REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox
https://bugs.webkit.org/show_bug.cgi?id=132337

Reviewed by Simon Fraser.

From Blink r154582 by <jchaffraix@chromium.org>

Source/WebCore:
This is a regression from the changes in OrderIterator. The issue is
that we don't invalidate our iterator when a child is removed. This
means that we could hold onto free'd memory until the next layout
when we will recompute the iterator.

The solution is simple: just clear the memory when we remove a child.

Note that RenderGrid is not impacted by this bug as we don't use the
iterator outside layout yet, but if we do it at some point the very same
problem will arise, so the same treatment was applied to the class.

Test: fast/flexbox/order-iterator-crash.html

* rendering/OrderIterator.cpp:
(WebCore::OrderIterator::invalidate): Clear m_children Vector.
* rendering/OrderIterator.h:
(WebCore::OrderIteratorPopulator::OrderIteratorPopulator): Use
invalidate() method.
* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::removeChild): Invalidate m_orderIterator.
* rendering/RenderFlexibleBox.h: Add removeChild() signature.
* rendering/RenderGrid.cpp: Invalidate m_orderIterator.
(WebCore::RenderGrid::removeChild):
* rendering/RenderGrid.h: Add removeChild() header.

LayoutTests:
Add new layout test to check that removing a child doesn't cause a crash
in OrderIterator.

* fast/flexbox/order-iterator-crash-expected.txt: Added.
* fast/flexbox/order-iterator-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167942 268f45cc-cd09-0410-ab3c-d52691b4dbfc

iOS build fix after trac.webkit.org/changeset/167937.
Unreviewed.

* rendering/RenderThemeIOS.mm:
(WebCore::RenderThemeIOS::adjustButtonStyle):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167941 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] Introduce -didNotHandleTapAsClickAtPoint: to WKUIDelegatePrivate
https://bugs.webkit.org/show_bug.cgi?id=132316

Reviewed by Darin Adler.

One WebKit2 client is interested to know if a tap was not handled by an element that responds to clicks.
Introduce a new, private WKUIDelegate method telling it that a tap at a location was not handled as a click on
an element.

* UIProcess/API/APIUIClient.h:
(API::UIClient::didNotHandleTapAsClick):
* UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
* UIProcess/Cocoa/UIDelegate.h:
* UIProcess/Cocoa/UIDelegate.mm:
(WebKit::UIDelegate::setDelegate):
(WebKit::UIDelegate::UIClient::didNotHandleTapAsClick):
* UIProcess/WebPageProxy.h:
* UIProcess/WebPageProxy.messages.in:
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::didNotHandleTapAsClick):
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::handleTap): Sent Messages::WebPageProxy::DidNotHandleTapAsClick if the tap wasn't handled, no
node responded to the click event, or the responding node wasn't an element.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167940 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r167751): svn-create-patch is very slow
https://bugs.webkit.org/show_bug.cgi?id=132300

Reviewed by Alexey Proskuryakov.

* Scripts/svn-create-patch:
Change default behavior of svn-create-patch to no longer run the style checker. It can still be run
by calling `svn-create-patch --style`.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167939 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Shapes] off-by-one error in Shape::createRasterShape()
https://bugs.webkit.org/show_bug.cgi?id=132154

Reviewed by Bem Jones-Bey.

Source/WebCore:
This is a port of a patch for a bug that was reported by and fixed in Blink by
David Vest: https://codereview.chromium.org/237123002/.  Shape::createRasterShape()
now consistently reports "end-point exclusive" intervals. Before the patch
an entire row of pixels was above the shape-image-threshold, the interval's end
index was reported as image.width. Now it's image.width + 1, which is consistent
with the way the end index is reported if the last above threshold pixel is within
an image row.

Two existing tests were revised to account for this change.

* rendering/shapes/RasterShape.cpp:
(WebCore::RasterShape::getExcludedIntervals):
* rendering/shapes/Shape.cpp:
(WebCore::Shape::createRasterShape):

LayoutTests:
Change two tests that had incorrect X values to account for the off-by-one
in Shape::createRasterShape().

* fast/shapes/shape-outside-floats/shape-outside-insert-svg-shape.html:
* fast/shapes/shape-outside-floats/shape-outside-linear-gradient-expected.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167938 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Wrap CSS length conversion arguments in an object
https://bugs.webkit.org/show_bug.cgi?id=131552

Reviewed by Andreas Kling.

This patch introduces a class CSSToLengthConversionData to wrap the
data required to convert CSS lengths to Lengths. This simplifies the
plumbing that goes on whenever we need to resolve CSS lengths and
makes it easier to update the arguments needed for resolving these (in
particular adding a RenderView for resolving viewport units at style
recalc time; removing the computingFontSize bool also appears
possible).

Note that the zoom argument, which was previously a float in some
places and a double in others is now a float.

This is a port of a Blink patch by timloh@chromium.org.

No new tests, no behavior change.

* CMakeLists.txt:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.xcodeproj/project.pbxproj:
* css/BasicShapeFunctions.cpp:
(WebCore::convertToLength):
(WebCore::convertToLengthSize):
(WebCore::convertToCenterCoordinate):
(WebCore::cssValueToBasicShapeRadius):
(WebCore::basicShapeForValue):
* css/BasicShapeFunctions.h:
* css/CSSCalculationValue.cpp:
(WebCore::CSSCalcValue::computeLengthPx):
(WebCore::determineCategory):
* css/CSSCalculationValue.h:
(WebCore::CSSCalcValue::createCalculationValue):
* css/CSSGradientValue.cpp:
(WebCore::CSSGradientValue::addStops):
(WebCore::positionFromValue):
(WebCore::CSSGradientValue::computeEndPoint):
(WebCore::CSSLinearGradientValue::createGradient):
(WebCore::CSSRadialGradientValue::resolveRadius):
(WebCore::CSSRadialGradientValue::createGradient):
* css/CSSGradientValue.h:
* css/CSSPrimitiveValue.cpp:
(WebCore::CSSPrimitiveValue::computeLength):
(WebCore::CSSPrimitiveValue::computeLengthDouble):
* css/CSSPrimitiveValue.h:
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::convertToLength):
* css/CSSToLengthConversionData.cpp: Added.
(WebCore::CSSToLengthConversionData::zoom):
* css/CSSToLengthConversionData.h: Added.
(WebCore::CSSToLengthConversionData::CSSToLengthConversionData):
(WebCore::CSSToLengthConversionData::style):
(WebCore::CSSToLengthConversionData::rootStyle):
(WebCore::CSSToLengthConversionData::computingFontSize):
(WebCore::CSSToLengthConversionData::copyWithAdjustedZoom):
* css/CSSToStyleMap.cpp:
(WebCore::CSSToStyleMap::CSSToStyleMap):
(WebCore::CSSToStyleMap::mapFillSize):
(WebCore::CSSToStyleMap::mapFillXPosition):
(WebCore::CSSToStyleMap::mapFillYPosition):
(WebCore::CSSToStyleMap::mapNinePieceImageQuad):
* css/CSSToStyleMap.h:
(WebCore::CSSToStyleMap::CSSToStyleMap): Deleted.
* css/DeprecatedStyleBuilder.cpp:
(WebCore::ApplyPropertyAuto::applyValue):
(WebCore::ApplyPropertyClip::convertToLength):
(WebCore::ApplyPropertyLength::applyValue):
(WebCore::ApplyPropertyBorderRadius::applyValue):
(WebCore::ApplyPropertyComputeLength::applyValue):
(WebCore::ApplyPropertyFontSize::applyValue):
(WebCore::csstoLengthConversionDataWithTextZoomFactor):
(WebCore::ApplyPropertyMarqueeIncrement::applyValue):
(WebCore::ApplyPropertyLineHeight::applyValue):
(WebCore::ApplyPropertyLineHeightForIOSTextAutosizing::applyValue):
(WebCore::ApplyPropertyWordSpacing::applyValue):
(WebCore::ApplyPropertyPageSize::mmLength):
(WebCore::ApplyPropertyPageSize::inchLength):
(WebCore::ApplyPropertyPageSize::applyValue):
(WebCore::ApplyPropertyVerticalAlign::applyValue):
(WebCore::ApplyPropertyClipPath::applyValue):
(WebCore::ApplyPropertyShape::applyValue):
(WebCore::ApplyPropertyTextIndent::applyValue):
* css/MediaQueryEvaluator.cpp:
(WebCore::colorMediaFeatureEval):
(WebCore::color_indexMediaFeatureEval):
(WebCore::monochromeMediaFeatureEval):
(WebCore::orientationMediaFeatureEval):
(WebCore::aspect_ratioMediaFeatureEval):
(WebCore::device_aspect_ratioMediaFeatureEval):
(WebCore::device_pixel_ratioMediaFeatureEval):
(WebCore::resolutionMediaFeatureEval):
(WebCore::gridMediaFeatureEval):
(WebCore::computeLength):
(WebCore::device_heightMediaFeatureEval):
(WebCore::device_widthMediaFeatureEval):
(WebCore::heightMediaFeatureEval):
(WebCore::widthMediaFeatureEval):
(WebCore::min_colorMediaFeatureEval):
(WebCore::max_colorMediaFeatureEval):
(WebCore::min_color_indexMediaFeatureEval):
(WebCore::max_color_indexMediaFeatureEval):
(WebCore::min_monochromeMediaFeatureEval):
(WebCore::max_monochromeMediaFeatureEval):
(WebCore::min_aspect_ratioMediaFeatureEval):
(WebCore::max_aspect_ratioMediaFeatureEval):
(WebCore::min_device_aspect_ratioMediaFeatureEval):
(WebCore::max_device_aspect_ratioMediaFeatureEval):
(WebCore::min_device_pixel_ratioMediaFeatureEval):
(WebCore::max_device_pixel_ratioMediaFeatureEval):
(WebCore::min_heightMediaFeatureEval):
(WebCore::max_heightMediaFeatureEval):
(WebCore::min_widthMediaFeatureEval):
(WebCore::max_widthMediaFeatureEval):
(WebCore::min_device_heightMediaFeatureEval):
(WebCore::max_device_heightMediaFeatureEval):
(WebCore::min_device_widthMediaFeatureEval):
(WebCore::max_device_widthMediaFeatureEval):
(WebCore::min_resolutionMediaFeatureEval):
(WebCore::max_resolutionMediaFeatureEval):
(WebCore::animationMediaFeatureEval):
(WebCore::transitionMediaFeatureEval):
(WebCore::transform_2dMediaFeatureEval):
(WebCore::transform_3dMediaFeatureEval):
(WebCore::view_modeMediaFeatureEval):
(WebCore::video_playable_inlineMediaFeatureEval):
(WebCore::hoverMediaFeatureEval):
(WebCore::pointerMediaFeatureEval):
(WebCore::MediaQueryEvaluator::eval):
* css/SVGCSSStyleSelector.cpp:
(WebCore::StyleResolver::applySVGProperty):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::State::clear):
(WebCore::StyleResolver::State::initForStyleResolve):
(WebCore::StyleResolver::convertToIntLength):
(WebCore::StyleResolver::convertToFloatLength):
(WebCore::createGridTrackBreadth):
(WebCore::StyleResolver::applyProperty):
(WebCore::StyleResolver::createFilterOperations):
* css/StyleResolver.h:
(WebCore::StyleResolver::State::setStyle):
(WebCore::StyleResolver::State::cssToLengthConversionData):
* css/TransformFunctions.cpp:
(WebCore::convertToFloatLength):
(WebCore::transformsForValue):
* css/TransformFunctions.h:
* css/WebKitCSSMatrix.cpp:
(WebCore::WebKitCSSMatrix::setMatrixValue):
* rendering/RenderThemeIOS.mm:
(WebCore::applyCommonButtonPaddingToStyle):
(WebCore::RenderThemeIOS::adjustButtonStyle):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167937 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Shapes] complex calc args for inset round vanish
https://bugs.webkit.org/show_bug.cgi?id=132293

Reviewed by Bem Jones-Bey.

Source/WebCore:
In order to use calc in the rounded parameters for inset shapes, we need
to pass RenderStyle for the value creation as we did for the width arguments.
Without taking RenderStyle into account, we hit an assert not reache
in CSSPrimitiveValue::init in the debug builds.

I've added new parsing test.

* css/BasicShapeFunctions.cpp:
(WebCore::valueForBasicShape):
* css/CSSPrimitiveValue.cpp:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::init):
* css/CSSPrimitiveValue.h:
(WebCore::CSSPrimitiveValue::create):
* css/CSSValuePool.h:
(WebCore::CSSValuePool::createValue):

LayoutTests:
* fast/shapes/parsing/parsing-shape-outside-expected.txt:
* fast/shapes/parsing/parsing-test-utils.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167936 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Shapes] complex calc values for shape-margin return null for computed style
https://bugs.webkit.org/show_bug.cgi?id=132313

Reviewed by Bem Jones-Bey.

Source/WebCore:
We need to pass RenderStyle* to the cssValuePool when parsing
shape-margin in order to use calc() as a parameter.

I've added the new test case to parsing-shape-margin.html

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::ComputedStyleExtractor::propertyValue):

LayoutTests:
* fast/shapes/parsing/parsing-shape-margin.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167935 268f45cc-cd09-0410-ab3c-d52691b4dbfc

AX: Row span info is wrong for table cells when a footer section is placed above a body section
https://bugs.webkit.org/show_bug.cgi?id=131832

Reviewed by Mario Sanchez Prada.

Source/WebCore:
If a <footer> section is placed before the body, it renders AX row information and order incorrectly.
This also affects ARIA tables because they add their children by looking at renderer children, instead
interrogating the RenderTable directly.

Test: accessibility/table-with-footer-section-above-body.html

* accessibility/AccessibilityARIAGrid.cpp:
(WebCore::AccessibilityARIAGrid::addTableCellChild):
(WebCore::AccessibilityARIAGrid::addChildren):
* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::addChildren):
(WebCore::AccessibilityTable::addChildrenFromSection):
* accessibility/AccessibilityTable.h:
* accessibility/AccessibilityTableCell.cpp:
(WebCore::AccessibilityTableCell::rowIndexRange):
(WebCore::AccessibilityTableCell::columnIndexRange):

LayoutTests:
* accessibility/table-with-footer-section-above-body-expected.txt: Added.
* accessibility/table-with-footer-section-above-body.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167934 268f45cc-cd09-0410-ab3c-d52691b4dbfc

AX: SpeechSynthesisUtterance cannot addEventListener
https://bugs.webkit.org/show_bug.cgi?id=132321

Reviewed by Mario Sanchez Prada.

Source/WebCore:
Modified an existing test (speech-synthesis-speak.html) to use addEventTarget.

* Modules/speech/SpeechSynthesisUtterance.idl:

LayoutTests:
* platform/mac/fast/speechsynthesis/speech-synthesis-speak.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167933 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Generate Eclipse project + ninja build for GTK+ if Eclipse in available in the PATH
https://bugs.webkit.org/show_bug.cgi?id=132190

Patch by Enrique Ocaña González <eocanha@igalia.com> on 2014-04-29
Reviewed by Gustavo Noronha Silva.

* Scripts/webkitdirs.pm:
(canUseEclipse): Test if Eclipse is in the path. This is the same method used to test
    if ninja is in the path.
(generateBuildSystemFromCMakeProject): Use the eclipse generator if possible, fallback
    to the previous ninja generator if not.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167932 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Shapes] shape-outside polygon fails when first vertex is 0,0
https://bugs.webkit.org/show_bug.cgi?id=132132

Reviewed by Bem Jones-Bey.

Source/WebCore:
ShapeInterval now distinguishes between x1==x2 - isEmpty() and x1,x2 haven't been
set yet - isUndefined(). Removed the ShapeInterval setX1() and setX2() methods, since
they're no longer used.

The polygon algorithm for computing excluded intervals now ignores horizontal
edges. It also ignores edges whose lower vertex matches the top of the line, if
the edge's Y direction is upwards (away from the top of the line). The rationale
for this was explained here:
http://hansmuller-webkit.blogspot.com/2012/11/revised-horizontal-box-algorithm.html

Test: fast/shapes/shape-outside-floats/shape-outside-polygon-zero-vertex.html

* rendering/shapes/PolygonShape.cpp:
(WebCore::OffsetPolygonEdge::clippedEdgeXRange):
(WebCore::PolygonShape::getExcludedIntervals):
* rendering/shapes/ShapeInterval.h:
(WebCore::ShapeInterval::ShapeInterval):
(WebCore::ShapeInterval::isUndefined):
(WebCore::ShapeInterval::x1):
(WebCore::ShapeInterval::x2):
(WebCore::ShapeInterval::width):
(WebCore::ShapeInterval::isEmpty):
(WebCore::ShapeInterval::setX1):
(WebCore::ShapeInterval::setX2):
(WebCore::ShapeInterval::overlaps):
(WebCore::ShapeInterval::contains):
(WebCore::ShapeInterval::unite):

LayoutTests:
* fast/shapes/shape-outside-floats/shape-outside-polygon-zero-vertex-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-polygon-zero-vertex.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167931 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Regions] Fix getClientRects() for content nodes
https://bugs.webkit.org/show_bug.cgi?id=117407

Reviewed by David Hyatt.

Source/WebCore:
This patch modifies getClientRects() to return a list of fragments
for a fragmented box instead of a single rectangle positioned inside
the region where the box center would appear.

The approach is to split the border box of the element in regions using
the layout positioning. Then each fragment is mapped to the view coordinates
and the result added to the list of rectangles. To preserve the originating
region when mapping the fragment through the ancestor tree I've introduced
the concept of a current region. The current region is stored inside a
CurrentRenderRegionMaintainer object, created whenever an algorithm needing
it needs to run. When the maintainer is destroyed, the cleanup is made
automatically. The RenderFlowThread holds a pointer to this structure for
easy access.

Tests: fast/regions/cssom/client-rects-fixed-content.html
       fast/regions/cssom/client-rects-forced-breaks.html
       fast/regions/cssom/client-rects-inline-complex.html
       fast/regions/cssom/client-rects-inline.html
       fast/regions/cssom/client-rects-nested-regions.html
       fast/regions/cssom/client-rects-positioned.html
       fast/regions/cssom/client-rects-relative-position.html
       fast/regions/cssom/client-rects-simple-block.html
       fast/regions/cssom/client-rects-transforms.html
       fast/regions/cssom/client-rects-unsplittable-float.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::absoluteQuads): Split the box in fragments.
* rendering/RenderBox.cpp:
(WebCore::RenderBox::absoluteQuads): Split the box in fragments.
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::RenderFlowThread):
(WebCore::RenderFlowThread::mapFromFlowToRegion):
(WebCore::RenderFlowThread::mapLocalToContainer):
(WebCore::RenderFlowThread::currentRegion):
* rendering/RenderFlowThread.h:
* rendering/RenderNamedFlowFragment.cpp:
(WebCore::RenderNamedFlowFragment::absoluteQuadsForBoxInRegion): Get
the fragments for this box in the region.
* rendering/RenderNamedFlowFragment.h:
* rendering/RenderNamedFlowThread.cpp:
(WebCore::RenderNamedFlowThread::absoluteQuadsForBox): Virtual function
that can be used to implement fragments to client rects mapping.
* rendering/RenderNamedFlowThread.h:
* rendering/RenderRegion.cpp:
(WebCore::RenderRegion::rectFlowPortionForBox): Small change to correctly
map empty rectangles to containers.
(WebCore::CurrentRenderRegionMaintainer::CurrentRenderRegionMaintainer):
(WebCore::CurrentRenderRegionMaintainer::~CurrentRenderRegionMaintainer):
* rendering/RenderRegion.h:
(WebCore::RenderRegion::absoluteQuadsForBoxInRegion):
(WebCore::CurrentRenderRegionMaintainer::region):

LayoutTests:
Tests verifying getClientRects works correctly in different situations.

* fast/regions/cssom/client-rects-fixed-content-expected.txt: Added.
* fast/regions/cssom/client-rects-fixed-content.html: Added.
* fast/regions/cssom/client-rects-forced-breaks-expected.txt: Added.
* fast/regions/cssom/client-rects-forced-breaks.html: Added.
* fast/regions/cssom/client-rects-inline-complex-expected.txt: Added.
* fast/regions/cssom/client-rects-inline-complex.html: Added.
* fast/regions/cssom/client-rects-inline-expected.txt: Added.
* fast/regions/cssom/client-rects-inline.html: Added.
* fast/regions/cssom/client-rects-nested-regions-expected.txt: Added.
* fast/regions/cssom/client-rects-nested-regions.html: Added.
* fast/regions/cssom/client-rects-positioned-expected.txt: Added.
* fast/regions/cssom/client-rects-positioned.html: Added.
* fast/regions/cssom/client-rects-relative-position-expected.txt: Added.
* fast/regions/cssom/client-rects-relative-position.html: Added.
* fast/regions/cssom/client-rects-simple-block-expected.txt: Added.
* fast/regions/cssom/client-rects-simple-block.html: Added.
* fast/regions/cssom/client-rects-transforms-expected.txt: Added.
* fast/regions/cssom/client-rects-transforms.html: Added.
* fast/regions/cssom/client-rects-unsplittable-float-expected.txt: Added.
* fast/regions/cssom/client-rects-unsplittable-float.html: Added.
* fast/regions/resources/helper.js:
(testClientRects): Function that compares the actual client rects for an
element to a list of expected client rects.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167930 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LLINT loadisFromInstruction doesn't need special case for big endians
https://bugs.webkit.org/show_bug.cgi?id=132330

Patch by Tomas Popela <tpopela@redhat.com> on 2014-04-29
Reviewed by Mark Lam.

The change introduced in r167076 was wrong. We should not apply the offset
adjustment on loadisFromInstruction usage as the instruction
(UnlinkedInstruction) is declared as an union (i.e. with the int32_t
operand variable). The offset of the other union members will be the
same as the offset of the first one, that is 0. The behavior here is the
same on little and big endian architectures. Thus we don't need
special case for big endians.

* llint/LowLevelInterpreter.asm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167929 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Store the containing region map inside the flow thread
https://bugs.webkit.org/show_bug.cgi?id=131647

Reviewed by Mihnea Ovidenie.

Source/WebCore:
The patch moves the containing region map inside the flow thread where
it can be better handled in case the region chain changes and the map
needs to be cleared.

As a result of this move we are able to also cleanup the lines region
information of a block flow when it is removed from the tree.

Test: fast/regions/inline-strike-through.html

* rendering/InlineFlowBox.h:
(WebCore::InlineFlowBox::InlineFlowBox):
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::addOverflowFromInlineChildren):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::removeFlowChildInfo):
(WebCore::RenderFlowThread::invalidateRegions):
(WebCore::RenderFlowThread::removeLineRegionInfo):
(WebCore::RenderFlowThread::checkLinesConsistency):
(WebCore::RenderFlowThread::containingRegionMap):
* rendering/RenderFlowThread.h:
* rendering/RootInlineBox.cpp:
(WebCore::containingRegionMap):
(WebCore::RootInlineBox::~RootInlineBox):
(WebCore::RootInlineBox::paint):
(WebCore::RootInlineBox::containingRegion):
(WebCore::RootInlineBox::clearContainingRegion):
(WebCore::RootInlineBox::setContainingRegion):

LayoutTests:
Add a test that verifies the containing region map is properly cleared
when the region chain changes.

* fast/regions/inline-strike-through-expected.txt: Added.
* fast/regions/inline-strike-through.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167928 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed EFL gardening.

Removed remaining editing/pasteboard which are already skipped.

* platform/efl/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167927 268f45cc-cd09-0410-ab3c-d52691b4dbfc

check-webkit-style should understand --git-index
https://bugs.webkit.org/show_bug.cgi?id=125364

Patch by Jozsef Berta <jberta.u-szeged@partner.samsung.com> on 2014-04-29
Reviewed by Csaba Osztrogonác.

* Scripts/webkitpy/common/checkout/scm/git.py:
(Git.create_patch): The command now supports the --cached option.
* Scripts/webkitpy/style/main.py:
(CheckWebKitStyle.main): Passing the --git-index option.
* Scripts/webkitpy/style/optparser.py:
(CommandOptionValues.__init__): The git-index option is switched off by default.
(CommandOptionValues.__eq__): Equality check for the new option.
(ArgumentParser._create_option_parser):Adding the --git-index option
(ArgumentParser.parse):
* Scripts/webkitpy/style/optparser_unittest.py: New tests for the --git-index option
(CommandOptionValuesTest.test_init):
(CommandOptionValuesTest.test_eq):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167926 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed GTK gardening.

* platform/gtk/TestExpectations: Flagged some tests.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167925 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK][WK2] Avoid Vector copies in WebViewBaseInputMethodFilter::setPreedit()
https://bugs.webkit.org/show_bug.cgi?id=132323

Reviewed by Carlos Garcia Campos.

* UIProcess/API/gtk/WebViewBaseInputMethodFilter.cpp:
(WebKit::WebViewBaseInputMethodFilter::setPreedit): Inline the Vector object construction into
the WebPageProxy::setComposition() call to avoid extra Vector copies and moves.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167924 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/16750708> REGRESSION (r159358): Crash in InjectedBundleHitTestResult::frame
https://bugs.webkit.org/show_bug.cgi?id=132318

Reviewed by Andy Estes.

* UIProcess/Cocoa/NavigationState.mm:
(WebKit::NavigationState::PolicyClient::decidePolicyForNavigationAction): Fixed a typo: set
the source frame, not the destination frame.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction): Changed to get the
frame for the action not from a hit test result, because some link activation actions are
not mouse events, but rather from the event’s target.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167923 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Simplify tryCacheGetById
https://bugs.webkit.org/show_bug.cgi?id=132314

Reviewed by Oliver Hunt and Filip Pizlo.

This is neutral across all benchmarks we track, although it looks like a wee 0.5% progression on sunspider.

* jit/Repatch.cpp:
(JSC::tryCacheGetByID): If we fail to cache on self, we just repatch to call tryBuildGetByIDList next time.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167922 268f45cc-cd09-0410-ab3c-d52691b4dbfc

SelectorCodeGenerator::generateElementIsNthChild() leaks the parent register :nth-child() is non-filtering
https://bugs.webkit.org/show_bug.cgi?id=132311

Reviewed by Andreas Kling.

Source/WebCore:
In two cases, the parent register was never returned to the register allocator:
-Non filtering selectors (the early return).
-Non marking selectors (at the moment: only querySelector API).

Unfortunately, generateElementIsNthChild() makes function call, which forces us to do this manual allocation
of the parentElement register. Long term, I want RegisterAllocator and FunctionCall to have a special type for that.

Test: fast/selectors/several-nth-child.html

* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):

LayoutTests:
* fast/selectors/several-nth-child-expected.txt: Added.
* fast/selectors/several-nth-child.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167921 268f45cc-cd09-0410-ab3c-d52691b4dbfc

CSS JIT: backtracking with current / parent element for child
https://bugs.webkit.org/show_bug.cgi?id=132057

Patch by Yusuke Suzuki <utatane.tea@gmail.com> on 2014-04-28
Reviewed by Benjamin Poulain.

Calculate appropriate backtracking start height from the closest
descendant. And at first, we use it for a simple optimization.

1. When backtracking start height equals to current height, we
can simply jump to a descendant element check phase.
2. When backtracking start height equals to current height + 1, we
can simply jump to a descendant element traversing phase.

We can apply this optimization to fragments with adjacent combinators.
But, in the meantime, we start to implement it for a fragment with
child combinator.

Source/WebCore:
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
(WebCore::SelectorCompiler::TagNamePattern::TagNamePattern):
(WebCore::SelectorCompiler::solveDescendantBacktrackingActionForChild):
(WebCore::SelectorCompiler::solveBacktrackingAction):
(WebCore::SelectorCompiler::equalTagNames):
(WebCore::SelectorCompiler::equalTagNamePatterns):
(WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant):
(WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
(WebCore::SelectorCompiler::requiresAdjacentTail):
(WebCore::SelectorCompiler::requiresDescendantTail):
(WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentNode):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentElement):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateParentElementTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateAncestorTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):

LayoutTests:
* fast/selectors/backtracking-child-combinator-with-tail-expected.txt: Added.
* fast/selectors/backtracking-child-combinator-with-tail.html: Added.
* fast/selectors/backtracking-child-combinator-without-tail-expected.txt: Added.
* fast/selectors/backtracking-child-combinator-without-tail.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167920 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167919 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r153142) ASSERT from CodeBlock::dumpBytecode dumping String Switch Jump Tables
https://bugs.webkit.org/show_bug.cgi?id=132315

Reviewed by Mark Hahnenberg.

Used the StringImpl version of utf8() instead of creating a String first.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167917 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS][WK2] Restore the scroll position and scale from the HistoryItem (mostly)
https://bugs.webkit.org/show_bug.cgi?id=132307

Source/WebCore:

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

* WebCore.exp.in:

Source/WebKit2:
<rdar://problem/16031704>

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

Restore the scroll position and scale on back-forward by restoring the values from HistoryItem.
This covers the common cases, see <rdar://problem/16031704>.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _didCommitLayerTree:WebKit::]):
(-[WKWebView _didCommitLoadForMainFrame]): Deleted.
* UIProcess/API/Cocoa/WKWebViewInternal.h:
* UIProcess/ios/WKContentView.mm:
(-[WKContentView _didCommitLoadForMainFrame]):
Get rid of the old code restoring the scroll position. This is now done by the WebProcess.

* UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):
Update the scrolling tree after invoking didCommitLayerTree() on the WebPageProxy.

WKContentView and WKWebView states are updated in response to didCommitLayerTree(), the content size
and scale in particular are set there.

After that, the content size/scale is in the same state as the layerTree update, and we can scroll
the content as needed.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
* WebProcess/WebCoreSupport/ios/WebFrameLoaderClientIOS.mm:
(WebKit::WebFrameLoaderClient::restoreViewState):
iOS WebKit1 uses a custom restoreViewState(), do the same for WebKit2 since the generic code is #ifdefed out.
This is also necessary for the main frame's state update.

* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::restorePageState):
Restore the scale and position of the main frame. For now, we assume m_userHasChangedPageScaleFactor is set otherwise
the initial-scale would override the restored value. We will need to fix that, the value should probably be saved with
the history.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167916 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed EFL gardening.

Skip editing/pasteboard which EFL port does not support.

* platform/efl-wk1/TestExpectations:
* platform/efl-wk2/TestExpectations:
* platform/efl/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167915 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS][WK2] iOS fix after r167867
https://bugs.webkit.org/show_bug.cgi?id=132302

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

iOS Touch Points uses "phase" for describing the touch points state for historical reasons.
This patch adds state() as a synonym for phase, and revert r167893.

* Shared/WebEvent.h:
(WebKit::WebPlatformTouchPoint::state):
* UIProcess/WebPageProxy.cpp:
(WebKit::areAllTouchPointsReleased):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167914 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash in platform/mac/accessibility/table-visible-rows.html
https://bugs.webkit.org/show_bug.cgi?id=132146

Reviewed by Filip Pizlo.

Instead of creating a local JSValueRef array on the stack and passing that to
JSObjectMakeArray(), changed to create an empty JSArray and then populate the
values using the JSObjectSetPropertyAtIndex() API.

* DumpRenderTree/AccessibilityUIElement.cpp:
(elementsForRangeCallback):
(convertElementsToObjectArray):
* DumpRenderTree/mac/TestRunnerMac.mm:
(originsArrayToJS):
* WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
(WTR::EventSendingController::contextClick):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::stringArrayToJS):
* WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:
(WTR::convertElementsToObjectArray):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167913 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix a transcription error from r167901.

When addressing Darin's review feedback, I moved the iteration of dataArray from
QuickLookDocumentData::append() to WebQuickLookHandleClient::didReceiveDataArray(),
but I forgot to update the context argument to CFArrayApplyFunction() accordingly.

* WebProcess/WebCoreSupport/ios/WebQuickLookHandleClient.cpp:
(WebKit::WebQuickLookHandleClient::didReceiveDataArray):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167912 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Scrollbars do not update properly when topContentInset changes dynamically
https://bugs.webkit.org/show_bug.cgi?id=132309
-and corresponding-
<rdar://problem/16642232>

Reviewed by Tim Horton.

It is not sufficient to do a layout and call updateScrollbars(). We must also call
RenderLayerCompositor::frameViewDidChangeSize() in order to properly adjust the
size and position of all of the scrolling-related layers.
* page/FrameView.cpp:
(WebCore::FrameView::topContentInsetDidChange):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167911 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[New Multicolumn] event.offsetX/offsetY don't work correctly
https://bugs.webkit.org/show_bug.cgi?id=132284

Reviewed by Simon Fraser.

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
Change the code here to only trigger for CSS Regions and not for
multi-column. Add a FIXME pointing out that the code is broken even for
CSS regions.

 * rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::mapAbsoluteToLocalPoint):
Override mapAbsoluteToLocalPoint in order to guess a region and attempt
to translate the point from that region to the flow thread local coordinate
space.

(WebCore::RenderMultiColumnFlowThread::physicalTranslationFromRegionToFlow):
* rendering/RenderMultiColumnFlowThread.h:
New helper function that just wraps calling the region's logical translation
function and converting to/from physical coordinates.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167910 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WK2 iOS] Need to show title in the action sheet for images not inside an anchor element.
https://bugs.webkit.org/show_bug.cgi?id=132304
<rdar://problem/16535227>

Reviewed by Benjamin Poulain.

If the image in not inside an anchor tag, we must use the title attribute as
title for the action sheet.

* UIProcess/ios/WKActionSheetAssistant.mm:
(-[WKActionSheetAssistant _createSheetWithElementActions:showLinkTitle:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167909 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r167857.
https://bugs.webkit.org/show_bug.cgi?id=132305

the change was rolled out, roll out the new expectations as
well (Requested by thorton on #webkit).

Reverted changeset:

"Unreviewed. Updating one bindings test baseline after
r167855."
http://trac.webkit.org/changeset/167857

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167908 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Mac] Use the animated version of setHighlighted on NSButtonCell where available
https://bugs.webkit.org/show_bug.cgi?id=132295
<rdar://problem/16747240>

Reviewed by Beth Dakin.

Like setState, there is an animated version of setHighlighted available.

* platform/mac/ThemeMac.mm:
(WebCore::updateStates): Use private version of _setHighlighted where possible.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167907 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore: The LLInt is awesome and it should get more of the action.

Rubber stamped by Geoffrey Garen.

5% speed-up on JSBench and no meaningful regressions.  Should be a PLT/DYE speed-up also.

* runtime/Options.h:

Tools: Make sure that the coverage of our tests doesn't change much if we change the thresholds now and in the future, but making
"no-cjit" runs force the old-school threshold.

Rubber stamped by Mark Hahnenberg.

* Scripts/run-jsc-stress-tests:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167906 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebKit2 View Gestures (Swipe): Discard snapshots made with a different view size/pixel density
https://bugs.webkit.org/show_bug.cgi?id=132115

Reviewed by Simon Fraser.

We shouldn't try to use snapshots if they no longer match the destination view size.
To do this, we need an accurate understanding of the topContentInset, both for the Web view,
and for any custom views, because we don't want to include the inset area in the snapshot,
and we don't want to reject snapshots that differ from the current view only because they have an inset or not.

* UIProcess/API/Cocoa/WKViewPrivate.h:
* UIProcess/API/mac/WKView.mm:
(-[WKView _takeViewSnapshot]):
(-[WKView _setCustomSwipeViewsTopContentInset:]):
Add and plumb through a topContentInset property to apply to the custom swipe views.
For simplicitly's sake in the multi-view case, it is applied in window coordinates,
so clients will have to do conversions if necessary.
Don't include the top content inset in the snapshot that is taken.

* UIProcess/mac/ViewGestureController.h:
(WebKit::ViewGestureController::setCustomSwipeViewsTopContentInset):
* UIProcess/mac/ViewGestureControllerMac.mm:
(WebKit::ViewGestureController::ViewGestureController):
(WebKit::ViewGestureController::windowRelativeBoundsForCustomSwipeViews):
Apply the aforementioned custom swipe view top content inset.

(WebKit::ViewGestureController::determineSnapshotLayerParent):
(WebKit::ViewGestureController::determineLayerAdjacentToSnapshotForParent):
Factor these out of beginSwipeGesture.

(WebKit::ViewGestureController::retrieveSnapshotForItem):
Don't return a snapshot if the current deviceScaleFactor doesn't match that
at which the snapshot was taken, or if the size of the snapshot doesn't match
the unobscured part of the snapshot layer (the layer's size sans top content inset).

(WebKit::layerGeometryFlippedToRoot): Added.
Determine whether geometry flipping occurs between a layer and the root of the tree it is in.

(WebKit::ViewGestureController::applyDebuggingPropertiesToSwipeViews):
Factor out debugging layer properties, and add some borders and backgrounds to our layers.
I switched to invert instead of blur because blur makes the borders hard to use.

(WebKit::ViewGestureController::beginSwipeGesture):
Add an additional layer, the swipeLayer, which is the parent of the swipeSnapshotLayer.
We use this layer to compensate for geometry flipping, since we don't necessarily
know the structure of the layer tree ahead of time when inserting snapshots into the
client's layer tree, in the custom swipe view case.
The swipe layer is always the full size of the view, including topContentInset, and
has a white background in order to fill in that space. The snapshot layer is the size
of the view *excluding* the topContentInset, which should match the size of the snapshot image
itself (and we reject the image and just paint white if this is not the case).

(WebKit::ViewGestureController::handleSwipeGesture):
(WebKit::ViewGestureController::removeSwipeSnapshot):
Move and remove the new swipeLayer.

* UIProcess/mac/ViewSnapshotStore.h:
* UIProcess/mac/ViewSnapshotStore.mm:
(WebKit::ViewSnapshotStore::recordSnapshot):
Store the deviceScaleFactor at the time the snapshot was taken.
Fix a bug where the count of snapshots with live images was too high
because we were failing to decrement it when replacing a snapshot of
an existing item with a fresh one.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167905 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r167855.
https://bugs.webkit.org/show_bug.cgi?id=132301

Broke the windows build (Requested by bfulgham on #webkit).

Reverted changeset:

"ScriptExecutionContext::Task should work well with C++11
lambdas"
https://bugs.webkit.org/show_bug.cgi?id=129795
http://trac.webkit.org/changeset/167855

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167904 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WK2 iOS: crash when handling a synthetic keyboard event.
https://bugs.webkit.org/show_bug.cgi?id=132296
<rdar://problem/16469726>

Reviewed by Benjamin Poulain.

Adding a null check, since synthetic keyboard events do not
have a corresponding platform event. We already do this on OS X.

* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::handleEditingKeyboardEvent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167903 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] install-dependencies should also install ruby-json and ruby-highline
https://bugs.webkit.org/show_bug.cgi?id=132292

Patch by Carlos Alberto Lopez Perez <clopez@igalia.com> on 2014-04-28
Reviewed by Philippe Normand.

* gtk/install-dependencies: Install ruby json and highline packages.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167902 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] Implement WebQuickLookHandleClient for WebKit2
https://bugs.webkit.org/show_bug.cgi?id=132157

Reviewed by Darin Adler.

Source/WebCore:
* WebCore.exp.in: Exported QuickLookHandle::previewUTI().
* platform/network/ios/QuickLook.h:
* platform/network/ios/QuickLook.mm:
(WebCore::QuickLookHandle::previewFileName): Changed to return a WTF::String.
(WebCore::QuickLookHandle::previewUTI): Added.

Source/WebKit2:
* Shared/API/Cocoa/_WKNSFileManagerExtras.h: Added.
* Shared/API/Cocoa/_WKNSFileManagerExtras.mm: Added.
(+[NSFileManager _web_createTemporaryFileForQuickLook:]): Called WebCore::createTemporaryFileForQuickLook().
* Shared/ios/QuickLookDocumentData.cpp: Added.
(WebKit::QuickLookDocumentData::QuickLookDocumentData):
(WebKit::QuickLookDocumentData::append): Appened each CFDataRef to m_data and added their sizes to m_size.
(WebKit::QuickLookDocumentData::decodedData): Returned the combined CFDataRef created by decode().
Named this method 'decodedData' to indicate that it should only be called on objects populated by decode().
(WebKit::QuickLookDocumentData::clear): Cleared m_data and reset m_size to 0.
(WebKit::QuickLookDocumentData::encode): Implemented a custom encoding function to avoid having to combine
m_data into contiguous memory at encoding time. Encoded m_size then sequentially encoded each member of m_data.
(WebKit::QuickLookDocumentData::decode): Decoded the byte stream into a single CFDataRef. Eagerly copied the
decoded data rather than using a DataReference since we know this will outlive the decoder.
* Shared/ios/QuickLookDocumentData.h: Added.
* UIProcess/API/APILoaderClient.h:
(API::LoaderClient::didStartLoadForQuickLookDocumentInMainFrame):
(API::LoaderClient::didFinishLoadForQuickLookDocumentInMainFrame):
* UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
* UIProcess/Cocoa/NavigationState.h:
* UIProcess/Cocoa/NavigationState.mm:
(WebKit::NavigationState::setNavigationDelegate):
(WebKit::NavigationState::LoaderClient::didStartLoadForQuickLookDocumentInMainFrame):
(WebKit::NavigationState::LoaderClient::didFinishLoadForQuickLookDocumentInMainFrame):
* UIProcess/WebPageProxy.h:
* UIProcess/WebPageProxy.messages.in:
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::didStartLoadForQuickLookDocumentInMainFrame):
(WebKit::WebPageProxy::didFinishLoadForQuickLookDocumentInMainFrame):
* WebKit2.xcodeproj/project.pbxproj:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
* WebProcess/WebCoreSupport/ios/WebFrameLoaderClientIOS.mm:
(WebKit::WebFrameLoaderClient::didCreateQuickLookHandle):
* WebProcess/WebCoreSupport/ios/WebQuickLookHandleClient.cpp: Added.
(WebKit::WebQuickLookHandleClient::WebQuickLookHandleClient): Sent DidStartLoadForQuickLookDocumentInMainFrame
to WebPageProxy.
(WebKit::WebQuickLookHandleClient::didReceiveDataArray): Appended dataArray to m_data.
(WebKit::WebQuickLookHandleClient::didFinishLoading): Sent DidFinishLoadForQuickLookDocumentInMainFrame to
WebPageProxy and then cleared m_data.
(WebKit::WebQuickLookHandleClient::didFail): Cleared m_data.
* WebProcess/WebCoreSupport/ios/WebQuickLookHandleClient.h: Added.
(WebKit::WebQuickLookHandleClient::create):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167901 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Layout Test fast/events/shadow-event-path[-2].html is failing
https://bugs.webkit.org/show_bug.cgi?id=132238

Add the file that was supposed to be committed in r167840.

* TestExpectations:
* fast/events/resources/shadow-event-path-shared.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167900 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION: Intermittent crash in SpeechSynthesis::didFinishSpeaking
https://bugs.webkit.org/show_bug.cgi?id=111613

Reviewed by Mark Lam.

I think it's possible that didFinishSpeaking ends up calling directly back into start speaking, and the utterance reference
we were holding can get cleared, so protecting this should avoid a few asserts.

* platform/mock/PlatformSpeechSynthesizerMock.cpp:
(WebCore::PlatformSpeechSynthesizerMock::speakingFinished):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167899 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r167845): ASSERT(!m_renderView.needsLayout()) in svg/custom/bug79798.html
https://bugs.webkit.org/show_bug.cgi?id=132297

* platform/wk2/TestExpectations:
Skip the test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167898 268f45cc-cd09-0410-ab3c-d52691b4dbfc

GC should be able to remove things from the DFG worklist and cancel on-going compilations if it knows that the compilation would already be invalidated
https://bugs.webkit.org/show_bug.cgi?id=132166

Reviewed by Oliver Hunt and Mark Hahnenberg.

The GC can aid type inference by removing structures that are dead and jettisoning
code that relies on those structures. This can dramatically accelerate type inference
for some tricky programs.

Unfortunately, we previously pinned any structures that enqueued compilations depended
on. This means that if you're on a machine that only runs a single compilation thread
and where compilations are relatively slow, you have a high chance of large numbers of
structures being pinned during any GC since the compilation queue is likely to be full
of random stuff.

This comprehensively fixes this issue by allowing the GC to remove compilation plans
if the things they depend on are dead, and to even cancel safepointed compilations.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
(JSC::CodeBlock::isKnownToBeLiveDuringGC):
(JSC::CodeBlock::finalizeUnconditionally):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan): Deleted.
* dfg/DFGDesiredIdentifiers.cpp:
(JSC::DFG::DesiredIdentifiers::DesiredIdentifiers):
* dfg/DFGDesiredIdentifiers.h:
* dfg/DFGDesiredWatchpoints.h:
* dfg/DFGDesiredWeakReferences.cpp:
(JSC::DFG::DesiredWeakReferences::DesiredWeakReferences):
* dfg/DFGDesiredWeakReferences.h:
* dfg/DFGGraphSafepoint.cpp:
(JSC::DFG::GraphSafepoint::GraphSafepoint):
* dfg/DFGGraphSafepoint.h:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::Plan):
(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::notifyCompiling):
(JSC::DFG::Plan::notifyCompiled):
(JSC::DFG::Plan::notifyReady):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::isKnownToBeLiveDuringGC):
(JSC::DFG::Plan::cancel):
(JSC::DFG::Plan::visitChildren): Deleted.
* dfg/DFGPlan.h:
* dfg/DFGSafepoint.cpp:
(JSC::DFG::Safepoint::Result::~Result):
(JSC::DFG::Safepoint::Result::didGetCancelled):
(JSC::DFG::Safepoint::Safepoint):
(JSC::DFG::Safepoint::~Safepoint):
(JSC::DFG::Safepoint::checkLivenessAndVisitChildren):
(JSC::DFG::Safepoint::isKnownToBeLiveDuringGC):
(JSC::DFG::Safepoint::cancel):
(JSC::DFG::Safepoint::visitChildren): Deleted.
* dfg/DFGSafepoint.h:
(JSC::DFG::Safepoint::Result::Result):
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::compilationState):
(JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
(JSC::DFG::Worklist::removeAllReadyPlansForVM):
(JSC::DFG::Worklist::completeAllReadyPlansForVM):
(JSC::DFG::Worklist::visitWeakReferences):
(JSC::DFG::Worklist::removeDeadPlans):
(JSC::DFG::Worklist::runThread):
(JSC::DFG::Worklist::visitChildren): Deleted.
* dfg/DFGWorklist.h:
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* ftl/FTLCompile.h:
* heap/CodeBlockSet.cpp:
(JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
* heap/Heap.cpp:
(JSC::Heap::markRoots):
(JSC::Heap::visitCompilerWorklistWeakReferences):
(JSC::Heap::removeDeadCompilerWorklistEntries):
(JSC::Heap::visitWeakHandles):
(JSC::Heap::collect):
(JSC::Heap::visitCompilerWorklists): Deleted.
* heap/Heap.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167897 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Hide service controls for selection behind a runtime switch
<rdar://problem/16736616> and https://bugs.webkit.org/show_bug.cgi?id=132291

Reviewed by Tim Horton.

* Shared/WebPreferencesStore.h:

* WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::selectionRectsDidChange): Do nothing if the UI is disabled.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::WebPage):
(WebKit::WebPage::updatePreferences):

* WebProcess/WebPage/WebPage.h:
(WebKit::WebPage::serviceControlsEnabled):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167896 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r167871.
https://bugs.webkit.org/show_bug.cgi?id=132290

broke a newmulticol test (spanner-nested-dynamic) (Requested
by thorton on #webkit).

Reverted changeset:

"Store the containing region map inside the flow thread"
https://bugs.webkit.org/show_bug.cgi?id=131647
http://trac.webkit.org/changeset/167871

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r167853.
https://bugs.webkit.org/show_bug.cgi?id=132288

caused crashes+timeouts+layout test failures described in the
bug (Requested by thorton on #webkit).

Reverted changeset:

"Coalesce responses on network process side"
https://bugs.webkit.org/show_bug.cgi?id=132229
http://trac.webkit.org/changeset/167853

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167894 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix the iOS buld.

* UIProcess/WebPageProxy.cpp:
(WebKit::areAllTouchPointsReleased):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167893 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS WK2] Make subview rebuilding more incremental
https://bugs.webkit.org/show_bug.cgi?id=132162
<rdar://problem/16718916>

Reviewed by Sam Weinig.

Previously we did bulk replacement of subviews, but that triggers
UIKit to send spurious will/DidMoveToWindow messages, which can
interfere with UIScrollView scrolling.

Make _web_setSubviews more incremental, only removing
deleted subviews, adding new ones, and moving existing ones
into the correct order.

* Shared/mac/RemoteLayerTreePropertyApplier.mm:
(-[UIView _web_setSubviews:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167892 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS WK2] flickery scrolling with overflow-scrolling:touch
https://bugs.webkit.org/show_bug.cgi?id=132150

Source/WebCore:

Reviewed by Tim Horton.

Fix typo in a comment.

* page/scrolling/AsyncScrollingCoordinator.cpp:
(WebCore::AsyncScrollingCoordinator::scheduleUpdateScrollPositionAfterAsyncScroll):

Source/WebKit2:
<rdar://problem/16683006>

Reviewed by Tim Horton.

Maintain a flag that tells us if the user is interacting
with the UIScrollView, and while set, don't clobber the contentOffset
via scrolling tree updates.

* UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.mm:
(-[WKOverflowScrollViewDelegate initWithScrollingTreeNode:WebKit::]):
(-[WKOverflowScrollViewDelegate scrollViewWillBeginDragging:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDragging:willDecelerate:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDecelerating:]): We need this one,
not scrollViewDidEndScrollingAnimation:, to detect the end of decleration.
(WebKit::ScrollingTreeOverflowScrollingNodeIOS::updateAfterChildren):
(-[WKOverflowScrollViewDelegate scrollViewDidEndScrollingAnimation:]): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167891 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[X11] Add missing case for mime type application/x-webkit-test-netscape
https://bugs.webkit.org/show_bug.cgi?id=132278

Patch by Krzysztof Wolanski <k.wolanski@samsung.com> on 2014-04-28
Reviewed by Darin Adler.

Case for x-webkit-test-netscape has been omitted along with r167759.

* WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
(WebKit::NetscapePlugin::initialize):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167890 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Deleting properties poisons objects
https://bugs.webkit.org/show_bug.cgi?id=131551

Reviewed by Oliver Hunt.

Source/JavaScriptCore:
This is ~3% progression on Dromaeo with a ~6% progression on the jslib portion of Dromaeo in particular.

* runtime/JSPropertyNameIterator.cpp:
(JSC::JSPropertyNameIterator::create):
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::hasDeletedOffset):
(JSC::PropertyTable::hadDeletedOffset): If we ever had deleted properties we can no longer cache offsets when
iterating properties because we're required to iterate properties in insertion order.
* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap): We now re-use deleted properties when materializing the property map.
(JSC::Structure::removePropertyTransition): We allow up to 5 deletes for a particular path through the tree of
Structure transitions. After that, we convert to an uncacheable dictionary like we used to. We don't cache
delete transitions, but we allow transitioning from them.
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::removePropertyWithoutTransition):
(JSC::Structure::pin): Now does only what it says it does--marks the property table as pinned.
(JSC::Structure::pinAndPreventTransitions): More descriptive version of what the old pin() was doing.
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::setEnumerationCache):
(JSC::Structure::hadDeletedOffsets):
(JSC::Structure::propertyTable):
(JSC::Structure::checkOffsetConsistency): Rearranged variables to be more sensible.
* tests/stress/for-in-after-delete.js: Added.
(foo):

LayoutTests:
New JS regress test. We're ~3.5x faster on this microbenchmark now.

* js/regress/delete-a-few-properties-then-get-by-id-expected.txt: Added.
* js/regress/delete-a-few-properties-then-get-by-id.html: Added.
* js/regress/script-tests/delete-a-few-properties-then-get-by-id.js: Added.
(MyObject):
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167889 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed GTK gardening.

* platform/gtk/TestExpectations: Flagged some tests.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167888 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Builtin cursors do not properly handle transparency
https://bugs.webkit.org/show_bug.cgi?id=131866

Reviewed by Gustavo Noronha Silva.

Tested by ManualTests/cursor.html.

* platform/gtk/CursorGtk.cpp:
(WebCore::createNamedCursor): Instead of interpreting the source bitmap as an A1 image, use
it as a 1-bit black and white image. We do this by:
    1. Painting the result to a full color image with transparency instead of an alpha-only surface.
    2. Masking a white background using the cursor alpha surface.
    3. Painting the black parts of the cursor by painting the source surface, where black pixels
    will be interpreted as full opaque pixels.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167887 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed GTK gardening.

* platform/gtk/TestExpectations: Flagged some tests.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167886 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WK2][X11] NetscapePluginModule::scanPlugin() should write UTF-8 strings to stdout
https://bugs.webkit.org/show_bug.cgi?id=132245

Reviewed by Carlos Garcia Campos.

NetscapePluginModule::scanPlugin(), in the helper writeLine function, takes each character
of the given string and writes it out as a UChar, doing two fputc calls for each byte of the
16-bit type.

This fails badly with characters with integer value less than 256 as the most significant byte
of the UChar is written out as a null character. This effectively chops the output that's gathered
in the UIProcess and is parsed in PluginProcessProxy::scanPlugin().

To avoid all this, the UTF-8 encoding of the string is written out in the PluginProcess, and
String::fromUTF8() is called in the UIProcess to properly decode the received string.

* Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp:
(WebKit::writeCharacter):
(WebKit::writeLine):
(WebKit::writeByte): Deleted.
* UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:
(WebKit::PluginProcessProxy::scanPlugin):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167885 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK][WK2] Missing return statement in webkit_plugin_get_description()
https://bugs.webkit.org/show_bug.cgi?id=132263

Reviewed by Carlos Garcia Campos.

* UIProcess/API/gtk/WebKitPlugin.cpp:
(webkit_plugin_get_description): Actually return the data of the cached
plugin description CString.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167884 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Crash in debug build with removing windowed plugin child widgets from the view
https://bugs.webkit.org/show_bug.cgi?id=132252

Reviewed by Philippe Normand.

It crashes due to an assert in HashTable that checks the iterators
validity. The problem is that we are iterating the children map
and the callback called on every iteration might modify the map,
making the iterators invalid. This happens when the WebView is
destroyed, GtkContainer calls gtk_container_foreach() with
gtk_widget_destroy as callback. When a widget inside a container
is destroyed, it's removed from the container, and in our case,
the child widget is removed from the map. This fixes several
crashes when running layout tests in debug bot.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseContainerForall): Use copyKeysToVector() instead
of using a range iterator for the map keys and check in every
iteration that the child widget from the keys vector is still
present in the map before calling the callback.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167883 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed GTK gardening. Adding failure expectations for 6
failing and flaky tests. Removed 1.

* platform/gtk/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167882 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Review media bugs flags
https://bugs.webkit.org/show_bug.cgi?id=132246

Reviewed by Philippe Normand.

* platform/gtk/TestExpectations: Review flags of the GTK media
bugs.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167881 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. Update GObject DOM bindings symbols file.

* bindings/gobject/webkitdom.symbols: Add missing symbols.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167880 268f45cc-cd09-0410-ab3c-d52691b4dbfc

OrderIterator refactoring to avoid extra loops
https://bugs.webkit.org/show_bug.cgi?id=119061

Reviewed by Darin Adler.

This patch removes order values Vector and use a Vector of pairs instead. The pairs are formed by a child
(RenderBox) and the index of this child. In addition, OrderIterator code is simplified.

It provides a helper class OrderIteratorPopulator, used for manipulating the Vector directly. Which allows to
consolidate the code into a single implementation across flexbox and grid. OrderIteratorPopulator part is based
on a patch from Blink r153971 by <jchaffraix@chromium.org>.

Current implementation is O(number of children * number of order values). Now it will just do a sort operation
and then a regular loop. So if you have different order values in a flexbox or grid the performance will
improve.

Comparing results of perf-tests:
* Layout/auto-grid-lots-of-data: ~0.5% worse.
* Layout/fixed-grid-lots-of-data: ~0.5% worse.
* Layout/fixed-grid-lots-of-data (setting 100 different order values): ~50% better.
* Layout/flexbox-lots-of-data: ~5% better.

No new tests, already covered by current tests.

* rendering/OrderIterator.cpp:
(WebCore::OrderIterator::currentChild): Return current child according to m_childrenIndex.
(WebCore::OrderIterator::first): Initialize m_childrenIndex and return current child.
(WebCore::OrderIterator::next): Increase m_childrenIndex and return current child.
(WebCore::compareByOrderValueAndIndex): Sorts the Vector by order value and index.
(WebCore::OrderIteratorPopulator::~OrderIteratorPopulator): Calls compareByOrderValueAndIndex() if there is any
child with non default order value.
(WebCore::OrderIteratorPopulator::collectChild): Adds the child and index to the Vector. Update
m_allChildrenHaveDefaultOrderValue accordingly.
(WebCore::OrderIterator::OrderIterator): Deleted.
(WebCore::OrderIterator::setOrderValues): Deleted.
(WebCore::OrderIterator::reset): Deleted.
* rendering/OrderIterator.h:
(WebCore::OrderIteratorPopulator::OrderIteratorPopulator): New helper class to manipulate the Vector.
(WebCore::OrderIterator::currentChild): Deleted.
* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::RenderFlexibleBox): Remove OrderIterator intialization.
(WebCore::RenderFlexibleBox::layoutBlock): Remove unneeded code related to old OrderValues vector.
(WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins): Populate OrderIterator using collectChild().
(WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Deleted.
* rendering/RenderFlexibleBox.h: Rename computeMainAxisPreferredSizes() to prepareOrderIteratorAndMargins().
* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::RenderGrid): Remove OrderIterator initialization.
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator): Populate OrderIterator using collectChild().

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167879 268f45cc-cd09-0410-ab3c-d52691b4dbfc

std::bitset<>::test() does unnecessary bounds checks on CSSPropertyID bitsets
https://bugs.webkit.org/show_bug.cgi?id=131685

Patch by Zan Dobersek <zdobersek@igalia.com> on 2014-04-28
Reviewed by Darin Adler.

Use std::bitset<>::operator[]() instead of std::bitset<>::test() to avoid
bounds checks which are not necessary as long as a CSSPropertyID value is used.

* css/CSSParser.cpp:
(WebCore::filterProperties):
* css/StyleProperties.cpp:
(WebCore::StyleProperties::asText):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::CascadedProperties::hasProperty):
(WebCore::StyleResolver::CascadedProperties::set):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167878 268f45cc-cd09-0410-ab3c-d52691b4dbfc

std::bitset<>::test() does unnecessary bounds checks on CSSPropertyID bitsets
https://bugs.webkit.org/show_bug.cgi?id=131685

Reviewed by Darin Adler.

Use std::bitset<>::operator[]() instead of std::bitset<>::test() to avoid
bounds checks which are not necessary as long as a CSSPropertyID value is used.

* css/CSSParser.cpp:
(WebCore::filterProperties):
* css/StyleProperties.cpp:
(WebCore::StyleProperties::asText):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::CascadedProperties::hasProperty):
(WebCore::StyleResolver::CascadedProperties::set):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167877 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] TextTrack kind and mode attributes are enums since r166180
https://bugs.webkit.org/show_bug.cgi?id=132228

Reviewed by Martin Robinson.

We don't support enum values yet in GObject DOM bindings, but they
are internally strings anyway, so we can keep the old
implementations using strings as custom functions until we
properly support enums.

* bindings/gobject/WebKitDOMCustom.cpp:
(webkit_dom_text_track_get_kind):
(webkit_dom_text_track_get_mode):
(webkit_dom_text_track_set_mode):
* bindings/gobject/WebKitDOMCustom.h:
* bindings/gobject/WebKitDOMCustom.symbols:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167876 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] TextTrack::addCue can raise an exception since r163974
https://bugs.webkit.org/show_bug.cgi?id=132227

Reviewed by Martin Robinson.

webkit_dom_text_track_add_cue() now receives a GError paramater
which is an API break. Add
webkit_dom_text_track_add_cue_with_error and keep
webkit_dom_text_track_add_cue as deprecated to keep API
compatibility.

* bindings/gobject/WebKitDOMDeprecated.cpp:
(webkit_dom_text_track_add_cue):
* bindings/gobject/WebKitDOMDeprecated.h:
* bindings/gobject/WebKitDOMDeprecated.symbols:
* bindings/gobject/webkitdom.symbols:
* bindings/scripts/CodeGeneratorGObject.pm:
(GetEffectiveFunctionName):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167875 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] TextTrackCue API changed in r163649
https://bugs.webkit.org/show_bug.cgi?id=132226

Reviewed by Martin Robinson.

TextTrackCue is now a base class and part of its API was moved to
the derived class VTTCue. Update the GObject DOM bindings to keep
backwards compatibility.

* PlatformGTK.cmake: Generate bindings for DataCue and VTTCue.
* bindings/gobject/WebKitDOMDeprecated.cpp:
(webkit_dom_text_track_cue_get_cue_as_html): Mark as deprecated in
favor of VTTCue API.
(webkit_dom_text_track_cue_get_vertical): Ditto.
(webkit_dom_text_track_cue_set_vertical): Ditto.
(webkit_dom_text_track_cue_get_snap_to_lines): Ditto.
(webkit_dom_text_track_cue_set_snap_to_lines): Ditto.
(webkit_dom_text_track_cue_get_line): Ditto.
(webkit_dom_text_track_cue_set_line): Ditto.
(webkit_dom_text_track_cue_get_position): Ditto.
(webkit_dom_text_track_cue_set_position): Ditto.
(webkit_dom_text_track_cue_get_size): Ditto.
(webkit_dom_text_track_cue_set_size): Ditto.
(webkit_dom_text_track_cue_get_align): Ditto.
(webkit_dom_text_track_cue_set_align): Ditto.
(webkit_dom_text_track_cue_get_text): Ditto.
(webkit_dom_text_track_cue_set_text): Ditto.
* bindings/gobject/WebKitDOMDeprecated.h:
* bindings/gobject/WebKitDOMDeprecated.symbols: Add new deprecated symbols.
* bindings/gobject/WebKitDOMPrivate.cpp:
(WebKit::wrap): Add generic wrap for TextTrackCue now that it's a
base class to generate DataCue or VTTCue objects.
* bindings/gobject/WebKitDOMPrivate.h:
* bindings/gobject/webkitdom.symbols: Add DataCue symbols.
* bindings/scripts/CodeGeneratorGObject.pm:
(IsPolymorphic): Add TextTrackCue to the list of polymorphic classes.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167874 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] GObject introspection links to installed libs when using jhbuild
https://bugs.webkit.org/show_bug.cgi?id=132220

Reviewed by Martin Robinson.

The problem is that gobject-introspection is linking the temporary
binaries adding the library paths present LDFLAGS environment
variable first, taking precedence over the libraries in the build
dir. Since the libraries paths of the dependencies are already
correctly deduced by gobject-introspection using ldd, we can
just unset the LDFLAGS variable before calling g-ir-scanner to
make sure the libraries in the build dir take predence.

* PlatformGTK.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167873 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL] Remove indexedDB's dependency on leveldb and disable indexedDB
https://bugs.webkit.org/show_bug.cgi?id=132176

Patch by Joonghun Park <jh718.park@samsung.com> on 2014-04-27
Reviewed by Gyuyoung Kim.

.:
EFL port will use sqlite to support indexedDB. So, this patch removes levelDB dependency for now.

* Source/cmake/OptionsEfl.cmake:

Tools:
EFL port will use sqlite to support indexedDB. So, this patch removes levelDB dependency
and turn off indexedDB feature until the sqlite implementation is introduced.

* Scripts/webkitperl/FeatureList.pm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167872 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Store the containing region map inside the flow thread
https://bugs.webkit.org/show_bug.cgi?id=131647

Reviewed by Mihnea Ovidenie.

Source/WebCore:
The patch moves the containing region map inside the flow thread where
it can be better handled in case the region chain changes and the map
needs to be cleared.

As a result of this move we are able to also cleanup the lines region
information of a block flow when it is removed from the tree.

Test: fast/regions/inline-strike-through.html

* rendering/InlineFlowBox.h:
(WebCore::InlineFlowBox::InlineFlowBox):
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::addOverflowFromInlineChildren):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::removeFlowChildInfo):
(WebCore::RenderFlowThread::invalidateRegions):
(WebCore::RenderFlowThread::removeLineRegionInfo):
(WebCore::RenderFlowThread::checkLinesConsistency):
(WebCore::RenderFlowThread::containingRegionMap):
* rendering/RenderFlowThread.h:
* rendering/RootInlineBox.cpp:
(WebCore::containingRegionMap):
(WebCore::RootInlineBox::~RootInlineBox):
(WebCore::RootInlineBox::paint):
(WebCore::RootInlineBox::containingRegion):
(WebCore::RootInlineBox::clearContainingRegion):
(WebCore::RootInlineBox::setContainingRegion):

LayoutTests:
Add a test that verifies the containing region map is properly cleared
when the region chain changes.

* fast/regions/inline-strike-through-expected.txt: Added.
* fast/regions/inline-strike-through.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167871 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r159345): The hover state for links in the top navigation of Yahoo.com doesn't work
https://bugs.webkit.org/show_bug.cgi?id=132241
rdar://problem/16501924

Reviewed by Andreas Kling.

Source/WebCore:
Test: fast/text/simple-lines-hover-underline.html

Checked that this does not hurt performance by running the
run-perf-tests PerformanceTests/Layout/line-layout.html command before and after.

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::hitTestInlineChildren): Use simpleLineLayout function rather than
getting at the data member directly.
(WebCore::RenderBlockFlow::firstLineBaseline): Ditto.
(WebCore::RenderBlockFlow::inlineBlockBaseline): Ditto.
(WebCore::RenderBlockFlow::lineCount): Ditto.
(WebCore::RenderBlockFlow::paintInlineChildren): Ditto.
(WebCore::RenderBlockFlow::hasLines): Ditto.
(WebCore::RenderBlockFlow::simpleLineLayout): Added logic to determine which path to use if
m_lineLayoutPath is undetermined, and call createLineBoxes if it's not simple.
(WebCore::RenderBlockFlow::ensureLineBoxes): Factored out most of the code into a new
createLineBoxes function.
(WebCore::RenderBlockFlow::createLineBoxes): Ditto.

* rendering/RenderBlockFlow.h: Made simpleLineLayout function no longer an inline.
Added a private createLineBoxes function.

LayoutTests:
* fast/text/simple-lines-hover-underline-expected.html: Added.
* fast/text/simple-lines-hover-underline.html: Added.

* fast/text/simple-lines-hover.html: Removed an unneeded style element with a style rule that
does nothing.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167870 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r164702): Double tap doesn't stay under the new element once the animation finishes
https://bugs.webkit.org/show_bug.cgi?id=132239
<rdar://problem/16192842>

Reviewed by Darin Adler.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::scalePage):
The change in r167864 broke iOS animated resize, because it was depending on
the dynamic size update code not running if the scale wasn't going to change.
So, as a band-aid we should bail from doing that work if the scales aren't different.
In the long term we should try to untangle this code and make it less platform dependent.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167869 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[MediaStream] .ended shouldn't be part of MediaStream IDL
https://bugs.webkit.org/show_bug.cgi?id=132104

Patch by Praveen R Jadhav <praveen.j@samsung.com> on 2014-04-27
Reviewed by Eric Carlson.

Source/WebCore:
.ended attribute is spec'ed out of MediaStream IDL. Instead, .active
is introduced to handle more scenarios. This patch replaces all 'ended'
attribute calls with corresponding 'active' attributes.

MediaStream-add-remove-tracks.html is updated.

* Modules/mediastream/MediaStream.cpp:
(WebCore::MediaStream::addTrack): Replaced ended() with active().
(WebCore::MediaStream::removeTrack): setEnded() isn't called. setActive()
is retained which propagates oninactive event.
(WebCore::MediaStream::trackDidEnd): setEnded() isn't called.
(WebCore::MediaStream::removeRemoteSource): Replaced ended() with active().
(WebCore::MediaStream::addRemoteTrack): Replaced ended() with active().
(WebCore::MediaStream::removeRemoteTrack): Replaced ended() with active().
(WebCore::MediaStream::ended): Deleted.
(WebCore::MediaStream::setEnded): Deleted.
(WebCore::MediaStream::streamDidEnd): Deleted.
* Modules/mediastream/MediaStream.h:
* Modules/mediastream/MediaStream.idl:
* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::didRemoveRemoteStream): Replaced setEnded()
with setActive().
* platform/mediastream/MediaStreamPrivate.cpp:
(WebCore::MediaStreamPrivate::MediaStreamPrivate):
(WebCore::MediaStreamPrivate::setActive): Updated comment from bug
https://bugs.webkit.org/show_bug.cgi?id=131973
(WebCore::MediaStreamPrivate::setEnded): Deleted.
* platform/mediastream/MediaStreamPrivate.h:
(WebCore::MediaStreamPrivate::ended): Deleted.

LayoutTests:
.ended is not part of MediaStream IDL. Updated test case.

* fast/mediastream/MediaStream-add-remove-tracks-expected.txt:
* fast/mediastream/MediaStream-add-remove-tracks.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167868 268f45cc-cd09-0410-ab3c-d52691b4dbfc

TouchEvent is not handled after releasing any point among touched points.
https://bugs.webkit.org/show_bug.cgi?id=132043

Reviewed by Benjamin Poulain.

Handle TouchEvent until all touched points are released by setting
trackingTouchEvents variable to false when all points are released.

* UIProcess/WebPageProxy.cpp:
(WebKit::areAllTouchPointsReleased):
(WebKit::WebPageProxy::handleTouchEventSynchronously):
(WebKit::WebPageProxy::handleTouchEventAsynchronously):
(WebKit::WebPageProxy::handleTouchEvent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167867 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Don't use DispatchMessageEvenWhenWaitingForSyncReply for messages from NetworkProcess
https://bugs.webkit.org/show_bug.cgi?id=132144

Reviewed by Darin Adler.

* NetworkProcess/AsynchronousNetworkLoaderClient.cpp:
(WebKit::AsynchronousNetworkLoaderClient::willSendRequest):
(WebKit::AsynchronousNetworkLoaderClient::canAuthenticateAgainstProtectionSpace):
Dont use the IPC::DispatchMessageEvenWhenWaitingForSyncReply flag. It's not needed,
almost never works in NetworkProcess, but may cause trouble if it did.

* NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::NetworkConnectionToWebProcess): Removed
setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage()
function call, because there are no more any messages in NetworkProcess it could affect.

* Platform/IPC/Connection.cpp: (IPC::Connection::dispatchMessage): Added a FIXME
for an unrelated bug Anders and myself noticed while looking into this.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167866 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Cocoa] -[WKWebProcessPlugInController parameters] returns nil if no parameters have been set yet
https://bugs.webkit.org/show_bug.cgi?id=132223

Reviewed by Sam Weinig.

* WebProcess/InjectedBundle/mac/InjectedBundleMac.mm:
(WebKit::InjectedBundle::bundleParameters): Create the WKWebProcessBundleParameters if
needed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167865 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r164702): Double tap doesn't stay under the new element once the animation finishes
https://bugs.webkit.org/show_bug.cgi?id=132239
<rdar://problem/16192842>

Reviewed by Sam Weinig.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::scalePage):
The early-return added to WebPage::scalePage breaks callers who depend
on being able to call scalePage() with the same scale but a different
origin and having that change take effect.

Page::setPageScaleFactor already has the requisite logic, so move
the early return down after that call, and guard only notification
of page scale changes.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167864 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] Stop creating a WKWebResourceQuickLookDelegate for every WebResourceLoader
https://bugs.webkit.org/show_bug.cgi?id=132215

Reviewed by Dan Bernstein.

Source/WebCore:
* WebCore.exp.in: Moved QuickLook symbols to the USE(QUICK_LOOK) stanza.
* platform/network/ios/QuickLook.h: Changed one of the create() overloads to no longer take a delegate argument.
* platform/network/ios/QuickLook.mm: Moved WKWebResourceQuickLookDelegate to here and renamed to WebResourceLoaderQuickLookDelegate.
(WebCore::QuickLookHandle::create): Created a WebResourceLoaderQuickLookDelegate only if QuickLook can handle the response.

Source/WebKit2:
* WebKit2.xcodeproj/project.pbxproj:
* WebProcess/Network/WebResourceLoader.cpp:
(WebKit::WebResourceLoader::didReceiveResponseWithCertificateInfo): Called QuickLookHandle::create() directly.
* WebProcess/Network/WebResourceLoader.h:
* WebProcess/ios/WebResourceLoaderIOS.mm: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167863 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (167840): Layout Test fast/events/shadow-event-path[-2].html is failing

* TestExpectations:
Mark as failing until the shared JS file can be recovered.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167862 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS WebKit2] Add support for text autosizing
<rdar://problem/16545245>
https://bugs.webkit.org/show_bug.cgi?id=132237

Reviewed by Tim Horton.

../WebCore:
Move text autosizing width from Frame to Page, as it is a Page level concept.

* WebCore.exp.in:
* page/Frame.cpp:
(WebCore::Frame::textAutosizingWidth): Deleted.
(WebCore::Frame::setTextAutosizingWidth): Deleted.
* page/Frame.h:
* page/FrameView.cpp:
(WebCore::FrameView::layout):
* page/Page.cpp:
(WebCore::Page::Page):
* page/Page.h:
(WebCore::Page::textAutosizingWidth):
(WebCore::Page::setTextAutosizingWidth):

../WebKit/mac:
* WebView/WebFrame.mm:
(-[WebFrame _setTextAutosizingWidth:]):
Forward setting of the text autosizing width to the Page.

../WebKit2:
* Shared/WebPageCreationParameters.cpp:
(WebKit::WebPageCreationParameters::encode):
(WebKit::WebPageCreationParameters::decode):
* Shared/WebPageCreationParameters.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::creationParameters):
* UIProcess/WebPageProxy.h:
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::textAutosizingWidth):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::WebPage):
Pass the text autosizing width from the UIProcess to WebProcess.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167861 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebKit2 View Gestures (Zoom): Pages with 'background-attachment: fixed' don't behave correctly when zoomed
https://bugs.webkit.org/show_bug.cgi?id=132225
<rdar://problem/15729975>

Reviewed by Darin Adler.

* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
(WebKit::TiledCoreAnimationDrawingArea::layerForTransientZoom):
(WebKit::TiledCoreAnimationDrawingArea::shadowLayerForTransientZoom):
(WebKit::TiledCoreAnimationDrawingArea::adjustTransientZoom):
(WebKit::TiledCoreAnimationDrawingArea::commitTransientZoom):
(WebKit::TiledCoreAnimationDrawingArea::applyTransientZoomToPage):
Factor out code to choose which layer (and shadow layer) to apply the transient zoom to.
If we have a contentsContainmentLayer (because we have composited background-attachment: fixed),
it applies page scale, so we should apply the transient zoom to that layer
instead of the RenderView's main GraphicsLayer.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167860 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. iOS build fix.

* UIProcess/ios/SmartMagnificationController.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167859 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed GTK gardening. Adding failure expectations for 6 failing reference tests.

* platform/gtk/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167858 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. Updating one bindings test baseline after r167855.

* bindings/scripts/test/JS/JSTestCallback.cpp:
(WebCore::JSTestCallback::~JSTestCallback):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167857 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Webpages can trigger loads with invalid URLs
https://bugs.webkit.org/show_bug.cgi?id=132224
rdar://problem/16697142

Reviewed by Alexey Proskuryakov.

Invalid URLs can be a way to trick the user about what website they
are looking at.  Still trying to figure out a good way to regression-test this.

* dom/Document.cpp:
(WebCore::Document::processHttpEquiv): Pass a URL rather than a String to
the navigation scheduler.
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::receivedFirstData): Ditto.

* loader/NavigationScheduler.cpp:
(WebCore::ScheduledURLNavigation::ScheduledURLNavigation): Take a URL rather
than a string.
(WebCore::ScheduledURLNavigation::url): Ditto.
(WebCore::ScheduledRedirect::ScheduledRedirect): Ditto.
(WebCore::ScheduledLocationChange::ScheduledLocationChange): Ditto.
(WebCore::ScheduledRefresh::ScheduledRefresh): Ditto.
(WebCore::NavigationScheduler::shouldScheduleNavigation): Added a check that
prevents navigation to any URL that is invalid, except for JavaScript URLs,
which need not be valid.
(WebCore::NavigationScheduler::scheduleRedirect): Use URL instead of String.
(WebCore::NavigationScheduler::scheduleLocationChange): Use URL instead of
String. Also got rid of empty string check since empty URLs are also invalid,
and so shouldScheduleNavigation will take care of it.
(WebCore::NavigationScheduler::scheduleRefresh): Use URL instead of String.

* loader/NavigationScheduler.h: Take URL instead of String. Also removed some
unneeded incldues and uses of WTF_MAKE_NONCOPYABLE. NavigationScheduler is
already noncopyable because it has a reference for a data member, and the
disabler doesn't have any real reason to be noncopyable.

* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::loadOrRedirectSubframe): Pass a URL rather than a
String to the NavigationScheduler.
* page/DOMWindow.cpp:
(WebCore::DOMWindow::createWindow): Ditto.

* page/SecurityOrigin.cpp:
(WebCore::SecurityOrigin::urlWithUniqueSecurityOrigin): Return a URL instead
of a String.
* page/SecurityOrigin.h: Updated for above change.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167856 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ScriptExecutionContext::Task should work well with C++11 lambdas
https://bugs.webkit.org/show_bug.cgi?id=129795

Reviewed by Darin Adler.

Instead of having classes that subclass ScriptExecutionContext::Task and override
the performTask(ScriptExecutionContext*) method, have the ScriptExecutionContext::Task
take in a std::function<void (ScriptExecutionContext*)>-like object trough the constructor
which would contain the code currently kept in the performTask() methods.

This enables inlining C++11 lambdas into ScriptExecutionContext::postTask() calls. For
cleanup tasks, the Task object can be implicitly constructed by using the initializer list
constructor with the first argument being the ScriptExecutionContext::Task::CleanupTask tag.
The ScriptExecutionContext class remains non-copyable and now stores the passed-in invokable
object in the std::function wrapper, along with a boolean member that indicates whether the
task is of cleanup nature.

* Modules/quota/StorageErrorCallback.cpp:
(WebCore::StorageErrorCallback::CallbackTask::CallbackTask):
(WebCore::StorageErrorCallback::CallbackTask::performTask): Deleted.
* Modules/quota/StorageErrorCallback.h:
(WebCore::StorageErrorCallback::CallbackTask::create): Deleted.
* Modules/webdatabase/Database.cpp:
(WebCore::Database::~Database):
(WebCore::Database::runTransaction):
(WebCore::Database::scheduleTransactionCallback):
(WebCore::DerefContextTask::create): Deleted.
(WebCore::DerefContextTask::performTask): Deleted.
(WebCore::DerefContextTask::isCleanupTask): Deleted.
(WebCore::DerefContextTask::DerefContextTask): Deleted.
(WebCore::callTransactionErrorCallback): Deleted.
(WebCore::DeliverPendingCallbackTask::create): Deleted.
(WebCore::DeliverPendingCallbackTask::performTask): Deleted.
(WebCore::DeliverPendingCallbackTask::DeliverPendingCallbackTask): Deleted.
* Modules/webdatabase/DatabaseManager.cpp:
(WebCore::DatabaseManager::openDatabase):
(WebCore::DatabaseCreationCallbackTask::create): Deleted.
(WebCore::DatabaseCreationCallbackTask::performTask): Deleted.
(WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask): Deleted.
* Modules/webdatabase/DatabaseSync.cpp:
(WebCore::CloseSyncDatabaseOnContextThreadTask::create): Deleted.
(WebCore::CloseSyncDatabaseOnContextThreadTask::performTask): Deleted.
(WebCore::CloseSyncDatabaseOnContextThreadTask::CloseSyncDatabaseOnContextThreadTask): Deleted.
* Modules/webdatabase/SQLCallbackWrapper.h:
(WebCore::SQLCallbackWrapper::clear):
(WebCore::SQLCallbackWrapper::SafeReleaseTask::create): Deleted.
(WebCore::SQLCallbackWrapper::SafeReleaseTask::performTask): Deleted.
(WebCore::SQLCallbackWrapper::SafeReleaseTask::isCleanupTask): Deleted.
(WebCore::SQLCallbackWrapper::SafeReleaseTask::SafeReleaseTask): Deleted.
* Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
(WebCore::ThreadableWebSocketChannelClientWrapper::didConnect):
(WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessage):
(WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
(WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
(WebCore::ThreadableWebSocketChannelClientWrapper::didStartClosingHandshake):
(WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
(WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageError):
(WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
* Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
* Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
(WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
(WebCore::WorkerThreadableWebSocketChannel::mainThreadDestroy):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
(WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::create): Deleted.
(WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::~WorkerGlobalScopeDidInitializeTask): Deleted.
(WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::WorkerGlobalScopeDidInitializeTask): Deleted.
* Modules/websockets/WorkerThreadableWebSocketChannel.h:
* bindings/js/JSCallbackData.h:
(WebCore::DeleteCallbackDataTask::DeleteCallbackDataTask):
(WebCore::DeleteCallbackDataTask::create): Deleted.
(WebCore::DeleteCallbackDataTask::performTask): Deleted.
(WebCore::DeleteCallbackDataTask::isCleanupTask): Deleted.
* bindings/js/JSDOMGlobalObjectTask.cpp:
(WebCore::JSGlobalObjectTask::JSGlobalObjectTask):
(WebCore::JSGlobalObjectTask::~JSGlobalObjectTask): Deleted.
(WebCore::JSGlobalObjectTask::performTask): Deleted.
* bindings/js/JSDOMGlobalObjectTask.h:
* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::queueTaskToEventLoop):
* bindings/js/JSWorkerGlobalScopeBase.cpp:
(WebCore::JSWorkerGlobalScopeBase::queueTaskToEventLoop):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateCallbackImplementation):
* dom/CrossThreadTask.h:
(WebCore::CrossThreadTask1::performTask):
(WebCore::CrossThreadTask2::performTask):
(WebCore::CrossThreadTask3::performTask):
(WebCore::CrossThreadTask4::performTask):
(WebCore::CrossThreadTask5::performTask):
(WebCore::CrossThreadTask6::performTask):
(WebCore::CrossThreadTask7::performTask):
(WebCore::CrossThreadTask8::performTask):
(WebCore::createCallbackTask):
(WebCore::CrossThreadTask1::create): Deleted.
(WebCore::CrossThreadTask2::create): Deleted.
(WebCore::CrossThreadTask3::create): Deleted.
(WebCore::CrossThreadTask4::create): Deleted.
(WebCore::CrossThreadTask5::create): Deleted.
(WebCore::CrossThreadTask6::create): Deleted.
(WebCore::CrossThreadTask7::create): Deleted.
(WebCore::CrossThreadTask8::create): Deleted.
* dom/Document.cpp:
(WebCore::Document::addConsoleMessage):
(WebCore::Document::addMessage):
(WebCore::Document::postTask):
(WebCore::Document::pendingTasksTimerFired):
(WebCore::PerformTaskContext::PerformTaskContext): Deleted.
(WebCore::Document::didReceiveTask): Deleted.
* dom/Document.h:
* dom/ScriptExecutionContext.cpp:
(WebCore::ScriptExecutionContext::processMessagePortMessagesSoon):
(WebCore::ScriptExecutionContext::timerAlignmentInterval):
(WebCore::ProcessMessagesSoonTask::create): Deleted.
(WebCore::ScriptExecutionContext::AddConsoleMessageTask::performTask): Deleted.
(WebCore::ScriptExecutionContext::Task::~Task): Deleted.
* dom/ScriptExecutionContext.h:
(WebCore::ScriptExecutionContext::Task::Task):
(WebCore::ScriptExecutionContext::Task::performTask):
(WebCore::ScriptExecutionContext::Task::isCleanupTask):
(WebCore::ScriptExecutionContext::AddConsoleMessageTask::AddConsoleMessageTask):
(WebCore::ScriptExecutionContext::AddConsoleMessageTask::create): Deleted.
* dom/StringCallback.cpp:
(WebCore::StringCallback::scheduleCallback):
* loader/appcache/ApplicationCacheGroup.cpp:
(WebCore::ApplicationCacheGroup::postListenerTask):
(WebCore::CallCacheListenerTask::create): Deleted.
(WebCore::CallCacheListenerTask::CallCacheListenerTask): Deleted.
* workers/DefaultSharedWorkerRepository.cpp:
(WebCore::SharedWorkerProxy::postTaskToLoader):
(WebCore::SharedWorkerProxy::postTaskForModeToWorkerGlobalScope):
(WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
(WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
(WebCore::DefaultSharedWorkerRepository::connectToWorker):
(WebCore::SharedWorkerConnectTask::create): Deleted.
(WebCore::SharedWorkerConnectTask::performTask): Deleted.
* workers/WorkerEventQueue.cpp:
(WebCore::WorkerEventQueue::EventDispatcher::EventDispatcher):
(WebCore::WorkerEventQueue::EventDispatcher::~EventDispatcher):
(WebCore::WorkerEventQueue::EventDispatcher::dispatch):
(WebCore::WorkerEventQueue::enqueueEvent):
(WebCore::WorkerEventQueue::cancelEvent):
(WebCore::WorkerEventQueue::close):
* workers/WorkerEventQueue.h:
* workers/WorkerGlobalScope.cpp:
(WebCore::WorkerGlobalScope::close):
(WebCore::WorkerGlobalScope::postTask):
(WebCore::WorkerGlobalScope::addConsoleMessage):
(WebCore::WorkerGlobalScope::addMessage):
(WebCore::CloseWorkerGlobalScopeTask::create): Deleted.
(WebCore::CloseWorkerGlobalScopeTask::performTask): Deleted.
(WebCore::CloseWorkerGlobalScopeTask::isCleanupTask): Deleted.
* workers/WorkerGlobalScope.h:
* workers/WorkerLoaderProxy.h:
* workers/WorkerMessagingProxy.cpp:
(WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
(WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope):
(WebCore::WorkerMessagingProxy::postTaskForModeToWorkerGlobalScope):
(WebCore::WorkerMessagingProxy::postTaskToLoader):
(WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
(WebCore::WorkerMessagingProxy::workerThreadCreated):
(WebCore::WorkerMessagingProxy::notifyNetworkStateChange):
(WebCore::WorkerMessagingProxy::workerGlobalScopeDestroyed):
(WebCore::WorkerMessagingProxy::workerGlobalScopeClosed):
(WebCore::WorkerMessagingProxy::postMessageToPageInspector):
(WebCore::WorkerMessagingProxy::confirmMessageFromWorkerObject):
(WebCore::WorkerMessagingProxy::reportPendingActivity):
(WebCore::MessageWorkerGlobalScopeTask::create): Deleted.
(WebCore::MessageWorkerGlobalScopeTask::MessageWorkerGlobalScopeTask): Deleted.
(WebCore::MessageWorkerGlobalScopeTask::performTask): Deleted.
(WebCore::MessageWorkerTask::create): Deleted.
(WebCore::MessageWorkerTask::MessageWorkerTask): Deleted.
(WebCore::MessageWorkerTask::performTask): Deleted.
(WebCore::WorkerExceptionTask::create): Deleted.
(WebCore::WorkerExceptionTask::WorkerExceptionTask): Deleted.
(WebCore::WorkerExceptionTask::performTask): Deleted.
(WebCore::WorkerGlobalScopeDestroyedTask::create): Deleted.
(WebCore::WorkerGlobalScopeDestroyedTask::WorkerGlobalScopeDestroyedTask): Deleted.
(WebCore::WorkerGlobalScopeDestroyedTask::performTask): Deleted.
(WebCore::WorkerTerminateTask::create): Deleted.
(WebCore::WorkerTerminateTask::WorkerTerminateTask): Deleted.
(WebCore::WorkerTerminateTask::performTask): Deleted.
(WebCore::WorkerThreadActivityReportTask::create): Deleted.
(WebCore::WorkerThreadActivityReportTask::WorkerThreadActivityReportTask): Deleted.
(WebCore::WorkerThreadActivityReportTask::performTask): Deleted.
(WebCore::PostMessageToPageInspectorTask::create): Deleted.
(WebCore::PostMessageToPageInspectorTask::PostMessageToPageInspectorTask): Deleted.
(WebCore::PostMessageToPageInspectorTask::performTask): Deleted.
(WebCore::NotifyNetworkStateChangeTask::create): Deleted.
(WebCore::NotifyNetworkStateChangeTask::NotifyNetworkStateChangeTask): Deleted.
(WebCore::NotifyNetworkStateChangeTask::performTask): Deleted.
* workers/WorkerMessagingProxy.h:
* workers/WorkerRunLoop.cpp:
(WebCore::WorkerRunLoop::postTask):
(WebCore::WorkerRunLoop::postTaskAndTerminate):
(WebCore::WorkerRunLoop::postTaskForMode):
(WebCore::WorkerRunLoop::Task::create):
(WebCore::WorkerRunLoop::Task::performTask):
(WebCore::WorkerRunLoop::Task::Task):
* workers/WorkerRunLoop.h:
* workers/WorkerThread.cpp:
(WebCore::WorkerThread::stop):
(WebCore::WorkerThread::releaseFastMallocFreeMemoryInAllThreads):
(WebCore::WorkerThreadShutdownFinishTask::create): Deleted.
(WebCore::WorkerThreadShutdownFinishTask::performTask): Deleted.
(WebCore::WorkerThreadShutdownFinishTask::isCleanupTask): Deleted.
(WebCore::WorkerThreadShutdownStartTask::create): Deleted.
(WebCore::WorkerThreadShutdownStartTask::performTask): Deleted.
(WebCore::WorkerThreadShutdownStartTask::isCleanupTask): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167855 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move cross-port WebKit2 code to std::unique_ptr
https://bugs.webkit.org/show_bug.cgi?id=129670

Reviewed by Darin Adler.

Replace uses of OwnPtr, PassOwnPtr in cross-port WebKit2 code with std::unique_ptr.

* DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp:
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::createIndex):
* DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h:
* NetworkProcess/NetworkProcess.h:
(WebKit::NetworkProcess::addSupplement):
* NetworkProcess/SynchronousNetworkLoaderClient.cpp:
(WebKit::SynchronousNetworkLoaderClient::didReceiveBuffer):
* NetworkProcess/SynchronousNetworkLoaderClient.h:
* Platform/IPC/Connection.cpp:
(IPC::Connection::dispatchWorkQueueMessageReceiverMessage):
* Platform/IPC/Connection.h:
* Platform/IPC/MessageReceiver.h:
* Platform/Module.h:
* Platform/WorkQueue.h:
* Platform/efl/ModuleEfl.cpp:
(WebKit::Module::load):
* Platform/mac/LayerHostingContext.mm:
* Shared/APIURL.h:
* Shared/Network/CustomProtocols/CustomProtocolManager.h:
* Shared/Plugins/NPRemoteObjectMap.cpp:
* Shared/ShareableBitmap.h:
* UIProcess/DrawingAreaProxyImpl.h:
* UIProcess/InspectorServer/WebSocketServer.cpp:
(WebKit::WebSocketServer::didAcceptConnection):
(WebKit::WebSocketServer::didCloseWebSocketServerConnection):
* UIProcess/InspectorServer/WebSocketServer.h:
* UIProcess/InspectorServer/soup/WebSocketServerSoup.cpp:
(WebKit::connectionCallback):
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::createDownloadProxy):
* UIProcess/Network/NetworkProcessProxy.h:
* UIProcess/Notifications/WebNotificationManagerProxy.h:
* UIProcess/Plugins/WebPluginSiteDataManager.cpp:
(WebKit::WebPluginSiteDataManager::getSitesWithData):
(WebKit::WebPluginSiteDataManager::clearSiteData):
(WebKit::WebPluginSiteDataManager::didGetSitesWithDataForAllPlugins):
(WebKit::WebPluginSiteDataManager::didClearSiteDataForAllPlugins):
* UIProcess/Plugins/WebPluginSiteDataManager.h:
* UIProcess/Storage/StorageManager.cpp:
(WebKit::callCallbackFunction):
(WebKit::StorageManager::getOriginsInternal):
* UIProcess/WebPageProxy.cpp:
(WebKit::ExceededDatabaseQuotaRecords::areBeingProcessed):
(WebKit::ExceededDatabaseQuotaRecords::createRecord):
(WebKit::ExceededDatabaseQuotaRecords::add):
(WebKit::ExceededDatabaseQuotaRecords::next):
(WebKit::WebPageProxy::handleMouseEvent):
(WebKit::WebPageProxy::handleWheelEvent):
(WebKit::WebPageProxy::processNextQueuedWheelEvent):
(WebKit::WebPageProxy::internalShowContextMenu):
* UIProcess/WebPageProxy.h:
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::createDownloadProxy):
* UIProcess/WebProcessProxy.h:
* WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
(WebKit::PluginDestructionProtector::PluginDestructionProtector):
* WebProcess/Plugins/Netscape/NetscapePluginStream.cpp:
(WebKit::NetscapePluginStream::deliverData):
* WebProcess/Plugins/Netscape/NetscapePluginStream.h:
* WebProcess/Plugins/PluginProcessConnectionManager.h:
* WebProcess/Plugins/PluginProxy.cpp:
(WebKit::PluginProxy::initialize):
(WebKit::PluginProxy::didCreatePluginInternal):
(WebKit::PluginProxy::didFailToCreatePluginInternal):
* WebProcess/Plugins/PluginProxy.h:
* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::createWebEvent):
(WebKit::PluginView::handleEvent):
* WebProcess/Plugins/PluginView.h:
* WebProcess/WebCoreSupport/WebPopupMenu.h:
* WebProcess/WebPage/EventDispatcher.cpp:
(WebKit::EventDispatcher::EventDispatcher):
* WebProcess/WebPage/EventDispatcher.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::WebPage):
(WebKit::WebPage::beginPrinting):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebProcess.h:
(WebKit::WebProcess::addSupplement):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167854 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Coalesce responses on network process side
https://bugs.webkit.org/show_bug.cgi?id=132229

Reviewed by Andreas Kling.

Source/WebCore:

* WebCore.exp.in:

Source/WebKit2:

To reduce IPC we should coalesce response data in the network process and send it over with single IPC call.

* NetworkProcess/AsynchronousNetworkLoaderClient.cpp:
(WebKit::AsynchronousNetworkLoaderClient::AsynchronousNetworkLoaderClient):
(WebKit::AsynchronousNetworkLoaderClient::didReceiveResponse):
(WebKit::AsynchronousNetworkLoaderClient::didReceiveBuffer):
(WebKit::AsynchronousNetworkLoaderClient::didFinishLoading):
(WebKit::AsynchronousNetworkLoaderClient::didFail):
(WebKit::AsynchronousNetworkLoaderClient::dispatchPartialCoalescedResponse):
(WebKit::AsynchronousNetworkLoaderClient::clearCoalescedResponse):
(WebKit::AsynchronousNetworkLoaderClient::responseCoalesceTimerFired):

    Coalesce the response. Completed response is sent on didFinishLoading. If the coalesce timer fires
    before that the data accumulated so far is dispatched.

* NetworkProcess/AsynchronousNetworkLoaderClient.h:
* NetworkProcess/NetworkResourceLoader.h:
* WebProcess/Network/WebResourceLoader.cpp:
(WebKit::WebResourceLoader::didReceiveCompleteResponse):
* WebProcess/Network/WebResourceLoader.h:
* WebProcess/Network/WebResourceLoader.messages.in:

    Add a new message type that covers didReceiveResponse, didReceiveBuffer and didFinishLoading in a single message.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167853 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Roll out changes not part of the patch reviewed for Bug 132089
<http://webkit.org/b/132089>

* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::loadOrRedirectSubframe):
* page/DOMWindow.cpp:
(WebCore::DOMWindow::setLocation):
(WebCore::DOMWindow::createWindow):
(WebCore::DOMWindow::open):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167852 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Frame and page lifetime fixes in WebCore::createWindow
https://bugs.webkit.org/show_bug.cgi?id=132089

Reviewed by Sam Weinig.

Speculative fix because I was unable to reproduce the crash that was
reported with the test case attached to this bug.

* loader/FrameLoader.cpp:
(WebCore::createWindow): Changed code to remove the assumption that calls
out will not destroy the page or frame. Use RefPtr for the frame, and
added early exits if frame->page() becomes null at any point before we
use a page pointer.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167851 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Local files should not be allowed to read pasteboard data during drag
https://bugs.webkit.org/show_bug.cgi?id=131767

Reviewed by Sam Weinig.

Source/WebCore:
Test: fast/files/local-file-drag-security.html

* page/DragController.cpp:
(WebCore::DragController::dragExited):
(WebCore::DragController::tryDHTMLDrag):
Make an old Dashboard quirk really Dashboard only.

LayoutTests:
* fast/files/local-file-drag-security-expected.txt: Added.
* fast/files/local-file-drag-security.html: Added.
* platform/wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167850 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r167775): Safari crashes in ViewSnapshotStore::pruneSnapshots after loading 20 pages
https://bugs.webkit.org/show_bug.cgi?id=132204
<rdar://problem/16735622>

Reviewed by Dan Bernstein and Sam Weinig.

* UIProcess/mac/ViewSnapshotStore.mm:
(WebKit::ViewSnapshotStore::pruneSnapshots):
(WebKit::ViewSnapshotStore::recordSnapshot):
Fix a bug where the count of snapshots with live images was too high
because we were failing to decrement it when replacing a snapshot of
an existing item with a fresh one.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167849 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Cocoa] Rename a bundle form delegate method
https://bugs.webkit.org/show_bug.cgi?id=132221

Reviewed by Adele Peterson.

* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInFormDelegatePrivate.h: Renamed.
* WebProcess/InjectedBundle/API/mac/WKWebProcessPlugInBrowserContextController.mm:
(-[WKWebProcessPlugInBrowserContextController _setFormDelegate:]): Check for the method
under the old (“new”) name and under the new name.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167846 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r164133): Selection doesn't paint when scrolling some pages
https://bugs.webkit.org/show_bug.cgi?id=132172

Source/WebCore:
rdar://problem/16719473

Reviewed by Brent Fulgham.

Tests: fast/dynamic/remove-invisible-node-inside-selection.html
       fast/dynamic/remove-node-inside-selection.html

* editing/FrameSelection.cpp:
(WebCore::clearRenderViewSelection): Changed to take a Node& because having
this take a Position& was unnecessary and strange, when really it just needs
to take a document as an argument.
(WebCore::DragCaretController::nodeWillBeRemoved): Updated for the above.
(WebCore::FrameSelection::respondToNodeModification): Added code to set the
m_pendingSelectionUpdate flag and call RenderView::setNeedsLayout so the
selection will be recomputed after it's temporarily cleared when one of
the selected nodes is removed.

LayoutTests:

Reviewed by Brent Fulgham.

* fast/dynamic/remove-invisible-node-inside-selection-expected.html: Added.
* fast/dynamic/remove-invisible-node-inside-selection.html: Added.
* fast/dynamic/remove-node-inside-selection-expected.html: Added.
* fast/dynamic/remove-node-inside-selection.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167845 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Inline (C++) GetByVal with numeric indices more aggressively.
<https://webkit.org/b/132218>

We were already inlining the string indexed GetByVal path pretty well,
while the path for numeric indices got neglected. No more!

~9.5% improvement on Dromaeo/dom-traverse.html on my MBP:

    Before: 199.50 runs/s
     After: 218.58 runs/s

Reviewed by Phil Pizlo.

* dfg/DFGOperations.cpp:
* runtime/JSCJSValueInlines.h:
(JSC::JSValue::get):

    ALWAYS_INLINE all the things.

* runtime/JSObject.h:
(JSC::JSObject::getPropertySlot):

    Avoid fetching the Structure more than once. We have the same
    optimization in the string-indexed code path.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167842 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Cocoa] Synthesized getter for WKNavigationAction's _userInitiated property has the wrong name
https://bugs.webkit.org/show_bug.cgi?id=132219

Reviewed by Sam Weinig.

* UIProcess/API/Cocoa/WKNavigationActionInternal.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167841 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r167689): Hovering file name in a file input causes a crash
https://bugs.webkit.org/show_bug.cgi?id=132214

Reviewed by Andreas Kling.

Source/WebCore:
The bug was caused by callDefaultEventHandlersInTheBubblingOrder unconditionally
accessing path.contextAt(0) even if the event path was empty.

Fixed the bug by exiting early when the event path is empty.

Test: fast/events/shadow-event-path-2.html

* dom/EventDispatcher.cpp:
(WebCore::callDefaultEventHandlersInTheBubblingOrder):

LayoutTests:
Add a regression test.

* fast/events/shadow-event-path-2-expected.txt: Added.
* fast/events/shadow-event-path-2.html: Added.
* fast/events/shadow-event-path.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167840 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] getAssistedNodeInformation crashes getting the bounding box if it doesn't have a renderer
https://bugs.webkit.org/show_bug.cgi?id=132217
<rdar://problem/16671662>

Patch by Simon Fraser <simon.fraser@apple.com> on 2014-04-25
Reviewed by Dean Jackson.

* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::getAssistedNodeInformation): Check that m_assistedNode has
a renderer before asking for its bounding box.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167839 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Bump jQuery to same version that dromaeo.com uses.

Rubber-stamped by Ryosuke Niwa.

* Dromaeo/resources/dromaeo/web/lib/jquery-1.10.2.min.js: Added.
* Dromaeo/resources/dromaeo/web/tests/cssquery-jquery.html:
* Dromaeo/resources/dromaeo/web/tests/jslib-attr-jquery.html:
* Dromaeo/resources/dromaeo/web/tests/jslib-event-jquery.html:
* Dromaeo/resources/dromaeo/web/tests/jslib-modify-jquery.html:
* Dromaeo/resources/dromaeo/web/tests/jslib-style-jquery.html:
* Dromaeo/resources/dromaeo/web/tests/jslib-traverse-jquery.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167838 268f45cc-cd09-0410-ab3c-d52691b4dbfc