WebCore:
[WebKit-https.git] / WebCore / ChangeLog
index eb5d377..8393014 100644 (file)
+2008-04-29  David Hyatt  <hyatt@apple.com>
+
+        Implement the new box-reflect property in CSS.  This property enables real-time reflections on
+        objects (yes you can reflect <video>!).
+
+        Reviewed by Dan Bernstein
+
+        Test cases added in fast/reflections/
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::valueForReflection):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseReflect):
+        (WebCore::BorderImageParseContext::commitBorderImage):
+        (WebCore::CSSParser::parseBorderImage):
+        (WebCore::parseGradientColorStop):
+        (WebCore::CSSParser::parseTransform):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSReflectValue.cpp: Added.
+        (WebCore::CSSReflectValue::cssText):
+        * css/CSSReflectValue.h: Added.
+        (WebCore::):
+        (WebCore::CSSReflectValue::CSSReflectValue):
+        (WebCore::CSSReflectValue::direction):
+        (WebCore::CSSReflectValue::offset):
+        (WebCore::CSSReflectValue::mask):
+        (WebCore::CSSReflectValue::setDirection):
+        (WebCore::CSSReflectValue::setOffset):
+        (WebCore::CSSReflectValue::setMask):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapNinePieceImage):
+        * css/CSSStyleSelector.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/Length.h:
+        (WebCore::Length::calcFloatValue):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight):
+        (WebCore::RenderBlock::overflowWidth):
+        (WebCore::RenderBlock::overflowLeft):
+        (WebCore::RenderBlock::overflowTop):
+        (WebCore::RenderBlock::overflowRect):
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::setStyle):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::imageChanged):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::isTransparent):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::operator delete):
+        (WebCore::RenderLayer::destroy):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        (WebCore::RenderLayer::insertOnlyThisLayer):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::updateZOrderLists):
+        (WebCore::RenderLayer::updateOverflowList):
+        (WebCore::RenderLayer::collectLayers):
+        (WebCore::RenderLayer::shouldBeOverflowOnly):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::reflectionLayer):
+        (WebCore::RenderLayer::createReflection):
+        (WebCore::RenderLayer::updateReflectionStyle):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasReflection):
+        (WebCore::RenderLayer::reflection):
+        (WebCore::RenderLayer::paintingInsideReflection):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::requiresLayer):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::updateImage):
+        (WebCore::RenderObject::reflectionBox):
+        (WebCore::RenderObject::reflectionOffset):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasTransform):
+        (WebCore::RenderObject::setHasReflection):
+        (WebCore::RenderObject::hasReflection):
+        * rendering/RenderReplica.cpp: Added.
+        (WebCore::RenderReplica::RenderReplica):
+        (WebCore::RenderReplica::~RenderReplica):
+        (WebCore::RenderReplica::layout):
+        (WebCore::RenderReplica::calcPrefWidths):
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderReplica.h: Added.
+        (WebCore::RenderReplica::renderName):
+        (WebCore::RenderReplica::requiresLayer):
+        * rendering/RenderStyle.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        (WebCore::StyleRareNonInheritedData::reflectionDataEquivalent):
+        (WebCore::RenderStyle::diff):
+        (WebCore::RenderStyle::applyTransform):
+        * rendering/RenderStyle.h:
+        (WebCore::TranslateTransformOperation::apply):
+        (WebCore::StyleReflection::StyleReflection):
+        (WebCore::StyleReflection::operator==):
+        (WebCore::StyleReflection::operator!=):
+        (WebCore::StyleReflection::direction):
+        (WebCore::StyleReflection::offset):
+        (WebCore::StyleReflection::mask):
+        (WebCore::StyleReflection::setDirection):
+        (WebCore::StyleReflection::setOffset):
+        (WebCore::StyleReflection::setMask):
+        (WebCore::RenderStyle::boxReflect):
+        (WebCore::RenderStyle::setBoxReflect):
+        (WebCore::RenderStyle::initialBoxReflect):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paintMask):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::requiresLayer):
+        (WebCore::RenderTableCell::paintMask):
+
+2008-04-29  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Alice.
+
+        Initial implementation of the following ARIA roles: button, 
+        checkbox, heading, link, radio, textbox.
+
+        * html/HTMLAttributeNames.in: Add 'role' to list of attributes.
+
+        * page/AccessibilityObject.cpp:
+         When an ARIA role is set, the role overrides whatever the actual 
+element is when the element reports itself to the screen reader. So all of these isBlah functions report based on their roleValue now.
+        (WebCore::AccessibilityObject::isWebArea):
+        (WebCore::AccessibilityObject::isImageButton):
+        (WebCore::AccessibilityObject::isAnchor):
+        (WebCore::AccessibilityObject::isTextControl):
+        (WebCore::AccessibilityObject::isImage):
+        (WebCore::AccessibilityObject::isAttachment):
+        (WebCore::AccessibilityObject::isPasswordField):
+        (WebCore::AccessibilityObject::isCheckboxOrRadio):
+        (WebCore::AccessibilityObject::isHeading):
+        (WebCore::AccessibilityObject::isLink):
+
+        Check for ARIA information:
+        (WebCore::AccessibilityObject::headingLevel):
+        (WebCore::AccessibilityObject::anchorElement):
+        (WebCore::AccessibilityObject::actionElement):
+        (WebCore::AccessibilityObject::hasIntValue):
+        (WebCore::AccessibilityObject::intValue):
+        (WebCore::AccessibilityObject::stringValue):
+        (WebCore::AccessibilityObject::title):
+        (WebCore::AccessibilityObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityObject::roleValue):
+
+        There are a few places in the code where it is important to identify the difference between ARIA and non-ARIA.
+        (WebCore::AccessibilityObject::isNativeImage):
+        (WebCore::AccessibilityObject::isNativeTextControl):
+        (WebCore::isARIAInput):
+        (WebCore::isARIAControl):
+
+        A lot of spots in the code used to cast to RenderTextControl to get information about the text inside the element. Now that non-native text controls can run this code with the ARIA role 'textbox', it needs to be as general as possible. 
+        (WebCore::AccessibilityObject::text): Still calls into 
+        RenderTextControl's text() for native text controls. Uses Element's 
+        innerText() for ARIA textboxes.
+        (WebCore::AccessibilityObject::textLength): Call 
+        AccessibilityObject's text() instead of RenderTextControl's.
+        (WebCore::AccessibilityObject::ariaSelectedTextDOMRange):
+        (WebCore::AccessibilityObject::selectedText):
+        (WebCore::AccessibilityObject::selectedTextRange):
+        (WebCore::AccessibilityObject::selectionStart):
+        (WebCore::AccessibilityObject::selectionEnd):
+        (WebCore::AccessibilityObject::setSelectedTextRange):
+        (WebCore::AccessibilityObject::setValue):
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        (WebCore::AccessibilityObject::indexForVisiblePosition):
+        (WebCore::AccessibilityObject::textMarkerRangeForRange):
+        (WebCore::AccessibilityObject::textMarkerForIndex):
+        (WebCore::AccessibilityObject::indexForTextMarker):
+        (WebCore::AccessibilityObject::doAXRangeForLine):
+        (WebCore::AccessibilityObject::doAXRangeForIndex):
+        (WebCore::AccessibilityObject::doAXStringForRange):
+        (WebCore::AccessibilityObject::doAXBoundsForRange):
+        
+        Reports ARIA role. If the role is not valid or simply not set, return UnknownRole.
+        (WebCore::AccessibilityObject::ariaRoleAttribute):
+        
+        Added several new functions. Most of them existed before but were static, or have been added to reduce the dependency on RenderTextControl for a lot of the text functionality.
+        * page/AccessibilityObject.h:
+
+        Eliminated dependency on RenderTextControl cast. The information is generalized now and available directly through the AccessibilityObject.
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper doAXAttributedStringForRange:]):
+
+2008-04-29  Timothy Hatcher  <timothy@apple.com>
+
+        Make the exceptions that the InspectorController catches log the
+        original file and line number, if present on the exception object.
+
+        Reviewed by Adam Roben.
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::callFunction): Pass the context to HANDLE_EXCEPTION.
+        (WebCore::InspectorController::~InspectorController): Ditto.
+        (WebCore::InspectorController::scriptObjectReady): Ditto.
+        (WebCore::InspectorController::addScriptResource): Ditto.
+        (WebCore::InspectorController::updateScriptResourceRequest): Ditto.
+        (WebCore::InspectorController::updateScriptResourceResponse): Ditto.
+        (WebCore::InspectorController::updateScriptResource): Ditto.
+        (WebCore::InspectorController::addDatabaseScriptResource): Ditto.
+        (WebCore::InspectorController::addScriptConsoleMessage): Ditto.
+        (WebCore::InspectorController::handleException): Take a context. Pull the line
+        and sourceURL properties off the exception if it is an object.
+        * page/InspectorController.h: Change handleException to take a context.
+
+2008-04-29  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a regression where the Page's debugger would not be reattached
+        when a new JSDOMWindow is created.
+
+        Reviewed by Sam Weinig.
+
+        * bindings/js/kjs_proxy.cpp:
+        (WebCore::KJSProxy::clear): Call attachDebugger after creating the JSDOMWindow.
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): For the case where the CachedPage doesn't
+        contain a window, reattach the debugger to the new JSDOMWindow by calling
+        proxy->attachDebugger. Also restore the setPageGroupIdentifier.
+
+2008-04-29  Anatoli Papirovski  <apapirovski@mac.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=18355
+        Fixed RGB and RGBA parsing to ignore the declaration when the value is not
+        "either three integer values or three percentage values."
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColorParameters):
+
+2008-04-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Fix crash when setHtml gets called from slots connected to QWebPage::unsupportedContent
+
+        Ben found this crash in the demo browser.
+
+        In void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
+
+        case PolicyDownload:
+        frameLoader()->client()->download(m_handle.get(), request(), m_handle.get()->request(), r);
+        receivedError(interruptionForPolicyChangeError());
+
+        We are in a policy check, the download() call will call setHtml, which will start loading
+        the data into a frame. The loading will cancel all policy checks and call ResourceLoader::releaseResources
+        which will set m_frame to 0. Then we return and invoke interruptionForPolicyChangeError() which
+        will use the m_frame->loader() but it is gone. Do not call into receivedError and
+        interruptionForPolicyChangeError if we are gone anyway...
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+
+2008-04-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Rely on auto-boxing of C++ for the QCursor c'tor
+
+        * platform/qt/CursorQt.cpp:
+
+2008-04-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Add the remaining cursors that defaulted to PointerCursor
+
+        * Resources/WebKitResources.qrc:
+        * platform/qt/CursorQt.cpp:
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::copyCursor):
+        (WebCore::progressCursor):
+        (WebCore::aliasCursor):
+
+2008-04-29  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Comply with HTML5 spec about parsing tabindex property according to
+        integer parsing rules
+
+        Test: fast/parser/tabindex-parsing.html
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+
+2008-04-29  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixes: Fix timing problem where scrollbars in subframes were sometimes not property repainted.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18482
+
+        We need to repaint scrollbars after a geometry change, and also make sure
+        the computed clipping rect for the corners between scrollbars is propagated
+        to the chrome client without beeing intersected by the visible content rect
+        of the frame.
+
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::geometryChanged):
+        (WebCore::ScrollView::suppressScrollbars):
+        (WebCore::ScrollView::invalidateScrollbars):
+
+2008-04-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Calling QWebView::setCursor will override the WebCore Cursor.
+        Calling QWebView::setCursor will override the WebCore Cursor using
+        QWidget::unsetCursor will revert to the WebCore Cursor.
+
+        For detecting the unset we have to compare the shape of the
+        cursor to the default arrow. Qt::WA_SetCursor can not be used
+        as it is set unconditionally but conditionally removed.
+
+        Calling QWidget::setCursor will immediately send the CursorChange
+        event. We listen to this event to decide if we currently use a
+        WebCore cursor, got a cursor from outside, or revert to the default.
+
+        This should be race free and work reliable, the manual test for this
+        is WebCore/manual-tests/cursor.html
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2008-04-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=18795
+          REGRESSION (r32660): Text heavier with text-shadow
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows): The loop was doing one extra pass
+        without shadow even in cases where the last pass with a shadow was
+        painting the text at the right position (rather than outside the clip).
+        Fixed that. The only case where a separate pass without shadow is needed
+        is when there is text-stroke, since in that case all shadow passes
+        paint the text outside the clip.
+
+2008-04-28  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Add Storage.clear(), per updates to HTML5
+
+        Tests: storage/domstorage/localstorage/clear.html
+               storage/domstorage/sessionstorage/clear.html
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::areaCleared):
+        * storage/LocalStorageArea.h:
+
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::areaCleared):
+        * storage/SessionStorageArea.h:
+
+        * storage/Storage.cpp:
+        (WebCore::Storage::clear):
+        * storage/Storage.h:
+        * storage/Storage.idl:
+
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::internalClear):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::clear):
+
+2008-04-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein, Tim Hatcher, Anders Carlsson, and Darin Adler.
+
+        WebCore part of fix for <rdar://problem/3709505>
+        Safari should have a way to upload bundles from the file upload control (as zip)
+
+        * WebCore.base.exp: Added symbols.
+
+        * html/HTMLFormElement.cpp: (WebCore::HTMLFormElement::formData): Ask the application if a file will need to be replaced before it's uploaded.
+          It will also give the replacement filename which is used to determine the correct mime-type and to construct the correct header.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Asks the application to generate any files for the form data before a form submission starts.
+        (WebCore::FrameLoader::loadItem): ditto.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveResponse): Tells the FormData from the request to remove any generated files if it needs to.
+        (WebCore::ResourceLoader::didCancel): ditto.
+        (WebCore::ResourceLoader::didFail): ditto.
+
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::FormData): Initializes m_hasGeneratedFiles, which keeps track of whether there are files that will need to be removed.
+        (WebCore::FormData::~FormData): Added.  Assert that there are no files that need to be removed, but if there are, release builds will still remove them here.
+        (WebCore::FormData::appendFile): Passes along a shouldGenerateFile flag to the FormDataElement.
+        (WebCore::FormData::generateFiles): Added. Iterates through the FormDataElements, and using the ChromeClient pointer, asks the application to
+         create any compressed files so the FormDataElements can store the paths.
+        (WebCore::FormData::removeGeneratedFilesIfNeeded): Added.  Removes generated files and their directories (if empty).
+        * platform/network/FormData.h:
+        (WebCore::FormDataElement::FormDataElement): Added a boolean to track whether the file will need to be generated,
+         and a string to hold the path of the generated file.
+
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream): Uses the generated file path instead of the original file path when streaming the file.
+        (WebCore::setHTTPBody): Uses the generated file path when determining the size of the file to be uploaded.
+
+        * platform/FileSystem.h: Added directoryName.
+        * platform/posix/FileSystemPOSIX.cpp: (WebCore::directoryName): Added.
+        * platform/gtk/FileSystemGtk.cpp: (WebCore::directoryName): Added empty implementation.
+        * platform/qt/FileSystemQt.cpp: (WebCore::directoryName): ditto.
+        * platform/win/FileSystemWin.cpp: (WebCore::directoryName): ditto.
+        * platform/wx/FileSystemWx.cpp: (WebCore::directoryName): ditto.
+
+        Added new ChromeClient methods to give the application control over the file compression for uploading.
+        * page/Chrome.cpp:
+        (WebCore::ChromeClient::shouldReplaceWithGeneratedFileForUpload): Added a default implementation.
+        (WebCore::ChromeClient::generateReplacementFile): ditto.
+        * page/ChromeClient.h:
+
+2008-04-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam, Mark, Adele and Darin.
+
+        Add a (currently not called) method for opening the application cache database.
+        
+        * WebCore.base.exp:
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::setCacheDirectory):
+        (WebCore::ApplicationCacheStorage::openDatabase):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2008-04-28  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Darin.
+
+        Fix <rdar://problem/4911289> Add tabindex property to all children 
+        of HTMLElement (7138)
+        http://bugs.webkit.org/show_bug.cgi?id=7138
+
+        Test: fast/events/tabindex-focus-blur-all.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOMPrivate.h:
+        -DOMHTMLLabelElementPrivate.h and DOMHTMLLegendElementPrivate.h are no
+         longer needed
+
+        * bindings/objc/PublicDOMInterfaces.h:
+        -Moving focus, blur, tabindex to HTMLElement from its descendants.
+
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        (WebCore::Node::isFocusable):
+        (WebCore::Node::isKeyboardFocusable):
+        -The concept of being focusable now needs to account for tabindex
+        attribute.
+
+        * dom/Node.h:
+        -Need to use a bit to keep track of whether tabindex was explicitly set
+         to 0 or was just initialized to 0.
+        (WebCore::Node::tabIndex):
+        -Make this virtual so that Anchors and GenericFormElements can determine
+         tabindex without accounting for focusability
+        (WebCore::Node::setTabIndexExplicitly):
+        -Renamed setTabIndex() to setTabIndexExplicitly() so as not to hide
+         behind and/or be confused for HTMLElement::setTabIndex
+
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+        (WebCore::HTMLAnchorElement::tabIndex):
+        * html/HTMLGenericFormElement.cpp:
+        * html/HTMLGenericFormElement.h:
+        (WebCore::HTMLGenericFormElement::tabIndex):
+        -Anchors and form elements are normally focusable, and need to avert the
+         check for focusability in HTMLElement::tabIndex
+         because tabIndex could be queried before a first layout happens.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        -Function Node::setTabIndex changed to Node::setTabIndexExplicitly
+        (WebCore::HTMLElement::isFocusable):
+        -The concept of being focusable now needs to account for tabindex
+         attribute.
+        (WebCore::HTMLElement::tabIndex):
+        -HTML5 specifies that querying tabindex for elements that aren't
+         focusable shall return -1
+        (WebCore::HTMLElement::setTabIndex):
+        -New default implementation
+        * html/HTMLElement.h:
+
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::focus):
+        -Now with HTML5's enhanced specification of tabindex, legend elements
+         themselves shall focus (if they should), and not the first form element 
+         they encapsulate.  This matches Firefox behavior.  HTMLLabelElements
+         still forward focus to the encapsulated element.  This also matches
+         other browsers. 
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::isFocusable):
+        * html/HTMLAreaElement.h:
+        -HTMLAreaElement isn't subject to the same focusability requirements as
+         its parent, HTMLAnchorElement. Default HTMLElement implementation is
+         desired.  
+
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::isFocusable):
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::isFocusable):
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::isFocusable):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::isFocusable):
+        -These elements aren't subject to the same focusability requirements as
+         their parent, HTMLGenericFormElement. Default HTMLElement 
+         implementation is desired.  
+
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLLabelElement.idl:
+        * html/HTMLLegendElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        -Moving tabindex attribute, focus and blur methods from descendants of
+         HTMLElement to HTMLElement
+
+2008-04-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - support multiple box- and text-shadows
+
+        Tests: fast/css/shadow-multiple.html
+               fast/repaint/shadow-multiple-horizontal.html
+               fast/repaint/shadow-multiple-strict-horizontal.html
+               fast/repaint/shadow-multiple-strict-vertical.html
+               fast/repaint/shadow-multiple-vertical.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForShadow): Changed to account for reversing the order
+        of the shadow values in the ShadowData list.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::prepend): Added.
+        * css/CSSValueList.h:
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Changed to account for
+        all shadows in overflow calculation.
+        (WebCore::InlineFlowBox::placeBoxesVertically): Ditto.
+        (WebCore::InlineFlowBox::paint): Changed to account for all shadows
+        when testing for intersection with the damage rect.
+        (WebCore::InlineFlowBox::paintTextDecorations): Changed to paint all
+        shadows.
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows): Factored out from paint() and changed
+        to paint all shadows.
+        (WebCore::InlineTextBox::paint): Moved the text painting code out to
+        paintTextWithShadows(). Changed to not paint shadows for markers and
+        composition underlines and in "force black text" mode.
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintDecoration): Changed to paint all shadows.
+        * rendering/InlineTextBox.h: Changed some public methods to private
+        or protected.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Changed to account for all
+        shadows.
+        (WebCore::RenderBlock::overflowWidth): Ditto.
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Ditto.
+        (WebCore::RenderBlock::overflowRect): Ditto.
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Ditto.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintBoxShadow): Changed to paint all shadows.
+        Changed to avoid clipping out the box if it has a fully opaque
+        background.
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Changed to account
+        for all shadows.
+        (WebCore::RenderObject::selectionForegroundColor): Cleaned up.
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Changed to
+        account for all shadows.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadow): Ditto.
+
+        * rendering/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Changed to prepend when adding
+        so that the stacking order of shadows when painting will be "first o
+        top".
+        (WebCore::RenderStyle::setBoxShadow): Ditto.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout): Changed to account for all shadows.
+
+2008-04-28  Adam Roben  <aroben@apple.com>
+
+        Fix some more Windows build errors in COMPtr
+
+        * platform/win/COMPtr.h:
+        (WTF::): Define DefaultHash<COMPtr<P> > by using PtrHash<COMPtr<P> >,
+        which is just a copy of PtrHash<RefPtr<P> >.
+
+2008-04-28  Adam Roben  <aroben@apple.com>
+
+        Fix some Windows build errors in COMPtr
+
+        * platform/win/COMPtr.h: Explicitly name the WTF namespace when using
+        HashTableDeletedValueType.
+
+2008-04-28  Adam Roben  <aroben@apple.com>
+
+        Fix some Windows build errors in FontPlatfomrData
+
+        * platform/graphics/win/FontPlatformData.h: Removed the Deleted
+        constructor and replaced it with a HashTableDeletedValueType
+        constructor. Also added isHashTableDeletedValue() and
+        hashTableDeletedFontValue().
+
+2008-04-28  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=18780
+
+        Canvas can't draw itself into its own buffer.  Make sure the dirtying call comes after the image()
+        has been accessed.  Technically willDraw should be renamed to didDraw and all calls should be moved
+        to after draws have occurred (since if the draw op itself wants to reference the image it shouldn't get
+        a dirty copy either), but I'll take that up with olliej when he wakes up. :)
+
+        Reviewed by Dan Bernstein
+
+        Added fast/canvas/canvasDrawsIntoSelf.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2008-04-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/5825192> Replace use of Gestalt with BSD sysctl
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::isAvailable): There is no need to check QuickTime version post-Tiger,
+        as it will never be below 7.3 again. This change may make library loading happen earlier in
+        some cases, hopefully, that's not a big deal.
+
+2008-04-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Fix run-webkit-tests --threading
+        and provisionally fix <https://bugs.webkit.org/show_bug.cgi?id=18661>
+        Proxy server issue in Sunday's Nightly
+
+        Adjusted for JavaScriptCore changes: added a new member to ClassInfo objects, turned
+        ClassInfo::propHashTable into a function, made getPropertyAttributes() take an ExecState pointer.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+        * bindings/js/JSDOMWindowWrapper.cpp:
+        (WebCore::):
+        (WebCore::JSDOMWindowWrapper::getPropertyAttributes):
+        * bindings/js/JSDOMWindowWrapper.h:
+        * bindings/js/JSEventTargetBase.h:
+        (WebCore::JSEventTargetPrototype::classInfo):
+        * bindings/js/JSHTMLInputElementBase.cpp:
+        (WebCore::):
+        * bindings/js/JSHTMLOptionElementConstructor.cpp:
+        (WebCore::):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::customGetOwnPropertySlot):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::customGetOwnPropertySlot):
+        (WebCore::JSLocation::customPut):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::customPut):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::):
+        * bindings/js/JSXSLTProcessor.cpp:
+        (WebCore::):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_object.cpp:
+
+2008-04-28  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=18779
+
+        The arguments in drawImage were reversed when I switched away from the image buffer method.
+
+        Reviewed by Tim Hatcher
+
+        Added fast/canvas/drawImage.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2008-04-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Fix the crash on http://www.orad.pl. We called end too early.
+
+        1. we need a ::write that will pause the parser due a pending
+        script
+        2. we need a second write to queue data (tricky part)
+        3. we need to get a finish call (document loaded)
+        4. we resume the script and parse, schedule loading of a new script
+        and have called end
+        5. we resume the new script and we get a crash
+
+        This bug is hard to trigger, e.g. if the web server is only allowing
+        one connection per client/IP. This is why we need to sleep in the scripts. We
+        want to make sure that the page is first fully received before serving the
+        scripts.
+
+        Test: http/tests/misc/xmltokenizer-do-not-crash.pl
+
+        * dom/XMLTokenizer.cpp:
+
+2008-04-28  Ariya Hidayat  <ahidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix rounded corner on combo box with CSS border
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+
+2008-04-28  Ariya Hidayat  <ahidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix CSS border does not show up for combo boxes
+
+        Do not clear the border when painting the combo box for 'select' form element
+
+        * platform/qt/RenderThemeQt.cpp:
+
+2008-04-28  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon.
+
+        Avoid comparing to 0 in qFuzzyCompare for increased
+        numeric stability.
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
+
+2008-04-28  Benjamin Meyer  <bmeyer@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixes: Pages returning 404 with content are not displayed.
+
+        A web page that returns 404 can still have content.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2008-04-28  Paul Olav Tvete  <paul@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compiler warning; Avoid the implicity QString(const char *)
+        constructor
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::fallbackStyle):
+
+2008-04-28  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Prevent middle-click from triggering open URL from clipboard when the event has already been accepted.
+
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::PlatformScrollbar::handleMousePressEvent):
+
+2008-04-28  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix scrollbar behavior in QtWebKit to match QScrollBar.
+
+        Right click context menu is now supported, along with
+        middle click to center slider thumb over mouse cursor.
+
+        * platform/qt/PlatformScrollBar.h:
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (tr):
+        (WebCore::PlatformScrollbar::pixelPosToRangeValue):
+        (WebCore::PlatformScrollbar::handleMousePressEvent):
+        (WebCore::PlatformScrollbar::handleMouseReleaseEvent):
+        (WebCore::PlatformScrollbar::handleContextMenuEvent):
+
+2008-04-28  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Implemented channel-based logging for QtWebKit.
+
+        Comma-separated log channels are read from the QT_WEBKIT_LOG environment variable.
+        Warnings for notImplemented() is still output by default, but can be disabled
+        by setting DISABLE_NI_WARNINGS=1.
+
+        * WebCore.pro:
+        * platform/NotImplemented.h:
+        * platform/qt/LoggingQt.cpp: Added.
+        (WebCore::getChannelFromName):
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2008-04-28  Simon Hausmann  <shausman@trolltech.com>
+
+        Reviewed by Holger.
+
+        Fixes: Popups/Context menu in WebKit appearing at the wrong location when embedded in the graphics view or using multiple screens
+
+        Give the popups the right parent widget and the right coordinates relative within the parent.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+
+2008-04-28  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixes: Tabbing to a checkbox/button doesn't work on Win/X11
+
+        Respect platform settings for tabbing to all controls.
+
+        * page/qt/EventHandlerQt.cpp:
+
+2008-04-28  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        First part of the fix for tabbing to a checkbox/button doesn't work on Win/X11
+
+        Draw controls instead of pimitive elements, to get focus rects for free.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintButton):
+
+2008-04-28  Lincoln Ramsay  <lincoln.ramsay@trolltech.com>
+
+        Reviewed by Simon.
+
+        Compile when QT_NO_CLIPBOARD is defined.
+
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::ClipboardQt):
+        (WebCore::ClipboardQt::clearData):
+        (WebCore::ClipboardQt::clearAllData):
+        (WebCore::ClipboardQt::setData):
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        (WebCore::ClipboardQt::writeURL):
+        (WebCore::ClipboardQt::writeRange):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::Pasteboard::writeImage):
+
+2008-04-28  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Draw the arrow button on the styled combo box using the fallback ("Windows") style
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::~RenderThemeQt):
+        (WebCore::RenderThemeQt::fallbackStyle):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        * platform/qt/RenderThemeQt.h:
+
+2008-04-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Fix positioning of native widgets (plugins).
+
+        Correctly convert the coordinates of the Widget in Widget::setFrameGeometry()
+        to be relative to the containing toplevel QWidget using convertToContainingWindow().
+
+        Note: convertToContainingWindow() takes child coordinates.
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::setFrameGeometry):
+
+2008-04-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        plugins: fix scrolling issues
+
+        When scrolling you can see artefacts that remain on the screen, they
+        seem to originate from the backingstore handling. I'm not entirely sure
+        where they come from, my workarounds involved a
+        data->m_widget->parentWidget()->update() call in Widget::geometryChanged or
+        handling widgets with a native QWidget embedded like web pages with a
+        static background. This needs more investigations, I think the ScrollView
+        change is cleaner than the brute force in Widget::geometryChanged
+
+        Focus handling seems to be broken as well and needs further work, we don't
+        clip plugin QWidgets and they can draw out of their bounds, e.g. on the ScrollBar,
+        the z-order is likely not honored as well.
+
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::addChild):
+        (WebCore::ScrollView::removeChild):
+        (WebCore::ScrollView::incrementNativeWidgetCount):
+        (WebCore::ScrollView::decrementNativeWidgetCount):
+        (WebCore::ScrollView::hasNativeWidgets):
+
+2008-04-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Add manual test to test placement of QWidgets in iframe's
+
+        * manual-tests/qt/main.html: Added.
+        * manual-tests/qt/qtplugin.html: Added.
+
+2008-04-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the build with ENABLE_DATABASE=0 (Qt/Windows) by including
+        SecurityOrigin.h. It's used in the file and also implicitly included
+        through the database headers.
+
+        * page/DOMWindow.cpp:
+
+2008-04-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective Wx build fix.
+
+        * platform/graphics/wx/FontPlatformData.h:
+
+2008-04-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Alp.
+
+        Gtk build fix, similar to the changes done in r32609.
+
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+
+2008-04-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective build fix. After r32609 it seems the workaround here
+        is not needed anymore. With gcc 4.2/4.3 before 32609 the workaround
+        is needed for compilation, after 32609 compilation only succeeds
+        without the workaround.
+
+        * plugins/PluginPackage.h: Removed workaround of extra StorageTraits
+        specification for the custom hash function of PluginPackage used in
+        PluginSet.
+
+2008-04-28  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18713
+
+        Fix scrollbar painting issues in QtWebKit.
+
+        Hovering and click-draging outside of the scrollbar would
+        produce unexpected and inconcistent results. We also didn't
+        pass on leave-events to the underlying WebKit code, which
+        was nessecary to implement the paint fix.
+
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
+        (WebCore::PlatformScrollbar::handleMouseOutEvent):
+        (WebCore::PlatformScrollbar::handleMouseReleaseEvent):
+
+2008-04-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 17173: HTML5 Canvas API requires us to ignore certain operations
+        <https://bugs.webkit.org/show_bug.cgi?id=17173>
+
+        This fixes the semantics of a number of Canvas functions to match
+        the new HTML5 non-throwing semantics.
+
+        Test: fast/canvas/canvas-path-with-inf-nan-dimensions.html
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::moveTo):
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+        (WebCore::CanvasRenderingContext2D::arcTo):
+        (WebCore::CanvasRenderingContext2D::arc):
+        (WebCore::validateRectForCanvas):
+        (WebCore::CanvasRenderingContext2D::rect):
+        (WebCore::CanvasRenderingContext2D::clearRect):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        (WebCore::CanvasRenderingContext2D::strokeRect):
+        * html/CanvasRenderingContext2D.h:
+        * html/CanvasRenderingContext2D.idl:
+
+2008-04-27  Rob Buis  <buis@kde.org>
+
+        Reviewed by Adele.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18652
+        onchange events don't seem to fire for input[type=range] controls.
+
+        Fire changeEvent when dragging the slider.
+
+        Test: fast/forms/slider-onchange-event.html
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::valueChanged):
+
+2008-04-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - update for compatibility with HashTable that no longer has optimization to share
+          implementation between hash tables with integers, pointers, RefPtr, and String
+          objects as keys
+
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        (WebCore::PODTypeReadWriteHashInfo::PODTypeReadWriteHashInfo): Added constructor
+        for HashTableDeletedValue.
+        (WebCore::PODTypeReadWriteHashInfo::isHashTableDeletedValue): Added.
+        (WebCore::PODTypeReadWriteHashInfoTraits::constructDeletedValue): Added.
+        (WebCore::PODTypeReadWriteHashInfoTraits::isDeletedValue): Added.
+
+        * dom/Document.cpp: Made changedDocuments internal to the file rather than a
+        static data member of Document.
+        (WebCore::FormElementKey::ref): Removed unneeded check for deleted value -- this
+        will never be called on a deleted element.
+        (WebCore::FormElementKey::deref): Ditto.
+
+        * dom/Document.h: Added HashTableDeletedValue constructor and isHashTableDeletedValue
+        to FormElementKey. Changed FormElementKeyHashTraits to use construct/isDeletedValue.
+        Got rid of the changedDocuments data member. Changed iconURL to be an inline that
+        returns a const String&.
+
+        * dom/StyledElement.cpp: Changed MappedAttributeKeyTraits to use
+        construct/isDeletedValue.
+
+        * page/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::getAXID): Call isDeletedValue instead of deletedValue.
+
+        * platform/SecurityOriginHash.h: Added overload so that SecurityOriginHash can work
+        with raw pointers as well as RefPt (helpful with the new RefPtrHashMap). Eliminated
+        SecurityOriginTraits, since we can now use the default traits. Changed the value of
+        safeToCompareToEmptyOrDeleted to false, since it's not safe to compare a deleted
+        value using this hash function. I don't think it was safe before either; I'm not sure
+        why it didn't cause a problem before.
+
+        * platform/cf/SchedulePair.h: Removed SchedulePairTraits -- custom traits are no
+        longer needed.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey): Added constructor
+        for HashTableDeletedValue.
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue): Added.
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize): Added.
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue): Added.
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue): Added.
+        (WebCore::FontDataCacheKeyTraits::constructDeletedValue): Added.
+        (WebCore::FontDataCacheKeyTraits::isDeletedValue): Added.
+
+        * platform/graphics/IntSizeHash.h: Changed HashTraits<IntSize> to use
+        construct/isDeletedValue.
+
+        * platform/graphics/mac/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData): Added constructor for
+        HashTableDeletedValue.
+        (WebCore::FontPlatformData::isHashTableDeletedValue): Added.
+        (WebCore::FontPlatformData::hashTableDeletedFontValue): Added.
+
+        * platform/text/PlatformString.h:
+        (WebCore::String::swap): Added. Avoids any refcount churn when swapping two strings.
+        (WebCore::String::String): Added constructor for HashTableDeletedValue.
+        (WebCore::String::isHashTableDeletedValue): Added.
+        (WebCore::swap): Added. Avoids any refcount churn when swapping two strings.
+
+        * platform/text/StringHash.h: Changed specialization of HashTraits for
+        WebCore::String to use the deleted value now defined in that class and removed
+        the code to do ref/deref. Removed HashKeyStorageTraits specializations.
+        
+        * platform/win/COMPtr.h: Changed specialization of HashTraits for
+        COMPtr to use the deleted value now defined in that class and removed
+        the code to do ref/deref. Removed HashKeyStorageTraits specializations.
+        (COMPtr::COMPtr): Added constructor for HashTableDeletedValue.
+        (COMPtr::isHashTableDeletedValue): Added.
+        (COMPtr::query): Removed inline keyword not needed since functions defined in the
+        class definition are automatically marked inline.
+        (COMPtr::hashTableDeletedValue): Added.
+
+        * storage/DatabaseTracker.h: Removed now-unneeded SecurityOriginTraits.
+        * storage/LocalStorage.h: Ditto.
+        * storage/OriginQuotaManager.h: Ditto.
+        * storage/SessionStorage.h: Ditto.
+
+        * svg/SVGAnimatedTemplate.h:
+        (WebCore::SVGAnimatedTypeWrapperKey::SVGAnimatedTypeWrapperKey): Added constructor
+        for HashTableDeletedValue.
+        (WebCore::SVGAnimatedTypeWrapperKey::isHashTableDeletedValue): Added.
+        (WebCore::SVGAnimatedTypeWrapperKeyHashTraits::constructDeletedValue): Added.
+        (WebCore::SVGAnimatedTypeWrapperKeyHashTraits::isDeletedValue): Added.
+
+2008-04-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Initialize the extra member of the xmlEntity struct when using libxml2 >= 2.6.27.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::):
+
+2008-04-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=3729
+          <rdar://problem/4036353> REGRESSION: arrow keys move insertion bar backwards in RTL text
+
+        Test: editing/selection/move-left-right.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyMovingRight): Added. Currently
+        implemented for character granularity, all other being treated as
+        "forward".
+        (WebCore::SelectionController::modifyMovingForward): Renamed
+        modifyMovingRightForward() to this.
+        (WebCore::SelectionController::modifyMovingLeft): Added. Currently
+        implemented for character granularity, all other being treated as
+        "backward".
+        (WebCore::SelectionController::modifyMovingBackward): Renamed
+        modifyMovingLeftBackward() to this.
+        (WebCore::SelectionController::modify): Changed to call either the
+        visual (left/right) or logical (backward/forward) methods depending on
+        the 'dir' argument for moves.
+        * editing/SelectionController.h:
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate): Added.
+        (WebCore::VisiblePosition::left): Added.
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate): Added.
+        (WebCore::VisiblePosition::right): Added.
+        * editing/VisiblePosition.h:
+
+2008-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for <rdar://problem/5893385> Need to provide access to the CanvasRenderingContext2D prototype
+        Add a JS constructor for CanvasRenderingContext2D.
+
+        * html/CanvasRenderingContext2D.idl:
+        * page/DOMWindow.idl:
+
+2008-04-26  Adam Barth  <hk9565@gmail.com>
+
+        Reviewed by Adam Roben and Sam Weinig.
+
+        Fixes bug http://bugs.webkit.org/show_bug.cgi?id=17331
+        Fixes bug http://bugs.webkit.org/show_bug.cgi?id=16848
+        
+        Updates postMessage implementation to match HTML 5 specification:
+        1) Adds origin parameter to postMessage.
+        2) Removes domain and uri attributes of MessageEvent in favor of
+           origin attribute.
+
+        In order to do this correctly, we need to distinguish between hosts and domains
+        in the SecurityOrigin class. There are now three ways to compare security origins:
+        1) isSameSchemeHostPort compares scheme, host, and port, and is used for postMessage
+        2) equal compares all aspects of the security origin, and is used for hash keys
+        3) canAccess understands the semantics of schemes such as file:// and data:// URLs,
+           and should be used for scripting access checks.
+
+        Changed SecurityOrigin::toString() to generate identifiers that are suitable for 
+        being used as a MessageEvent's origin property. In the future, they could be used 
+        as database string identifiers as well. Re-used KURL parser to parse serialized 
+        SecurityOrigins.
+
+        Collin Jackson <collinj-webkit@collinjackson.com> also contributed to this patch.
+        
+        Tests: http/tests/security/postMessage/invalid-origin-throws-exception.html
+               http/tests/security/postMessage/javascript-page-still-sends-origin.html
+               http/tests/security/postMessage/origin-unaffected-by-base-tag.html
+               http/tests/security/postMessage/origin-unaffected-by-document-domain.html
+               http/tests/security/postMessage/target-origin.html
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * dom/Document.cpp:
+        (WebCore::Document::domain):
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::origin):
+        * dom/MessageEvent.idl:
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * platform/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::create):
+        (WebCore::SecurityOrigin::createForFrame):
+        (WebCore::SecurityOrigin::copy):
+        (WebCore::SecurityOrigin::setDomainFromDOM):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::isSecureTransitionTo):
+        (WebCore::SecurityOrigin::toString):
+        (WebCore::SecurityOrigin::createFromString):
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+        (WebCore::SecurityOrigin::databaseIdentifier):
+        (WebCore::SecurityOrigin::equal):
+        (WebCore::SecurityOrigin::isSameSchemeHostPort):
+        * platform/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::host):
+        (WebCore::SecurityOrigin::domain):
+        * platform/SecurityOriginHash.h:
+        (WebCore::SecurityOriginTraits::deletedValue):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::hasEntryForDatabase):
+        (WebCore::DatabaseTracker::originPath):
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::populateOrigins):
+        (WebCore::DatabaseTracker::databaseNamesForOrigin):
+        (WebCore::DatabaseTracker::detailsForNameAndOrigin):
+        (WebCore::DatabaseTracker::setDatabaseDetails):
+        (WebCore::DatabaseTracker::setQuota):
+        (WebCore::DatabaseTracker::addDatabase):
+        (WebCore::DatabaseTracker::deleteOrigin):
+        (WebCore::DatabaseTracker::deleteDatabase):
+
+2008-04-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add the AX*ActionVerb functions to the wx build.
+        
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+
+2008-04-26  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        wx build fix. Add needed wx includes for compilation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18758
+
+        * platform/wx/FileSystemWx.cpp:
+
+2008-04-26  Anatoli Papirovski  <apapirovski@mac.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=18583
+        WebKit should ignore declarations with a negative value for
+        line-height and font-size, including in the shorthand font form.
+
+        Tests: fast/css/font-size-negative.html
+               fast/css/line-height-negative.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFont):
+
+2008-04-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam.
+
+        Add empty ApplicationCacheStorage class.
+        
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/appcache/ApplicationCacheStorage.cpp: Added.
+        (WebCore::cacheStorage):
+        * loader/appcache/ApplicationCacheStorage.h: Added.
+
+2008-04-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace the JSDOMWindow with a new one instead of clearing it.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::clear):
+        Don't reset the window.
+
+        * bindings/js/kjs_proxy.cpp:
+        (WebCore::KJSProxy::clear):
+        Replace the current JSDOMWindow stored in the wrapper window
+        with a new one.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        (WebCore::CachedPage::clear):
+        * history/CachedPage.h:
+        Instead of storing the builtins, properties and localstorage in
+        special holding structs, store the entire JSDOMWindow.
+
+        For the case of a page that has no JSDOMWindow before it's first
+        navigation, has one created while it is in the cache and is then
+        navigated back, create a new JSDOMWindow to keep the assumption
+        in JSDOMWindowWrapper that it always has the correct window.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        We must clear the DOMWindow first, so that we create a new JSDOMWindow,
+        it gets a new one.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::clearDOMWindow):
+        Null out the domWindow so that on the next access, a new one is
+        created.
+
+2008-04-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        The EventListeners need to operate and store JSDOMWindows, not JSDOMWrapperWindows.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::findOrCreateJSEventListener):
+        (WebCore::JSDOMWindowBase::findOrCreateJSUnprotectedEventListener):
+        * bindings/js/JSSVGLazyEventListener.cpp:
+        (WebCore::JSSVGLazyEventListener::JSSVGLazyEventListener):
+        * bindings/js/JSSVGLazyEventListener.h:
+        * bindings/js/kjs_events.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSUnprotectedEventListener::JSUnprotectedEventListener):
+        (WebCore::JSUnprotectedEventListener::~JSUnprotectedEventListener):
+        (WebCore::JSUnprotectedEventListener::window):
+        (WebCore::JSUnprotectedEventListener::clearWindow):
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::window):
+        (WebCore::JSEventListener::clearWindow):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/kjs_events.h:
+        * bindings/js/kjs_proxy.cpp:
+        (WebCore::KJSProxy::createHTMLEventHandler):
+        (WebCore::KJSProxy::createSVGEventHandler):
+
+2008-04-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add some content to an empty ICU header file to prevent verification errors.
+
+        * icu/unicode/utf_old.h:
+
+2008-04-25  Anders Carlsson  <andersca@apple.com>
+
+        Fix tyop.
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::scheduleApplicationCacheLoad):
+
+2008-04-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam.
+
+        Add and honor offlineWebApplicationCacheEnabled setting.
+        
+        * WebCore.base.exp:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::scheduleApplicationCacheLoad):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::load):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setOfflineWebApplicationCacheEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::offlineWebApplicationCacheEnabled):
+
+2008-04-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5629139>
+        PluginInfoStoreWin needs to implement pluginNameForMIMEType().
+        
+        * plugins/PluginInfoStore.cpp:
+        (WebCore::PluginInfoStore::pluginNameForMIMEType):
+
+2008-04-25  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Respect antialiasing hint when drawing focus rects.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+
+2008-04-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        networking: Use Qt::QueuedConnection in QNetworkReplyHandler
+
+        Make sure we leave the networking backend before calling
+        into WebCore. Otheriwse we might return to the networking
+        backend when it is already deleted.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::FormDataIODevice::setParent):
+        (WebCore::QNetworkReplyHandler::start):
+
+2008-04-25  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix propagation of mouse double click events.
+
+        Treat a mouse double click as a regular mouse press with just a different click count.
+
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+
+2008-04-25  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixes: Fix strange button sizes (push, radio, and check) in QtWebKit.
+
+        We now use pixel metrics instead of fixed sizes for the
+        button margins, or if the style supports layout rects we
+        use the delta between the content rect and the layout rect.
+
+        In adition we compensate for the difference between the size
+        for content and the actual layout rect (if supported) by
+        reporting back the layout rect to WebKit for page layout,
+        and then inflating the rect we actually paint to.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::StylePainter::StylePainter):
+        (WebCore::StylePainter::~StylePainter):
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::adjustRepaintRect):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::setCheckboxSize):
+        (WebCore::RenderThemeQt::paintCheckbox):
+        (WebCore::RenderThemeQt::setRadioSize):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::setButtonSize):
+        (WebCore::RenderThemeQt::setButtonPadding):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::adjustMenuListStyle):
+        (WebCore::RenderThemeQt::setPopupPadding):
+        (WebCore::RenderThemeQt::paintMenuList):
+        * platform/qt/RenderThemeQt.h:
+
+2008-04-25  Benjamin Meyer  <bmeyer@trolltech.com>
+
+        Reviewed by Holger.
+
+        Fixes: Valgrind warnings about uninitilized variables used in jumps
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::trimmedPrefWidths):
+
+2008-04-25  Warwick Allison  <warwick@trolltech.com>
+
+        Reviewed by Simon.
+
+        Added simple getter function to PlatformScrollBar to return the
+        maximum value. Needed in the WebKit/qt API.
+
+        * platform/qt/PlatformScrollBar.h:
+
+2008-04-25  Benjamin Meyer  <bmeyer@trolltech.com>
+
+        Reviewed by Holger, Simon.
+
+        Implement NoDrop, ZoomIn, and ZoomOut cursors
+
+        * Resources/WebKitResources.qrc:
+        * platform/qt/CursorQt.cpp:
+        (WebCore::noDropCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+
+2008-04-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Handle the ListboxAppearance as 'TextField' as well. We are mainly interested in the background.
+
+        RenderBox will call us to paint the outline/background, it is handled the same as a
+        TextAreaAppearance in RenderTheme, handle it the same in the RenderThemeQt
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintTextField):
+
+2008-04-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        No reason to exit the application when we can not paint something. Replace the Q_ASSERT
+        with a runtime check. Return true to indicate that we did not handle the painting
+        of this element.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintTextField):
+
+2008-04-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Correct the comment. We are in painTextField and don't paint a button.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintTextField):
+
+2008-04-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Allow ListboxAppearance to take focus as well. Stolen from Tor Arne
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocus):
+
+2008-04-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Remove debug output.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2008-04-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Change the string for searchableIndexIntroduction() to match the mac
+        and pass http/tests/misc/isindex-formdata.html
+
+        * platform/qt/Localizations.cpp:
+
+2008-04-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        When we encounter a new/unknown HTTP request type report it back to WebCore as loading error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2008-04-25  Benjamin Meyer  <bmeyer@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix crash in the networking layer.
+
+        Set the m_reply to null right after calling deleteLater().
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2008-04-24  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        * WebCore.base.exp: Remove two symbols from the export list that don't need to be exported.
+
+2008-04-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=18722
+          <rdar://problem/5888360> REGRESSION (3.1 -> TOT): Webkit Nightly Build crashes when visiting i has a hotdog
+
+        Test: fast/dynamic/float-remove-above-line.html
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Avoid adding floats that
+        do not intrude into the line to its floats vector. When such floats go
+        away, they do not dirty the line (because they do not intersect with it)
+        and having it keep them in its floats vector is what caused the crash.
+
 2008-04-24  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by John Sullivan.