[WebKit-https.git] / Source / WebCore / ChangeLog

2014-07-31  Bear Travis  <betravis@adobe.com>

        [CSS Font Loading] Rename document.fontloader to document.fonts
        https://bugs.webkit.org/show_bug.cgi?id=135393

        Reviewed by Bem Jones-Bey.

        The most recent version of the specification has renamed
        document.fontloader to document.fonts. This change updates the
        names in WebCore and LayoutTests.

        Fixed up existing tests under LayoutTests/fast/css/fontloader-*
        and LayoutTests/http/webfont/fontloader-*

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::notifyFontLoader):
        (WebCore::CSSFontFace::notifyLoadingDone):
        * dom/Document.cpp:
        (WebCore::Document::fonts):
        (WebCore::Document::fontloader): Deleted.
        * dom/Document.h:
        * dom/Document.idl:
        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2014-07-31  Andrei Bucur  <abucur@adobe.com>

        REGRESSION: Search highlight is broken in RTL multicolumn content
        https://bugs.webkit.org/show_bug.cgi?id=135452

        Reviewed by Simon Fraser.

        The offsets for elements inside RTL multi-column elements are incorrectly computed because
        the columns don't calculate their left position according to the writing direction.

        The patch extracts the column position computation in two helper functions (for top and left)
        so they can be used when needed in different parts of the code. In our case, the |columnLogicalLeft|
        function should be used inside |columnTranslationForOffset|.

        Test: fast/multicol/content-bounding-box-rtl.html

        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::columnLogicalLeft): Return the logical left of a column relative to the set.
        (WebCore::RenderMultiColumnSet::columnLogicalTop): Return the logical top of a column relative to the set.
        (WebCore::RenderMultiColumnSet::columnRectAt): Split the code between columnLogicalLeft and columnLogicalTop.
        (WebCore::RenderMultiColumnSet::collectLayerFragments): Make code clearer by adding a new line.
        (WebCore::RenderMultiColumnSet::columnTranslationForOffset): Use columnLogicalLeft instead of duplicating logic.
        * rendering/RenderMultiColumnSet.h:

2014-07-31  Martin Hodovan  <mhodovan.u-szeged@partner.samsung.com>

        Eliminate "FractionConversion" from CSSPrimitiveValue::convertToLength
        https://bugs.webkit.org/show_bug.cgi?id=135377

        Reviewed by Darin Adler.

        The FractionConversion argument in CSSPrimitiveValue::convertToLength
        doesn't seem to actually have a purpose. It is for converting numbers
        into Length(x * 100, Percent), but this case shouldn't be reachable.
        The original patch introducing it doesn't shed any light either:
        [https://bugs.webkit.org/show_bug.cgi?id=74913

        This patch removes the now unused FractionConversion argument. Note
        that we can probably also merge the two Fixed conversions, as the
        two only differ in clamping large numbers (probably unintended).

        Patch by Timothy Loh, backported from Blink: https://codereview.chromium.org/71253002

        No new tests.

        * css/CSSCalculationValue.cpp:
        (WebCore::determineCategory):
        * css/CSSParser.cpp:
        (WebCore::parseTransformTranslateArguments):
        (WebCore::parseTranslateTransformValue):
        (WebCore::parseTransformArguments): Deleted.
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::convertToLength):
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::ApplyPropertyClip::convertToLength):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::convertToIntLength):
        (WebCore::StyleResolver::convertToFloatLength):
        * css/TransformFunctions.cpp:
        (WebCore::convertToFloatLength):

2014-07-31  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: console.profile missing profile information
        https://bugs.webkit.org/show_bug.cgi?id=135432

        Reviewed by Timothy Hatcher.

        By switching console.profile to start/stop the timeline we would
        not have a chance to recompile JS functions with profiling information.
        This used to work because whenever the inspector was open we would
        have profiling information enabled. Go back to that behavior.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::profilerEnabled):
        Instead of checking if the timeline agent has started, check if the
        timeline agent has been created. Going back to the normal behavior
        of always having profiling information when the inspector is open.

        * inspector/InspectorTimelineAgent.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend):
        Recompile initializing the timeline agent to include profiling information.

        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        Recompile destrying the timeline agent, only if needed.

        (WebCore::InspectorTimelineAgent::willCallFunction):
        (WebCore::InspectorTimelineAgent::didCallFunction):
        (WebCore::InspectorTimelineAgent::willEvaluateScript):
        (WebCore::InspectorTimelineAgent::didEvaluateScript):
        Using a boolean to track nested calls would not give expected
        behavior when un-nesting. Switch to a counter to ensure that
        as we start profiling in the outermost level we then stop
        profiling at that same level and not inside an inner nesting.

2014-07-31  Wenson Hsieh  <wenson_hsieh@apple.com>

        Refactor EventHandler to call ScrollAnimator::handleWheelEvent for overflow scrolling
        https://bugs.webkit.org/show_bug.cgi?id=135195

        Reviewed by Beth Dakin.

        ScrollableArea::handleWheelEvent is not currently being used to handle wheel events for overflow scrolling; it instead directly invokes ScrollableArea::scroll.
        In order to expose wheel phases on Mac, the PlatformWheelEvent itself should propagate down to ScrollableArea, not just the scroll granularity, direction and
        multiplier required by ScrollableArea::scroll. With this patch, PlatformWheelEvent will be "shipped" along with the WheelEvent.

        No new tests, since behavior should not have changed.

        * page/EventHandler.cpp:
        (WebCore::didScrollInScrollableAreaForSingleAxis): Calls ScrollableArea::scroll directly using WheelEvent's data. Used to handle programmatic WheelEvents, e.g. from JavaScript.
        (WebCore::handleWheelEventInAppropriateEnclosingBoxForSingleAxis): Finds the correct ScrollableArea and attempts to scroll it using the information contained in the WheelEvent via ScrollableArea::handleWheelEvent
        (WebCore::EventHandler::defaultWheelEventHandler): Updated to use handleWheelEventInAppropriateEnclosingBoxForSingleAxis instead of scrollNode.
        (WebCore::scrollNode): Deleted.
        * rendering/RenderListBox.h: Made RenderListBox::scroll public so it can be invoked from EventHandler::handleWheelEventInAppropriateEnclosingBoxForSingleAxis.
        * rendering/RenderNamedFlowThread.cpp: Refactored to let EventHandler update nextScrollBlock in the case of isRenderNamedFlowThread().
        (WebCore::RenderNamedFlowThread::fragmentFromRenderBoxAsRenderBlock): 
        * rendering/RenderNamedFlowThread.h:

2014-07-31  Dan Bernstein  <mitz@apple.com>

        WebCore part of: Server trust authentication challenges aren’t sent to the navigation delegate
        https://bugs.webkit.org/show_bug.cgi?id=135327

        Reviewed by Alexey Proskuryakov.

        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::receivedCredential): Don’t try to change the persistence of
        credentials used for server trust, because the platform doesn’t support persistence values
        other than Session for server trust.
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::receivedCredential): Ditto.

2014-07-31  Dan Bernstein  <mitz@apple.com>

        Tried to fix building with the OS X 10.9 SDK while targeting OS X 10.8.

        * platform/network/cocoa/CredentialCocoa.mm:
        (WebCore::toCredentialPersistence):

2014-07-31  Dan Bernstein  <mitz@apple.com>

        Reverted r171854, because it broke building with the OS X 10.8 SDK.

        * platform/network/cocoa/CredentialCocoa.mm:
        (WebCore::toCredentialPersistence):

2014-07-31  Dan Bernstein  <mitz@apple.com>

        Tried to fix building with the OS X 10.9 SDK while targeting OS X 10.8.

        * platform/network/cocoa/CredentialCocoa.mm:
        (WebCore::toCredentialPersistence):

2014-07-31  Jer Noble  <jer.noble@apple.com>

        REGRESSION(??): [iOS] Disabling MediaPlaybackRequiresUserGesture does not remove user gesture requirement for entering full screen.
        https://bugs.webkit.org/show_bug.cgi?id=135443

        Reviewed by Dean Jackson.

        Allow full screen mode to be entered without a user gesture if the gesture requirement for media playback
        has been unset.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):

2014-07-31  Andrei Bucur  <abucur@adobe.com>

        [CSS Multicolumn] Clear the lines when switching to multi-column layout
        https://bugs.webkit.org/show_bug.cgi?id=135127

        Reviewed by Alexandru Chiculita.

        When switching an element to multi-column layout it becomes a container of block
        children. When this happens the existing line boxes must be deleted in addition
        to clearing the hasInlineChildren flag.

        Tests: fast/multicol/inline-container-to-multicol.html
               fast/multicol/inline-container-to-multicol-float.html
               fast/multicol/inline-container-to-multicol-positioned.html

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::createMultiColumnFlowThread):

2014-07-30  Andreas Kling  <akling@apple.com>

        PropertyName's internal string is always atomic.
        <https://webkit.org/b/135451>

        Use PropertyName::publicName() directly instead of taking the slow route
        through AtomicString::findStringWithHash().

        These strings are always atomic, and findStringWithHash() would trudge
        through a full hash lookup just to discover that indeed, they are!

        Reviewed by Benjamin Poulain.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::findAtomicString): Deleted.
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::namedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::canGetItemsForName):
        (WebCore::JSHTMLDocument::nameGetter):

2014-07-30  Benjamin Poulain  <benjamin@webkit.org>

        ElementRuleCollector: group the shadow tree code
        https://bugs.webkit.org/show_bug.cgi?id=135410

        Reviewed by Andreas Kling.

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::collectMatchingRules):
        Little cleanup: group the shadow tree rule collection in the same block.

2014-07-30  Benjamin Poulain  <benjamin@webkit.org>

        Cleanup DetailsMarkerControl
        https://bugs.webkit.org/show_bug.cgi?id=135429

        Reviewed by Andreas Kling.

        Remove the override of shadowPseudoId(). This is a simple type of shadowId,
        it should use the generic pseudo() path.

        Move DetailsMarkerControl::create() out-of-line. One could justify inlining the constructor,
        inlining the ::create() function has little value.

        * html/shadow/DetailsMarkerControl.cpp:
        (WebCore::DetailsMarkerControl::create):
        (WebCore::DetailsMarkerControl::DetailsMarkerControl):
        (WebCore::DetailsMarkerControl::rendererIsNeeded):
        (WebCore::DetailsMarkerControl::shadowPseudoId): Deleted.
        (WebCore::DetailsMarkerControl::summaryElement): Deleted.
        * html/shadow/DetailsMarkerControl.h:
        (WebCore::DetailsMarkerControl::create): Deleted.

2014-07-30  Benjamin Poulain  <bpoulain@apple.com>

        Remove UploadButtonElement::shadowPseudoId()
        https://bugs.webkit.org/show_bug.cgi?id=135435

        Reviewed by Andreas Kling.

        Use the generic pseudo() path instead of a custom shadowPseudoId().

        * html/FileInputType.cpp:
        (WebCore::UploadButtonElement::create):
        (WebCore::UploadButtonElement::createForMultiple):
        (WebCore::UploadButtonElement::UploadButtonElement):
        Set the type in the common constructor instead of the call sites.
        (WebCore::UploadButtonElement::shadowPseudoId): Deleted.
        * html/FileInputType.h:

2014-07-30  Benjamin Poulain  <bpoulain@apple.com>

        Remove SpinButtonElement::shadowPseudoId
        https://bugs.webkit.org/show_bug.cgi?id=135436

        Reviewed by Andreas Kling.

        Use the generic pseudo.

        * html/shadow/SpinButtonElement.cpp:
        (WebCore::SpinButtonElement::SpinButtonElement):
        (WebCore::SpinButtonElement::shadowPseudoId): Deleted.
        * html/shadow/SpinButtonElement.h:

2014-07-30  Benjamin Poulain  <bpoulain@apple.com>

        Clean up YouTubeEmbedShadowElement
        https://bugs.webkit.org/show_bug.cgi?id=135437

        Reviewed by Andreas Kling.

        * html/shadow/YouTubeEmbedShadowElement.cpp:
        (WebCore::YouTubeEmbedShadowElement::YouTubeEmbedShadowElement):
        (WebCore::YouTubeEmbedShadowElement::pluginElement): Deleted.
        This is unused in WebCore.

        (WebCore::YouTubeEmbedShadowElement::shadowPseudoId): Deleted.
        Use the generic pseudo path instead of a custom shadowPseudoId.
        * html/shadow/YouTubeEmbedShadowElement.h:

2014-07-30  Benjamin Poulain  <bpoulain@apple.com>

        Remove shadowPseudoId() from InputFieldSpeechButtonElement and SearchFieldCancelButtonElement
        https://bugs.webkit.org/show_bug.cgi?id=135438

        Reviewed by Andreas Kling.

        Use the generic path.

        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldCancelButtonElement::SearchFieldCancelButtonElement):
        (WebCore::InputFieldSpeechButtonElement::InputFieldSpeechButtonElement):
        (WebCore::SearchFieldCancelButtonElement::shadowPseudoId): Deleted.
        (WebCore::InputFieldSpeechButtonElement::shadowPseudoId): Deleted.
        * html/shadow/TextControlInnerElements.h:

2014-07-30  Andy Estes  <aestes@apple.com>

        USE(CONTENT_FILTERING) should be ENABLE(CONTENT_FILTERING)
        https://bugs.webkit.org/show_bug.cgi?id=135439

        Reviewed by Tim Horton.

        We now support two different platform content filters, and will soon support a mock content filter (as part of
        webkit.org/b/128858). This makes content filtering a feature of WebKit, not just an adoption of a third-party
        library. ENABLE() is the correct macro to use for such a feature.

        * Configurations/FeatureDefines.xcconfig:
        * WebCore.exp.in:
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::finishedLoading):
        (WebCore::DocumentLoader::responseReceived):
        (WebCore::DocumentLoader::commitData):
        (WebCore::DocumentLoader::dataReceived):
        * loader/DocumentLoader.h:
        * loader/FrameLoaderClient.h:
        * platform/ContentFilter.h:
        * platform/ios/ContentFilterIOS.mm:
        * platform/mac/ContentFilterMac.mm:

2014-07-30  Andreas Kling  <akling@apple.com>

        Static hash tables no longer need to be coupled with a VM.
        <https://webkit.org/b/135421>

        Update for JSC::ClassInfo changes.
        
        Remove the JSNoStaticTables mode for IDL code generation, which was used to
        ensure that each VM had its own unique copy of certain static tables.
        This was used for interfaces that could be used in workers, and now there's
        no need to manually annotate these things anymore.

        Also remove the DOMObjectHashTableMap class that was only used for this.

        Reviewed by Geoffrey Garen.

        * Modules/indexeddb/IDBAny.idl:
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBFactory.idl:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBKeyRange.idl:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBOpenDBRequest.idl:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/indexeddb/IDBVersionChangeEvent.idl:
        * Modules/webdatabase/Database.idl:
        * Modules/webdatabase/DatabaseSync.idl:
        * Modules/webdatabase/SQLError.idl:
        * Modules/webdatabase/SQLException.idl:
        * Modules/webdatabase/SQLResultSet.idl:
        * Modules/webdatabase/SQLResultSetRowList.idl:
        * Modules/webdatabase/SQLTransaction.idl:
        * Modules/webdatabase/SQLTransactionSync.idl:
        * Modules/websockets/CloseEvent.idl:
        * Modules/websockets/WebSocket.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/DOMObjectHashTableMap.cpp: Removed.
        * bindings/js/DOMObjectHashTableMap.h: Removed.
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::getHashTableForGlobalData): Deleted.
        * bindings/js/JSDOMBinding.h:
        (WebCore::getStaticValueSlotEntryWithoutCaching):
        * bindings/js/JSDOMGlobalObject.cpp:
        * bindings/js/JSDOMWindowBase.cpp:
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::put):
        * bindings/js/JSDOMWindowShell.cpp:
        * bindings/js/JSImageConstructor.cpp:
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::deleteProperty):
        (WebCore::JSStorage::putDelegate):
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        * bindings/js/WebCoreJSClientData.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertySlotBody):
        (GenerateImplementation):
        (GenerateConstructorHelperMethods):
        (hashTableAccessor): Deleted.
        (prototypeHashTableAccessor): Deleted.
        (constructorHashTableAccessor): Deleted.
        * bindings/scripts/IDLAttributes.txt:
        * bridge/c/CRuntimeObject.cpp:
        * bridge/c/c_instance.cpp:
        * bridge/objc/ObjCRuntimeObject.mm:
        * bridge/objc/objc_instance.mm:
        * bridge/objc/objc_runtime.mm:
        * bridge/runtime_array.cpp:
        * bridge/runtime_method.cpp:
        * bridge/runtime_object.cpp:
        * crypto/CryptoKey.idl:
        * css/CSSFontFaceLoadEvent.idl:
        * dom/DOMCoreException.idl:
        * dom/DOMStringList.idl:
        * dom/ErrorEvent.idl:
        * dom/Event.idl:
        * dom/EventException.idl:
        * dom/EventListener.idl:
        * dom/MessageChannel.idl:
        * dom/MessageEvent.idl:
        * dom/MessagePort.idl:
        * dom/ProgressEvent.idl:
        * fileapi/Blob.idl:
        * fileapi/File.idl:
        * fileapi/FileError.idl:
        * fileapi/FileException.idl:
        * fileapi/FileList.idl:
        * fileapi/FileReader.idl:
        * fileapi/FileReaderSync.idl:
        * html/DOMURL.idl:
        * page/EventSource.idl:
        * page/WorkerNavigator.idl:
        * workers/DedicatedWorkerGlobalScope.idl:
        * workers/SharedWorkerGlobalScope.idl:
        * workers/WorkerGlobalScope.idl:
        * workers/WorkerLocation.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestException.idl:
        * xml/XMLHttpRequestProgressEvent.idl:
        * xml/XMLHttpRequestUpload.idl:

2014-07-30  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/17199364> [Mac] Popup button arrows appear on the left, underlapping text, when the UI layout direction is right-to-left
        https://bugs.webkit.org/show_bug.cgi?id=135426

        Reviewed by Dean Jackson.

        No test, because the UI layout direction in the test harness is always left-to-right.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::popupButton): Forced the user interface layout direction of the
        NSPopUpButtonCell to left-to-right. Added a FIXME about how we could make this vary based on
        the direction of the <select>, though that would require additional changes elsewhere.

2014-07-30  Dan Bernstein  <mitz@apple.com>

        Made Credential hold onto an NSURLCredential when needed.
        Work towards fixing https://bugs.webkit.org/show_bug.cgi?id=135327

        Reviewed by Alexey Proskuryakov.

        No change in functionality.

        * WebCore.exp.in: Updated.

        * platform/network/Credential.h: Removed definition of CERTIFICATE_CREDENTIALS_SUPPORTED,
        which is not used anymore.

        * platform/network/CredentialBase.h:
        (WebCore::CredentialBase::encodingRequiresPlatformData): Added a base implementation that
        returns false.

        * platform/network/cf/AuthenticationCF.cpp:
        Changed to use the Credential constructor that takes an CFURLCredential, and the new
        cfCredential member function. Made the createCF and core functions Windows-only and
        therefore removed the CERTIFICATE_CREDENTIALS_SUPPORTED code from them.
        * platform/network/cf/AuthenticationCF.h:

        * platform/network/cf/CredentialStorageCFNet.cpp:
        (WebCore::CredentialStorage::getFromPersistentStorage): Changed to construct a Credential
        from a CFURLCredential.
        (WebCore::CredentialStorage::saveToPersistentStorage): Changed to use the new cfCredential
        member function.

        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Ditto to both.
        (WebCore::ResourceHandle::receivedCredential): Ditto.

        * platform/network/cocoa/CredentialCocoa.h:
        Replaced the m_identity, m_certificates and m_type member variables with an m_nsCredential
        one holding onto an NSURLCredential. Declared constructors from and getters for
        NSURLCredential and CFURLCredentialRef.
        (WebCore::Credential::encodingRequiresPlatformData): Override that checks the
        NSURLCredential if necessary.

        * platform/network/cocoa/CredentialCocoa.mm:
        (WebCore::toNSURLCredentialPersistence): New helper function.
        (WebCore::toCredentialPersistence): Ditto.
        (WebCore::Credential::Credential): Defined constructors to create or take an
        NSURLCredential.
        (WebCore::Credential::cfCredential): Added.
        (WebCore::Credential::nsCredential): Added. Returns nil for the empty credential.
        (WebCore::Credential::isEmpty): Changed to check m_nsCredential.
        (WebCore::Credential::platformCompare): Changed to compare m_nsCredential if needed.
        (WebCore::Credential::encodingRequiresPlatformData): Returns true if the credential is not
        a user and a password.

        * platform/network/mac/AuthenticationMac.h: Removed mac and core functions for Credential.
        * platform/network/mac/AuthenticationMac.mm:
        (-[WebCoreAuthenticationClientAsChallengeSender useCredential:forAuthenticationChallenge:]):
        Changed to use Credential constructor that takes an NSURLCredential.
        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Ditto. Also use the
        nsCredential getter.

        * platform/network/mac/CredentialStorageMac.mm:
        (WebCore::CredentialStorage::getFromPersistentStorage): Use new Credential constructor.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Ditto. Also use the
        nsCredential getter.
        (WebCore::ResourceHandle::receivedCredential): Ditto.

2014-07-30  Sergio Villar Senin  <svillar@igalia.com>

        [GTK] Build depends on OpenGL ES
        https://bugs.webkit.org/show_bug.cgi?id=135289

        Reviewed by Martin Robinson.

        Guard the OpenGL ES code with USE(OPENGL_ES_2).

        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        * platform/graphics/opengl/Extensions3DOpenGLES.h:

2014-07-30  Radu Stavila  <stavila@adobe.com>

        Member name collision in RenderView and SelectionSubtreeRoot
        https://bugs.webkit.org/show_bug.cgi?id=135233

        Reviewed by Mihnea Ovidenie.

        The selectionStart/End members in RenderView have been renamed to fix confusion caused by the fact that
        RenderView inherits SelectionSubtreeRoot, which also has the same selectionStart/End members.

        No new tests required, no new functionality.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::isSelectionRoot):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        (WebCore::RenderView::setSelection):
        (WebCore::RenderView::getSelection):
        * rendering/RenderView.h:

2014-07-30  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Move TextureMapperLayer::textureMapper() definition into the header
        https://bugs.webkit.org/show_bug.cgi?id=135384

        Reviewed by Martin Robinson.

        Move the definitions of TextureMapperLayer::textureMapper() and TextureMapperLayer::rootLayer()
        into the TextureMapperLayer header. This makes both functions inline-able, removing unnecessary
        calling overhead in GraphicsLayerTextureMapper::flushCompositingState() and
        GraphicsLayerTextureMapper::updateBackingStoreIfNeeded().

        TextureMapperLayer::rootLayer() now also returns a reference.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::~TextureMapperLayer):
        (WebCore::TextureMapperLayer::rootLayer): Deleted.
        (WebCore::TextureMapperLayer::textureMapper): Deleted.
        * platform/graphics/texmap/TextureMapperLayer.h:
        (WebCore::TextureMapperLayer::textureMapper):
        (WebCore::TextureMapperLayer::rootLayer):

2014-07-29  Andreas Kling  <akling@apple.com>

        Crash when using 'em' units to specify font-size inside animation keyframe.
        <https://webkit.org/b/135395>
        <rdar://problem/17851910>

        We'd forgotten to initialize the "parent style" when resolving keyframe
        styles, and this led to a crash in length conversion where the code
        assumes a parent style will be present.

        To keep this fix minimal, simply make the "parent style" a clone of the
        base element style.

        Reviewed by Simon Fraser.

        Test: fast/animation/keyframe-with-font-size-in-em-units.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForKeyframe):

2014-07-29  Pratik Solanki  <psolanki@apple.com>

        [iOS] REGRESSION(r171526): PDF documents fail to load in WebKit1 with disk image caching enabled
        https://bugs.webkit.org/show_bug.cgi?id=135359
        <rdar://problem/17824645>

        Reviewed by Darin Adler.

        r171526 broke the case where we have a memory mapped file from the DiskImageCache in the
        SharedBuffer. In such a case, m_buffer is empty and createCFData() returned an
        WebCoreSharedBufferData with an empty buffer.

        Fix this by taking the easy route of bringing back the old code for the disk image cache
        file backed case. In the long run we probably want to remove the iOS specific disk image
        cache anyway.

        Review also uncovered another bug in r171526 where we were balancing an Objective-C alloc
        with a CFRelease which is incorrect when running under GC. Fix that by using adoptNS along
        with adoptCF which is what the code did before.

        No new tests because the bug only occurs on device and we can't run tests on device yet.

        * platform/mac/SharedBufferMac.mm:
        (-[WebCoreSharedBufferData initWithDiskImageSharedBuffer:]):
        (-[WebCoreSharedBufferData length]):
        (-[WebCoreSharedBufferData bytes]):
        (WebCore::SharedBuffer::createCFData):

2014-07-29  Benjamin Poulain  <bpoulain@apple.com>

        VisitedLinkState::determineLinkState should take a reference
        https://bugs.webkit.org/show_bug.cgi?id=135375

        Reviewed by Sam Weinig.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::initElement):
        * dom/VisitedLinkState.h:
        (WebCore::VisitedLinkState::determineLinkState):

2014-07-29  Brady Eidson  <beidson@apple.com>

        Make WKOriginDataManager actually operate on IndexedDatabases.
        https://bugs.webkit.org/show_bug.cgi?id=135346

        Reviewed by Sam Weinig (and David Kilzer and Alex Christensen)

        * WebCore.exp.in:

2014-07-29  Dan Bernstein  <mitz@apple.com>

        Moved the Cocoa-specific parts of CredentialBase into a Cocoa-specific Credential class.
        Work towards fixing https://bugs.webkit.org/show_bug.cgi?id=135327

        Reviewed by Alexey Proskuryakov.

        No change in functionality.

        * WebCore.exp.in: Updated for functions moved in the class hierarchy.

        * WebCore.xcodeproj/project.pbxproj: Added CredentialCocoa.{h,mm}.

        * platform/network/Credential.h: For Cocoa, include CredentialCocoa.h instead of the generic
        class.
        (WebCore::Credential::Credential): Removed #if CERTIFICATE_CREDENTIALS_SUPPORTED code.

        * platform/network/CredentialBase.cpp:
        (WebCore::CredentialBase::CredentialBase): Changed to use emptyString instead of "", removed
        #if CERTIFICATE_CREDENTIALS_SUPPORTED code.
        (WebCore::CredentialBase::isEmpty): Ditto.
        (WebCore::CredentialBase::compare): Renamed operator== to this, removed
        #if CERTIFICATE_CREDENTIALS_SUPPORTED code, but changed the end to call platformCompare.
        (WebCore::CredentialBase::identity): Deleted.
        (WebCore::CredentialBase::certificates): Deleted.
        (WebCore::CredentialBase::type): Deleted.
        * platform/network/CredentialBase.h: Removed #if CERTIFICATE_CREDENTIALS_SUPPORTED members.
        (WebCore::CredentialBase::platformCompare): Added a base implementation that returns true.
        (WebCore::operator==): Changed to use CredentialBase::compare.

        * platform/network/cocoa/CredentialCocoa.h: Added.
        (WebCore::Credential::Credential):
        * platform/network/cocoa/CredentialCocoa.mm: Added.
        (WebCore::Credential::Credential): Moved the constructor that takes an identity and
        certificates here.
        (WebCore::Credential::isEmpty): Moved here.
        (WebCore::Credential::identity): Ditto.
        (WebCore::Credential::certificates): Ditto.
        (WebCore::Credential::type): Ditto.
        (WebCore::Credential::platformCompare): Moved the code that compares client-certificate
        credentials here.

        * platform/network/mac/AuthenticationMac.mm:
        (WebCore::mac): Removed #if CERTIFICATE_CREDENTIALS_SUPPORTED guards in this Cocoa-only
        file.
        (WebCore::core): Ditto.

2014-07-29  Daniel Bates  <dabates@apple.com>

        Use WTF::move() instead of std::move() to help ensure move semantics
        https://bugs.webkit.org/show_bug.cgi?id=135351

        Reviewed by Alexey Proskuryakov.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::updateCaptionStyleSheetOveride):

2014-07-29  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Assertion failure hit testing a region-based multicolumn in a region
        https://bugs.webkit.org/show_bug.cgi?id=135385

        Reviewed by Andrei Bucur.

        When a region-based multicolumn element is displayed and hit tested in a region,
        we have to disable the named flow region information not only for painting,
        but also for hit-testing. This is a follow-up for https://bugs.webkit.org/show_bug.cgi?id=132121,
        which provided the fix for painting.

        Test: fast/regions/assert-hit-test-multicol-in-region.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hitTestLayer):

2014-07-29  Zalan Bujtas  <zalan@apple.com>

        Cleanup RenderSelectionInfoBase/RenderSelectionInfo/RenderBlockSelectionInfo.
        https://bugs.webkit.org/show_bug.cgi?id=135326

        Reviewed by Darin Adler.

        1. Move implementation to RenderSelectInfo.cpp
        2. RenderSelectionInfoBase/RenderSelectionInfo/RenderBlockSelectionInfo take Render* reference.
        3. Remove unused functions.
        4. Add RenderSelectionInfoBase::repaintRectangle()

        No change in behavior.

        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderSelectionInfo.cpp: Added.
        (WebCore::RenderSelectionInfoBase::RenderSelectionInfoBase):
        (WebCore::RenderSelectionInfoBase::repaintRectangle):
        (WebCore::RenderSelectionInfo::RenderSelectionInfo):
        (WebCore::RenderSelectionInfo::repaint):
        (WebCore::RenderBlockSelectionInfo::RenderBlockSelectionInfo):
        (WebCore::RenderBlockSelectionInfo::repaint):
        * rendering/RenderSelectionInfo.h:
        (WebCore::RenderSelectionInfo::collectedSelectionRects):
        (WebCore::RenderSelectionInfoBase::RenderSelectionInfoBase): Deleted.
        (WebCore::RenderSelectionInfoBase::object): Deleted.
        (WebCore::RenderSelectionInfo::RenderSelectionInfo): Deleted.
        (WebCore::RenderSelectionInfo::repaint): Deleted.
        (WebCore::RenderSelectionInfo::rects): Deleted.
        (WebCore::RenderBlockSelectionInfo::RenderBlockSelectionInfo): Deleted.
        (WebCore::RenderBlockSelectionInfo::repaint): Deleted.
        (WebCore::RenderBlockSelectionInfo::block): Deleted.
        * rendering/RenderView.cpp:
        (WebCore::RenderView::subtreeSelectionBounds):
        (WebCore::RenderView::repaintSubtreeSelection):
        (WebCore::RenderView::clearSubtreeSelection):
        (WebCore::RenderView::applySubtreeSelection):

2014-07-28  Pratik Solanki  <psolanki@apple.com>

        Get SharedBuffer.h out of ResourceBuffer.h (and a few other places)
        https://bugs.webkit.org/show_bug.cgi?id=131782

        Original patch by Tim Horton.
        Reviewed by Darin Adler.

        No new tests because no functional changes.

        * Modules/indexeddb/IDBCallbacks.h:
        * Modules/indexeddb/IDBCursorBackend.h:
        * loader/ios/DiskImageCacheIOS.h:
        Forward declare SharedBuffer in headers.

        * Modules/indexeddb/IDBRequest.cpp:
        * loader/cache/CachedImage.cpp:
        * loader/icon/IconLoader.cpp:
        * loader/ios/DiskImageCacheIOS.mm:
        * loader/cache/MemoryCache.cpp:
        * loader/mac/ResourceBuffer.mm:
        Include SharedBuffer.h in implementation files.

        * Modules/notifications/Notification.h:
        * loader/appcache/ApplicationCacheGroup.h:
        Remove unnecessary includes.

        * loader/ResourceBuffer.cpp:
        (WebCore::ResourceBuffer::adoptSharedBuffer):
        * loader/ResourceBuffer.h:
        Out-of-line adoptSharedBuffer so that the PassRefPtr doesn't require including SharedBuffer.h.

        * platform/graphics/opentype/OpenTypeMathData.cpp:
        * platform/graphics/opentype/OpenTypeMathData.h:
        Out-of-line destructor to avoid requiring SharedBuffer.h for the RefPtr.
        Forward-declare SharedBuffer in the header, include in implementation.

2014-07-29  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] GraphicsLayerTextureMapper::addAnimation() box size parameter should be FloatSize
        https://bugs.webkit.org/show_bug.cgi?id=135237

        Reviewed by Martin Robinson.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h: The boxSize parameter of the
        addAnimation() method must be of the same type as the parameter in the base class
        declaration -- a const FloatSize reference. Only then is the base virtual method
        actually overriden.

2014-07-28  Dan Bernstein  <mitz@apple.com>

        iOS build fix.

        * WebCore.exp.in:

2014-07-28  Dan Bernstein  <mitz@apple.com>

        Introduced CredentialBase and made Credential derive from it
        Work towards fixing https://bugs.webkit.org/show_bug.cgi?id=135327

        Reviewed by Darin Adler.

        No change in functionality.

        * CMakeLists.txt: Updated for source file rename.

        * WebCore.exp.in: Changed to export CredentialBase symbols.

        * WebCore.vcxproj/WebCore.vcxproj: Updated for source file rename and new header.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.

        * WebCore.xcodeproj/project.pbxproj: Ditto.

        * platform/network/Credential.cpp: Renamed to CredentialBase.cpp.

        * platform/network/Credential.h: Defined Credential to derive from CredentialBase.

        * platform/network/CredentialBase.cpp: Renamed Credential.cpp to this. Updated for the new
        name.

        * platform/network/CredentialBase.h: Copied from Credential.h, renamed the class to
        CredentialBase, and made the constructors protected.

2014-07-28  Zalan Bujtas  <zalan@apple.com>

        REGRESSION(r164133): Selection disappears after scrolling on nytimes.com
        https://bugs.webkit.org/show_bug.cgi?id=135361

        Reviewed by Ryosuke Niwa.

        Ensure that when a RenderElement, part of the current selection is removed,
        we recalculate and update the selection soon after layout.

        Test: fast/dynamic/selection-gets-cleared-when-part-of-it-gets-removed.html

        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::setNeedsSelectionUpdate):
        (WebCore::FrameSelection::didLayout): didLayout name reflects its functionality better.
        (WebCore::FrameSelection::layoutDidChange): Deleted.
        * editing/FrameSelection.h: : move some functions to private.
        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::willBeDestroyed):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::removeChildInternal):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::willBeDestroyed):

2014-07-28  Dean Jackson  <dino@apple.com>

        [Media iOS] Touching play button feels unresponsive
        https://bugs.webkit.org/show_bug.cgi?id=135370
        <rdar://problem/17756281>

        Reviewed by Simon Fraser.

        Add an :active rule that shows a slightly darker button when touched.

        * Modules/mediacontrols/mediaControlsiOS.css:
        (audio::-webkit-media-controls-start-playback-button:active):

2014-07-28  Brady Eidson  <beidson@apple.com>

        REGRESSION(168376): Standalone images pasted to Outlook 2011 don't display
        <rdar://problem/17768371> and https://bugs.webkit.org/show_bug.cgi?id=135363

        Reviewed by Tim Horton.

        Outlook isn’t prepared to handle the resource load callbacks when sent synchronously.

        r168376 was an optimization that we no longer need, so the simplest fix is to roll it out.

        * editing/mac/EditorMac.mm:
        (WebCore::Editor::WebContentReader::readImage):

        * loader/archive/ArchiveResource.cpp:
        (WebCore::ArchiveResource::ArchiveResource):
        * loader/archive/ArchiveResource.h:
        (WebCore::ArchiveResource::setShouldLoadImmediately): Deleted.
        (WebCore::ArchiveResource::shouldLoadImmediately): Deleted.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):

2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>

        ASSERTION FAILED: m_heap->vm()->currentThreadIsHoldingAPILock()
        https://bugs.webkit.org/show_bug.cgi?id=135352

        Reviewed by Oliver Hunt.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::ensureReplacementScriptInjected): This should be taking a 
        JSLock like its sibling methods do (e.g. installReplacement).

2014-07-28  Antti Koivisto  <antti@apple.com>

        <embed> videos flashes constantly while playing inline on iPad, making it unwatchable
        https://bugs.webkit.org/show_bug.cgi?id=135356
        <rdar://problem/16828238>

        Reviewed by Simon Fraser.
        
        The shadow tree for media controls is scheduling style recalc. The general silliness of
        HTMLPlugInImageElement::willRecalcStyle/willDetachRenderers is turning those into render
        tree reconstructions causing flicker.

        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::willRecalcStyle):
        
            Don't do the forced renderer reconstruction if there is no style change for the element
            or its ancestors. This way recalcs scheduled by the shadow tree don't trigger the widget
            update code path.

2014-07-27  Brent Fulgham  <bfulgham@apple.com>

        [Mac, iOS] Paint-on closed captions get out-of-order in Safari
        https://bugs.webkit.org/show_bug.cgi?id=135332
        <rdar://problem/15317278>

        Reviewed by Jer Noble.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): If the
        number of active cues is greater than the current set of CSS boxes representing
        the cues, throw away the CSS boxes and re-layout all the cues.
        * html/track/InbandGenericTextTrack.cpp:
        (WebCore::InbandGenericTextTrack::addGenericCue): Add some logging.
        (WebCore::InbandGenericTextTrack::removeGenericCue): Ditto.
        * html/track/TextTrackCueGeneric.cpp:
        (WebCore::TextTrackCueGeneric::isOrderedBefore): Revise ordering rules so that we put
        newer cues earlier in the layout order so they are drawn towards the bottom
        of the screen. Only do this for Generic captions.
        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
        (WebCore::InbandTextTrackPrivateAVF::processAttributedStrings): Adjust logging
        messages.
        (WebCore::InbandTextTrackPrivateAVF::removeCompletedCues): Add logging.

2014-07-28  Andreas Kling  <akling@apple.com>

        REGRESSION (r160806): CSS zoom property doesn't work on anything inside anchors.
        <https://webkit.org/b/135344>
        <rdar://problem/17759577>

        When DeprecatedStyleBuilder applies the CSS zoom property (ApplyPropertyZoom)
        it first resets the "effective zoom" by calling RenderStyle::setEffectiveZoom().

        This mechanism was not resistent to being called multiple times, due to the
        optimization in RenderStyle::setZoom() to avoid copy-on-writing the shared data
        when setting some property to the already-set value.

        The bug would happen in this sequence:

        ApplyPropertyZoom:
            - setEffectiveZoom(1);
            - setZoom(2); // this updates the effective zoom
        ApplyPropertyZoom:
            - setEffectiveZoom(1);
            - setZoom(2); // this doesn't update the effective zoom

        When we run the second setZoom(2); call, the RenderStyle's zoom value is 2
        already and we'll early return without updating the effective zoom.

        This change moves the updating of the effective zoom in setZoom() to take place
        before the early return due to overwriting with the same value.

        Note: the fact that we're apply the zoom property twice is an inefficiency that
        we should figure out a way to avoid in the future.

        Reviewed by Simon Fraser.

        Test: fast/css/zoom-inside-link.html

        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyle::setZoom):

2014-07-28  Bear Travis  <betravis@adobe.com>

        [CSS Font Loading] Update Font Loading Code
        https://bugs.webkit.org/show_bug.cgi?id=135340

        Reviewed by Antti Koivisto.

        Update the Font Loading code to build again, as trunk has evolved
        since the feature was originally written. Mostly, this requires
        updating the code to work with the new Font representation.

        The original tests were enabled only for the Chromium port.
        They will need to be updated when the feature is enabled by default.

        * WebCore.xcodeproj/project.pbxproj: Add missing files.
        * css/FontLoader.cpp: Update to new Font representation.
        (WebCore::LoadFontCallback::createFromParams):
        (WebCore::LoadFontCallback::~LoadFontCallback):
        (WebCore::FontLoader::loadFont):
        (WebCore::FontLoader::checkFont):
        (WebCore::applyPropertyToCurrentStyle):
        (WebCore::FontLoader::resolveFontStyle):

2014-07-28  Wenson Hsieh  <wenson_hsieh@apple.com>

        Let WheelEvent wrap a PlatformWheelEvent
        https://bugs.webkit.org/show_bug.cgi?id=135244

        WheelEvent now wraps a PlatformWheelEvent. m_directionInvertedFromDevice, as well as m_phase and m_momentumPhase
        have been removed, since the information is redundant in PlatformWheelEvent. Note that deltaX and deltaY have
        NOT been replaced, since we need double precision instead of float precision.

        Reviewed by Beth Dakin.

        No new tests, since behavior should not have changed.

        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::WheelEvent):
        (WebCore::WheelEvent::initWheelEvent):
        * dom/WheelEvent.h:
        (WebCore::WheelEvent::wheelEvent): Returns a non-null pointer to the PlatformWheelEvent iff WheelEvent was initialized by PlatformWheelEvent.
        (WebCore::WheelEvent::webkitDirectionInvertedFromDevice): Updated to use PlatformWheelEvent.
        (WebCore::WheelEvent::phase): Updated to use PlatformWheelEvent.
        (WebCore::WheelEvent::momentumPhase): Updated to use PlatformWheelEvent.

2014-07-28  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed 'merge' fix.

        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
        Correct line endings to allow EWS merges again.

2014-07-28  Zoltan Horvath  <zoltan@webkit.org>

        [CSS3-Text] Adjust text-justify implementation to the latest spec
        https://bugs.webkit.org/show_bug.cgi?id=135317

        Reviewed by Darin Adler.

        Text-justify no longer accepts the following values: Inter-ideograph, inter-
        cluster, and kashida. This patch removes them and updates the tests as well.

        [1] http://dev.w3.org/csswg/css-text-3/#propdef-text-justify

        Updated existing tests.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator TextJustify):
        * css/CSSValueKeywords.in:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayout):
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleRareInheritedData.h:

2014-07-28  Radu Stavila  <stavila@adobe.com>

        REGRESSION (r169105): Crash in selection
        https://bugs.webkit.org/show_bug.cgi?id=134303

        Reviewed by Mihnea Ovidenie.

        When splitting the selection between different subtrees, all subtrees must have their selection cleared before
        starting to apply the new selection. Otherwise, when selecting objects in a named flow thread and going up
        its containing block chain, we can end up in the view's selection root, which has not yet been updated and so
        we get inconsistent data.

        To achieve this goal, the selection update was split into a "clear" and an "apply" method. The updateSelectionForSubtrees
        method first iterates through all subtrees and performs the "clear" method and then starts all over again
        and performs the "apply" method.

        Test: fast/regions/selection/crash-deselect.html

        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderSelectionInfo.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setSelection):
        (WebCore::RenderView::splitSelectionBetweenSubtrees):
        (WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
        (WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
        (WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
        (WebCore::RenderView::setSubtreeSelection): Deleted.
        * rendering/RenderView.h:
        * rendering/SelectionSubtreeRoot.cpp:
        (WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):
        * rendering/SelectionSubtreeRoot.h:
        (WebCore::SelectionSubtreeRoot::OldSelectionData::OldSelectionData):

2014-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>

        CSS: Fix :visited behavior for SubSelectors
        https://bugs.webkit.org/show_bug.cgi?id=135324

        Reviewed by Benjamin Poulain.

        Disable :visited match for the selectors that has SubSelectors.

        Tests: fast/history/nested-visited-test-complex.html
               fast/history/sibling-visited-test-complex.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::matchRecursively):

2014-07-27  Ryuan Choi  <ryuan.choi@samsung.com>

        Remove GraphicsSurfaceGLX.cpp
        https://bugs.webkit.org/show_bug.cgi?id=135279

        Reviewed by Darin Adler.

        GraphicsSurfaceGLX.cpp is not used since Qt dropped and Efl port changed at r146458

        * platform/graphics/surfaces/glx/GraphicsSurfaceGLX.cpp: Removed.

2014-07-27  Bruno de Oliveira Abinader  <bruno.d@partner.samsung.com>

        Support for :enabled selector on Anchor & Area elements
        https://bugs.webkit.org/show_bug.cgi?id=134826

        Reviewed by Darin Adler.

        Updates the PseudoClassEnabled selector checker to check for Anchor & Area
        elements with a 'href' attribute.

        Spec: http://html.spec.whatwg.org/#selector-enabled

        Test: fast/css/css-selector-enabled-links.html

        * css/SelectorCheckerTestFunctions.h:
        (WebCore::isEnabled): Added check for anchor & area elements.

2014-07-27  Daniel Bates  <dabates@apple.com>

        [WK2] Crash when accessing window.localStorage after calling window.close()
        https://bugs.webkit.org/show_bug.cgi?id=135328
        <rdar://problem/17315237>

        Reviewed by Sam Weinig.

        Fixes an issue where accessing local storage for the first time after calling window.close()
        causes a crash.

        For now, we should disallow accessing local storage after calling window.close() regardless of
        whether it's the first access to local storage as this seems like a bad idiom to support. Note,
        this represents a change in behavior from WebKit1. If such usage of window.localStorage turns
        out to be reasonable then we can visit this decision again in <https://bugs.webkit.org/show_bug.cgi?id=135330>.

        Tests: storage/domstorage/localstorage/access-storage-after-window-close.html
               storage/domstorage/localstorage/access-storage-then-set-value-in-storage-after-window-close.html
               storage/domstorage/localstorage/set-value-in-storage-after-window-close.html

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::localStorage): Modified to only return the cached local storage or
        create a new local storage so long as the page isn't being closed. Also, substitute nullptr
        for 0.
        (WebCore::DOMWindow::close): Call Page::setIsClosing() to mark that the page is closing.
        * page/Page.cpp:
        (WebCore::Page::Page): Initialize m_isClosing to false.
        * page/Page.h:
        (WebCore::Page::setIsClosing): Added.
        (WebCore::Page::isClosing): Added.

2014-07-27  Filip Pizlo  <fpizlo@apple.com>

        Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
        
        This fixes the previous mismerge and adds test coverage for the thing that went wrong.
        Also, this adds some helpers for making it easier to inspect JavaScript values.

        * testing/Internals.cpp:
        (WebCore::Internals::description):
        * testing/Internals.h:
        * testing/Internals.idl:

    2014-07-25  Mark Lam  <mark.lam@apple.com>
    
            [ftlopt] Renamed DebuggerActivation to DebuggerScope.
            <https://webkit.org/b/134273>
    
            Reviewed by Michael Saboff.
    
            No new tests.
    
            * ForwardingHeaders/debugger/DebuggerActivation.h: Removed.
            - Removed because this is not used.
    
2014-07-26  Brian J. Burg  <burg@cs.washington.edu>

        Web Replay: log and enforce session/segment state machine transitions
        https://bugs.webkit.org/show_bug.cgi?id=135224

        Reviewed by Timothy Hatcher.

        For debugging purposes, log session and segment state transitions.
        Assert that segment state transitions are valid.

        No new tests. No behavior was changed.

        * replay/ReplayController.cpp:
        (WebCore::logDispatchedDOMEvent):
        (WebCore::sessionStateToString):
        (WebCore::segmentStateToString):
        (WebCore::ReplayController::setSessionState):
        (WebCore::ReplayController::setSegmentState):
        (WebCore::ReplayController::createSegment):
        (WebCore::ReplayController::completeSegment): Remove a wrong state transition.
        (WebCore::ReplayController::loadSegmentAtIndex):
        (WebCore::ReplayController::unloadSegment): Fix a now-erroneous assertion.
        (WebCore::ReplayController::startPlayback):
        (WebCore::ReplayController::pausePlayback):
        (WebCore::ReplayController::willDispatchEvent):
        (WebCore::ReplayController::cancelPlayback):
        * replay/ReplayController.h:

2014-07-26  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
        reland later.

        * ForwardingHeaders/debugger/DebuggerActivation.h: Added.

2014-07-26  Timothy Horton  <timothy_horton@apple.com>

        Crash in Web Content Process under ~PDFDocument under clearTouchEventListeners at topDocument()
        https://bugs.webkit.org/show_bug.cgi?id=135319
        <rdar://problem/17315168>

        Reviewed by Darin Adler and Antti Koivisto.

        * dom/Document.h:
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::prepareForDestruction):
        Add a flag on Document, m_hasPreparedForDestruction, which ensures
        that each Document only goes through prepareForDestruction() once.
        prepareForDestruction() can be called a number of times during teardown,
        but it's only necessary to actually execute it once.
        
        This was previously achieved by virtue of all callers of prepareForDestruction()
        first checking hasLivingRenderTree, and prepareForDestruction() tearing down
        the render tree, but that meant that prepareForDestruction() was not called
        for Documents who never had a render tree in the first place.

        The only part of prepareForDestruction() that is now predicated on hasLivingRenderTree()
        is the call to destroyRenderTree(); the rest of the function has the potential to be relevant
        for non-rendered placeholder documents and can safely deal with them in other ways.

        It is important to call prepareForDestruction() on non-rendered placeholder documents
        because some of the cleanup (like disconnectFromFrame()) is critical to safe destruction.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear):
        Call prepareForDestruction() even if we don't have a living render tree.
        For the sake of minimizing change, removeFocusedNodeOfSubtree still
        depends on having a living render tree before calling prepareForDestruction().

        * page/Frame.cpp:
        (WebCore::Frame::setView):
        (WebCore::Frame::setDocument):
        Call prepareForDestruction() even if we don't have a living render tree.

2014-07-25  Filip Pizlo  <fpizlo@apple.com>

        Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.

    2014-07-25  Mark Lam  <mark.lam@apple.com>
    
            [ftlopt] Renamed DebuggerActivation to DebuggerScope.
            <https://webkit.org/b/134273>
    
            Reviewed by Michael Saboff.
    
            No new tests.
    
            * ForwardingHeaders/debugger/DebuggerActivation.h: Removed.
            - Removed because this is not used.
    
2014-07-25  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Rounded rect gets non-renderable at certain subpixel size.
        https://bugs.webkit.org/show_bug.cgi?id=135314
        <rdar://problem/17812921>

        Reviewed by Tim Horton.

        While calculating the rounded rect for painting, the radius is adjusted to compensate
        for the pixel snapped size. However while scaling the radius, certain values overflow
        (float) mantissa and it produces a non-renderable rounded rect where the radius becomes bigger
        than the rectangle dimensions. In such cases, we need to shrink the radius to make it
        renderable again.

        Test: transitions/rounded-rect-becomes-non-renderable-while-transitioning.html

        * platform/graphics/RoundedRect.cpp:
        (WebCore::RoundedRect::pixelSnappedRoundedRectForPainting): shrink the radius by
        one device pixel. It is as good as any other small value.

2014-07-25  Jer Noble  <jer.noble@apple.com>

        [EME][Mac] CDM error messages not piped through to MediaKeySession correctly; clients don't receive error events
        https://bugs.webkit.org/show_bug.cgi?id=135312
        <rdar://problem/17817223>

        Reviewed by Brent Fulgham.

        Set (and clear) the client interface so that errors can be piped from the CDMSession up to the MediaKeySession.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::MediaKeySession):
        (WebCore::MediaKeySession::close):

2014-07-25  Jer Noble  <jer.noble@apple.com>

        [MSE] Playback stalls & readyState drops to HAVE_CURRENT_DATA at end of stream with unbalanced buffered SourceBuffers
        https://bugs.webkit.org/show_bug.cgi?id=135291
        <rdar://problem/17715503>

        Reviewed by Sam Weinig.

        Test: media/media-source/media-source-end-of-stream-buffered.html

        When determining the correct ReadyState for the MediaSource in monitorSourceBuffers(), use the same
        definition of "buffered" as is used in the calculation of HTMLMediaElement.buffered and in the
        Stream Ended algorithm. Namely, when the stream has ended, treat each SourceBuffer as if its last
        buffered range extends to the duration of the stream. This allows playback to continue through to
        the duration without stalling due to monitorSourceBuffers().

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::bufferedAccountingForEndOfStream): Added; extends the last range in buffered
            to MediaSource::duration() if the MediaSource is ended.
        (WebCore::SourceBuffer::hasCurrentTime): Uses bufferedAccountingForEndOfStream().
        (WebCore::SourceBuffer::hasFutureTime): Ditto.
        (WebCore::SourceBuffer::canPlayThrough): Ditto.
        * Modules/mediasource/SourceBuffer.h:

        Add a convenience method for determining whether the MediaSource has ended:
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::isEnded):
        * Modules/mediasource/MediaSource.h:

        Add start() and end() methods that don't take a (usually ignored) isValid inout parameter. Add duration()
        and maximumBufferedTime() convenience methods:
        * platform/graphics/PlatformTimeRanges.cpp:
        (WebCore::PlatformTimeRanges::start):
        (WebCore::PlatformTimeRanges::end):
        (WebCore::PlatformTimeRanges::duration):
        (WebCore::PlatformTimeRanges::maximumBufferedTime):
        * platform/graphics/PlatformTimeRanges.h:

2014-07-25  Pratik Solanki  <psolanki@apple.com>

        [iOS] REGRESSION(r171526): Images fail to load sometimes
        https://bugs.webkit.org/show_bug.cgi?id=135304
        <rdar://problem/17811922>

        Reviewed by Alexey Proskuryakov.

        SharedBuffer::createCFData() calls data() as a way to coalesce the data array elements and
        segments into m_buffer. However, data() has an optimization where if we had a single element
        in the data array, it would just return that and not do coalescing. So when we passed
        m_buffer to WebCoreSharedData, we passed a buffer with no data in it.

        Fix this by bringing the optimization to createCFData() and return the CFDataRef from the
        data array if we just have a single element.

        No new tests. Should be covered by existing tests.

        * platform/mac/SharedBufferMac.mm:
        (WebCore::SharedBuffer::createCFData):

2014-07-25  Jer Noble  <jer.noble@apple.com>

        [MSE] High CPU usage in SampleMap::findSamplesWithinPresentationRange() with a large number of buffered samples.
        https://bugs.webkit.org/show_bug.cgi?id=135247

        Reviewed by Geoffrey Garen.

        Anchor our search for overlapping frames to the end of the search range when the overlap range is sufficiently
        close to the end of the search range. The common case for this search is when a sample is about to be appended
        to the end of the sample queue, so this should turn most searches into no-ops.

        * Modules/mediasource/SampleMap.cpp:
        (WebCore::PresentationOrderSampleMap::findSamplesWithinPresentationRangeFromEnd):
        * Modules/mediasource/SampleMap.h:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2014-07-25  Gavin Barraclough  <baraclough@apple.com>

        Yosemite version number is 101000
        https://bugs.webkit.org/show_bug.cgi?id=135301

        Reviewed by Sam Weinig.

        * WebCore.exp.in:
        * platform/ContentFilter.h:
        * platform/mac/ScrollViewMac.mm:
        (WebCore::ScrollView::platformVisibleContentRect):
        * platform/mac/ThemeMac.mm:
        (WebCore::updateStates):
        (WebCore::paintToggleButton):
        * platform/network/cf/CookieJarCFNet.cpp:
        (WebCore::copyCookiesForURLWithFirstPartyURL):
        * platform/network/cf/ResourceRequest.h:
        (WebCore::ResourceRequest::resourcePrioritiesEnabled):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::search):

2014-07-25  David Hyatt  <hyatt@apple.com>

        [New Multicolumn] RenderViews paginated as RL or LR don't handle percentage widths correctly.
        REGRESSION: Images don’t scale to fit in page in vertical text books

        https://bugs.webkit.org/show_bug.cgi?id=135204
        <rdar://problem/17043792>
        
        Reviewed by Simon Fraser.

        Added fast/multicol/pagination/RightToLeft-max-width.html

        * rendering/RenderView.cpp:
        (WebCore::RenderView::availableLogicalHeight):
        Put back in the same code that used to exist for the old columns (but ported to the new
        columns).
    
2014-07-25  Dan Bernstein  <mitz@apple.com>

        [Mac] Unneeded MobileMe workaround in ResourceHandle::receivedCredential
        https://bugs.webkit.org/show_bug.cgi?id=135297

        Reviewed by Alexey Proskuryakov.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::receivedCredential): Removed the site-specific behavior for
        gallery.me.com.

2014-07-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r171480.
        https://bugs.webkit.org/show_bug.cgi?id=135300

        it broke replaced elements in pagination (Requested by dhyatt_
        on #webkit).

        Reverted changeset:

        "Ensure we compute the min and max height of replaced elements
        to 'none' or 0 when appropriate."
        https://bugs.webkit.org/show_bug.cgi?id=135181
        http://trac.webkit.org/changeset/171480

2014-07-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r171587.
        https://bugs.webkit.org/show_bug.cgi?id=135294

        Made fast/dom/HTMLObjectElement/beforeload-set-text-
        crash.xhtml crash again (Requested by ap on #webkit).

        Reverted changeset:

        "REGRESSION (r169105): Crash in selection"
        https://bugs.webkit.org/show_bug.cgi?id=134303
        http://trac.webkit.org/changeset/171587

2014-07-25  Dan Bernstein  <mitz@apple.com>

        ResourceErrorBase::compare doesn’t call the right platformCompare override
        https://bugs.webkit.org/show_bug.cgi?id=135240

        Reviewed by Alexey Proskuryakov.

        * platform/network/ResourceErrorBase.cpp:
        (WebCore::ResourceErrorBase::compare): Changed to call ResourceError::platformCompare.
        * platform/network/cf/ResourceError.h: Made platformCompare public.
        * platform/network/soup/ResourceError.h: Ditto.

2014-07-25  Dan Bernstein  <mitz@apple.com>

        [Cocoa] WebProtectionSpace::receivesCredentialSecurely incorrectly returns false in some cases
        https://bugs.webkit.org/show_bug.cgi?id=135241

        Reviewed by Alexey Proskuryakov.

        * WebCore.exp.in: Export ProtectionSpace::receivesCredentialSecurely.

        * platform/network/cocoa/ProtectionSpaceCocoa.h: Declare override of receivesCredentialSecurely.
        * platform/network/cocoa/ProtectionSpaceCocoa.mm:
        (WebCore::ProtectionSpace::receivesCredentialSecurely): Use -[NSURLProtectionSpace receivesCredentialSecurely].

2014-07-25  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: iOS video playback controls look blurry.
        https://bugs.webkit.org/show_bug.cgi?id=135245
        <rdar://problem/16878037>

        Reviewed by Simon Fraser.

        This patch introduces a compositing parent of the overlay control panel so that
        the transformed overlay panel becomes sharp. This is a workaround for webkit.org/b/135246.

        Can't find a way to test it yet.

        * Modules/mediacontrols/mediaControlsApple.css:
        (video::-webkit-media-controls-panel-composited-parent):
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.createControls):
        (Controller.prototype.addControls):
        * Modules/mediacontrols/mediaControlsiOS.css:
        (video::-webkit-media-controls-panel-composited-parent):
        * Modules/mediacontrols/mediaControlsiOS.js: This is a workaround for webkit.org/b/135248
        It pushes the overlay panel down to close the gap with the video element. Since the
        panel's size in css pixels is scale dependent, the gap needs to be scale dependent too.
        (ControllerIOS.prototype.set pageScaleFactor):

2014-07-24  Dirk Schulze  <krit@webkit.org>

        Turn x/y to presentation attributes
        https://bugs.webkit.org/show_bug.cgi?id=135215

        Reviewed by Dean Jackson.

        This follows the patch for width and height presentation attributes and
        turns x and y to presentation attributes as well:

        http://trac.webkit.org/changeset/171341

        Tests: svg/css/parse-length.html
               transitions/svg-layout-transition.html

        Added copyright where I forgot it in previous patch.

        * css/CSSComputedStyleDeclaration.cpp: Computed style of x and y.
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::isSimpleLengthPropertyID): Add x and y to list.
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder): Resolve x and y.
        * css/SVGCSSParser.cpp:
        (WebCore::CSSParser::parseSVGValue): Parse x and y property.
        * css/SVGCSSPropertyNames.in: Add x and y to list of names.
        * css/StyleResolver.h:
        * page/animation/CSSPropertyAnimation.cpp: Animate x and y as Length.
        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
        * rendering/style/RenderStyle.h: Add x and y setters and getters.
        * rendering/style/SVGRenderStyle.cpp: Add x and y setters for StyleLayoutData.
        (WebCore::SVGRenderStyle::SVGRenderStyle):
        (WebCore::SVGRenderStyle::operator==):
        (WebCore::SVGRenderStyle::copyNonInheritedFrom):
        (WebCore::SVGRenderStyle::diff):
        * rendering/style/SVGRenderStyle.h:
        (WebCore::SVGRenderStyle::setX):
        (WebCore::SVGRenderStyle::setY):
        (WebCore::SVGRenderStyle::x):
        (WebCore::SVGRenderStyle::y):
        * rendering/style/SVGRenderStyleDefs.cpp: Add StyleLayoutData for style storing.
        (WebCore::StyleLayoutData::StyleLayoutData):
        (WebCore::StyleLayoutData::copy):
        (WebCore::StyleLayoutData::operator==):
        * rendering/style/SVGRenderStyleDefs.h:
        (WebCore::StyleLayoutData::create):
        (WebCore::StyleLayoutData::operator!=):
        * rendering/svg/RenderSVGRect.cpp:
        (WebCore::RenderSVGRect::updateShapeFromElement):
        * rendering/svg/SVGPathData.cpp: Use RenderStyle values rather than attribute values.
        (WebCore::updatePathFromRectElement):
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::isTargetAttributeCSSProperty): Fix text detection.
        * svg/SVGElement.cpp: Add x and y to the relevant property lists.
        (WebCore::populateAttributeNameToCSSPropertyIDMap):
        (WebCore::populateCSSPropertyWithSVGDOMNameToAnimatedPropertyTypeMap):
        * svg/SVGFilterElement.cpp: Style update on change of x and y.
        (WebCore::SVGFilterElement::svgAttributeChanged):
        * svg/SVGMaskElement.cpp: Ditto.
        (WebCore::SVGMaskElement::svgAttributeChanged):
        * svg/SVGPatternElement.cpp: Ditto.
        (WebCore::SVGPatternElement::svgAttributeChanged):
        * svg/SVGRectElement.cpp: Ditto.
        (WebCore::SVGRectElement::svgAttributeChanged):
        * svg/SVGTextPositioningElement.cpp: Exclude x and y of text elements since they
            are lists instead of individual values. Solution about to be discussed
            in the WG. Keep current behavior for now.
        (WebCore::SVGTextPositioningElement::collectStyleForPresentationAttribute):
        (WebCore::SVGTextPositioningElement::isPresentationAttribute):
        * svg/SVGTextPositioningElement.h:

2014-07-24  Yusuke Suzuki  <utatane.tea@gmail.com>

        CSS JIT: Implement Pseudo Element
        https://bugs.webkit.org/show_bug.cgi?id=134835

        Reviewed by Benjamin Poulain.

        Implement Pseudo Element handling for CSS JIT SelectorCompiler.
        At first, we start with the simple implementation. We handle limited number of pseudo element,
        before, after, first-line, first-letter.

        Tests: fast/selectors/pseudo-element-inside-any.html
               fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-any.html
               fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-not.html
               fast/selectors/querySelector-pseudo-element.html

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ruleMatches):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::matchRecursively):
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
        (WebCore::SelectorCompiler::constructFragments):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::loadCheckingContext):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::branchOnResolvingModeWithCheckingContext):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::branchOnResolvingMode):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::jumpIfNotResolvingStyle):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsActive):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsHovered):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementHasPseudoElement):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateRequestedPseudoElementEqualsToSelectorPseudoElement):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateMarkPseudoStyleForPseudoElement):
        * cssjit/SelectorCompiler.h:
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:

2014-07-24  Radu Stavila  <stavila@adobe.com>

        REGRESSION (r169105): Crash in selection
        https://bugs.webkit.org/show_bug.cgi?id=134303

        Patch by Radu Stavila <stavila@adobe.com> on 2014-07-24
        Reviewed by David Hyatt.

        When splitting the selection between different subtrees, all subtrees must have their selection cleared before
        starting to apply the new selection. Otherwise, when selecting objects in a named flow thread and going up
        its containing block chain, we can end up in the view's selection root, which has not yet been updated and so
        we get inconsistent data.

        To achieve this goal, the selection update was split into a "clear" and an "apply" method. The updateSelectionForSubtrees
        method first iterates through all subtrees and performs the "clear" method and then starts all over again
        and performs the "apply" method.

        Test: fast/regions/selection/crash-deselect.html

        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderSelectionInfo.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setSelection):
        (WebCore::RenderView::splitSelectionBetweenSubtrees):
        (WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
        (WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
        (WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
        (WebCore::RenderView::setSubtreeSelection): Deleted.
        * rendering/RenderView.h:
        * rendering/SelectionSubtreeRoot.cpp:
        (WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):
        * rendering/SelectionSubtreeRoot.h:
        (WebCore::SelectionSubtreeRoot::OldSelectionData::OldSelectionData):

2014-07-24  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r164401): Placing a caret doesn't bring up autocorrection panel
        https://bugs.webkit.org/show_bug.cgi?id=135278

        Reviewed by Tim Horton.

        The bug was caused by editorUIUpdateTimerFired calling respondToChangedSelection only if the selection was
        triggered by dictation instead of only if it was NOT triggered by dictation.

        Prior to r164401, AlternativeTextController::respondToMarkerAtEndOfWord exited early when SetSelectionOptions
        had DictationTriggered set. r164401 intended to move this check to editorUIUpdateTimerFired to avoid passing
        options around but the boolean condition was erroneously flipped.

        Fixed the bug by negating the condition in editorUIUpdateTimerFired.

        No new tests for now since autocorrection panel cannot be tested automatically. (We should really automate this!)

        * editing/Editor.cpp:
        (WebCore::Editor::editorUIUpdateTimerFired):

2014-07-24  Pratik Solanki  <psolanki@apple.com>

        REGRESSION(r171526): [GTK] Massive crashes.
        https://bugs.webkit.org/show_bug.cgi?id=135283

        Unreviewed. GTK build fix after r171526. Initialize m_buffer in SharedBuffer constructor.

        * platform/soup/SharedBufferSoup.cpp:
        (WebCore::SharedBuffer::SharedBuffer):

2014-07-24  Tim Horton  <timothy_horton@apple.com>

        Crashes under scanSelectionForTelephoneNumbers in Range::text() on some sites
        https://bugs.webkit.org/show_bug.cgi?id=135281
        <rdar://problem/17803347>

        Reviewed by Ryosuke Niwa.

        * editing/Editor.cpp:
        (WebCore::Editor::scanSelectionForTelephoneNumbers):
        toNormalizedRange is not guaranteed to return a non-null range.
        If it returns null, pass the empty markedRanges down to the client as our new set.

2014-07-24  Dan Bernstein  <mitz@apple.com>

        WebCore part of <rdar://problem/17593701> Assertion failure in WebPage::reload (!m_pendingNavigationID) when reloading after a same-document back navigation
        https://bugs.webkit.org/show_bug.cgi?id=135129

        Reviewed by Darin Adler.

        * WebCore.exp.in: Exported equalIgnoringFragmentIdentifier(const URL&, const URL&).

2014-07-24  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK1] CSS viewport units use the wrong viewport size in WebKit1
        https://bugs.webkit.org/show_bug.cgi?id=135254
        <rdar://problem/17781423>

        Reviewed by Tim Horton.

        Test: fast/css/viewport-units-dynamic.html
        
        In WebKit1 on iOS, we want to resolve viewport units against the visible
        viewport, not the legacy WK1 notion of the "viewport" which is the entire document.
        
        Fixes rendering of medium.com articles in WK1 views on iPad.

        * page/FrameView.cpp:
        (WebCore::FrameView::viewportSizeForCSSViewportUnits):

2014-07-24  Myles C. Maxfield  <mmaxfield@apple.com>

        Crash when measuring a glyphs from a fallback SVG font
        https://bugs.webkit.org/show_bug.cgi?id=135264

        Reviewed by Simon Fraser.

        We can't realize font data for all fallback fonts ahead
        of time, but we don't have all the necessary context to
        realize SVG fallback data when it's needed. For now, we
        can just bail; however, a larger, more invasive fix is
        in order.

        Test: svg/text/svg-fallback-font-crash.html

        * platform/graphics/WidthIterator.cpp:
        (WebCore::applyFontTransforms):

2014-07-24  Daniel Bates  <dabates@apple.com>
            And Alexey Proskuryakov  <ap@apple.com>

        [iOS] REGRESSION (WebKit2): Can't login to Wordpress.com, facebook.com when always allowing cookies
        https://bugs.webkit.org/show_bug.cgi?id=135273
        <rdar://problem/17598815>

        Reviewed by Alexey Proskuryakov.

        Fixes an issue where cookies may be created in the wrong cookie store.

        Currently, when we update the CFURLRequest object associated with a ResourceRequest object
        we explicitly set a cookie storage, cookie accept policy, and SSL properties based on the
        corresponding values in the old CFURLRequest object (if we have one). This ultimately leads
        to CFNetwork associating the cookies for the request with a different cookie store when we
        handle the request in the NetworkProcess. Instead, we shouldn't set these properties
        explicitly as we already copy them implicitly earlier (via CFURLRequestCreateMutableCopy()).

        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doUpdatePlatformRequest):

2014-07-24  Peyton Randolph  <prandolph@apple.com>

        Rename feature flag for long-press gesture on Mac.                                                                   
        https://bugs.webkit.org/show_bug.cgi?id=135259                                                                  

        Reviewed by Beth Dakin.

        * Configurations/FeatureDefines.xcconfig:
        Rename LINK_LONG_PRESS to MAC_LONG_PRESS.

2014-07-24  Dan Bernstein  <mitz@apple.com>

        Fixed Windows build fix.

        * platform/network/cf/AuthenticationCF.cpp:

2014-07-24  Dan Bernstein  <mitz@apple.com>

        Attempted Windows build fix.

        * platform/network/cf/AuthenticationCF.cpp:
        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
        * platform/network/cf/CredentialStorageCFNet.cpp:
        (WebCore::CredentialStorage::getFromPersistentStorage):
        * platform/network/cf/ProtectionSpaceCFNet.cpp:
        (WebCore::ProtectionSpace::receivesCredentialSecurely):
        (WebCore::ProtectionSpaceBase::receivesCredentialSecurely): Deleted.

2014-07-24  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/17766348> [Cocoa] WebCore::ProtectionSpace doesn’t preserve all NSURLProtectionSpace properties, such as the distinguishedNames array
        https://bugs.webkit.org/show_bug.cgi?id=135229

        Reviewed by Alexey Proskuryakov.

        * CMakeLists.txt: Updated for rename of a source file.

        * WebCore.exp.in: Updated.

        * WebCore.vcxproj/WebCore.vcxproj: Updated for rename of source files, added
        ProtectionSpaceCFNet.{cpp,h}.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.

        * WebCore.xcodeproj/project.pbxproj: Updated for rename of source files, added
        ProtectionSpaceCococa.{h.mm}.

        * platform/network/ProtectionSpace.cpp: Renamed to ProtectionSpaceBase.cpp.
        * platform/network/ProtectionSpace.h: This file was renamed to ProtectionSpaceBase.h, and
        in its place added a generic ProtectionSpace class that just derives from
        ProtectionSpaceBase. For Cocoa and CFNetwork, ProtectionSpace{Cocoa,CFNet}.h is included
        instead of the generic class.

        * platform/network/ProtectionSpaceBase.cpp: Renamed ProtectionSpace.cpp to this.
        (WebCore::ProtectionSpaceBase::ProtectionSpaceBase): Updated for rename.
        (WebCore::ProtectionSpaceBase::host): Ditto.
        (WebCore::ProtectionSpaceBase::port): Ditto.
        (WebCore::ProtectionSpaceBase::serverType): Ditto.
        (WebCore::ProtectionSpaceBase::isProxy): Ditto.
        (WebCore::ProtectionSpaceBase::realm): Ditto.
        (WebCore::ProtectionSpaceBase::authenticationScheme): Ditto.
        (WebCore::ProtectionSpaceBase::receivesCredentialSecurely): Removed CFNetwork-specific part,
        which is now implemented in ProtectionSpaceCFNet.cpp.
        (WebCore::ProtectionSpaceBase::compare): Replaced operator== with this, and made it call
        ProtectionSpace::platformCompare at the end if needed.

        * platform/network/ProtectionSpaceBase.h: Renamed ProtectionSpace.h to this.
        (WebCore::ProtectionSpaceBase::encodingRequiresPlatformData): Added with a default
        implementation that returns false, for ProtectionSpace implementations to override.
        (WebCore::ProtectionSpaceBase::platformCompare): Added with a default implementation that
        returns true, for ProtectionSpace implementations to override.
        (WebCore::operator==): Changed to call compare.

        * platform/network/cf/AuthenticationCF.cpp:
        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Changed to use the
        ProtectionSpace constructor that takes a CFURLProtectionSpaceRef.
        (WebCore::createCF): Changed to use ProtectionSpace::cfSpace.

        * platform/network/cf/AuthenticationCF.h: Guarded a couple of functiosn that aren’t used in
        Cocoa with #if PLATFORM(WIN).

        * platform/network/cf/CredentialStorageCFNet.cpp:
        (WebCore::CredentialStorage::getFromPersistentStorage): Changed to use
        ProtectionSpace::cfSpace.
        (WebCore::CredentialStorage::saveToPersistentStorage): Ditto.

        * platform/network/cf/ProtectionSpaceCFNet.cpp: Added.
        (WebCore::ProtectionSpaceBase::receivesCredentialSecurely): Override with the
        CFNetwork-specific test that was previously in ProtectionSpace.cpp.

        * platform/network/cf/ProtectionSpaceCFNet.h: Copied from Source/WebCore/platform/network/ProtectionSpace.h.
        Declare ProtectionSpace and override receivesCredentialSecurely.

        * platform/network/mac/AuthenticationMac.h: Deleted the ProtectionSpace core() and mac().
        * platform/network/mac/AuthenticationMac.mm:
        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Changed to use the
        ProtectionSpace constructor that takes an NSURLProtectionSpace.
        (WebCore::mac): Changed to use ProtectionSpace::nsSpace.

        * platform/network/mac/CredentialStorageMac.mm:
        (WebCore::CredentialStorage::getFromPersistentStorage): Ditto.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::receivedCredential): Changed to use the ProtectionSpace
        constructor that takes an NSURLProtectionSpace.

        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:canAuthenticateAgainstProtectionSpace:]):
        Ditto.

        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:canAuthenticateAgainstProtectionSpace:]):
        Ditto.

2014-07-24  Benjamin Poulain  <benjamin@webkit.org>

        [WK2] Fixed/Sticky layers can get mispositioned when the layer tree commit change their position or size
        https://bugs.webkit.org/show_bug.cgi?id=135227
        <rdar://problem/17279500>

        Reviewed by Simon Fraser.

        Keep track of the creation/destruction of Fixed and Sticky nodes in the ScrollingTree.

        * page/scrolling/ScrollingTree.cpp:
        (WebCore::ScrollingTree::ScrollingTree):
        * page/scrolling/ScrollingTree.h:
        (WebCore::ScrollingTree::hasFixedOrSticky):
        (WebCore::ScrollingTree::fixedOrStickyNodeAdded):
        (WebCore::ScrollingTree::fixedOrStickyNodeRemoved):
        * page/scrolling/mac/ScrollingTreeFixedNode.mm:
        (WebCore::ScrollingTreeFixedNode::ScrollingTreeFixedNode):
        (WebCore::ScrollingTreeFixedNode::~ScrollingTreeFixedNode):
        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
        (WebCore::ScrollingTreeStickyNode::ScrollingTreeStickyNode):
        (WebCore::ScrollingTreeStickyNode::~ScrollingTreeStickyNode):

2014-07-24  Wenson Hsieh  <wenson_hsieh@apple.com>

        Let WheelEvent wrap a PlatformWheelEvent
        https://bugs.webkit.org/show_bug.cgi?id=135244

        When WheelEvent is initialized with a PlatformWheelEvent, store that PlatformWheelEvent for future use.

        Reviewed by Beth Dakin.

        No new tests because behavior should not have changed.

        * dom/WheelEvent.cpp: Added method to access the PlatformWheelEvent.
        (WebCore::WheelEvent::WheelEvent):
        * dom/WheelEvent.h: Added field to store PlatformWheelEvent, if initialized via PlatformWheelEvent.
        (WebCore::WheelEvent::wheelEvent):

2014-07-24  Brian J. Burg  <burg@cs.washington.edu>

        Web Replay: don't encode/decode primitive types that lack explicit sizes
        https://bugs.webkit.org/show_bug.cgi?id=133430

        Reviewed by Anders Carlsson.

        Remove uses of unsigned long in encode/decode methods because the type lacks an
        explicit size. Move frame index serialization away from using unsigned long.

        * replay/ReplayController.cpp:
        (WebCore::logDispatchedDOMEvent): Fix the format string.
        * replay/SerializationMethods.cpp:
        (WebCore::frameIndexFromDocument):
        (WebCore::frameIndexFromFrame):
        (WebCore::documentFromFrameIndex):
        (WebCore::frameFromFrameIndex):
        (JSC::EncodingTraits<PluginData>::encodeValue):
        (JSC::EncodingTraits<PluginData>::decodeValue):
        * replay/SerializationMethods.h:
        * replay/WebInputs.json: Remove primitive types without explicit sizes.

2014-07-24  Pratik Solanki  <psolanki@apple.com>

        Sharing SharedBuffer between WebCore and ImageIO is racy and crash prone
        https://bugs.webkit.org/show_bug.cgi?id=135069
        <rdar://problem/17470655>

        Reviewed by Simon Fraser.

        When passing image data to ImageIO for decoding, we pass an NSData subclass that is a wraper
        around SharedBuffer. This can be a problem when ImageIO tries to access the data on the CA
        thread. End result is data corruption on large image loads and potential crashes. The fix is
        to have SharedBuffer create a copy of its data if the data has been passed to ImageIO and
        might be accessed concurrently.

        Since Vector is not refcounted, we do this by having a new refcounted object in SharedBuffer
        that contains the buffer and we pass that in our NSData subclass WebCoreSharedBufferData.
        Code that would result in the Vector memory moving e.g. append(), resize(), now checks to
        see if the buffer was shared and if so, will create a new copy of the vector. This ensures
        that the main thread does not end up invalidating the vector memory that we have passed it
        to ImageIO.

        No new tests because no functional changes.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::makePurgeable):
            Remove early return - createPurgeableMemory() has the correct check now.
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::SharedBuffer):
        (WebCore::SharedBuffer::adoptVector):
        (WebCore::SharedBuffer::createPurgeableBuffer):
            Don't create purgeable buffer if we are sharing the buffer.
        (WebCore::SharedBuffer::append):
        (WebCore::SharedBuffer::clear):
        (WebCore::SharedBuffer::copy):
        (WebCore::SharedBuffer::duplicateDataBufferIfNecessary): Added.
            Create a new copy of the data if we have shared the buffer and if appending to it would
            exceed the capacity of the vector resulting in memmove.
        (WebCore::SharedBuffer::appendToInternalBuffer): Added.
        (WebCore::SharedBuffer::clearInternalBuffer): Added.
        (WebCore::SharedBuffer::buffer):
            Create a new copy of the buffer if we have shared it.
        (WebCore::SharedBuffer::getSomeData):
        * platform/SharedBuffer.h:
        * platform/cf/SharedBufferCF.cpp:
        (WebCore::SharedBuffer::SharedBuffer):
        (WebCore::SharedBuffer::singleDataArrayBuffer):
        (WebCore::SharedBuffer::maybeAppendDataArray):
        * platform/mac/SharedBufferMac.mm:
            Pass the InternalBuffer object to WebCoreSharedBufferData
        (-[WebCoreSharedBufferData dealloc]):
        (-[WebCoreSharedBufferData initWithSharedBufferInternalBuffer:]):
        (-[WebCoreSharedBufferData length]):
        (-[WebCoreSharedBufferData bytes]):
        (WebCore::SharedBuffer::createNSData):
            Call createCFData() instead of duplicating code.
        (WebCore::SharedBuffer::createCFData):
            If the data is in purgeable memory, make a copy of it since m_buffer was cleared when
            creating the purgeable buffer.
        (-[WebCoreSharedBufferData initWithSharedBuffer:]): Deleted.

2014-07-24  peavo@outlook.com  <peavo@outlook.com>

        [Curl] Enable file logging.
        https://bugs.webkit.org/show_bug.cgi?id=135202

        Reviewed by Alex Christensen.

        The Curl api offers the possibility to write log messages to file. Enable this for debugging purposes.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::ResourceHandleManager):
        (WebCore::ResourceHandleManager::~ResourceHandleManager):
        (WebCore::ResourceHandleManager::initializeHandle):
        * platform/network/curl/ResourceHandleManager.h:

2014-07-24  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>

        Sort WebCore.exp.in after r171252
        https://bugs.webkit.org/show_bug.cgi?id=135239

        Reviewed by Csaba Osztrogonác.

        * WebCore.exp.in:

2014-07-24  Mihnea Ovidenie  <mihnea@adobe.com>

        [New Multicolumn] Assertion failure when an input element has multicolumn style
        https://bugs.webkit.org/show_bug.cgi?id=135234

        Reviewed by Andrei Bucur.

        Restrict the assertion in RenderBlock::canComputeRegionRangeForBox
        only to RenderNamedFlowThread objects since for RenderMultiColumnFlowThread
        objects we can compute a range of regions during their parent block layout.   

        Test: fast/multicol/newmulticol/input-as-multicol.html

        * rendering/RenderBlock.cpp:
        (WebCore::canComputeRegionRangeForBox):

2014-07-23  Jeremy Jones  <jeremyj@apple.com>

        Transparent fullscreen background when video is not present.
        https://bugs.webkit.org/show_bug.cgi?id=135226

        Reviewed by Simon Fraser.

        Set background to black just before beginning the animation to fullscreen.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::enterFullscreen): set background color black.

2014-07-23  Joseph Pecoraro  <pecoraro@apple.com>

        ScriptController::updateDocument ASSERT mutating map while iterating map
        https://bugs.webkit.org/show_bug.cgi?id=135211

        Reviewed by Oliver Hunt.

        Avoid iterating over m_windowShells in more places. This prevents
        the possibility of a collection during JSC allocation which might
        cause a mutation to m_windowShells (HTMLMediaElement destruction).

        Have ScriptController defriend ScriptCachedFrameData by providing
        a getter for the list of window shells.

        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
        (WebCore::ScriptCachedFrameData::restore):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::windowShells):
        (WebCore::ScriptController::clearWindowShell):
        (WebCore::ScriptController::attachDebugger):
        (WebCore::ScriptController::updateDocument):
        * bindings/js/ScriptController.h:

2014-07-23  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r171498.
        https://bugs.webkit.org/show_bug.cgi?id=135223

        It will regress some scroll position restoration on navigation
        (r167916). (Requested by smfr on #webkit).

        Reverted changeset:

        "[iOS WK2] Header bar on nytimes articles lands in the wrong
        place after rubberbanding"
        https://bugs.webkit.org/show_bug.cgi?id=135221
        http://trac.webkit.org/changeset/171498

2014-07-23  Tim Horton  <timothy_horton@apple.com>

        REGRESSION (r171376): Sometimes we detect less than the whole phone number
        https://bugs.webkit.org/show_bug.cgi?id=135220
        <rdar://problem/17783423>

        Reviewed by Brady Eidson.

        * editing/Editor.cpp:
        (WebCore::Editor::scanSelectionForTelephoneNumbers):
        Use the visible selection's start and end instead of base and extent, because they'll
        always be in the right order in the case of a directional selection (base can be *after* extent
        if you select from right to left). This fixes the code that expands the selection.

        Pass the *entire* expanded selection to DataDetectors, instead of using TextIterator.
        This way, we will find each number only once, and will never get part of a phone number once
        and then the whole phone number later.

2014-07-23  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] Header bar on nytimes articles lands in the wrong place after rubberbanding
        https://bugs.webkit.org/show_bug.cgi?id=135221

        Reviewed by Tim Horton.

        Add a function on GraphicsLayer to force a flush of the layer position
        to the underlying graphics system, so that when layers cease being
        scroll-coordinated, we can ensure that their layers are repositioned
        in the correct location.

        * WebCore.exp.in:
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::forcePositionUpdate):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::forcePositionUpdate):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer):

2014-07-23  Pratik Solanki  <psolanki@apple.com>

        Get rid of SharedBuffer::NSDataRetainPtrWithoutImplicitConversionOperator
        https://bugs.webkit.org/show_bug.cgi?id=135219

        Reviewed by Anders Carlsson.

        No new tests because no functional changes.

        * loader/ResourceBuffer.h:
        * loader/mac/ResourceBuffer.mm:
        (WebCore::ResourceBuffer::createNSData):
        * platform/SharedBuffer.h:
        (WebCore::SharedBuffer::NSDataRetainPtrWithoutImplicitConversionOperator::NSDataRetainPtrWithoutImplicitConversionOperator): Deleted.
        * platform/mac/SharedBufferMac.mm:
        (WebCore::SharedBuffer::createNSData):

2014-07-23  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Cleanup RenderLayerCompositor::deviceScaleFactor()
        https://bugs.webkit.org/show_bug.cgi?id=135208

        Reviewed by Simon Fraser.

        Use m_renderView.document() to retrieve device scale factor value. m_renderView.document()
        is always available while this->page() is not.

        No change in behavior.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateTransform):
        (WebCore::RenderLayerBacking::computeTransformOriginForPainting):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::deviceScaleFactor):

2014-07-23  peavo@outlook.com  <peavo@outlook.com>

        [WinCairo] Gstreamer rendering is not working.
        https://bugs.webkit.org/show_bug.cgi?id=135201

        Reviewed by Alex Christensen.

        WinCairo does not support accelerated rendering yet.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        (WebCore::MediaPlayerPrivateGStreamerBase::supportsAcceleratedRendering):

2014-07-23  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r171455.
        https://bugs.webkit.org/show_bug.cgi?id=135209

        completely broke selection highlight invalidation (Requested
        by thorton on #webkit).

        Reverted changeset:

        "REGRESSION (r169105): Crash in selection"
        https://bugs.webkit.org/show_bug.cgi?id=134303
        http://trac.webkit.org/changeset/171455

2014-07-23  Alex Christensen  <achristensen@webkit.org>

        Compile window-inactive and fullscreen pseudoclasses in css selectors.
        https://bugs.webkit.org/show_bug.cgi?id=135200

        Reviewed by Benjamin Poulain.

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        Removed the check of context.hasSelectionPseudo for a window-inactive pseudoclass.
        Moved logic to SelectorCheckerTestFunctions.h to share with the selector compiler.
        * css/SelectorCheckerTestFunctions.h:
        (WebCore::isWindowInactive):
        (WebCore::matchesFullScreenAnimatingFullScreenTransitionPseudoClass):
        (WebCore::matchesFullScreenAncestorPseudoClass):
        (WebCore::matchesFullScreenDocumentPseudoClass):
        Added from SelectorChecker.cpp.
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::addPseudoClassType):
        Added unoptimized pseudoclass cases for window-inactive and fullscreen pseudoclasses.
        Explicitly listed uncompiled pseudoclasses for future work instead of using a default.

2014-07-23  Brent Fulgham  <bfulgham@apple.com>

        [Win] Use NO_RETURN_DUE_TO_CRASH on Windows.
        https://bugs.webkit.org/show_bug.cgi?id=13519

        Reviewed by Mark Lam.

        * svg/SVGZoomAndPan.h: Add NO_RETURN_DUE_TO_CRASH to
        header so function declarations match implementation.

2014-07-23  Joseph Pecoraro  <pecoraro@apple.com>

        JSDOMWindowShell leaks on pages with media elements
        https://bugs.webkit.org/show_bug.cgi?id=135178

        Reviewed by Oliver Hunt.

        The DOMWindowWorld for HTMLMediaElements with MEDIA_CONTROLS_SCRIPT
        was not getting cleared and removed.

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::clearWindowShell):
        Iterate over a copy of the values. A sweep / garbage collection caused by
        any JSC allocation during iteration could trigger a mutation of the m_windowShells
        table that was being iterating. So instead iterate a list that won't mutate.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        If we had an isolated world, release as much memory as possible.

2014-07-23  Bem Jones-Bey  <bjonesbe@adobe.com>

        Ensure we compute the min and max height of replaced elements to 'none' or 0 when appropriate.
        https://bugs.webkit.org/show_bug.cgi?id=135181

        Reviewed by David Hyatt.

        If a replaced element has a percentage min or max height specified then that height value should
        compute to 'none' for max-height and 0 for min-height when its containing block
        does not have a height 'specified explicitly'.

        This is based on a Blink patch by Robert Hogan.

        Tests: css2.1/20110323/max-height-percentage-003.html
               fast/replaced/max-height-percentage-quirks.html
               fast/replaced/min-height-percentage-quirks.html
               fast/replaced/min-height-percentage.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::logicalHeightComputesAsNone):
        (WebCore::RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight):
        * rendering/RenderBox.h:

2014-07-23  Bem Jones-Bey  <bjonesbe@adobe.com>

        Remove CSS_EXCLUSIONS compile flag and leftover code
        https://bugs.webkit.org/show_bug.cgi?id=135175

        Reviewed by Zoltan Horvath.

        At this point, the CSS_EXCLUSIONS flag guards nothing but some useless
        stubs. This removes the flag and the useless code.

        No new tests, just removing code.

        * Configurations/FeatureDefines.xcconfig:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setCSSExclusionsEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::cssExclusionsEnabled): Deleted.
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setCSSExclusionsEnabled): Deleted.
        * testing/InternalSettings.h:
        * testing/InternalSettings.idl:

2014-07-23  Jer Noble  <jer.noble@apple.com>

        [MSE][Mac] Support abort() in SourceBufferPrivateAVFObjC.
        https://bugs.webkit.org/show_bug.cgi?id=135163

        Reviewed by Brent Fulgham.

        Recreate the parser when asked to abort().

        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (WebCore::SourceBufferPrivateAVFObjC::abort):

2014-07-23  Myles C. Maxfield  <mmaxfield@apple.com>

        Migrate accessibility/ to using nullptr instead of 0
        https://bugs.webkit.org/show_bug.cgi?id=135185

        Reviewed by Simon Fraser.

        No new tests because there is no behavior change.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::focusedImageMapUIElement):
        (WebCore::AXObjectCache::focusedUIElementForPage):
        (WebCore::AXObjectCache::get):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::rootObject):
        (WebCore::AXObjectCache::rootObjectForFrame):
        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::focusedUIElementForPage):
        (WebCore::AXObjectCache::get):
        (WebCore::AXObjectCache::getOrCreate):
        (WebCore::AXObjectCache::rootObject):
        (WebCore::AXObjectCache::rootObjectForFrame):
        (WebCore::AXObjectCache::rootAXEditableElement):
        * accessibility/AccessibilityARIAGridRow.cpp:
        (WebCore::AccessibilityARIAGridRow::disclosedByRow):
        * accessibility/AccessibilityImageMapLink.cpp:
        (WebCore::AccessibilityImageMapLink::AccessibilityImageMapLink):
        (WebCore::AccessibilityImageMapLink::parentObject):
        * accessibility/AccessibilityListBox.cpp:
        (WebCore::AccessibilityListBox::listBoxOptionAccessibilityObject):
        (WebCore::AccessibilityListBox::elementAccessibilityHitTest):
        * accessibility/AccessibilityListBoxOption.cpp:
        (WebCore::AccessibilityListBoxOption::AccessibilityListBoxOption):
        (WebCore::AccessibilityListBoxOption::parentObject):
        (WebCore::AccessibilityListBoxOption::listBoxOptionParentNode):
        * accessibility/AccessibilityMenuListPopup.cpp:
        (WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):
        * accessibility/AccessibilityMockObject.cpp:
        (WebCore::AccessibilityMockObject::AccessibilityMockObject):
        * accessibility/AccessibilityMockObject.h:
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::detach):
        (WebCore::AccessibilityNodeObject::firstChild):
        (WebCore::AccessibilityNodeObject::lastChild):
        (WebCore::AccessibilityNodeObject::previousSibling):
        (WebCore::AccessibilityNodeObject::nextSibling):
        (WebCore::AccessibilityNodeObject::parentObject):
        (WebCore::AccessibilityNodeObject::document):
        (WebCore::AccessibilityNodeObject::anchorElement):
        (WebCore::nativeActionElement):
        (WebCore::AccessibilityNodeObject::actionElement):
        (WebCore::AccessibilityNodeObject::mouseButtonListener):
        (WebCore::AccessibilityNodeObject::labelForElement):
        (WebCore::AccessibilityNodeObject::menuItemElementForMenu):
        (WebCore::AccessibilityNodeObject::menuButtonForMenu):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::AccessibilityObject):
        (WebCore::AccessibilityObject::detach):
        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
        (WebCore::AccessibilityObject::findMatchingObjects):
        (WebCore::renderListItemContainerForNode):
        (WebCore::AccessibilityObject::accessibilityObjectForPosition):
        (WebCore::AccessibilityObject::document):
        (WebCore::AccessibilityObject::page):
        (WebCore::AccessibilityObject::documentFrameView):
        (WebCore::AccessibilityObject::anchorElementForNode):
        (WebCore::AccessibilityObject::headingElementForNode):
        (WebCore::AccessibilityObject::firstAnonymousBlockChild):
        (WebCore::AccessibilityObject::element):
        (WebCore::AccessibilityObject::focusedUIElement):
        (WebCore::AccessibilityObject::scrollToMakeVisibleWithSubFocus):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::node):
        (WebCore::AccessibilityObject::renderer):
        (WebCore::AccessibilityObject::selectedRadioButton):
        (WebCore::AccessibilityObject::selectedTabItem):
        (WebCore::AccessibilityObject::accessibilityHitTest):
        (WebCore::AccessibilityObject::firstChild):
        (WebCore::AccessibilityObject::lastChild):
        (WebCore::AccessibilityObject::previousSibling):
        (WebCore::AccessibilityObject::nextSibling):
        (WebCore::AccessibilityObject::parentObjectIfExists):
        (WebCore::AccessibilityObject::observableObject):
        (WebCore::AccessibilityObject::titleUIElement):
        (WebCore::AccessibilityObject::correspondingLabelForControlElement):
        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
        (WebCore::AccessibilityObject::scrollBar):
        (WebCore::AccessibilityObject::anchorElement):
        (WebCore::AccessibilityObject::actionElement):
        (WebCore::AccessibilityObject::widget):
        (WebCore::AccessibilityObject::widgetForAttachmentView):
        (WebCore::AccessibilityObject::activeDescendant):
        (WebCore::AccessibilityObject::mathRadicandObject):
        (WebCore::AccessibilityObject::mathRootIndexObject):
        (WebCore::AccessibilityObject::mathUnderObject):
        (WebCore::AccessibilityObject::mathOverObject):
        (WebCore::AccessibilityObject::mathNumeratorObject):
        (WebCore::AccessibilityObject::mathDenominatorObject):
        (WebCore::AccessibilityObject::mathBaseObject):
        (WebCore::AccessibilityObject::mathSubscriptObject):
        (WebCore::AccessibilityObject::mathSuperscriptObject):
        (WebCore::AccessibilityObject::getScrollableAreaIfScrollable):
        * accessibility/AccessibilityProgressIndicator.cpp:
        (WebCore::AccessibilityProgressIndicator::progressElement):
        (WebCore::AccessibilityProgressIndicator::meterElement):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::detach):
        (WebCore::AccessibilityRenderObject::renderBoxModelObject):
        (WebCore::AccessibilityRenderObject::firstChild):
        (WebCore::AccessibilityRenderObject::lastChild):
        (WebCore::startOfContinuations):
        (WebCore::childBeforeConsideringContinuations):
        (WebCore::AccessibilityRenderObject::previousSibling):
        (WebCore::AccessibilityRenderObject::nextSibling):
        (WebCore::nextContinuation):
        (WebCore::AccessibilityRenderObject::renderParentObject):
        (WebCore::AccessibilityRenderObject::parentObject):
        (WebCore::AccessibilityRenderObject::anchorElement):
        (WebCore::AccessibilityRenderObject::textUnderElement):
        (WebCore::AccessibilityRenderObject::node):
        (WebCore::AccessibilityRenderObject::labelElementContainer):
        (WebCore::AccessibilityRenderObject::internalLinkElement):
        (WebCore::AccessibilityRenderObject::titleUIElement):
        (WebCore::AccessibilityRenderObject::setFocused):
        (WebCore::AccessibilityRenderObject::topRenderer):
        (WebCore::AccessibilityRenderObject::document):
        (WebCore::AccessibilityRenderObject::widget):
        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
        (WebCore::AccessibilityRenderObject::documentFrameView):
        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
        (WebCore::AccessibilityRenderObject::rootEditableElementForPosition):
        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
        (WebCore::AccessibilityRenderObject::remoteSVGElementHitTest):
        (WebCore::AccessibilityRenderObject::accessibilityHitTest):
        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
        (WebCore::AccessibilityRenderObject::correspondingLabelForControlElement):
        (WebCore::AccessibilityRenderObject::observableObject):
        (WebCore::AccessibilityRenderObject::inheritsPresentationalRole):
        (WebCore::AccessibilityRenderObject::detachRemoteSVGRoot):
        (WebCore::AccessibilityRenderObject::addHiddenChildren):
        (WebCore::AccessibilityRenderObject::setAccessibleName):
        (WebCore::AccessibilityRenderObject::getScrollableAreaIfScrollable):
        (WebCore::AccessibilityRenderObject::mathRadicandObject):
        (WebCore::AccessibilityRenderObject::mathRootIndexObject):
        (WebCore::AccessibilityRenderObject::mathNumeratorObject):
        (WebCore::AccessibilityRenderObject::mathDenominatorObject):
        (WebCore::AccessibilityRenderObject::mathUnderObject):
        (WebCore::AccessibilityRenderObject::mathOverObject):
        (WebCore::AccessibilityRenderObject::mathBaseObject):
        (WebCore::AccessibilityRenderObject::mathSubscriptObject):
        (WebCore::AccessibilityRenderObject::mathSuperscriptObject):
        * accessibility/AccessibilitySVGRoot.cpp:
        (WebCore::AccessibilitySVGRoot::AccessibilitySVGRoot):
        * accessibility/AccessibilityScrollView.cpp:
        (WebCore::AccessibilityScrollView::detach):
        (WebCore::AccessibilityScrollView::scrollBar):
        (WebCore::AccessibilityScrollView::updateScrollbars):
        (WebCore::AccessibilityScrollView::addChildScrollbar):
        (WebCore::AccessibilityScrollView::clearChildren):
        (WebCore::AccessibilityScrollView::webAreaObject):
        (WebCore::AccessibilityScrollView::accessibilityHitTest):
        (WebCore::AccessibilityScrollView::documentFrameView):
        (WebCore::AccessibilityScrollView::parentObject):
        (WebCore::AccessibilityScrollView::parentObjectIfExists):
        * accessibility/AccessibilityScrollbar.cpp:
        (WebCore::AccessibilityScrollbar::document):
        * accessibility/AccessibilitySpinButton.cpp:
        (WebCore::AccessibilitySpinButton::AccessibilitySpinButton):
        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::AccessibilityTable):
        (WebCore::AccessibilityTable::clearChildren):
        (WebCore::AccessibilityTable::cellForColumnAndRow):
        * accessibility/AccessibilityTableCell.cpp:
        (WebCore::AccessibilityTableCell::parentTable):
        (WebCore::AccessibilityTableCell::titleUIElement):
        * accessibility/AccessibilityTableColumn.cpp:
        (WebCore::AccessibilityTableColumn::headerObject):
        (WebCore::AccessibilityTableColumn::headerObjectForSection):
        * accessibility/AccessibilityTableRow.cpp:
        (WebCore::AccessibilityTableRow::parentTable):
        (WebCore::AccessibilityTableRow::headerObject):
        * accessibility/ios/AXObjectCacheIOS.mm:
        (WebCore::AXObjectCache::detachWrapper):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper detach]):
        (-[WebAccessibilityObjectWrapper tableCellParent]):
        (-[WebAccessibilityObjectWrapper tableParent]):
        (-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
        (-[WebAccessibilityObjectWrapper convertRectToScreenSpace:]):
        (rendererForView):
        (-[WebAccessibilityObjectWrapper _convertToDOMRange:]):
        * accessibility/mac/AXObjectCacheMac.mm:
        (WebCore::AXObjectCache::detachWrapper):
        * accessibility/mac/AccessibilityObjectMac.mm:
        (WebCore::AccessibilityObject::detachFromParent):
        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
        (-[WebAccessibilityObjectWrapperBase detach]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (CreateCGColorIfDifferent):
        (-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
        (rendererForView):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        * accessibility/win/AccessibilityObjectWrapperWin.h:
        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):

2014-07-23  Mihnea Ovidenie  <mihnea@adobe.com>

        ASSERTION FAILED: generatingElement() in WebCore::RenderNamedFlowFragment::regionOversetState
        https://bugs.webkit.org/show_bug.cgi?id=135153

        Reviewed by David Hyatt.

        Even though the CSSRegions spec defines the behaviour of a multicolumn region,
        we currently do not support this functionality. This patch ensures that a multicolumn
        element does not become a region. In the future, when we will implement the multicolumn
        as region functionality, http://dev.w3.org/csswg/css-regions/#multi-column-regions, we
        will remove this restriction.

        Test: fast/regions/multicol-as-region-prevented.html

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):

2014-07-23  Zan Dobersek  <zdobersek@igalia.com>

        [CMake] Avoid building WebCore with ANGLE's OpenGL/EGL headers
        https://bugs.webkit.org/show_bug.cgi?id=135167

        Reviewed by Martin Robinson.

        * CMakeLists.txt: Don't add ANGLE/include to the WebCore_INCLUDE_DIRECTORIES list
        as this results in ANGLE's OpenGL and EGL headers being included, instead of the
        headers that are provided by the system. Only the ANGLESupport library should be built
        with that specific header inclusion path.

2014-07-10  Radu Stavila  <stavila@adobe.com>

        REGRESSION (r169105): Crash in selection
        https://bugs.webkit.org/show_bug.cgi?id=134303

        Reviewed by David Hyatt.

        When splitting the selection between different subtrees, all subtrees must have their selection cleared before
        starting to apply the new selection. Otherwise, when selecting objects in a named flow thread and going up
        its containing block chain, we can end up in the view's selection root, which has not yet been updated and so
        we get inconsistent data.

        To achieve this goal, the selection update was split into a "clear" and an "apply" method. The updateSelectionForSubtrees
        method first iterates through all subtrees and performs the "clear" method and then starts all over again
        and performs the "apply" method.

        Also, the selectionStart/End members in RenderView have been renamed to fix problems caused by the fact that
        RenderView inherits SelectionSubtreeRoot, which also has the same selectionStart/End members.

        Test: fast/regions/selection/crash-deselect.html

        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::isSelectionRoot):
        * rendering/RenderSelectionInfo.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        (WebCore::RenderView::setSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
        (WebCore::RenderView::splitSelectionBetweenSubtrees):
        (WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
        (WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
        (WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
        (WebCore::RenderView::getSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
        (WebCore::RenderView::setSubtreeSelection): Deleted.
        * rendering/RenderView.h:
        * rendering/SelectionSubtreeRoot.cpp:
        (WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):
        * rendering/SelectionSubtreeRoot.h:
        (WebCore::SelectionSubtreeRoot::OldSelectionData::OldSelectionData):

2014-07-22  Brent Fulgham  <bfulgham@apple.com>

        [Win] Build fix for bot.

        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::createLegibleOutputSubtypes): Declare 'wvtt' locally, rather
        than relying on potentially unavailable declaration.

2014-07-22  Brent Fulgham  <bfulgham@apple.com>

        [Win] Build fix for Windows bots

        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Provide missing
        structure definition when needed by bot.

2014-07-22  Brent Fulgham  <bfulgham@apple.com>

        [Win] Build fix for EWS bots.

        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Forward declare
        structure definition.

2014-07-22  Brent Fulgham  <bfulgham@apple.com>

        [Win] Fix Crash when handling Legible Output callbacks
        https://bugs.webkit.org/show_bug.cgi?id=134946

        Reviewed by Dean Jackson.

        Relanding after adding fixes to support build bots.

        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
        (WebCore::InbandTextTrackPrivateAVF::processNativeSamples): Remove
        Windows-specific 'ASSERT_NOT_REACHED' code path.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::createLegibleOutputSubtypes): Added.
        (WebCore::AVFWrapper::createPlayerItem): Updated to request native
        samples from AVFoundationCF.

2014-07-16  Myles C. Maxfield  <mmaxfield@apple.com>

        Copying and pasting trivial H2 content causes a crash in firstPositionInNode
        https://bugs.webkit.org/show_bug.cgi?id=134897

        Reviewed by Ryosuke Niwa.

        ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder() attempts
        to move pasted headings out of existed headings, with out regard to if the existing
        heading is the contenteditable root.

        Test: editing/pasteboard/heading-crash.html

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):

2014-07-22  Ryuan Choi  <ryuan.choi@samsung.com>

        Remove dead APIs from TiledBackingStore
        https://bugs.webkit.org/show_bug.cgi?id=135158

        Reviewed by Gyuyoung Kim.

        setContentsFrozen and related code of TiledBackingStore are not used since Qt port is removed.

        * platform/graphics/TiledBackingStore.cpp:
        (WebCore::TiledBackingStore::TiledBackingStore):
        (WebCore::TiledBackingStore::updateTileBuffers):
        (WebCore::TiledBackingStore::setContentsScale):
        (WebCore::TiledBackingStore::createTiles):
        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
        (WebCore::TiledBackingStore::startBackingStoreUpdateTimer):
        (WebCore::TiledBackingStore::commitScaleChange): Deleted.
        (WebCore::TiledBackingStore::isBackingStoreUpdatesSuspended): Deleted.
        (WebCore::TiledBackingStore::isTileBufferUpdatesSuspended): Deleted.
        (WebCore::TiledBackingStore::setContentsFrozen): Deleted.
        * platform/graphics/TiledBackingStore.h:
        (WebCore::TiledBackingStore::contentsFrozen): Deleted.

2014-07-22  Alex Christensen  <achristensen@webkit.org>

        Fix window-inactive css selectors when using querySelector.
        https://bugs.webkit.org/show_bug.cgi?id=135149

        Reviewed by Tim Horton.

        Test: fast/selectors/querySelector-window-inactive.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        Removed default and implemented case PseudoClassWindowInactive.

2014-07-22  Tim Horton  <timothy_horton@apple.com>

        REGRESSION (r171016): Reproducible infinite spin selecting phone number
        https://bugs.webkit.org/show_bug.cgi?id=135183
        <rdar://problem/17727342>

        Reviewed by Ryosuke Niwa.

        * editing/Editor.cpp:
        (WebCore::Editor::scanRangeForTelephoneNumbers):
        Make use of TextIterator::subrange, which knows how to make a subrange from character positions,
        instead of assuming that our character positions translate directly to positions in the incoming range.
        Make use of DocumentMarkerController::addMarker, which takes a range and applies the marker to
        all text nodes inside the range as appropriate.
        Fix naming of the shadowed 'length' local.
        Fix a typo in the comment.

2014-07-22  Myles C. Maxfield  <mmaxfield@apple.com>

        [iOS] [OSX] Don't transcode WOFF on platforms that support it natively
        https://bugs.webkit.org/show_bug.cgi?id=134904

        Reviewed by Andreas Kling.

        No new tests because there is no behavior change.

        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::ensureCustomFontData):

2014-07-22  peavo@outlook.com  <peavo@outlook.com>

        [Win] Crash after plugin is unloaded.
        https://bugs.webkit.org/show_bug.cgi?id=119044

        Reviewed by Darin Adler.

        We need to invalidate all runtime objects when a plugin view is destroyed, in case the plugin is unloaded,
        and one of these runtime objects accesses the plugin function table upon destruction afterwards, which will cause a crash.
        If we use the weak pointer to the runtime object when invalidating, it will be null if it's in the WeakImpl::Dead state.
        This means the runtime object will not be invalidated, possibly causing a crash if the plugin is unloaded.
        It should be safe to use the raw pointer to the runtime object when invalidating, since finalized runtime objects
        will be removed from the set of runtime objects in the method RootObject::finalize().

        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::invalidate): Make sure all runtime objects are invalidated by getting the raw runtime object pointer from the hash key.

2014-07-22  Enrica Casucci  <enrica@apple.com>

        REGRESSION (WebKit2): Selection inside accelerated overflow:scroll doesn't track scrolling.
        https://bugs.webkit.org/show_bug.cgi?id=135180
        <rdar://problem/16721055>

        Reviewed by Simon Fraser.

        AsyncScrollingCoordinator will force a selection update on iOS
        when scrolling terminates in an overflow scroll.

        * loader/EmptyClients.h:
        * page/EditorClient.h:
        * page/scrolling/AsyncScrollingCoordinator.cpp:
        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
        * page/scrolling/ScrollingTree.h:
        (WebCore::ScrollingTree::scrollingTreeNodeWillStartScroll):
        (WebCore::ScrollingTree::scrollingTreeNodeDidEndScroll):

2014-07-22  Myles C. Maxfield  <mmaxfield@apple.com>

        [Mac] Cocoa throws exception when the return type of NSAccessibilityLinkedUIElementsAttribute is not an array
        https://bugs.webkit.org/show_bug.cgi?id=135165

        Reviewed by Simon Fraser.

        Return an empty array instead of nil.

        Updated tests.

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

2014-07-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r171357.
        https://bugs.webkit.org/show_bug.cgi?id=135173

        broke Windows build. (Requested by bfulgham on #webkit).

        Reverted changeset:

        "[Win] Fix Crash when handling Legible Output callbacks"
        https://bugs.webkit.org/show_bug.cgi?id=134946
        http://trac.webkit.org/changeset/171357

2014-07-22  Brent Fulgham  <bfulgham@apple.com>

        [Win] Fix Crash when handling Legible Output callbacks
        https://bugs.webkit.org/show_bug.cgi?id=134946

        Reviewed by Dean Jackson.

        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
        (WebCore::InbandTextTrackPrivateAVF::processNativeSamples): Remove
        Windows-specific 'ASSERT_NOT_REACHED' code path.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::createLegibleOutputSubtypes): Added.
        (WebCore::AVFWrapper::createPlayerItem): Updated to request native
        samples from AVFoundationCF.

2014-07-21  Sam Weinig  <sam@webkit.org>

        [Cocoa] WKScriptMessageHandlers don't seem to function properly after navigating
        https://bugs.webkit.org/show_bug.cgi?id=135148

        Reviewed by Geoffrey Garen.

        The "webkit" property on the window was not getting installed for subsequent
        loads due to intricate dance playing setting the JSDOMWindow where the DOMWindow
        object is not yet in a Frame when the JSDOMWindow is created. Since we were
        adding the "webkit" property on construction, the property was returning null
        thinking it had no Frame and was in a bad state. We can fix this by making the
        "webkit" property behave like all the other window properties moving its getting
        to JSDOMWindow::getOwnPropertySlot.

        Added API test (WebKit2Cocoa/UserContentController).

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::finishCreation):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowWebKit):
        (WebCore::JSDOMWindow::getOwnPropertySlot):

2014-07-22  Brent Fulgham  <bfulgham@apple.com>

        [Win] Fix Leak in WebCore::createGlobalImageFileDescriptor 
        https://bugs.webkit.org/show_bug.cgi?id=134423
        <rdar://problem/17492758>

        Reviewed by Geoffrey Garen.

        * platform/win/PasteboardWin.cpp:
        (WebCore::createGlobalImageFileDescriptor): Unlock and release the
        HGLOBAL when exiting early.

2014-07-21  Myles C. Maxfield  <mmaxfield@apple.com>

        Clicking on links while accessibility is enabled sometimes crashes
        https://bugs.webkit.org/show_bug.cgi?id=135074

        Reviewed by Chris Fleizach.

        When an accessibility request comes in from the system, we call updateBackingStore() on the
        relevant AccessibilityObject, which triggers a relayout of the entire document. This relayout
        might delete that accessibility node and its parent, which would cause the node to be deleted.
        After the stack unwinds, we then call a member function on the node without checking for this
        condition.

        Test: accessibility/parent-delete.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::updateBackingStore): Retain the node for the duration of the
        function.

2014-07-22  Jeremy Jones  <jeremyj@apple.com>

        Don't create new UIWindow for video fullscreen.
        https://bugs.webkit.org/show_bug.cgi?id=135038

        Reviewed by Darin Adler.

        * WebCore.exp.in:
        * platform/ios/WebVideoFullscreenControllerAVKit.h: use UIView instead of UIScreen.
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (-[WebVideoFullscreenController enterFullscreen:]): provide parent UIView.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h: remove UIWindow.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm: 
        (WebVideoFullscreenInterfaceAVKit::setupFullscreen): ditto 
        (WebVideoFullscreenInterfaceAVKit::cleanupFullscreen): ditto
        (WebVideoFullscreenInterfaceAVKit::invalidate): ditto
        (WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen): ditto

2014-07-22  Carlos Alberto Lopez Perez  <clopez@igalia.com>

        [GTK] Rollout r170529 due to ~10% performance regression on the
        perf test Animation/balls.
        https://bugs.webkit.org/show_bug.cgi?id=134972

        Reviewed by Martin Robinson.

        Reverted changeset:
        "Increase priority on SharedTimer source."
        https://trac.webkit.org/r170529

2014-07-18  Dirk Schulze  <krit@webkit.org>

        Turn width/height to presentation attributes
        https://bugs.webkit.org/show_bug.cgi?id=135046

        Reviewed by Dean Jackson.

        The elements <svg>, <image>, <pattern>, <mask> and <foreignObject> have the
        'width' and 'height' attributes. So far they can just be set by SVG DOM or
        setAttribute. Furthermore, animations just work with SVG Animation - No support
        for CSS Animations and CSS Transitions. We started to turn the width and height
        attributes on SVG roots to presentation attributes already. A presentation
        attribute is a CSS property that can also be set by DOM (or now by SVG DOM).

        This patch turns all width and height attributes to presentation attributes. It
        basically allows authors to style width and height with CSS as well. Width and
        height can now be set with CSS style sheets and can be animated with CSS.

        To some degree it made it possible to remove code duplication. However, since
        SVG DOM requires us to use SVGLength types and since we did not turn all
        SVG attributes to the CSS length values (and our internal Length struct) yet,
        we still need a hybrid - a bridge between SVGLength (for SVG DOM) and Length (for
        RenderStyle). Once we move all attributes to use the Length struct, we can make SVGLength
        a wrapper for Length and can move more code to the render tree.

        The current challenge is to synchronize SVG DOM, normal DOM and RenderStyle.
        With this patch we handle most part in RenderStyle. SVG DOM changes are
        synchronized to DOM and RenderStyle will call needsStyleRecalc. Furthermore,
        SVG Animations will continue to animate the SVG DOM (and synchronize the changes
        back to RenderStyle) if the element has a JS property for the currently animated
        attribute.

        Short example:

            <rect>
                <animate attributeName="width">
            </rect>

        The <rect> element has the SVG DOM property 'width'. Therefore, we animate the SVG DOM
        property and synchronize RenderStyle.

            <ellipse>
                <animate attributeName="width">
            </ellipse>

        The <ellipse> element does NOT have the SVG DOM property 'width'. Therefore, we
        animate the CSS property directly. With synchronizing RenderStyle in all cases, we
        make sure that the CSS cascade works even on animating on multiple SVG hierarchy
        levels (animation of 'width' on <g> and inheriting the property value on a child
        <rect>).

        With using presentation attributes, we also inherit the CSS property parsing for
        SVG attributes. <rect width="  100px  "> is possible now. (Note the trailing whitespaces.)
        This follows a recent resolution of the SVG WG.

        Since we turned width and height to presentation attributes, the layout optimization
        selfHasRelativeLengths() in the DOM can't be used anymore. selfHasRelativeLengths() was
        intended to solve a problem where we did not layout relatively position/sized elements
        when the parent changes its size. However, as a side effect it did not call layout
        for absolutely positioned/sized elements since the layout does not change. I run
        all performance tests that we have and even wrote a test with hundreds of elements
        that would be affected by this optimization. The differences were inside the sigma
        of a normal test run. (Means I couldn't measure a performance difference.)
        Therefore, it is not worth it to keep the "optimization" around and I will probably
        remove it entirely for all basic shapes but <path> and <polygon> in future patches.

        Tests: svg/css/parse-height.html
               svg/css/parse-width.html
               svg/css/width-height-presentation-attribute-expected.svg
               svg/css/width-height-presentation-attribute.svg

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::propertyValue): We never calculated the computed
            value of width/height for SVG elements and returned auto instead. This is based
            on a rule of CSS 2 and needs to be fixed in CSS3.
        * css/DeprecatedStyleBuilder.cpp:
        (WebCore::ApplyPropertyLength::applyValue): Length always incorporates the zoom level.
            In SVG we still apply the zoom after all operations by scaling the context. We need
            to take this in account for Length and don't apply zoom on SVG inline elements.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::useSVGZoomRulesForLength):
            See above.
        * css/StyleResolver.h:
        * rendering/svg/RenderSVGRect.cpp:
        (WebCore::RenderSVGRect::updateShapeFromElement): Do not call width() and height() on
            SVG DOM but use the values of RenderStyle instead.
        * rendering/svg/SVGPathData.cpp:
        (WebCore::updatePathFromRectElement): Ditto.
        * svg/SVGAnimateElement.cpp:
        (WebCore::SVGAnimateElement::resetAnimatedType): We need to differ between CSS properties
            with and without SVG DOM on the current element. In the later case we animate the 
            SVG DOM and need to synch RenderStyle.
        (WebCore::SVGAnimateElement::clearAnimatedType): Ditto.
        (WebCore::SVGAnimateElement::applyResultsToTarget): Ditto.
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::isTargetAttributeCSSProperty): This checks if the CSS property
            has to be synched with SVG DOM.
        (WebCore::SVGAnimationElement::shouldApplyAnimation): Ditto.
        * svg/SVGAnimationElement.h:
        * svg/SVGElement.cpp:
        (WebCore::populateAttributeNameToCSSPropertyIDMap): Add width and heigth to the CSS property
            list for presentation attributes.
        (WebCore::populateCSSPropertyWithSVGDOMNameToAnimatedPropertyTypeMap): CSS properties with
            SVG DOM synchronization need to be treated differently. Collect them in a separate map.
        (WebCore::cssPropertyWithSVGDOMNameToAnimatedPropertyTypeMap): Caller for the map.
        (WebCore::SVGElement::animatedPropertyTypeForAttribute): We need to check both maps here:
            CSS properties and CSS properties with SVG DOM synch.
        (WebCore::SVGElement::isAnimatableCSSProperty): Ditto.
        (WebCore::SVGElement::isPresentationAttributeWithSVGDOM): Just return true if the property name
            is in the map of properties with SVG DOM for the current element.
        * svg/SVGElement.h:
        (WebCore::SVGElement::invalidateSVGPresentationAttributeStyle): Call needsStyleRecalc.
        * svg/SVGFilterElement.cpp: Make width/height presentation attribute.
        (WebCore::SVGFilterElement::svgAttributeChanged):
        (WebCore::SVGFilterElement::selfHasRelativeLengths): Deleted.
        * svg/SVGFilterElement.h: Ditto.
        * svg/SVGForeignObjectElement.cpp:
        (WebCore::SVGForeignObjectElement::svgAttributeChanged):
        (WebCore::SVGForeignObjectElement::selfHasRelativeLengths): Deleted.
        * svg/SVGForeignObjectElement.h:
        * svg/SVGImageElement.cpp: Ditto.
        (WebCore::SVGImageElement::svgAttributeChanged):
        (WebCore::SVGImageElement::isPresentationAttribute): Deleted.
        (WebCore::SVGImageElement::collectStyleForPresentationAttribute): Deleted.
        (WebCore::SVGImageElement::selfHasRelativeLengths): Deleted.
        * svg/SVGImageElement.h:
        * svg/SVGLength.h: Transform an Length value to an absolute value by taking the SVG viewport
            into account. (An SVG viewport is not the same as the CSS viewport.)
        * svg/SVGLengthContext.cpp: Ditto.
        (WebCore::SVGLengthContext::valueForLength):
        * svg/SVGLengthContext.h:
        * svg/SVGMaskElement.cpp: Make width/height presentation attribute.
        (WebCore::SVGMaskElement::svgAttributeChanged):
        (WebCore::SVGMaskElement::selfHasRelativeLengths): Deleted.
        * svg/SVGMaskElement.h:
        * svg/SVGPatternElement.cpp: Ditto.
        (WebCore::SVGPatternElement::svgAttributeChanged):
        (WebCore::SVGPatternElement::selfHasRelativeLengths): Deleted.
        * svg/SVGPatternElement.h:
        * svg/SVGRectElement.cpp: Ditto.
        (WebCore::SVGRectElement::svgAttributeChanged):
        (WebCore::SVGRectElement::selfHasRelativeLengths): Deleted.
        * svg/SVGRectElement.h:
        * svg/SVGSVGElement.cpp: Ditto.
        (WebCore::SVGSVGElement::svgAttributeChanged): Clean up redundant layout calls.
        (WebCore::SVGSVGElement::isPresentationAttribute): Deleted.
        (WebCore::SVGSVGElement::collectStyleForPresentationAttribute): Deleted.
        * svg/SVGSVGElement.h:
        * svg/properties/SVGAnimatedProperty.cpp: Synchronize SVG DOM with DOM.
        (WebCore::SVGAnimatedProperty::commitChange):

2014-07-22  Adrian Perez de Castro  <aperez@igalia.com>

        [GStreamer] [GTK] WebKit does not build with GStreamer 1.4
        https://bugs.webkit.org/show_bug.cgi?id=135114

        Reviewed by Philippe Normand.

        Fix build with GStreamer 1.4

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        Change GstMpegTs-prefixed types to use the GstMpegts prefix.
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
        (WebCore::MediaPlayerPrivateGStreamer::processMpegTsSection):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        Ditto.

2014-07-21  Benjamin Poulain  <bpoulain@apple.com>

        [iOS][WK2] Improve event throttling for Scroll Events
        https://bugs.webkit.org/show_bug.cgi?id=135082
        <rdar://problem/17445266>

        Reviewed by Simon Fraser.

        This patch is composed of two parts. The first part in the WebKit layer
        track an approximate measurement of the main thread responsiveness.
        The second part in WebCore use that information to avoid sending events
        if a page is unresponsive.

        In WebCore, this patch only consider scroll events so far. Hopefully the concept
        should be easy to generalize.

        * loader/EmptyClients.h:
        * page/ChromeClient.h:
        Chrome client provides us with one information: how long an incoming event should be delayed.
        Every port is free to implement whatever logic is suitable for them.

        * page/FrameView.cpp:
        (WebCore::FrameView::FrameView):
        (WebCore::FrameView::reset):
        (WebCore::FrameView::delayedScrollEventTimerFired):
        (WebCore::FrameView::scrollPositionChanged):
        (WebCore::FrameView::sendScrollEvent):
        * page/FrameView.h:
        Scroll events do not have any associated information so they can be coalesced by just skipping
        all input hapenning during the throttling delay.

        The implementation is done by using a timer to delay the events.

2014-07-21  Tim Horton  <timothy_horton@apple.com>

        Avoid putting empty-sized surfaces into IOSurfacePool
        https://bugs.webkit.org/show_bug.cgi?id=135136

        Reviewed by Simon Fraser.

        * platform/graphics/cg/IOSurfacePool.cpp:
        (WebCore::IOSurfacePool::addSurface):
        Avoid adding 0x0 surfaces to the pool, because they will wreak havoc
        when their size is used as the key in the CachedSurfaceMap.
        Additionally, avoid any empty sizes, because they're just pointless.

2014-07-21  Beth Dakin  <bdakin@apple.com>

        WK1 should always setAcceleratedCompositingForFixedPositionEnabled(true) on 
        Yosemite
        https://bugs.webkit.org/show_bug.cgi?id=135135

        Reviewed by Darin Adler.

        This patch gets rid of the ChromeClient function that was introduced with 
        http://trac.webkit.org/changeset/171308 We’ll just enable the Setting instead.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle):
        (WebCore::fixedPositionCreatesStackingContext): Deleted.
        * page/ChromeClient.h:
        (WebCore::ChromeClient::requiresAcceleratedCompositingForViewportConstrainedPosition): Deleted.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):

2014-07-21  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] Turn off position:fixed behavior when the keyboard is up
        https://bugs.webkit.org/show_bug.cgi?id=132537

        Reviewed by Benjamin Poulain.

        Export RenderObject::localToContainerPoint().

        * WebCore.exp.in:

2014-07-21  Jer Noble  <jer.noble@apple.com>

        [MSE] YouTube video decode error when variant-switching
        https://bugs.webkit.org/show_bug.cgi?id=135128

        Reviewed by Brent Fulgham.

        Test: media/media-source/media-source-overlapping-decodetime.html

        When variant-switching, the situation can arise where an existing sample with a presentation
        timestamp of N and a decode timestamp of M, and a new sample with a presentation timestamp > N
        and the same decode timestamp of M, will keep the new sample from being added to the SampleMap.
        This can result in a decode error when samples depending on that new, missing sample are enqueued.

        The MSE spec is silent on the issue of overlapping decode timestamps. However, it guarantees that
        presentation timestamps are non-overlapping. So instead of using just the decode timestamp as a key
        for storing the samples in decode order, use both the decode timestamp and the presentation timestamp.
        That ensures that samples with different presentation times but equal decode times are both inserted
        into the decode queue, and in the correct order.

        * Modules/mediasource/SampleMap.cpp:
        (WebCore::SampleIsRandomAccess::operator()): Update the parameter type to match the new KeyType.
        (WebCore::SampleMap::addSample): Pass both decodeTime and presentationTime as the key to decodeOrder.
        (WebCore::SampleMap::removeSample): Ditto.
        (WebCore::DecodeOrderSampleMap::findSampleWithDecodeKey): Renamed from findSampleWithDecodeTime.
        (WebCore::DecodeOrderSampleMap::reverseFindSampleWithDecodeKey): renamed from reverseFindSampleWithDecodeTime.
        (WebCore::DecodeOrderSampleMap::findSyncSamplePriorToPresentationTime): Use renamed version of above.
        (WebCore::DecodeOrderSampleMap::findSyncSampleAfterPresentationTime): Ditto.
        (WebCore::DecodeOrderSampleMap::findDependentSamples): Ditto.
        (WebCore::DecodeOrderSampleMap::findSampleWithDecodeTime): Deleted.
        (WebCore::DecodeOrderSampleMap::reverseFindSampleWithDecodeTime): Deleted.
        * Modules/mediasource/SampleMap.h:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::removeCodedFrames): Ditto.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Ditto.
        (WebCore::SourceBuffer::reenqueueMediaForTime): Ditto.

2014-07-21  Andy Estes  <aestes@apple.com>

        [iOS] Handle QuickLook ResourceLoaders in the web process
        https://bugs.webkit.org/show_bug.cgi?id=135113

        Reviewed by David Kilzer.

        No new tests. QuickLook is not testable from WebKit.

        * WebCore.exp.in:
        * loader/ResourceLoadScheduler.cpp:
        (WebCore::ResourceLoadScheduler::maybeLoadQuickLookResource): Start loading the ResourceLoader if it is for a QuickLook resource.
        * loader/ResourceLoadScheduler.h:

2014-07-21  Alexey Proskuryakov  <ap@apple.com>

        Case sensitive file system build fix.

        * page/scrolling/ScrollingStateTree.cpp:

2014-07-21  Beth Dakin  <bdakin@apple.com>

        Put position:fixed elements into layers when a WK1 view is layer-backed
        https://bugs.webkit.org/show_bug.cgi?id=135075

        Reviewed by Darin Adler.

        This patch adds a new ChromeClient function called 
        requiresAcceleratedCompositingForViewportConstrainedPosition(). Since a view can 
        go in and out of layer backing, we need a ChromeClient method that can be 
        dynamically re-evaluated rather than using the existing settings for enabling 
        accelerated fixed and fixed that creates a stacking context.

        Ensure that fixed elements create a stacking context when 
        requiresAcceleratedCompositingForViewportConstrainedPosition is true.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle):

        New ChromeClient function.
        * page/ChromeClient.h:

2014-07-21  Simon Fraser  <simon.fraser@apple.com>

        Add helper functions to dump the scrolling state tree from the debugger
        https://bugs.webkit.org/show_bug.cgi?id=135101

        Reviewed by Darin Adler.

        Add debug-only showScrollingStateTree() functions that take a ScrollingStateTree* and ScrollingStateNode*
        for use while debugging.

        * page/scrolling/ScrollingStateTree.cpp:
        (showScrollingStateTree):
        * page/scrolling/ScrollingStateTree.h:

2014-07-20  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK1] Single touch div scrolling doesn't work in framesets (breaks Word previews)
        https://bugs.webkit.org/show_bug.cgi?id=135103
        <rdar://problem/11830219>

        Reviewed by Darin Adler.

        After r166117 all layer flushing starts on the root frame; we no longer flush layers
        for each frame during painting. However, flushing GraphicsLayers can set some state
        on a subframe RenderLayerCompositor that is now never processed, which breaks scroll
        layer registration.
        
        Fix by doing a walk of the Frame tree, and calling didFlushLayers() on subframe RenderLayerCompositors
        before calling didFlushLayers() on self.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
        (WebCore::RenderLayerCompositor::didFlushLayers):
        (WebCore::RenderLayerCompositor::notifySubframesAfterLayerFlush):
        (WebCore::RenderLayerCompositor::enclosingCompositorFlushingLayers): Drive-by nullptr.
        * rendering/RenderLayerCompositor.h:

2014-07-21  Eric Carlson  <eric.carlson@apple.com>

        [iOS] a Paused media session is not active
        https://bugs.webkit.org/show_bug.cgi?id=135108

        Reviewed by Darin Adler.

        Activating the shared AudioSession will pause audio playing in another application,
        so only report a Playing media sessions as active.

        * platform/audio/MediaSessionManager.cpp:
        * platform/audio/MediaSessionManager.h:
        (WebCore::MediaSessionManager::activeAudioSessionRequired): Renamed from hasActive to make
        clear what it does. Only return true for a session that is Playing.

        * platform/audio/mac/MediaSessionManagerMac.cpp:
        (MediaSessionManager::updateSessionState): hasActive renamed to activeAudioSessionRequired.

2014-07-21  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Update GObject DOM bindings test results after r171285.

        * bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestCustomNamedGetter.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestEventTarget.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestException.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestGenerateIsReachable.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestMediaQueryListListener.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestNamedConstructor.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestNode.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestNondeterministic.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestOverloadedConstructors.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestTypedefs.cpp:
        * bindings/scripts/test/GObject/WebKitDOMattribute.cpp:
        * bindings/scripts/test/GObject/WebKitDOMreadonly.cpp:

2014-07-20  Pratik Solanki  <psolanki@apple.com>

        Reduce the chances of a race condition when sharing SharedBuffer
        https://bugs.webkit.org/show_bug.cgi?id=135060
        <rdar://problem/17729444>

        Reviewed by Darin Adler.

        We currently pass a SharedBuffer wrapped in WebCoreSharedBufferData to ImageIO for image
        decoding. This is not thread safe since ImageIO will access this buffer on a separate
        thread. We access SharedBuffer::buffer() on the other thread which resizes the Vector
        m_buffer if m_size is greater than the vector size. Since the code in SharedBuffer::append()
        sets m_size before appending the data to the buffer, m_size is out of sync with the m_buffer
        size for the entire duration of the Vector append which could be doing a lot of copying if
        the resource is large. While this change does not fix the race condition, we can at least
        reduce the chances of SharedBuffer::buffer() calling resize() by setting m_size after the
        cector has finished appending.

        No new tests because no functional changes.

        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::append):

2014-07-20  Jeremy Jones  <jeremyj@apple.com>

        Fix test crashes when cloning video layer since r171286
        https://bugs.webkit.org/show_bug.cgi?id=135112

        Unreviewed. Fix crashing tests by conditionalizing inline video layer change.
        compositing/video/video-reflection.html [ Crash ]
        media/video-layer-crash.html [ Crash ]

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: add conditional
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: ditto
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer): ditto
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): ditto
        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformLayer): ditto

2014-07-20  Jeremy Jones  <jeremyj@apple.com>

        Disable ff/rw based on canPlayFastForward and canPlayFastRewind.
        https://bugs.webkit.org/show_bug.cgi?id=134894

        Reviewed by Darin Adler.

        * WebCore.exp.in: add symbol for canPlayFastReverse
        * html/HTMLMediaElement.cpp: Add two new accessors
        (WebCore::HTMLMediaElement::nextScanRate): possibly limit scanRate
        (WebCore::HTMLMediaElement::canPlayFastForward): added
        (WebCore::HTMLMediaElement::canPlayFastReverse): added
        * html/HTMLMediaElement.h: declare two new methods
        * platform/graphics/MediaPlayer.cpp: Plumb through two new accessors
        (WebCore::MediaPlayer::maxFastForwardRate): added
        (WebCore::MediaPlayer::minFastReverseRate): added
        * platform/graphics/MediaPlayer.h: Declare new methods
        * platform/graphics/MediaPlayerPrivate.h: Added two new methods.
        (WebCore::MediaPlayerPrivateInterface::maxFastForwardRate): added
        (WebCore::MediaPlayerPrivateInterface::minFastReverseRate): added
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: member to cache ff/rw enabled state
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): observe on item canPlayFastForward canPlayFastReverse
        (WebCore::MediaPlayerPrivateAVFoundationObjC::canPlayFastForwardDidChange): added
        (WebCore::MediaPlayerPrivateAVFoundationObjC::canPlayFastReverseDidChange): added
        (WebCore::itemKVOProperties): observe canPlayFastForward canPlayFastRewind
        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]): ditto
        * platform/ios/WebVideoFullscreenInterface.h: add new method
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h: ditto
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm: ditto
        (WebVideoFullscreenInterfaceAVKit::setCanPlayFastReverse): Set value on WebAVPlayerController.
        (-[WebAVPlayerController canScanBackward]): Deleted.
        (+[WebAVPlayerController keyPathsForValuesAffectingCanScanBackward]): Deleted.
        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
        (WebVideoFullscreenModelMediaElement::updateForEventName): update canPlayFastReverse.

2014-07-18  Gavin Barraclough  <baraclough@apple.com>

        HTMLMediaElement should registerWithDocument on iOS
        https://bugs.webkit.org/show_bug.cgi?id=135084
        <rdar://problem/17702531>

        Reviewed by Andreas Kling.

        Otherwise it won't know when the visibility changes!

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::registerWithDocument):
        (WebCore::HTMLMediaElement::unregisterWithDocument):

2014-07-20  Jeremy Jones  <jeremyj@apple.com>

        Decrease flicker when enter and exit fullscreen.
        https://bugs.webkit.org/show_bug.cgi?id=134919

        Reviewed by Simon Fraser.

        Put AVPlayerLayer in a container layer so moving it between inline and fullscreen
        is as easy as adding and removing it from a containter layer; no need to do a layout.

        Make sure fullscreen layers are transparent before moving moving the AVPlayerLayer
        between inline and fullscreen so you don't briefly see the empty fullscreen layers.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::platformLayer): remove fullscreen special case.
        (WebCore::HTMLMediaElement::setVideoFullscreenLayer): no need to recalc style
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: add inline container layer
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: 
        add WebVideoContainerLayer to contain AVPlayerLayer and keep layout correct.
        (-[WebVideoContainerLayer setBounds:]): forward setbounds to set child frame.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer): create the video container layer
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): destroy the video container layer
        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformLayer): use container layer instead of video layer
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer): use transactions to prevent unwanted animation.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenFrame): ditto
        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
        (PlatformCALayerMac::layerTypeForPlatformLayer): WebVideoContainerLayer is a kind of AVPlayerLayer
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (-[WebVideoFullscreenController didCleanupFullscreen]): remove video fullscreen layer first
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::setupFullscreen): make background transparent during transition.
           dispatch_async to allow CATransaction to complete before calling didSetupFullscreen()

2014-07-20  Ryuan Choi  <ryuan.choi@samsung.com>

        Move ExceptionCodeDescription.h into the files that actually need it
        https://bugs.webkit.org/show_bug.cgi?id=134968

        Reviewed by Darin Adler.

        No new tests because no functional changes.

        * Modules/indexeddb/IDBDatabaseException.cpp:
        * Modules/webdatabase/SQLException.cpp:
        * bindings/js/JSDOMBinding.cpp:
        * bindings/objc/ExceptionHandlers.mm:
        * bindings/scripts/CodeGeneratorGObject.pm:
        (Generate):
        * dom/DOMCoreException.cpp:
        * dom/EventException.cpp:
        * dom/ExceptionBase.cpp:
        * dom/ExceptionCode.h:
        * dom/RangeException.cpp:
        * fileapi/FileException.cpp:
        * inspector/DOMEditor.cpp:
        * inspector/InspectorDOMAgent.cpp:
        * svg/SVGException.cpp:
        * xml/XMLHttpRequestException.cpp:
        * xml/XPathException.cpp:

2014-07-20  Dan Bernstein  <mitz@apple.com>

        <rdar://problems/17742611> -[_WKActivatedElementInfo image] is often empty
        https://bugs.webkit.org/show_bug.cgi?id=135107

        Reviewed by Sam Weinig.

        Test: TestWebKitAPI/Tests/mac/RenderedImageFromDOMNode.mm

        * page/FrameView.cpp:
        (WebCore::FrameView::paintContents): To work around http://webkit.org/b/135106, replace the
        paint root with its nearest ancestor that isn’t an inline with culled line boxes, if needed.

2014-07-20  Darin Adler  <darin@apple.com>

        Crashes seen in wheel event handling
        https://bugs.webkit.org/show_bug.cgi?id=135102

        Reviewed by Beth Dakin.

        Speculative fix based on guesses about what could be crashing.
        The crash seems to be calling ref on an event target, and my guess is that this
        has something to do with latching.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::platformPrepareForWheelEvents): Updated argument types.
        (WebCore::EventHandler::handleWheelEvent): Refactored a little and made some local
        variables use RefPtr instead of raw pointers. Also added some comments.

        * page/EventHandler.h: Changed argument types to RefPtr.

        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformPrepareForWheelEvents): Updated argument types.
        Also added a FIXME.

2014-07-20  Simon Fraser  <simon.fraser@apple.com>

        Print layerIDs in GraphicsLayer dumps
        https://bugs.webkit.org/show_bug.cgi?id=135100

        Reviewed by Darin Adler.

        When calling showGraphicsLayerTree() from the debugger, it's useful to show
        layerIDs so they can be correlated with remote layer tree transactions. So
        when dumping with debug info, dump the primary layer ID.

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::dumpProperties):

2014-07-20  Eric Carlson  <eric.carlson@apple.com>

        [iOS] ignore requests to set volume
        https://bugs.webkit.org/show_bug.cgi?id=135081

        Applied post-review comments from Darin Adler.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVolume): Don't include unreachable
            code on iOS.

2014-07-19  Mark Rowe  <mrowe@apple.com>

        <https://webkit.org/b/135085> Ensure that make_names.pl generates the same result when run multiple times.

        Perl 5.18 introduced hash randomization. This results in the iteration order of hashes being different
        from one run to the next. To ensure identical output we can iterate over the hash keys in sorted order.

        Reviewed by Alexey Proskuryakov.

        * bindings/scripts/StaticString.pm:
        (GenerateStrings):
        (GenerateStringAsserts):
        * dom/make_names.pl:

2014-07-19  Zan Dobersek  <zdobersek@igalia.com>

        Document::unregisterNodeListforInvalidation() and Document::unregisterCollection() have incorrect assertions
        https://bugs.webkit.org/show_bug.cgi?id=134869

        Reviewed by Darin Adler.

        Both methods should assert that the relevant HashMap is either empty if invalidation originates
        from Document::invalidateNodeListAndCollectionCaches() or acutally contains the element that is
        being invalidated. In the first case the HashMap is empty because its entries were moved out in
        the Document::invalidateNodeListAndCollectionCaches().

        This was exposed by r170995 (later rolled out in r170999) which introduced move constructor and
        move assignment operators for HashTable. The assertions in the titular methods won't be passing
        until r170995 relands.

        * dom/Document.cpp:
        (WebCore::Document::unregisterNodeListForInvalidation):

2014-07-18  Eric Carlson  <eric.carlson@apple.com>

        [iOS] ignore requests to set volume
        https://bugs.webkit.org/show_bug.cgi?id=135081

        Reviewed by Jer Noble.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVolume): Do nothing on iOS.

2014-07-18  Andy Estes  <aestes@apple.com>

        [iOS] Tapping "Allow Website" on a restricted page does not bring up the keypad
        https://bugs.webkit.org/show_bug.cgi?id=135072
        <rdar://problem/17528188>

        Reviewed by David Kilzer.

        No new tests. Content filtering is not testable from WebKit.

        * WebCore.exp.in: Exported necessary ContentFilter symbols.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::finishedLoading): Called FrameLoaderClient::contentFilterDidBlockLoad().
        (WebCore::DocumentLoader::responseReceived): Created a new ContentFilter.
        (WebCore::DocumentLoader::dataReceived): Called FrameLoaderClient::contentFilterDidBlockLoad().
        (WebCore::DocumentLoader::setContentFilterForBlockedLoad): Deleted.
        (WebCore::DocumentLoader::handleContentFilterRequest): Deleted.
        * loader/DocumentLoader.h:
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::contentFilterDidBlockLoad):
        * loader/PolicyChecker.cpp:
        (WebCore::PolicyChecker::checkNavigationPolicy): Removed the check for unblock navigations, as this is now
        handled at the WebKit layer.
        * platform/ContentFilter.h: ContentFilter no longer needs to be RefCounted, so made various changes in order to
        make it compatible with unique_ptr.
        * platform/ios/ContentFilterIOS.mm:
        (WebCore::scheme): Changed from a public member function to a static inline free function.
        (WebCore::ContentFilter::handleUnblockRequestAndDispatchIfSuccessful): Renamed from requestUnblockAndDispatchIfSuccessful.
        * platform/mac/ContentFilterMac.mm:
        (WebCore::ContentFilter::ContentFilter): Added a default constructor for use during message decoding.
        (WebCore::ContentFilter::addData): Removed calls to ref() and deref(). These were never actually needed since
        we were dispatching the block synchronously.
        (WebCore::ContentFilter::finishedAddingData): Ditto.
        (WebCore::ContentFilter::encode): Encoded m_platformContentFilter to the NSKeyedArchiver if it conforms to NSSecureCoding.
        (WebCore::ContentFilter::decode): Decoded m_platformContentFilter from the NSKeyedUnarchiver if it conforms to NSSecureCoding.
        (WebCore::ContentFilter::create): Deleted.

2014-07-18  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] position:fixed in iframes with programmatic scroll could end up in the wrong place
        https://bugs.webkit.org/show_bug.cgi?id=135078
        <rdar://problem/17401823>

        Reviewed by Tim Horton.
        
        When the UI-side scrolling tree receives a requested scroll position update, it scrolls
        the node (e.g. a frame) then traverses child nodes to update them, e.g. for fixed position.
        However, we would always use a viewport rect for the main document (from the scrolling tree),
        which is not appropriate for subframes. Subframes should just use their own visible
        rect to position fixed children.

        Test: platform/mac-wk2/tiled-drawing/scrolling/frames/fixed-inside-frame.html

        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):

2014-07-18  Beth Dakin  <bdakin@apple.com>

        Fixed position elements are misplaced when a WK1 view has contentInsets set
        https://bugs.webkit.org/show_bug.cgi?id=135031
        -and corresponding-
        <rdar://problem/17682335>

        Reviewed by Tim Horton.

        [NSScrollView documentVisibleRect] includes content that is within the inset-area 
        of a view, but WebCore is interested in the content that is fully visible, so we 
        need to factor the inset sizes out of this rect.

        Implement contract() to avoid the awkwardness of calling expand() with negative 
        values.
        * platform/graphics/IntSize.h:
        (WebCore::IntSize::contract):

        Factor out insets
        * platform/mac/ScrollViewMac.mm:
        (WebCore::ScrollView::platformVisibleContentRect):
        (WebCore::ScrollView::platformVisibleContentSize):

2014-07-18  Tim Horton  <timothy_horton@apple.com>

        Take navigation snapshots whenever the current back-forward item is going to change
        https://bugs.webkit.org/show_bug.cgi?id=135058
        <rdar://problem/17464515>

        Reviewed by Dan Bernstein.

        * loader/HistoryController.cpp:
        (WebCore::HistoryController::updateForCommit):
        (WebCore::HistoryController::recursiveUpdateForCommit):
        (WebCore::HistoryController::recursiveUpdateForSameDocumentNavigation):
        (WebCore::HistoryController::createItem):
        Use setCurrentItem instead of duplicating the contents of it inside each of these functions.

        (WebCore::HistoryController::setCurrentItem):
        (WebCore::HistoryController::replaceCurrentItem):
        When setting or replacing the current item, let the FrameLoaderClient know that we're going
        to change which history item is "current".

        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::willChangeCurrentHistoryItem): Added.

2014-07-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r171207.
        https://bugs.webkit.org/show_bug.cgi?id=135056

        Broke multiple tests on Yosemite (Requested by ap on #webkit).

        Reverted changeset:

        "Fixed position elements are misplaced when a WK1 view has
        contentInsets set"
        https://bugs.webkit.org/show_bug.cgi?id=135031
        http://trac.webkit.org/changeset/171207

2014-07-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r171218.
        https://bugs.webkit.org/show_bug.cgi?id=135055

        Made fast/dom/HTMLObjectElement/beforeload-set-text-
        crash.xhtml crash (Requested by ap on #webkit).

        Reverted changeset:

        "REGRESSION (r169105): Crash in selection"
        https://bugs.webkit.org/show_bug.cgi?id=134303
        http://trac.webkit.org/changeset/171218

2014-07-18  Radu Stavila  <stavila@adobe.com>

        REGRESSION (r169105): Crash in selection
        https://bugs.webkit.org/show_bug.cgi?id=134303

        Reviewed by Ryosuke Niwa.

        When splitting the selection between different subtrees, all subtrees must have their selection cleared before
        starting to apply the new selection. Otherwise, when selecting objects in a named flow thread and going up
        its containing block chain, we can end up in the view's selection root, which has not yet been updated and so
        we get inconsistent data.

        To achieve this goal, the selection update was split into a "clear" and an "apply" method. The updateSelectionForSubtrees
        method first iterates through all subtrees and performs the "clear" method and then starts all over again
        and performs the "apply" method.

        Also, the selectionStart/End members in RenderView have been renamed to fix problems caused by the fact that
        RenderView inherits SelectionSubtreeRoot, which also has the same selectionStart/End members.

        Test: fast/regions/selection/crash-deselect.html

        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::isSelectionRoot):
        * rendering/RenderSelectionInfo.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        (WebCore::RenderView::setSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
        (WebCore::RenderView::splitSelectionBetweenSubtrees):
        (WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
        (WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
        (WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
        (WebCore::RenderView::getSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
        (WebCore::RenderView::setSubtreeSelection): Deleted.
        * rendering/RenderView.h:
        * rendering/SelectionSubtreeRoot.cpp:
        (WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):
        * rendering/SelectionSubtreeRoot.h:
        (WebCore::SelectionSubtreeRoot::OldSelectionData::OldSelectionData):

2014-07-17  Jer Noble  <jer.noble@apple.com>

        [MSE] Re-enqueue after a removeCodedFrames() only if the removed frames overlap what may have possibly been enqueued but undisplayed.
        https://bugs.webkit.org/show_bug.cgi?id=135039

        Reviewed by Eric Carlson.

        When a client calls removeCodedFrames(), we must re-enqueue those ranges if the removed samples overlap with
        enqueued but possibly un-displayed samples. Otherwise, replacement samples may lead to decode errors as those
        new samples dependencies are not met. But if we re-enqueue too frequently, this may cause subtle but noticible
        display timing glitches, so only re-enqueue when removeCodedFrames have a possiblity of removing enqueued, but
        not yet displayed samples.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::removeCodedFrames):

2014-07-17  David Kilzer  <ddkilzer@apple.com>

        SECTORDER_FLAGS should be defined in target's xcconfig file, not Base.xcconfig
        <http://webkit.org/b/135006>

        Reviewed by Darin Adler.

        * Configurations/Base.xcconfig: Move SECTORDER_FLAGS to
        WebCore.xcconfig.
        * Configurations/DebugRelease.xcconfig: Remove empty
        SECTORDER_FLAGS definition.
        * Configurations/WebCoreTestShim.xcconfig: Ditto.
        * Configurations/WebCoreTestSupport.xcconfig: Ditto.
        * Configurations/WebCore.xcconfig: Use $(CONFIGURATION) so
        SECTORDER_FLAGS is only set on Production builds.

2014-07-17  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Embedded non-compositing rotate transform paints to wrong position.
        https://bugs.webkit.org/show_bug.cgi?id=135028

        Reviewed by Simon Fraser.

        CTM always translates to where the layer's renderer() is going to paint.
        It ensures that the pixel snapped renderer() always end up painting to (0, 0) which is
        required to be able to position properly on transformed context.

        Test: fast/layers/hidpi-transform-on-child-content-is-mispositioned.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::beginTransparencyLayers):
        (WebCore::RenderLayer::clipToRect):
        (WebCore::RenderLayer::paintLayerByApplyingTransform):
        (WebCore::RenderLayer::paintBackgroundForFragments):
        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
        (WebCore::RenderLayer::paintOutlineForFragments):
        (WebCore::RenderLayer::paintMaskForFragments):
        (WebCore::RenderLayer::paintOverflowControlsForFragments):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:

2014-07-17  Beth Dakin  <bdakin@apple.com>

        Fixed position elements are misplaced when a WK1 view has contentInsets set
        https://bugs.webkit.org/show_bug.cgi?id=135031
        -and corresponding-
        <rdar://problem/17682335>

        Reviewed by Tim Horton.

        [NSScrollView documentVisibleRect] is not the rect that we are looking for when 
        this function is called. WebCore is interested in the rect that does not include 
        content that is within the inset region.

        Implement contract() to avoid the awkwardness of calling expand() with negative 
        values.
        * platform/graphics/IntSize.h:
        (WebCore::IntSize::contract):

        Use _insetBounds instead of documentVisibleRect, and when it’s necessary to use 
        the frame’s dimensions, extract the inset from that size.
        * platform/mac/ScrollViewMac.mm:
        (WebCore::ScrollView::platformVisibleContentRect):
        (WebCore::ScrollView::platformVisibleContentSize):

2014-07-17  Enrica Casucci  <enrica@apple.com>

        [REGRESSION WK2]The menu bar does not show up when tapping on the caret.
        https://bugs.webkit.org/show_bug.cgi?id=135023
        <rdar://problem/17617282>

        Reviewed by Benjamin Poulain.

        Adding some exports.
        
        * WebCore.exp.in:

2014-07-17  Timothy Hatcher  <timothy@apple.com>

        Make console.profile record to the Timeline.

        https://bugs.webkit.org/show_bug.cgi?id=134643

        Reviewed by Joseph Pecoraro.

        Passes existing profiler tests in fast/profiler.

        * bindings/js/ScriptState.cpp:
        (WebCore::domWindowFromExecState):
        (WebCore::frameFromExecState):
        (WebCore::scriptExecutionContextFromExecState):
        (WebCore::mainWorldExecState):
        (WebCore::execStateFromNode):
        * bindings/js/ScriptState.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::profilerEnabled):
        (WebCore::InspectorController::setProfilerEnabled):
        * inspector/InspectorController.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::startProfilingImpl):
        (WebCore::InspectorInstrumentation::stopProfilingImpl):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend):
        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorTimelineAgent::start):
        (WebCore::InspectorTimelineAgent::stop):
        (WebCore::startProfiling):
        (WebCore::stopProfiling):
        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        (WebCore::InspectorTimelineAgent::didWriteHTML):
        (WebCore::InspectorTimelineAgent::breakpointActionProbe):
        (WebCore::toProtocol):
        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
        (WebCore::InspectorTimelineAgent::didCompleteRecordEntry):
        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
        (WebCore::InspectorTimelineAgent::sendEvent):
        (WebCore::InspectorTimelineAgent::createRecordEntry):
        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
        * inspector/InspectorTimelineAgent.h:
        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
        * inspector/InstrumentingAgents.cpp:
        (WebCore::InstrumentingAgents::InstrumentingAgents):
        (WebCore::InstrumentingAgents::reset):
        * inspector/InstrumentingAgents.h:
        (WebCore::InstrumentingAgents::persistentInspectorTimelineAgent):
        (WebCore::InstrumentingAgents::setPersistentInspectorTimelineAgent):
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createConsoleProfileData):
        * inspector/TimelineRecordFactory.h:
        * inspector/protocol/Timeline.json:
        * page/PageConsole.cpp:
        (WebCore::PageConsole::profileEnd):

2014-07-16  Sam Weinig  <sam@webkit.org>

        Don't send geolocation permission requests when the page is not visible
        <rdar://problem/17208715>
        https://bugs.webkit.org/show_bug.cgi?id=134989

        Reviewed by Darin Adler.

        Instead of eagerly requesting geolocation permission for pages that aren't visible,
        store a set of pending requests, and send them only once the page has become visible.

        * Modules/geolocation/GeolocationController.cpp:
        (WebCore::GeolocationController::GeolocationController):
        (WebCore::GeolocationController::~GeolocationController):
        (WebCore::GeolocationController::requestPermission):
        (WebCore::GeolocationController::cancelPermissionRequest):
        (WebCore::GeolocationController::viewStateDidChange):
        (WebCore::provideGeolocationTo):
        * Modules/geolocation/GeolocationController.h:
        Store pending requests to be fired once the page is visible.

        * WebCore.xcodeproj/project.pbxproj:
        Add ViewStateChangeObserver.h

        * page/Page.cpp:
        (WebCore::Page::addViewStateChangeObserver):
        (WebCore::Page::removeViewStateChangeObserver):
        (WebCore::Page::setViewState):
        * page/Page.h:
        Add a set of registered view state observers, and notify them when the
        view state changes.

        * page/ViewStateChangeObserver.h: Added.
        (WebCore::ViewStateChangeObserver::~ViewStateChangeObserver):
        Add an observer that can register with the page for view state changes.

2014-07-17  Jer Noble  <jer.noble@apple.com>

        Enable legacy fullscreen API in media controls
        https://bugs.webkit.org/show_bug.cgi?id=134985

        Reviewed by Eric Carlson.

        Allow clients who have not enabled HTML5 Fullscreen APIs to still use fullscreen mode
        with <video> elements by using the legacy, video-element-specific fullscreen APIs in
        the <video> media controls.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller):
        (Controller.prototype.handleReadyStateChange):
        (Controller.prototype.isFullScreen):
        (Controller.prototype.handlePlayButtonClicked):
        (Controller.prototype.updateFullscreenButton):
        (Controller.prototype.handleFullscreenButtonClicked):

2014-07-17  Vineet Chaudhary  <code.vineet@gmail.com>

        [GObject] StrictTypeChecking extended attribute fails for methods with sequence<T>.
        https://bugs.webkit.org/show_bug.cgi?id=121698

        Reviewed by Antonio Gomes.

        GodeGenerator was including wrong heeaders as WebKitDOMlong[] for methods with
        array parameters and StrictTypeChecking extended attribute.
        No new tests. TestObj.idl covers the tests.

        * bindings/scripts/CodeGenerator.pm:
        (GetArrayOrSequenceType):
        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateFunction):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_strict_function_with_array):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/GObject/WebKitDOMTestTypedefs.cpp:
        (webkit_dom_test_typedefs_func):
        (webkit_dom_test_typedefs_nullable_array_arg):
        * bindings/scripts/test/GObject/WebKitDOMTestTypedefs.h:
        * bindings/scripts/test/TestObj.idl:

2014-07-17  Yusuke Suzuki  <utatane.tea@gmail.com>

        CSS JIT: Clean up return path
        https://bugs.webkit.org/show_bug.cgi?id=135011

        Reviewed by Benjamin Poulain.

        Clean up the existing CSS JIT return path before adding new early return path
        for pseudo elements.

        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
        * cssjit/StackAllocator.h:
        (WebCore::StackAllocator::StackReference::StackReference):
        (WebCore::StackAllocator::StackReference::isValid):
        (WebCore::StackAllocator::popAndDiscard): Deleted.

2014-07-16  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Adjust cliprect with devicePixelFractionFromRenderer() before painting.
        https://bugs.webkit.org/show_bug.cgi?id=134950
        <rdar://problem/17617994>

        Reviewed by Simon Fraser.

        The cliprect coming from the graphics layer needs to be adjusted with the subpixel gap
        from renderer. This is symmetric with the offsetting we do, when the dirty rect is sent off to the GraphicsLayer.
        It puts us back to the correct coordinating system for intersecting with renderers.

        Test: compositing/hidpi-compositing-layer-with-tile-layers-on-subpixel-position.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::beginTransparencyLayers):
        (WebCore::RenderLayer::clipToRect):

2014-07-16  Simon Fraser  <simon.fraser@apple.com>

        Fix a typo noticed by Darin.
        
        * rendering/RenderBox.cpp:
        (WebCore::shouldApplyContainersClipAndOffset):
        (WebCore::RenderBox::computeRectForRepaint):
        (WebCore::shouldAppyContainersClipAndOffset): Deleted.

2014-07-16  Simon Fraser  <simon.fraser@apple.com>

        Improve showTree() logging
        https://bugs.webkit.org/show_bug.cgi?id=134997