::NodeRenderingTraversal::nodeCanBeDistributed): Deleted.
+        (WebCore::NodeRenderingTraversal::findFirstSiblingEnteringInsertionPoints): Deleted.
+        (WebCore::NodeRenderingTraversal::findFirstEnteringInsertionPoints): Deleted.
+        (WebCore::NodeRenderingTraversal::findFirstFromDistributedNode): Deleted.
+        (WebCore::NodeRenderingTraversal::findLastSiblingEnteringInsertionPoints): Deleted.
+        (WebCore::NodeRenderingTraversal::findLastEnteringInsertionPoints): Deleted.
+        (WebCore::NodeRenderingTraversal::findLastFromDistributedNode): Deleted.
+        * dom/ShadowRoot.h:
+        (WebCore::ShadowRoot::distributor): Deleted.
+        * html/HTMLInputElement.cpp:
+        * html/HTMLSlotElement.cpp:
+        * html/HTMLSlotElement.h:
+        * html/shadow/ContentDistributor.cpp: Removed.
+        * html/shadow/ContentDistributor.h: Removed.
+        * html/shadow/InsertionPoint.cpp: Removed.
+        * html/shadow/InsertionPoint.h: Removed.
+        * page/FocusController.cpp:
+        (WebCore::FocusController::previousFocusableElement):
+        * testing/Internals.cpp:
+
+2015-10-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Use references and more const in SVGPathUtilities
+        https://bugs.webkit.org/show_bug.cgi?id=150007
+
+        Reviewed by Zalan Bujtas.
+        
+        SVGPathUtilities had lots of pointers whose non-nullness was asserted,
+        little const, and was very trigger-happy with stack allocations. Clean
+        that all up.
+
+        * svg/SVGAnimatedPath.cpp:
+        (WebCore::SVGAnimatedPathAnimator::constructFromString):
+        (WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal):
+        (WebCore::SVGAnimatedPathAnimator::addAnimatedTypes):
+        (WebCore::SVGAnimatedPathAnimator::calculateAnimatedValue):
+        * svg/SVGPathByteStream.h:
+        (WebCore::SVGPathByteStream::begin):
+        (WebCore::SVGPathByteStream::end):
+        (WebCore::SVGPathByteStream::append):
+        * svg/SVGPathByteStreamSource.cpp:
+        (WebCore::SVGPathByteStreamSource::SVGPathByteStreamSource):
+        * svg/SVGPathByteStreamSource.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getTotalLength):
+        (WebCore::SVGPathElement::getPointAtLength):
+        (WebCore::SVGPathElement::getPathSegAtLength):
+        (WebCore::SVGPathElement::parseAttribute):
+        (WebCore::SVGPathElement::svgAttributeChanged):
+        (WebCore::SVGPathElement::pathByteStream):
+        (WebCore::SVGPathElement::lookupOrCreateDWrapper):
+        (WebCore::SVGPathElement::pathSegListChanged):
+        (WebCore::SVGPathElement::SVGPathElement): Deleted.
+        * svg/SVGPathElement.h:
+        * svg/SVGPathUtilities.cpp:
+        (WebCore::globalSVGPathBuilder):
+        (WebCore::globalSVGPathSegListBuilder):
+        (WebCore::globalSVGPathByteStreamBuilder):
+        (WebCore::globalSVGPathStringBuilder):
+        (WebCore::globalSVGPathTraversalStateBuilder):
+        (WebCore::globalSVGPathParser):
+        (WebCore::globalSVGPathBlender):
+        (WebCore::buildPathFromString):
+        (WebCore::buildSVGPathByteStreamFromSVGPathSegList):
+        (WebCore::appendSVGPathByteStreamFromSVGPathSeg):
+        (WebCore::buildPathFromByteStream):
+        (WebCore::buildSVGPathSegListFromByteStream):
+        (WebCore::buildStringFromByteStream):
+        (WebCore::buildStringFromSVGPathSegList):
+        (WebCore::buildSVGPathByteStreamFromString):
+        (WebCore::buildAnimatedSVGPathByteStream):
+        (WebCore::addToSVGPathByteStream):
+        (WebCore::getSVGPathSegAtLengthFromSVGPathByteStream):
+        (WebCore::getTotalLengthOfSVGPathByteStream):
+        (WebCore::getPointAtLengthOfSVGPathByteStream):
+        (WebCore::buildStringFromPath):
+        * svg/SVGPathUtilities.h:
+        * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
+        (WebCore::SVGAnimatedPathSegListPropertyTearOff::animValDidChange):
+
+2015-10-10  Andreas Kling  <akling@apple.com>
+
+        Reduce pointless malloc traffic in ElementRuleCollector.
+        <https://webkit.org/b/150003>
+
+        Reviewed by Antti Koivisto.
+
+        Don't use a unique_ptr for the m_matchedRules vector in ElementRuleCollector.
+        This is one of our heaviest sources of transient allocations, with ~88000
+        malloc/free pairs on loading theverge.com.
+
+        * css/ElementRuleCollector.cpp:
+        (WebCore::ElementRuleCollector::addMatchedRule):
+        (WebCore::ElementRuleCollector::clearMatchedRules):
+        (WebCore::ElementRuleCollector::sortAndTransferMatchedRules):
+        (WebCore::ElementRuleCollector::sortMatchedRules):
+        (WebCore::ElementRuleCollector::hasAnyMatchingRules):
+        * css/ElementRuleCollector.h:
+        (WebCore::ElementRuleCollector::hasMatchedRules):
+
+2015-10-10  Dan Bernstein  <mitz@apple.com>
+
+        [iOS] Remove unnecessary iOS version checks
+        https://bugs.webkit.org/show_bug.cgi?id=150002
+
+        Reviewed by Alexey Proskuryakov.
+
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::ensureCustomFontData):
+        * loader/cocoa/DiskCacheMonitorCocoa.h:
+        (WebCore::DiskCacheMonitor::monitorFileBackingStoreCreation):
+        * page/mac/SettingsMac.mm:
+        (WebCore::sansSerifTraditionalHanFontFamily):
+        (WebCore::sansSerifSimplifiedHanFontFamily):
+        * platform/graphics/cocoa/FontCacheCoreText.cpp:
+        (WebCore::appendOpenTypeFeature):
+        * platform/graphics/ios/FontCacheIOS.mm:
+        (WebCore::getSystemFontFallbackForCharacters):
+        (WebCore::platformLookupFallbackFont):
+        * platform/ios/PlatformSpeechSynthesizerIOS.mm:
+        (WebCore::PlatformSpeechSynthesizer::initializeVoiceList):
+        * platform/ios/WebCoreSystemInterfaceIOS.h:
+        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
+        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
+        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
+        * platform/ios/wak/WAKWindow.mm:
+        (+[WAKWindow hasLandscapeOrientation]):
+        (-[WAKWindow hostLayer]):
+        * platform/network/cf/CookieJarCFNet.cpp:
+        (WebCore::copyCookiesForURLWithFirstPartyURL):
+        (WebCore::createCookies):
+        * platform/network/mac/CertificateInfoMac.mm:
+        (WebCore::CertificateInfo::containsNonRootSHA1SignedCertificate):
+        * platform/spi/cf/CFNetworkSPI.h:
+        * platform/spi/cocoa/AVKitSPI.h:
+        * platform/spi/cocoa/CoreTextSPI.h:
+        * platform/spi/cocoa/NEFilterSourceSPI.h:
+        * platform/spi/cocoa/QuartzCoreSPI.h:
+        * platform/spi/cocoa/SecuritySPI.h:
+        * platform/spi/ios/LaunchServicesSPI.h:
+        * platform/spi/mac/AVFoundationSPI.h:
+        * platform/text/TextBreakIterator.cpp:
+        * platform/text/TextFlags.h:
+        * platform/text/ios/LocalizedDateCache.mm:
+        (WebCore::LocalizedDateCache::calculateMaximumWidth):
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::LocaleMac::LocaleMac):
+        * rendering/RenderThemeIOS.mm:
+        (WebCore::RenderThemeIOS::cachedSystemFontDescription):
+        (WebCore::RenderThemeIOS::updateCachedSystemFontDescription):
+        * svg/SVGToOTFFontConversion.cpp:
+        (WebCore::SVGToOTFFontConverter::appendKERNTable):
+        (WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):
+
+2015-10-10  Antti Koivisto  <antti@apple.com>
+
+        Rewrite HTMLDetailsElement using HTMLSlotElement
+        https://bugs.webkit.org/show_bug.cgi?id=149698
+
+        Reviewed by Andreas Kling.
+
+        Use the modern Shadow DOM to implement <details> element. After this the legacy InsertionPoint and
+        related code can be removed.
+
+        Based on a patch by Ryosuke.
+
+        * dom/Element.cpp:
+        (WebCore::Element::childrenChanged):
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventPath::EventPath):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::~ShadowRoot):
+        (WebCore::ShadowRoot::removeAllEventListeners):
+        (WebCore::ShadowRoot::findAssignedSlot):
+        (WebCore::ShadowRoot::addSlotElementByName):
+        (WebCore::ShadowRoot::removeSlotElementByName):
+        (WebCore::ShadowRoot::invalidateSlotAssignments):
+        (WebCore::ShadowRoot::invalidateDefaultSlotAssignments):
+        (WebCore::ShadowRoot::assignedNodesForSlot):
+        * dom/ShadowRoot.h:
+        (WebCore::ShadowRoot::create):
+        (WebCore::ShadowRoot::distributor):
+        (WebCore::ShadowRoot::isOrphan):
+        * dom/SlotAssignment.cpp:
+        (WebCore::slotNameFromAttributeValue):
+
+            Rename for clarity.
+
+        (WebCore::slotNameFromSlotAttribute):
+
+            SlotAssignment can now be specialized by providing function that maps from node to slot name.
+            This is the default function that gets the name from the slot attribute.
+
+        (WebCore::SlotAssignment::SlotAssignment):
+        (WebCore::SlotAssignment::findAssignedSlot):
+
+            Use the name mapping function.
+            Ensure that the slots are assigned.
+
+        (WebCore::SlotAssignment::addSlotElementByName):
+        (WebCore::SlotAssignment::removeSlotElementByName):
+        (WebCore::SlotAssignment::assignedNodesForSlot):
+        (WebCore::SlotAssignment::invalidate):
+        (WebCore::SlotAssignment::invalidateDefaultSlot):
+        (WebCore::SlotAssignment::resolveAllSlotElements):
+        (WebCore::SlotAssignment::assignSlots):
+
+            Use the name mapping function.
+
+        (WebCore::SlotAssignment::assignToSlot):
+
+            Factor into function.
+
+        (WebCore::treatNullAsEmpty): Deleted.
+        * dom/SlotAssignment.h:
+        (WebCore::SlotAssignment::~SlotAssignment):
+        (WebCore::SlotAssignment::defaultSlotName):
+
+            Add static getter for emptyAtom for clarity.
+
+        (WebCore::SlotAssignment::SlotAssignment): Deleted.
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::summarySlotName):
+        (WebCore::slotNameFunction):
+
+            Slot name function for <details>. It assigns the first <summary> child to the summary slot and others
+            to the default content slot if the element is open.
+
+        (WebCore::HTMLDetailsElement::create):
+        (WebCore::HTMLDetailsElement::didAddUserAgentShadowRoot):
+        (WebCore::HTMLDetailsElement::isActiveSummary):
+        (WebCore::HTMLDetailsElement::parseAttribute):
+        (WebCore::HTMLDetailsElement::toggleOpen):
+        (WebCore::summaryQuerySelector): Deleted.
+        (WebCore::DetailsContentElement::create): Deleted.
+        (WebCore::DetailsSummaryElement::create): Deleted.
+        (WebCore::HTMLDetailsElement::findMainSummary): Deleted.
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer): Deleted.
+        * html/HTMLDetailsElement.h:
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::create):
+        (WebCore::HTMLSummaryElement::createElementRenderer):
+        (WebCore::HTMLSummaryElement::didAddUserAgentShadowRoot):
+        (WebCore::HTMLSummaryElement::detailsElement):
+        (WebCore::HTMLSummaryElement::isActiveSummary):
+        (WebCore::isClickableControl):
+        (WebCore::HTMLSummaryElement::supportsFocus):
+        (WebCore::HTMLSummaryElement::defaultEventHandler):
+        (WebCore::HTMLSummaryElement::willRespondToMouseClickEvents):
+        (WebCore::SummaryContentElement::create): Deleted.
+        (WebCore::HTMLSummaryElement::childShouldCreateRenderer): Deleted.
+        (WebCore::HTMLSummaryElement::isMainSummary): Deleted.
+        * html/HTMLSummaryElement.h:
+        * html/shadow/DetailsMarkerControl.cpp:
+        (WebCore::DetailsMarkerControl::rendererIsNeeded):
+        * style/RenderTreePosition.cpp:
+        (WebCore::RenderTreePosition::computeNextSibling):
+
+            Skip the verification assert for shadow host children. Getting this right requires
+            better shadow-aware traversal code.
+
+        * style/StyleResolveTree.cpp:
+        (WebCore::Style::invalidateWhitespaceOnlyTextSiblingsAfterAttachIfNeeded):
+        (WebCore::Style::attachChildren):
+        (WebCore::Style::attachShadowRoot):
+        (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded):
+        (WebCore::Style::attachSlotAssignees):
+        (WebCore::Style::attachRenderTree):
+        (WebCore::Style::detachChildren):
+        (WebCore::Style::detachShadowRoot):
+        (WebCore::Style::detachSlotAssignees):
+        (WebCore::Style::detachRenderTree):
+        (WebCore::Style::resolveChildren):
+        (WebCore::Style::resolveSlotAssignees):
+        (WebCore::Style::resolveTree):
+        (WebCore::Style::attachDistributedChildren): Deleted.
+        (WebCore::Style::detachDistributedChildren): Deleted.
+
+            Remove InsertionPoint related code paths.
+
+2015-10-10  Andreas Kling  <akling@apple.com>
+
+        SerializedScriptValue should use a compact encoding for 8-bit strings.
+        <https://webkit.org/b/149934>
+
+        Reviewed by Antti Koivisto.
+
+        We were encoding known 8-bit strings in a 16-bit format when serializing script values.
+
+        Extend the format to support 8-bit strings. The 8-bittiness is encoded in the highest bit
+        of the string length. This is possible while supporting all older formats due to string
+        lengths >= 0x7FFFFFFF being disallowed.
+
+        This patch knocks ~1 MB off of theverge.com, where some ad or tracker or whatever likes to
+        do a ton of postMessage() business.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CurrentVersion): Bump the serialization format version. Also updated the grammar
+        comment to describe the new format. Artistic license applied in description of bitfield.
+
+        (WebCore::writeLittleEndianUInt16): Deleted.
+
+        (WebCore::CloneSerializer::serialize):
+        (WebCore::CloneSerializer::write):
+        (WebCore::CloneDeserializer::deserializeString):
+        (WebCore::CloneDeserializer::readString):
+        (WebCore::CloneDeserializer::readStringData): Support 8-bit strings. I kept the string
+        length limit at UINT_MAX/sizeof(UChar) since the highest bit of the length is no longer
+        available. Besides, it seems flimsy to support longer strings if they happen to have all
+        8-bit characters.
+
+2015-10-10  Dan Bernstein  <mitz@apple.com>
+
+        [iOS] Remove project support for iOS 8
+        https://bugs.webkit.org/show_bug.cgi?id=149993
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/WebCore.xcconfig:
+        * Configurations/WebCoreTestSupport.xcconfig:
+
+2015-10-09  Zalan Bujtas  <zalan@apple.com>
+
+        Check if start and end positions are still valid after updating them through VisibleSelection.
+        https://bugs.webkit.org/show_bug.cgi?id=149982
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch is required to be able to clean up anonymous tables structure.
+        In certain edge cases, start/end positions could become nullptr after various text splitting
+        operations. 
+
+        Covered by editing/execCommand/crash-137961.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+
+2015-10-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Rename RenderObject::isRoot() to isDocumentElementRenderer()
+        https://bugs.webkit.org/show_bug.cgi?id=149976
+
+        Reviewed by Zalan Bujtas.
+
+        RenderObject::isRoot() was confusingly named, because it returns true for
+        the document element's renderer, not for the actual root (the RenderView).
+        In this way it mismatched RenderLayer::isRootLayer(), which returned true
+        for the RenderView's layer.
+        
+        Rename it to the more accurate isDocumentElementRenderer().
+
+        * dom/Node.cpp:
+        (WebCore::Node::renderRect):
+        * page/ios/FrameIOS.mm:
+        (WebCore::Frame::renderRectForPoint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::isSelectionRoot):
+        (WebCore::RenderBlock::selectionGaps):
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::rebuildFloatingObjectSetFromIntrudingFloats):
+        (WebCore::RenderBlockFlow::layoutBlock):
+        (WebCore::RenderBlockFlow::requiresColumns):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::updateFromStyle):
+        (WebCore::RenderBox::paintBackground):
+        (WebCore::RenderBox::computeBackgroundIsKnownToBeObscured):
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+        (WebCore::RenderBox::createsNewFormattingContext):
+        (WebCore::RenderBox::percentageLogicalHeightIsResolvableFromBlock):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::stretchesToViewport):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::fixedBackgroundPaintsInLocalCoordinates):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::styleWillChange):
+        (WebCore::RenderElement::rendererForRootBackground):
+        (WebCore::shouldRepaintForImageAnimation):
+        * rendering/RenderElement.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::layoutBlock):
+        * rendering/RenderLayer.cpp:
+        (WebCore::shouldSuppressPaintingLayer):
+        (WebCore::paintForFixedRootBackground):
+        (WebCore::RenderLayer::paintLayerContents):
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::rendererBackgroundColor):
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+        * rendering/RenderLayerModelObject.cpp:
+        (WebCore::RenderLayerModelObject::styleDidChange):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintSlowRepaintObject):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isDocumentElementRenderer):
+        (WebCore::RenderObject::isRoot): Deleted.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::shouldApplyViewportClip):
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::isOverflowHidden):
+
+2015-10-09  Nan Wang  <n_wang@apple.com>
+
+        AX: ARIA 1.1 implement aria-colcount, aria-colindex, aria-colspan, aria-rowcount, aria-rowindex and aria-rowspan
+        https://bugs.webkit.org/show_bug.cgi?id=148967
+
+        Reviewed by Chris Fleizach.
+
+        Added support for ARIA 1.1 table/grid related attributes. Created new attributes for mac, so
+        VoiceOver can pick up the information and speak accordingly.
+
+        Test: accessibility/mac/aria-table-attributes.html
+
+        * accessibility/AccessibilityARIAGridCell.cpp:
+        (WebCore::AccessibilityARIAGridCell::AccessibilityARIAGridCell):
+        (WebCore::AccessibilityARIAGridCell::rowIndexRange):
+        (WebCore::AccessibilityARIAGridCell::columnIndexRange):
+        (WebCore::AccessibilityARIAGridCell::parentRowGroup):
+        * accessibility/AccessibilityARIAGridCell.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::initializeRoleMap):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::title):
+        (WebCore::AccessibilityTable::ariaColumnCount):
+        (WebCore::AccessibilityTable::ariaRowCount):
+        * accessibility/AccessibilityTable.h:
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::AccessibilityTableCell):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        (WebCore::AccessibilityTableCell::ariaColumnIndex):
+        (WebCore::AccessibilityTableCell::ariaRowIndex):
+        (WebCore::AccessibilityTableCell::ariaColumnSpan):
+        (WebCore::AccessibilityTableCell::ariaRowSpan):
+        * accessibility/AccessibilityTableCell.h:
+        (WebCore::AccessibilityTableCell::setARIAColIndexFromRow):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::headerObject):
+        (WebCore::AccessibilityTableRow::addChildren):
+        (WebCore::AccessibilityTableRow::ariaColumnIndex):
+        (WebCore::AccessibilityTableRow::ariaRowIndex):
+        * accessibility/AccessibilityTableRow.h:
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2015-10-09  Anders Carlsson  <andersca@apple.com>
+
+        Remove hack that allowed plug-ins to always take over certain image formats
+        https://bugs.webkit.org/show_bug.cgi?id=149972
+
+        Reviewed by Tim Horton.
+
+        This hack was added 8 years ago to allow a certain plug-in to show multi-page TIFF images on uspto.gov. 
+        We now support said TIFFs natively, and the plug-in has been discontinued so it's safe to get rid of this.
+
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::shouldUsePlugin): Deleted.
+
+2015-10-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Garbage texture data with composited table row
+        https://bugs.webkit.org/show_bug.cgi?id=148984
+
+        Reviewed by Zalan Bujtas.
+        
+        Don't pretend to know if the layer for a table header, section or cell is
+        opaque, since table painting is special.
+
+        Test: compositing/contents-opaque/table-parts.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::backgroundIsKnownToBeOpaqueInRect):
+
+2015-10-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Garbage pixels on enphaseenergy.com site
+        https://bugs.webkit.org/show_bug.cgi?id=149915
+        rdar://problem/22976184
+
+        Reviewed by Darin Adler.
+        
+        When the <html> gets a composited RenderLayer, and we ask whether its background
+        is opaque, return false, since the document element's background propagates
+        to the root, and is painted by the RenderView.
+        
+        Also improve the compositing logging to indicate when fore- and background layers
+        are present.
+
+        Test: compositing/contents-opaque/negative-z-before-html.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::logLayerInfo):
+
+2015-10-09  Antoine Quint  <graouts@apple.com>
+
+        Dynamic background color changes do not update until a layout is forced
+        https://bugs.webkit.org/show_bug.cgi?id=131623
+
+        Compute correct repaint rect for decorated RenderSVGRoots.
+
+        The current implementation of clippedOverflowRectForRepaint() uses the
+        generic repaint-rect calculations in SVGRenderSupport. Those in turn make
+        use of repaintRectInLocalCoordinates(), which for RenderSVGRoot is the
+        union of the painted children (w/ some expansion). If there're no children,
+        or they do not fill the entire content box, then a repaint would not
+        repaint the correct parts.
+        Fix by calculating the union of the border-box and the SVG content
+        when the SVG root is decorated (has background/border/etc.)
+
+        Adapted from a Chromium patch by fs@opera.com
+        https://src.chromium.org/viewvc/blink?revision=170890&view=revision
+
+        Reviewed by Darin Adler.
+
+        Tests: svg/repaint/add-background-property-on-root.html
+               svg/repaint/add-border-property-on-root.html
+               svg/repaint/add-outline-property-on-root.html
+               svg/repaint/change-background-color.html
+               svg/repaint/remove-background-property-on-root.html
+               svg/repaint/remove-border-property-on-root.html
+               svg/repaint/remove-outline-property-on-root.html
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::styleDidChange):
+        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):
+
+2015-10-09  Simon Fraser  <simon.fraser@apple.com>
+
+        [iOS WK2] Fix assertion in ViewportConfiguration::setDefaultConfiguration seen in testing
+        https://bugs.webkit.org/show_bug.cgi?id=149959
+
+        Reviewed by Tim Horton.
+
+        When loading tests which set a flexible viewport, ViewportConfiguration::setDefaultConfiguration()
+        is called first with testingParameters() and then with webpageParameters(). This
+        would trigger the assertion that m_defaultConfiguration.initialScaleIsSet but
+        the new initial scale is zero.
+        
+        The assertion seems wrong anyway; it's consulting m_defaultConfiguration.initialScaleIsSet
+        but defaultConfiguration.initialScale, so fix it to test defaultConfiguration.initialScaleIsSet.
+
+        * page/ViewportConfiguration.cpp:
+        (WebCore::ViewportConfiguration::setDefaultConfiguration):
+
+2015-10-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(STREAM_API) build after r190794
+        https://bugs.webkit.org/show_bug.cgi?id=149955
+
+        Reviewed by Darin Adler.
+
+        * bindings/js/WebCoreJSBuiltinInternals.h:
+        (WebCore::JSBuiltinInternalFunctions::visit):
+        (WebCore::JSBuiltinInternalFunctions::init):
+
+2015-10-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the binding generator after r190785
+        https://bugs.webkit.org/show_bug.cgi?id=149956
+
+        Reviewed by Darin Adler.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorHelperMethods):
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
+        (WebCore::JSTestJSBuiltinConstructorConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorNamedConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::JSTestNodeConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::JSTestOverloadedConstructorsConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefsConstructor::getConstructData):
+
+2015-10-08  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Backgrounds bleed out of natively rendered text fields
+        https://bugs.webkit.org/show_bug.cgi?id=149843
+        <rdar://problem/22896977>
+
+        Reviewed by Darin Adler.
+
+        When natively rendering a text field with a background on Mac, the background bleeds out
+        of the text field's border when the graphics context is scaled (as a result of a retina
+        display or zoom/scale effects). This is because when we render the text field in bezeled
+        style within a certain frame, AppKit adds 1 device pixel insets on all sides of the frame,
+        which renders a text field that is slightly smaller than the frame. To adjust for this, we
+        inflate the paint rect.
+
+        Test: fast/forms/hidpi-textfield-background-bleeding.html
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintTextField):
+
+2015-10-09  Xabier Rodriguez Calvar  <calvaris@igalia.com> and Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Refactor WebCore JS builtins to prepare for automatic generation
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+
+        Reviewed by Darin Adler.
+
+        Adding annotations to JS files to know whether they should be under a compilation flag and
+        whether they are JS internals or JS tied to WebIDL.
+        If a file is said as JS internals, all function names should be exported automatically.
+        Added WebCoreJSBuiltins.h to simplify handling of builtins in JSVMClientData.
+        Added WebCoreJSInternals.h to simplify handling of builtin private function in JSDOMWindowBase.
+        Renamed WebCoreJSClientData to JSVMClientData.
+
+        Covered by existing tests.
+
+        * CMakeLists.txt:
+        * Modules/streams/ByteLengthQueuingStrategy.js:
+        * Modules/streams/CountQueuingStrategy.js:
+        * Modules/streams/ReadableStream.js:
+        * Modules/streams/ReadableStreamController.js:
+        * Modules/streams/ReadableStreamInternals.js:
+        * Modules/streams/ReadableStreamReader.js:
+        * WebCore.order:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        (WebCore::normalWorld):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::finishCreation):
+        (WebCore::JSDOMWindowBase::visitChildren):
+        (WebCore::JSDOMWindowBase::fireFrameClearedWatchpointsForWindow):
+        (WebCore::JSDOMWindowBase::destroy): Deleted.
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::transferArrayBuffers):
+        * bindings/js/WebCoreJSBuiltinInternals.h: Added.
+        (WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions):
+        (WebCore::JSBuiltinInternalFunctions::readableStreamInternals):
+        (WebCore::JSBuiltinInternalFunctions::visit):
+        (WebCore::JSBuiltinInternalFunctions::init):
+        * bindings/js/WebCoreJSBuiltins.cpp:
+        * bindings/js/WebCoreJSBuiltins.h: Added.
+        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
+        (WebCore::JSBuiltinFunctions::byteLengthQueuingStrategyBuiltins):
+        (WebCore::JSBuiltinFunctions::countQueuingStrategyBuiltins):
+        (WebCore::JSBuiltinFunctions::readableStreamBuiltins):
+        (WebCore::JSBuiltinFunctions::readableStreamControllerBuiltins):
+        (WebCore::JSBuiltinFunctions::readableStreamInternalsBuiltins):
+        (WebCore::JSBuiltinFunctions::readableStreamReaderBuiltins):
+        * bindings/js/WebCoreJSClientData.h:
+        (WebCore::JSVMClientData::JSVMClientData):
+        (WebCore::JSVMClientData::~JSVMClientData):
+        (WebCore::JSVMClientData::builtinFunctions):
+        (WebCore::initNormalWorldClientData):
+        (WebCore::JSVMClientData::normalWorld): Deleted.
+        (WebCore::JSVMClientData::getAllWorlds): Deleted.
+
+2015-10-09  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Rationalize JSXXConstructor class definition
+        https://bugs.webkit.org/show_bug.cgi?id=149923
+
+        Reviewed by Darin Adler.
+
+        Declaration of JSXXConstructor::construct and JSXXConstructor::getConstructData
+        as long as JSXX is constructable from JavaScript.
+
+        Previously, JSXXConstructor::construct was not generated in case of CustomConstructor.
+        It is now generated and directly calls the custom constructor function.
+
+        getConstructData was declared conditionally with #if in case of ConstructorConditional.
+        The #if are now within getConstructData body.
+
+        Covered by binding tests.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDeclaration):
+        (GenerateOverloadedConstructorDefinition):
+        (GenerateConstructorDefinition):
+        (GenerateConstructorHelperMethods):
+        (GenerateConstructorDefinitions):.
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::construct):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::getConstructData):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::finishCreation):.
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::construct):
+        (WebCore::JSTestEventConstructorConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::construct):
+        (WebCore::JSTestInterfaceConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
+        (WebCore::JSTestJSBuiltinConstructorConstructor::construct):
+        (WebCore::JSTestJSBuiltinConstructorConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorNamedConstructor::construct):
+        (WebCore::JSTestNamedConstructorNamedConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::JSTestNodeConstructor::construct):
+        (WebCore::JSTestNodeConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::construct):
+        (WebCore::JSTestObjConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::constructJSTestOverloadedConstructors1):
+        (WebCore::constructJSTestOverloadedConstructors2):
+        (WebCore::constructJSTestOverloadedConstructors3):
+        (WebCore::constructJSTestOverloadedConstructors4):
+        (WebCore::constructJSTestOverloadedConstructors5):
+        (WebCore::JSTestOverloadedConstructorsConstructor::construct):
+        (WebCore::JSTestOverloadedConstructorsConstructor::getConstructData):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefsConstructor::construct):
+        (WebCore::JSTestTypedefsConstructor::getConstructData):
+
+2015-10-07  Sergio Villar Senin  <svillar@igalia.com>
+
+        [css-grid] Include freeSpace in GridSizingData struct
+        https://bugs.webkit.org/show_bug.cgi?id=149876
+
+        Reviewed by Darin Adler.
+
+        During the layout process we keep the free space for rows and
+        columns in two variables that are passed to a few methods
+        along with the GridSizingData struct. Those two variables
+        should clearly be part of GridSizingData as they're temporary
+        values used just for the sake of the layout.
+
+        No new tests required as this is just a refactoring.
+
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::GridSizingData::GridSizingData):
+        (WebCore::RenderGrid::GridSizingData::freeSpaceForDirection):
+        (WebCore::RenderGrid::computeIntrinsicLogicalWidths):
+        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
+        (WebCore::RenderGrid::applyStretchAlignmentToTracksIfNeeded):
+        (WebCore::RenderGrid::layoutGridItems):
+        (WebCore::RenderGrid::populateGridPositions):
+        (WebCore::contentDistributionOffset):
+        (WebCore::RenderGrid::computeContentPositionAndDistributionOffset):
+        * rendering/RenderGrid.h:
+
+2015-10-08  Sergio Villar Senin  <svillar@igalia.com>
+
+        [css-grid] Remove unneeded calls to compute(Content)LogicalWidth(Height)
+        https://bugs.webkit.org/show_bug.cgi?id=149926
+
+        Reviewed by Darin Adler.
+
+        In order to resolve a Length to a LayoutUnit we need to
+        provide a maximum value so that i.e. percentages are correctly
+        computed. That maximum value was computeLogicalWidth() for
+        columns and computeContentLogicalHeight() for rows. We were
+        calling it for every single track with a definite size instead
+        of computing it once and reusing it multiple times.
+
+        This brings some nice performance improvements:
+        - 2.9%  in /Layout/fixed-grid-lots-of-data
+        - 2.95% in /Layout/fixed-grid-lots-of-stretched-data
+
+        No new tests required as there is no change in functionality.
+
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
+        (WebCore::RenderGrid::computeUsedBreadthOfMinLength):
+        (WebCore::RenderGrid::computeUsedBreadthOfMaxLength):
+        (WebCore::RenderGrid::tracksAreWiderThanMinTrackBreadth):
+        * rendering/RenderGrid.h:
+
+2015-10-08  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, build fix for ENABLE(MEDIA_SESSION) after r190030.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateIsPlayingMedia):
+
+2015-10-08  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, build fixes for ENABLE(MEDIA_SESSION) after r190030.
+
+        * Modules/mediasession/HTMLMediaElementMediaSession.cpp:
+        (WebCore::HTMLMediaElementMediaSession::session):
+        * Modules/mediasession/HTMLMediaElementMediaSession.h:
+        * Modules/mediasession/MediaSession.cpp:
+        (WebCore::MediaSession::controls):
+        * Modules/mediasession/MediaSession.h:
+
+2015-10-08  Jiewen Tan  <jiewen_tan@apple.com>
+
+        Gracefully handle XMLDocumentParser being detached by mutation events.
+        https://bugs.webkit.org/show_bug.cgi?id=149485
+        <rdar://problem/22811489>
+
+        This is a merge of Blink change 200026,
+        https://codereview.chromium.org/1267283002
+
+        Reviewed by Darin Adler.
+
+        Test: fast/parser/xhtml-dom-character-data-modified-crash.html
+
+        * xml/parser/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::createLeafTextNode):
+        Renamed from enterText() to make it more descriptive. 
+
+        (WebCore::XMLDocumentParser::updateLeafTextNode):
+        Renamed from exitText to firm up this stage.
+
+        (WebCore::XMLDocumentParser::end):
+        Gracefully handle stopped states.
+
+        (WebCore::XMLDocumentParser::enterText): Deleted.
+        (WebCore::XMLDocumentParser::exitText): Deleted.
+
+        * xml/parser/XMLDocumentParser.h:
+        Rename enterText to createLeafTextNode.
+        Rename exitText to updateLeafTextNode.
+
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::startElementNs):
+        (WebCore::XMLDocumentParser::endElementNs):
+        (WebCore::XMLDocumentParser::characters):
+        (WebCore::XMLDocumentParser::processingInstruction):
+        (WebCore::XMLDocumentParser::cdataBlock):
+        (WebCore::XMLDocumentParser::comment):
+        (WebCore::XMLDocumentParser::endDocument):
+        Rename function calls and firm up updateLeafTextNode stage accordingly.
+
+2015-10-08  Chris Dumez  <cdumez@apple.com>
+
+        data: URLs should not be preloaded
+        https://bugs.webkit.org/show_bug.cgi?id=149829
+
+        Reviewed by Darin Adler.
+
+        Fix review comments after r190605:
+        Use protocolIs() instead of String::startsWith().
+
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore::TokenPreloadScanner::StartTagScanner::shouldPreload):
+
+2015-10-08  Chris Dumez  <cdumez@apple.com>
+
+        Revert r187626 (and r188025) as it caused a PLT regression
+        https://bugs.webkit.org/show_bug.cgi?id=149898
+        <rdar://problem/22657123>
+
+        Reviewed by Myles Maxfield.
+
+        * css/CSSPropertyNames.in:
+        * css/StyleBuilderCustom.h:
+        (WebCore::StyleBuilderCustom::applyValueWebkitLocale):
+        * platform/graphics/Font.cpp:
+        (WebCore::CharacterFallbackMapKey::CharacterFallbackMapKey):
+        (WebCore::CharacterFallbackMapKey::operator==):
+        (WebCore::CharacterFallbackMapKeyHash::hash):
+        (WebCore::Font::systemFallbackFontForCharacter):
+        * platform/graphics/FontCache.h:
+        (WebCore::FontDescriptionKey::operator==):
+        (WebCore::FontDescriptionKey::FontDescriptionKey): Deleted.
+        (WebCore::FontDescriptionKey::computeHash): Deleted.
+        * platform/graphics/FontDescription.cpp:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::traitsMask): Deleted.
+        (WebCore::FontCascadeDescription::FontCascadeDescription): Deleted.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::setScript):
+        (WebCore::FontDescription::operator==):
+        (WebCore::FontDescription::setFeatureSettings): Deleted.
+        (WebCore::FontCascadeDescription::initialVariantAlternates): Deleted.
+        * platform/graphics/cocoa/FontCacheCoreText.cpp:
+        (WebCore::FontCache::systemFallbackForCharacters):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::changeRequiresLayout):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        * style/StyleResolveForDocument.cpp:
+        (WebCore::Style::resolveForDocument):
+
+2015-10-08  Andreas Kling  <akling@apple.com>
+
+        Generated frame tree names should be kept reasonably long.
+        <https://webkit.org/b/149874>
+
+        Reviewed by Darin Adler.
+
+        Some clumsy advertising script is going around assigning JavaScript source code
+        to the "name" attribute of iframes. This is causing WebKit to generate way too huge
+        names for anonymous descendants of such iframes.
+
+        Previously, the generated name of an anonymous subframe would be its slash-separated
+        path from the root frame, with the "name" attribute of each ancestor between the
+        slashes, or "<!--frame${index in parent}-->" for anonymous ancestors.
+
+        These ad scripts are often over 100kB in size, with multiple subframes, so we'd end
+        up with frame names looking like this:
+
+        "<!--framePath //<MONSTER BLOB OF JAVASCRIPT FROM HELL>/<!--frame0--><!--frame0-->-->"
+
+        While this is worth fixing for the memory usage alone, we've been making it way
+        worse by also using these paths when recording the back/forward history parts of
+        WebKit session state.
+
+        This patch makes generated paths always use index-in-parent as the "directory name"
+        for ancestors of anonymous subframes. The above example path will now instead be:
+
+        "<!--framePath //<!--frame0-->/<!--frame0-->/<!--frame0-->-->"
+
+        Test: fast/frames/long-names-in-nested-subframes.html
+
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::indexInParent):
+        (WebCore::FrameTree::uniqueChildName):
+        * page/FrameTree.h:
+
+2015-10-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190701.
+        https://bugs.webkit.org/show_bug.cgi?id=149937
+
+        "It did not help, will try a full roll out instead" (Requested
+        by cdumez on #webkit).
+
+        Reverted changeset:
+
+        "Partial revert of r187626 as it caused a PLT regression"
+        https://bugs.webkit.org/show_bug.cgi?id=149898
+        http://trac.webkit.org/changeset/190701
+
+2015-10-08  Zalan Bujtas  <zalan@apple.com>
+
+        Fallback to the RenderView when repaint container is null.
+        https://bugs.webkit.org/show_bug.cgi?id=149903
+
+        Reviewed by Simon Fraser.
+
+        Reduces code complexity at the calling sites.
+
+        No change in functionality.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintUsingContainer):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+
+2015-10-08  Jiewen Tan  <jiewen_tan@apple.com>
+
+        Add NULL check for renderBox::layer() on applying zoom level change
+        https://bugs.webkit.org/show_bug.cgi?id=149302
+        <rdar://problem/22747292>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/css/zoom-on-nested-scroll-crash.html
+
+        This is a merge of Blink r158238:
+        https://chromiumcodereview.appspot.com/23526081
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+
+2015-10-08  Brady Eidson  <beidson@apple.com>
+
+        Update Inspector to only work with Legacy IDB (for now).
+        https://bugs.webkit.org/show_bug.cgi?id=149928.
+
+        Reviewed by Tim Horton.
+
+        * Modules/indexeddb/IDBAny.h:
+        (WebCore::IDBAny::isLegacy):
+        
+        * Modules/indexeddb/legacy/LegacyAny.h:
+        * inspector/InspectorIndexedDBAgent.cpp:
+
+2015-10-08  Antti Koivisto  <antti@apple.com>
+
+        CrashTracer: [USER] com.apple.WebKit.WebContent at …Core::SelectorChecker::checkScrollbarPseudoClass const + 217
+        https://bugs.webkit.org/show_bug.cgi?id=149921
+        rdar://problem/22731359
+
+        Reviewed by Andreas Kling.
+
+        Test: svg/css/use-window-inactive-crash.html
+
+        * css/SelectorCheckerTestFunctions.h:
+        (WebCore::isWindowInactive):
+
+            Null check page.
+
+2015-10-08  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Format string issues in LegacyRequest.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=149866
+
+        Reviewed by Csaba Osztrogonác.
+
+        Cast enums to ints before printing them to placate GCC's -Wformat.
+
+        * Modules/indexeddb/legacy/LegacyRequest.cpp:
+        (WebCore::LegacyRequest::dispatchEvent):
+        (WebCore::LegacyRequest::enqueueEvent):
+
+2015-10-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190716.
+        https://bugs.webkit.org/show_bug.cgi?id=149924
+
+        broke mac build from time to time (Requested by youenn on
+        #webkit).
+
+        Reverted changeset:
+
+        "Automate WebCore JS builtins generation and build system"
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+        http://trac.webkit.org/changeset/190716
+
+2015-10-08  Sergio Villar Senin  <svillar@igalia.com>
+
+        [css-grid] Percentages of indefinite sizes to be resolved as auto
+        https://bugs.webkit.org/show_bug.cgi?id=149810
+
+        Reviewed by Darin Adler.
+
+        Specs mention that percentages in grid track sizes must be
+        resolved as 'auto' if the grid container has an indefinite
+        size in the corresponding axis.
+
+        The 'auto' keyword used to be resolved as
+        minmax(min-content,max-content) but since r189911 it's
+        resolved as minmax(auto,auto). Updated the implementation so
+        we properly resolve those percentages.
+
+        No new tests as the behavior does not change at all. That's
+        because 'auto' as min-track sizing function is the same as
+        min-content (unless we have a specified value for
+        min-{width|height}, but those cases were already handled in the
+        code), and as a max sizing function is works as max-content.
+
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::gridTrackSize):
+
+2015-10-08  Xabier Rodriguez Calvar  <calvaris@igalia.com> and Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Automate WebCore JS builtins generation and build system
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+
+        Reviewed by Darin Adler.
+
+        Adding annotations to JS files to know whether they should be under a compilation flag and
+        whether they are JS internals or JS tied to WebIDL.
+        If a file is said as JS internals, all function names are exported automatically.
+        Added auto generation of WebCoreJSBuiltins.cpp
+        Added auto generation of JSBuiltinFunctions class inside WebCoreJSBuiltins that takes the role of
+        WebCoreJSClientData as wrapper for builtins.
+        Added auto generation of WebCoreJSBuiltinInternals.h which contain a wrapper around all private functions, used by
+        JSDOMWindowBase. The class is named JSBuiltinInternalFunctions.
+        Renamed WebCoreJSClientData to JSVMClientData.
+
+        The remaining manual part for private functions is the pairing between private identifiers and
+        the private JS functions within JSDOMWindowBase::finishCreation.
+
+        Covered by existing tests.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * Modules/streams/ByteLengthQueuingStrategy.js:
+        * Modules/streams/CountQueuingStrategy.js:
+        * Modules/streams/ReadableStream.js:
+        * Modules/streams/ReadableStreamInternals.js:
+        * WebCore.order:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        (WebCore::normalWorld):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::finishCreation):
+        (WebCore::JSDOMWindowBase::visitChildren):
+        (WebCore::JSDOMWindowBase::fireFrameClearedWatchpointsForWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::transferArrayBuffers):
+        * bindings/js/WebCoreJSClientData.h:
+        (WebCore::JSClientData::JSClientData):
+        (WebCore::JSClientData::~JSClientData):
+        (WebCore::JSClientData::builtinFunctions):
+        (WebCore::initNormalWorldClientData):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData): Deleted.
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData): Deleted.
+        (WebCore::WebCoreJSClientData::readableStreamBuiltins): Deleted.
+        (WebCore::WebCoreJSClientData::readableStreamControllerBuiltins): Deleted.
+        (WebCore::WebCoreJSClientData::readableStreamInternalsBuiltins): Deleted.
+        (WebCore::WebCoreJSClientData::readableStreamReaderBuiltins): Deleted.
+        (WebCore::WebCoreJSClientData::byteLengthQueuingStrategyBuiltins): Deleted.
+        (WebCore::WebCoreJSClientData::countQueuingStrategyBuiltins): Deleted.
+        * generate-js-builtins-allinone: Added.
+        (retrieveGenerationParameters):
+        (retrieveFilesWithParameters):
+        (retrieveFilesWithParameters.FileInput):
+        (writeConditional):
+        (JSBuiltinFunctions):
+        (Private):
+        (JSBuiltinInternalFunctions):
+        (copytempfile):
+
+2015-10-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Binding generated JS constructors should use GlobalObject references
+        https://bugs.webkit.org/show_bug.cgi?id=149872
+
+        Reviewed by Darin Adler.
+
+        Updated binding generator to generate JS DOM constructors code with JSDOMGlobalOBject references.
+        Updated WebCore JS binding layer accordingly.
+
+        Covered by updated binding tests.
+
+        * bindings/js/DOMConstructorWithDocument.h:
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        (WebCore::DOMConstructorWithDocument::finishCreation):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMStructure):
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorJSBuiltinObject::DOMConstructorJSBuiltinObject):
+        (WebCore::getDOMStructure):
+        (WebCore::deprecatedGetDOMStructure):
+        (WebCore::getDOMPrototype):
+        (WebCore::createJSBuiltin):
+        (WebCore::createWrapper):
+        * bindings/js/JSDOMConstructor.h:
+        (WebCore::JSBuiltinConstructor::JSBuiltinConstructor):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::image):
+        (WebCore::JSDOMWindow::touch):
+        (WebCore::JSDOMWindow::touchList):
+        * bindings/js/JSDOMWrapper.h:
+        (WebCore::JSDOMWrapper::JSDOMWrapper):
+        (WebCore::JSDOMWrapperWithImplementation::JSDOMWrapperWithImplementation):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        (WebCore::JSImageConstructor::finishCreation):
+        * bindings/js/JSImageConstructor.h:
+        (WebCore::JSImageConstructor::create):
+        (WebCore::JSImageConstructor::createStructure):
+        * bindings/js/JSReadableStreamPrivateConstructors.cpp:
+        (WebCore::JSBuiltinReadableStreamReaderPrivateConstructor::createJSObject):
+        (WebCore::JSBuiltinReadableStreamControllerPrivateConstructor::createJSObject):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        (GenerateCallbackImplementation):
+        (GenerateConstructorDeclaration):
+        (GenerateConstructorHelperMethods):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::JSTestActiveDOMObjectConstructor::create):
+        (WebCore::JSTestActiveDOMObjectConstructor::createStructure):
+        (WebCore::JSTestActiveDOMObjectConstructor::JSTestActiveDOMObjectConstructor):
+        (WebCore::JSTestActiveDOMObjectConstructor::finishCreation):
+        (WebCore::JSTestActiveDOMObject::JSTestActiveDOMObject):
+        (WebCore::JSTestActiveDOMObject::getConstructor):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
+        (WebCore::JSTestActiveDOMObject::create):
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallbackConstructor::create):
+        (WebCore::JSTestCallbackConstructor::createStructure):
+        (WebCore::JSTestCallbackConstructor::JSTestCallbackConstructor):
+        (WebCore::JSTestCallback::getConstructor):
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::create):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::createStructure):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::JSTestCustomConstructorWithNoInterfaceObjectConstructor):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::finishCreation):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::JSTestCustomConstructorWithNoInterfaceObject):
+        (WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::create):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore::JSTestCustomNamedGetterConstructor::create):
+        (WebCore::JSTestCustomNamedGetterConstructor::createStructure):
+        (WebCore::JSTestCustomNamedGetterConstructor::JSTestCustomNamedGetterConstructor):
+        (WebCore::JSTestCustomNamedGetterConstructor::finishCreation):
+        (WebCore::JSTestCustomNamedGetter::JSTestCustomNamedGetter):
+        (WebCore::JSTestCustomNamedGetter::getConstructor):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
+        (WebCore::JSTestCustomNamedGetter::create):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::create):
+        (WebCore::JSTestEventConstructorConstructor::createStructure):
+        (WebCore::JSTestEventConstructorConstructor::JSTestEventConstructorConstructor):
+        (WebCore::JSTestEventConstructorConstructor::finishCreation):
+        (WebCore::JSTestEventConstructor::JSTestEventConstructor):
+        (WebCore::JSTestEventConstructor::getConstructor):
+        * bindings/scripts/test/JS/JSTestEventConstructor.h:
+        (WebCore::JSTestEventConstructor::create):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTargetConstructor::create):
+        (WebCore::JSTestEventTargetConstructor::createStructure):
+        (WebCore::JSTestEventTargetConstructor::JSTestEventTargetConstructor):
+        (WebCore::JSTestEventTargetConstructor::finishCreation):
+        (WebCore::JSTestEventTarget::JSTestEventTarget):
+        (WebCore::JSTestEventTarget::getConstructor):
+        * bindings/scripts/test/JS/JSTestEventTarget.h:
+        (WebCore::JSTestEventTarget::create):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::JSTestExceptionConstructor::create):
+        (WebCore::JSTestExceptionConstructor::createStructure):
+        (WebCore::JSTestExceptionConstructor::JSTestExceptionConstructor):
+        (WebCore::JSTestExceptionConstructor::finishCreation):
+        (WebCore::JSTestException::JSTestException):
+        (WebCore::JSTestException::getConstructor):
+        * bindings/scripts/test/JS/JSTestException.h:
+        (WebCore::JSTestException::create):
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
+        (WebCore::JSTestGenerateIsReachableConstructor::create):
+        (WebCore::JSTestGenerateIsReachableConstructor::createStructure):
+        (WebCore::JSTestGenerateIsReachableConstructor::JSTestGenerateIsReachableConstructor):
+        (WebCore::JSTestGenerateIsReachableConstructor::finishCreation):
+        (WebCore::JSTestGenerateIsReachable::JSTestGenerateIsReachable):
+        (WebCore::JSTestGenerateIsReachable::getConstructor):
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
+        (WebCore::JSTestGenerateIsReachable::create):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::create):
+        (WebCore::JSTestInterfaceConstructor::createStructure):
+        (WebCore::JSTestInterfaceConstructor::JSTestInterfaceConstructor):
+        (WebCore::JSTestInterfaceConstructor::finishCreation):
+        (WebCore::JSTestInterface::JSTestInterface):
+        (WebCore::JSTestInterface::getConstructor):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
+        (WebCore::JSTestJSBuiltinConstructorConstructor::create):
+        (WebCore::JSTestJSBuiltinConstructorConstructor::createStructure):
+        (WebCore::JSTestJSBuiltinConstructorConstructor::JSTestJSBuiltinConstructorConstructor):
+        (WebCore::JSTestJSBuiltinConstructorConstructor::finishCreation):
+        (WebCore::JSTestJSBuiltinConstructor::JSTestJSBuiltinConstructor):
+        (WebCore::JSTestJSBuiltinConstructor::getConstructor):
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
+        (WebCore::JSTestJSBuiltinConstructor::create):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::JSTestMediaQueryListListenerConstructor::create):
+        (WebCore::JSTestMediaQueryListListenerConstructor::createStructure):
+        (WebCore::JSTestMediaQueryListListenerConstructor::JSTestMediaQueryListListenerConstructor):
+        (WebCore::JSTestMediaQueryListListenerConstructor::finishCreation):
+        (WebCore::JSTestMediaQueryListListener::JSTestMediaQueryListListener):
+        (WebCore::JSTestMediaQueryListListener::getConstructor):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        (WebCore::JSTestMediaQueryListListener::create):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorConstructor::create):
+        (WebCore::JSTestNamedConstructorConstructor::createStructure):
+        (WebCore::JSTestNamedConstructorNamedConstructor::create):
+        (WebCore::JSTestNamedConstructorNamedConstructor::createStructure):
+        (WebCore::JSTestNamedConstructorConstructor::JSTestNamedConstructorConstructor):
+        (WebCore::JSTestNamedConstructorConstructor::finishCreation):
+        (WebCore::JSTestNamedConstructorNamedConstructor::JSTestNamedConstructorNamedConstructor):
+        (WebCore::JSTestNamedConstructorNamedConstructor::finishCreation):
+        (WebCore::JSTestNamedConstructor::JSTestNamedConstructor):
+        (WebCore::JSTestNamedConstructor::getConstructor):
+        (WebCore::JSTestNamedConstructor::getNamedConstructor):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
+        (WebCore::JSTestNamedConstructor::create):
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::JSTestNodeConstructor::create):
+        (WebCore::JSTestNodeConstructor::createStructure):
+        (WebCore::JSTestNodeConstructor::JSTestNodeConstructor):
+        (WebCore::JSTestNodeConstructor::finishCreation):
+        (WebCore::JSTestNode::JSTestNode):
+        (WebCore::JSTestNode::getConstructor):
+        * bindings/scripts/test/JS/JSTestNode.h:
+        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
+        (WebCore::JSTestNondeterministicConstructor::create):
+        (WebCore::JSTestNondeterministicConstructor::createStructure):
+        (WebCore::JSTestNondeterministicConstructor::JSTestNondeterministicConstructor):
+        (WebCore::JSTestNondeterministicConstructor::finishCreation):
+        (WebCore::JSTestNondeterministic::JSTestNondeterministic):
+        (WebCore::JSTestNondeterministic::getConstructor):
+        * bindings/scripts/test/JS/JSTestNondeterministic.h:
+        (WebCore::JSTestNondeterministic::create):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::create):
+        (WebCore::JSTestObjConstructor::createStructure):
+        (WebCore::JSTestObjConstructor::JSTestObjConstructor):
+        (WebCore::JSTestObjConstructor::finishCreation):
+        (WebCore::JSTestObj::JSTestObj):
+        (WebCore::JSTestObj::getConstructor):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore::JSTestObj::create):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::JSTestOverloadedConstructorsConstructor::create):
+        (WebCore::JSTestOverloadedConstructorsConstructor::createStructure):
+        (WebCore::JSTestOverloadedConstructorsConstructor::JSTestOverloadedConstructorsConstructor):
+        (WebCore::JSTestOverloadedConstructorsConstructor::finishCreation):
+        (WebCore::JSTestOverloadedConstructors::JSTestOverloadedConstructors):
+        (WebCore::JSTestOverloadedConstructors::getConstructor):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
+        (WebCore::JSTestOverloadedConstructors::create):
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
+        (WebCore::JSTestOverrideBuiltinsConstructor::create):
+        (WebCore::JSTestOverrideBuiltinsConstructor::createStructure):
+        (WebCore::JSTestOverrideBuiltinsConstructor::JSTestOverrideBuiltinsConstructor):
+        (WebCore::JSTestOverrideBuiltinsConstructor::finishCreation):
+        (WebCore::JSTestOverrideBuiltins::JSTestOverrideBuiltins):
+        (WebCore::JSTestOverrideBuiltins::getConstructor):
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
+        (WebCore::JSTestOverrideBuiltins::create):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::create):
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::createStructure):
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::JSTestSerializedScriptValueInterfaceConstructor):
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
+        (WebCore::JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface):
+        (WebCore::JSTestSerializedScriptValueInterface::getConstructor):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        (WebCore::JSTestSerializedScriptValueInterface::create):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefsConstructor::create):
+        (WebCore::JSTestTypedefsConstructor::createStructure):
+        (WebCore::JSTestTypedefsConstructor::JSTestTypedefsConstructor):
+        (WebCore::JSTestTypedefsConstructor::finishCreation):
+        (WebCore::JSTestTypedefs::JSTestTypedefs):
+        (WebCore::JSTestTypedefs::getConstructor):
+        * bindings/scripts/test/JS/JSTestTypedefs.h:
+        (WebCore::JSTestTypedefs::create):
+        * bindings/scripts/test/JS/JSattribute.cpp:
+        (WebCore::JSattributeConstructor::create):
+        (WebCore::JSattributeConstructor::createStructure):
+        (WebCore::JSattributeConstructor::JSattributeConstructor):
+        (WebCore::JSattributeConstructor::finishCreation):
+        (WebCore::JSattribute::JSattribute):
+        (WebCore::JSattribute::getConstructor):
+        * bindings/scripts/test/JS/JSattribute.h:
+        (WebCore::JSattribute::create):
+        * bindings/scripts/test/JS/JSreadonly.cpp:
+        (WebCore::JSreadonlyConstructor::create):
+        (WebCore::JSreadonlyConstructor::createStructure):
+        (WebCore::JSreadonlyConstructor::JSreadonlyConstructor):
+        (WebCore::JSreadonlyConstructor::finishCreation):
+        (WebCore::JSreadonly::JSreadonly):
+        (WebCore::JSreadonly::getConstructor):
+        * bindings/scripts/test/JS/JSreadonly.h:
+        (WebCore::JSreadonly::create):
+
+2015-10-08  Philippe Normand  <pnormand@igalia.com>
+
+        WebRTC: Add event names needed by updated RTCPeerConnection
+        https://bugs.webkit.org/show_bug.cgi?id=149875
+
+        Reviewed by Eric Carlson.
+
+        The track event name was recently added in the WebRTC spec. The
+        icegatheringstatechange event has been part of the spec for a while but
+        was not registered in our DOM events.
+
+        * dom/EventNames.h: Add track and icegatheringstatechange even names.
+
+2015-10-07  Keith Rollin  <krollin@apple.com>
+
+        script.text shouldn't include text from non-direct children of the script element
+        https://bugs.webkit.org/show_bug.cgi?id=148851
+        <rdar://problem/22587759>
+
+        Reviewed by Chris Dumez.
+
+        Don't include text from non-direct children in script.text. Per:
+        https://html.spec.whatwg.org/multipage/scripting.html#dom-script-text
+        Chrome and Firefox behavior match the spec.
+
+        Test: fast/dom/script-subtext-in-script-elements.html
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::scriptContent):
+
+2015-10-07  Chris Dumez  <cdumez@apple.com>
+
+        Partial revert of r187626 as it caused a PLT regression
+        https://bugs.webkit.org/show_bug.cgi?id=149898
+
+        Reviewed by Myles C. Maxfield.
+
+        Do a partial revert of r187626 as it caused a regression on PLT.
+
+        * platform/graphics/FontCache.h:
+        (WebCore::FontDescriptionKey::operator==):
+        (WebCore::FontDescriptionKey::FontDescriptionKey): Deleted.
+        (WebCore::FontDescriptionKey::computeHash): Deleted.
+
+2015-10-07  Zalan Bujtas  <zalan@apple.com>
+
+        RenderObject::computeRectForRepaint/computeFloatRectForRepaint should return the computed rectangle.
+        https://bugs.webkit.org/show_bug.cgi?id=149883
+
+        Reviewed by Simon Fraser.
+
+        Reduces code complexity at the calling sites.
+        No change in functionality.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderInline.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::selectionRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::computeFloatRectForRepaint):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRectForRepaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::computeRectForRepaint):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::collectSelectionRectsForLineBoxes):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::computeRectForRepaint):
+        * rendering/RenderView.h:
+        * rendering/svg/RenderSVGForeignObject.cpp:
+        (WebCore::RenderSVGForeignObject::computeFloatRectForRepaint):
+        (WebCore::RenderSVGForeignObject::computeRectForRepaint):
+        * rendering/svg/RenderSVGForeignObject.h:
+        * rendering/svg/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::computeFloatRectForRepaint):
+        * rendering/svg/RenderSVGInline.h:
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeFloatRectForRepaint):
+        * rendering/svg/RenderSVGModelObject.h:
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeFloatRectForRepaint):
+        * rendering/svg/RenderSVGRoot.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::computeFloatRectForRepaint):
+        * rendering/svg/RenderSVGText.h:
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::clippedOverflowRectForRepaint):
+        (WebCore::SVGRenderSupport::computeFloatRectForRepaint):
+        * rendering/svg/SVGRenderSupport.h:
+
+2015-10-07  Antti Koivisto  <antti@apple.com>
+
+        Implement :host pseudo class
+        https://bugs.webkit.org/show_bug.cgi?id=149440
+        rdar://problem/22731953
+
+        Reviewed by Ryosuke Niwa.
+
+        This implements the basic non-function :host syntax.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::selectorText):
+        * css/CSSSelector.h:
+        * css/ElementRuleCollector.cpp:
+        (WebCore::ElementRuleCollector::matchAuthorRules):
+        (WebCore::ElementRuleCollector::matchHostPseudoClassRules):
+        (WebCore::ElementRuleCollector::matchUserRules):
+        * css/ElementRuleCollector.h:
+        * css/RuleSet.cpp:
+        (WebCore::computeMatchBasedOnRuleHash):
+        (WebCore::RuleSet::addRule):
+        * css/RuleSet.h:
+        (WebCore::RuleSet::cuePseudoRules):
+        (WebCore::RuleSet::hostPseudoClassRules):
+        (WebCore::RuleSet::focusPseudoClassRules):
+        (WebCore::RuleSet::universalRules):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOne):
+        * css/SelectorPseudoClassAndCompatibilityElementMap.in:
+        * cssjit/SelectorCompiler.cpp:
+        (WebCore::SelectorCompiler::addPseudoClassType):
+
+2015-10-07  Nan Wang  <n_wang@apple.com>
+
+        AX: ARIA 1.1 @aria-placeholder
+        https://bugs.webkit.org/show_bug.cgi?id=148970
+
+        Reviewed by Chris Fleizach.
+
+        Added support for aria-placeholder attribute.
+
+        Modified accessibility/placeholder.html test.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::placeholderValue):
+        * html/HTMLAttributeNames.in:
+
+2015-10-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190664.
+        https://bugs.webkit.org/show_bug.cgi?id=149877
+
+        mac build is sometimes borken due to missing generated header
+        file (Requested by youenn on #webkit).
+
+        Reverted changeset:
+
+        "Automate WebCore JS builtins generation and build system"
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+        http://trac.webkit.org/changeset/190664
+
+2015-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        will-change should trigger stacking context based purely on properties
+        https://bugs.webkit.org/show_bug.cgi?id=148068
+
+        Reviewed by Zalan Bujtas.
+
+        Previously, our will-change implementation didn't trigger stacking context
+        on an inline if the will-change property didn't apply to inlines (like 'transform').
+        However, this doesn't agree with the CSS-WG consensus (https://lists.w3.org/Archives/Public/www-style/2015Sep/0112.html).
+        
+        Change behavior to have stacking context creation behavior for will-change be
+        identical for inlines and blocks.
+
+        Test: fast/css/will-change/will-change-creates-stacking-context-inline.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::inFlowPositionedInlineAncestor):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::willChangeCreatesStackingContext):
+        * rendering/style/WillChangeData.cpp:
+        (WebCore::propertyCreatesStackingContext):
+        (WebCore::WillChangeData::addFeature):
+        (WebCore::propertyCreatesStackingContextOnBoxesOnly): Deleted.
+        * rendering/style/WillChangeData.h:
+        (WebCore::WillChangeData::canCreateStackingContextOnInline): Deleted.
+
 2015-10-07  Javier Fernandez  <jfernandez@igalia.com>
 
         [CSS Grid Layout] Modify grid item height doesn't work