WebCore:

[WebKit-https.git] / WebCore / ChangeLog

2007-09-10  Antti Koivisto  <antti@apple.com>

        Reviewed by Kevin.

        Fix <rdar://problem/5444866>
        REGRESSION: missing text in Acrobat "Getting Started" screen due to change in load ordering of large resources
        
        Make external scripts loaded using file: wait until all style sheet loads have completed before executing. 
        Fixes a class of problems where there is a dependency between script and stylesheet and results would effectively 
        get randomized based on which order the resources arrived. In Tiger file loads were effectively serialized by
        lower level components, which is why this regressed. 

        Test: http/tests/local/stylesheet-and-script-load-order.html

        * dom/Document.cpp:
        (WebCore::Document::removePendingSheet):
        * dom/Tokenizer.h:
        (WebCore::Tokenizer::executeScriptsWaitingForStylesheets):
        * html/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::HTMLTokenizer):
        (WebCore::HTMLTokenizer::begin):
        (WebCore::HTMLTokenizer::executeScriptsWaitingForStylesheets):
        (WebCore::HTMLTokenizer::notifyFinished):
        * html/HTMLTokenizer.h:

2007-09-08  David Smith  <catfish.man@gmail.com>

        Reviewed by Maciej Stachowiak.
        
        http://bugs.webkit.org/show_bug.cgi?id=15148
        Bug 15148: Poor performance on crazy DOM raytracer
        
        Switch data structures to avoid quadratic behavior.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutPositionedObjects): Update for ListHashSet
        (WebCore::RenderBlock::markPositionedObjectsForLayout): Update for ListHashSet
        (WebCore::RenderBlock::insertPositionedObject): Use ListHashSet to avoid expensive uniqueing
        (WebCore::RenderBlock::removePositionedObject): Update for ListHashSet
        (WebCore::RenderBlock::removePositionedObjects): Update for ListHashSet
        (WebCore::RenderBlock::lowestPosition): Update for ListHashSet
        (WebCore::RenderBlock::rightmostPosition): Update for ListHashSet
        (WebCore::RenderBlock::leftmostPosition): Update for ListHashSet
        (WebCore::RenderBlock::rightBottom): Update for ListHashSet
        * rendering/RenderBlock.h: Change m_positionedObjects from DeprecatedPtrList to ListHashSet

2007-09-09  Brady Eidson <beidson@apple.com>

        Rubberstamped by Darin

        pthread_main_np() is a Darwin thing, not a Mac thing

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::IconDatabase):

2007-09-09  Holger Hans Peter Freyther  <zecke@selfish.org>

        Build fix for Gtk+ by adding WebCore::callOnMainThread to the TemporaryLinkStubs.

        * platform/gdk/TemporaryLinkStubs.cpp:
        (WebCore::callOnMainThread):

2007-09-08  George Staikos  <staikos@kde.org>

        Reviewed by Olliej.

        Separate out and implement FileSystem functions,  and stub out the
        icondatabase function for future implementation.

        * WebCore.pro:
        * platform/qt/FileSystemQt.cpp: Added.
        (WebCore::fileExists):
        (WebCore::deleteFile):
        * platform/qt/TemporaryLinkStubs.cpp:
        * platform/qt/ThreadingQt.cpp: Added.
        (WebCore::callOnMainThread):

2007-09-08  Mark Rowe  <mrowe@apple.com>

        Build fix for when ENABLE(ICONDATABASE) is not set.

        * loader/icon/IconDatabaseNone.cpp:
        (WebCore::IconDatabase::~IconDatabase):

2007-09-08  Mark Rowe  <mrowe@apple.com>

        More fixes for the Qt and Gtk builds.

        * WebCore.pro: Update for file changes.
        * loader/icon/IconDatabase.cpp: Include errno.h for EDEADLK.
        * loader/icon/PageURLRecord.h:

2007-09-08  Justin Garcia  <justin.garcia@apple.com>

        Backing my change back in without the changes to VisiblePosition::next 
        and previous that weren't necessary to fix the bug and were causing some
        layout test failures.  Most of the failures appeared to be fixes but I
        want more time to investigate and have to move to on to another task.

        * editing/Selection.cpp:
        (WebCore::Selection::validate):
        * editing/visible_units.cpp:
        (WebCore::endOfWord):

2007-09-08  Brady Eidson  <beidson@apple.com>

        Reviewed by Mark Rowe

        Fix the _NSAutoreleaseNoPool() errors on launch - We were using NSFileManager on the secondary
        thread with no NSAutoreleasePool in place

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::iconDatabaseSyncThread):

2007-09-08  Sam Weinig  <sam@webkit.org>

        Add fix to the correct file.

        * loader/icon/SQLDatabase.h:
        * loader/icon/SQLStatement.h:

2007-09-08  Sam Weinig  <sam@webkit.org>

        Fix Windows build.

        * loader/icon/SQLStatement.h: Disable boolean conversion warning.

2007-09-08  Brady Eidson  <beidson@apple.com>

        Build fix for non-Mac platforms that use Icon Database

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::IconDatabase): Apparently only Mac has the beauty that is pthread_main_np()

2007-09-08  Mark Rowe  <mrowe@apple.com>

        Build fix.

        * WebCore.xcodeproj/project.pbxproj: Headers used up in WebKit need to be be "private" rather than "project".

2007-09-08  Brady Eidson  <beidson@apple.com>

        Reviewed by Darin

        <rdar://problem/5434431> - Asynchronous Icon Database

        The IconDatabase API was originally designed to be fully asynchronous - if an icon wasn't read in from disk
        when you asked for it, you would be notified when it was.

        Safari 2 did writes on a background thread, but reads blocked the main thread.

        The current WebCore implementation using SQLite attempted to get rid of the background thread by defering expensive 
        writes via timers, but falls short in moderate to extreme usage cases

        Time to make the IconDatabase live up to it's fully asynchronous destiny.

        This should -
        - Make the browser instantly usable while converting Safari 2 icons in the background occurs
        - Remedy any UI slowness/blocking when on slow network home directories
        - Remedy random UI slowness, pauses, and stutters do to random I/O occurring at the exact wrong time or under heavy
          disk usage from swapping or other apps on the system
        - Allow certain long-running procedures to be interruptible (Safari 2 import, reading icons in from disk when trying to quit, etc)

        This will have a noticeable effect on current Safari 2 and Safari 3 beta browsers, including icons not appearing in bookmarks, history,
        or the location field the first time they're asked for, as current released Safari's don't properly listen for these async notifations.  
        The second time such a menu or view is brought up, the icon should be there.

        Additionally this includes a SQLite schema change which will be a lot more efficient but will result in the loss of current SQLite icons.
        Converting from Safari 2 style icons will still work.

        WebCore, welcome to multi-threadedness

        * WebCore.exp:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCore.vcproj/WebCore.vcproj:

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::iconLoadDecisionAvailable): Called when an Icon becomes available that was requested by this 
          DocumentLoader (to support the webView:didReceiveIcon: delegate call in WebKit)
        * loader/DocumentLoader.h:

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::iconLoadDecisionAvailable): Called from the DocumentLoaders who get notified - if the FrameLoader 
          ends up not caring because the WebView has transitioned to a new page, nothing occurs.  Otherwise, the FrameLoader possibly
          starts it Icon Loader and possibly sends the webView:didReceiveIcon: delegate call
        (WebCore::FrameLoader::startIconLoader): Instead of "Yes, load the icon now" or "No, don't load it" there is a third possibility -
          "You might be asked to load your icon later."  Add supporting logic for receiving this state, and being called a second time
          when the load decision is finally available.
        * loader/FrameLoader.h:

        * loader/FrameLoaderClient.h: Added "registerForIconNotification" which is a way to tell WebViews "The icon you are interested in might
          become available via the generic WebIconDatabaseDidAddIconNotification instead of a targeted delegate call"
          A WebView can then receive the generic notification and pass on it's own targeted delegate call.

        * loader/icon/IconDataCache.cpp: Removed.
        * loader/icon/IconDataCache.h: Removed.

        * loader/icon/IconDatabase.cpp:
        (WebCore::urlForLogging): Cut a URL down in length for sane logging and debugging
        (WebCore::defaultClient): Return the default, empty IconDatabaseClient incase the API doesn't set one.

        Following block of methods are for the Main thread's usage -
        (WebCore::IconDatabase::setClient):
        (WebCore::makeAllDirectories): Small optimization that checks to see if the entire path exists already, and doesn't try to loop
          through each patch component if the full path is already present
        (WebCore::IconDatabase::open): Makes all directories to the target path and kicks off the background thread - nothing more.
        (WebCore::IconDatabase::close): Signals the thread to quit and waits for it to do so
        (WebCore::IconDatabase::removeAllIcons): Purge the icon database
        (WebCore::IconDatabase::iconForPageURL):
        (WebCore::IconDatabase::readIconForPageURLFromDisk):
        (WebCore::IconDatabase::iconURLForPageURL):
        (WebCore::IconDatabase::defaultIcon):
        (WebCore::IconDatabase::retainIconForPageURL):
        (WebCore::IconDatabase::releaseIconForPageURL):
        (WebCore::IconDatabase::setIconDataForIconURL):
        (WebCore::IconDatabase::setIconURLForPageURL):
        (WebCore::IconDatabase::loadDecisionForIconURL): Determine if an icon loader should load now.  If the decision is "maybe later", then
          mark the DocumentLoader to be notified later when the final decision is available.
        (WebCore::IconDatabase::iconDataKnownForIconURL): Determine if the actual image data has been read from disk (or set from the loader) for 
          icon URL in question
        (WebCore::IconDatabase::setEnabled):
        (WebCore::IconDatabase::isEnabled):
        (WebCore::IconDatabase::setPrivateBrowsingEnabled):
        (WebCore::IconDatabase::isPrivateBrowsingEnabled):
        (WebCore::IconDatabase::delayDatabaseCleanup): Restore this method from a year ago, as asynchronous pruning of icons can now occur on a 
          background thread.
        (WebCore::IconDatabase::allowDatabaseCleanup):
        (WebCore::IconDatabase::checkIntegrityBeforeOpening):
        (WebCore::IconDatabase::pageURLMappingCount):
        (WebCore::IconDatabase::retainedPageURLCount):
        (WebCore::IconDatabase::iconRecordCount):
        (WebCore::IconDatabase::iconRecordCountWithData):
        (WebCore::IconDatabase::IconDatabase):
        (WebCore::IconDatabase::~IconDatabase):
        (WebCore::IconDatabase::notifyPendingLoadDecisions): Tell all the registered DocumentLoaders "Hey, we've read in all URL mappings from disk,
          so check to see if you are interested in any of them"
        (WebCore::IconDatabase::notifyPendingLoadDecisionsInternal):
        (WebCore::IconDatabase::wakeSyncThread): Wake the sync thread, if it is idle
        (WebCore::IconDatabase::scheduleOrDeferSyncTimer): Even though we're on a background thread, we still defer writing out to disk during
          periods of high activity
        (WebCore::IconDatabase::syncTimerFired): Call wakeSyncThread()

        Following block of methods may be used by either thread -
        (WebCore::IconDatabase::isOpen):
        (WebCore::IconDatabase::databasePath):
        (WebCore::IconDatabase::defaultDatabaseFilename):
        (WebCore::IconDatabase::getOrCreateIconRecord):
        (WebCore::IconDatabase::getOrCreatePageURLRecord):

        Following block of methods are used by the secondary thread only -
        (WebCore::IconDatabase::importIconURLForPageURL): For the Safari 2 import procedure - write a URL mapping directly out to disk
        (WebCore::IconDatabase::importIconDataForIconURL): For the Safari 2 import procedure - write an Icon directly out to disk
        (WebCore::IconDatabase::shouldStopThreadActivity): To check and see if the thread should stop what it is doing now to do something
          more important (such as quit, or delete all icons)
        (WebCore::IconDatabase::iconDatabaseSyncThreadStart):
        (WebCore::IconDatabase::iconDatabaseSyncThread): Entry point for the background thread
        (WebCore::databaseVersionNumber):
        (WebCore::isValidDatabase):
        (WebCore::createDatabaseTables):
        (WebCore::IconDatabase::performOpenInitialization): Open and validate the SQLite database, making sure it's schema jives with what
          is expected
        (WebCore::IconDatabase::checkIntegrity):
        (WebCore::IconDatabase::performURLImport): Import all the Page URL -> Icon URL mappings from the database.  Done "1st thing" on startup,
          this is necessary to be able to give the loader decisions about whether or not it should load icons from the network
        (WebCore::IconDatabase::syncThreadMainLoop): Main loop - sleeps until woken up, then does a read cycle and a write cycle until both cycles
          do no work - then it goes back to sleep.
        (WebCore::IconDatabase::readFromDatabase): Reads icons from the database that clients are waiting on
        (WebCore::IconDatabase::writeToDatabase): Writes any changes page -> icon url mappings to disk, as well as any new image data that has 
          been received from the loader
        (WebCore::IconDatabase::pruneUnretainedIcons): Done only once, and only after the first write to the database, this procedure removes all
          icons and page URLs from disk that haven't been retained by any client.  Note that the prune can be delayed by utilizing delayDatabaseCleanup()
        (WebCore::IconDatabase::checkForDanglingPageURLs): Usually part of the prune procedure, prunes any pages who point to icons that no longer exist 
          in the database
        (WebCore::IconDatabase::removeAllIconsOnThread): Completely purge both the on-disk and in memory records of all icons
        (WebCore::IconDatabase::deleteAllPreparedStatements): Part of removeAllIcons and the thread cleanup procedure
        (WebCore::IconDatabase::cleanupSyncThread): Write out any last remaining writes to disk, close the database, and then end the thread
        (WebCore::IconDatabase::imported): Checks the DB to see if the Safari 2 import has occured
        (WebCore::IconDatabase::setImported): Sets the "Safari 2 imported" flag
        (WebCore::readySQLStatement):
        (WebCore::IconDatabase::setIconURLForPageURLInSQLDatabase): This and the following "SQLDatabase" suffixed methods are pretty self explanatory
        (WebCore::IconDatabase::setIconIDForPageURLInSQLDatabase):
        (WebCore::IconDatabase::removePageURLFromSQLDatabase):
        (WebCore::IconDatabase::getIconIDForIconURLFromSQLDatabase):
        (WebCore::IconDatabase::addIconURLToSQLDatabase):
        (WebCore::IconDatabase::getImageDataForIconURLFromSQLDatabase):
        (WebCore::IconDatabase::removeIconFromSQLDatabase):
        (WebCore::IconDatabase::writeIconSnapshotToSQLDatabase):
        * loader/icon/IconDatabase.h:

        * loader/icon/IconDatabaseClient.h: Added.
        (WebCore::IconDatabaseClient::~IconDatabaseClient):
        (WebCore::IconDatabaseClient::performImport): Perform the Safari 2 import, implemented by WebKit
        (WebCore::IconDatabaseClient::dispatchDidRemoveAllIcons): Send the API notification
        (WebCore::IconDatabaseClient::dispatchDidAddIconForPageURL): Ditto

        * loader/icon/IconDatabaseNone.cpp: Best attempt to keep non icon-DB platforms building
        (WebCore::IconDatabase::defaultDatabaseFilename):
        (WebCore::IconDatabase::readIconForPageURLFromDisk):
        (WebCore::IconDatabase::loadDecisionForIconURL):
        (WebCore::IconDatabase::iconDataKnownForIconURL):
        (WebCore::IconDatabase::setIconURLForPageURL):
        (WebCore::IconDatabase::isEnabled):
        (WebCore::IconDatabase::delayDatabaseCleanup):
        (WebCore::IconDatabase::allowDatabaseCleanup):
        (WebCore::IconDatabase::setClient):

        * loader/icon/IconRecord.cpp: Added.
        (WebCore::IconRecord::IconRecord): IconRecord used to be "IconDataCache" - it is merely a container for the url, timestamp, and image for a site icon.
          It is Shared, and therefore ref counted - PageURLRecords are the owning containers.  This is a tricky way to track how many page urls are retaining 
          an IconRecord and therefore tracking when we should try to get rid of one.
        (WebCore::IconRecord::~IconRecord):
        (WebCore::IconRecord::image):
        (WebCore::IconRecord::setImageData):
        (WebCore::IconRecord::loadImageFromResource):
        (WebCore::IconRecord::imageDataStatus): Return whether the image data hasn't been read yet, exists in memory, or is absent (site with no icon)
        (WebCore::IconRecord::snapshot): Returns a snapshot of the icon's data - url, timestamp, and image data - to be written to disk
        * loader/icon/IconRecord.h: Added.
        (WebCore::IconSnapshot::IconSnapshot):
        (WebCore::IconRecord::getTimestamp):
        (WebCore::IconRecord::setTimestamp):
        (WebCore::IconRecord::iconURL):
        (WebCore::IconRecord::retainingPageURLs):

        * loader/icon/PageURLRecord.cpp: Added.
        (WebCore::PageURLRecord::PageURLRecord): PageURLRecord is fundamentally a pairing of a Page URL to an Icon.  It has manual ref counting for the sake
          of "retainIconForPageURL" and "releaseIconForPageURL", and can provide a quick snapshot of it's Page URL -> Icon URL mapping for writing to
          the database
        (WebCore::PageURLRecord::setIconRecord):
        (WebCore::PageURLRecord::snapshot):
        * loader/icon/PageURLRecord.h: Added.
        (WebCore::PageURLSnapshot::PageURLSnapshot):
        (WebCore::PageURLRecord::url):
        (WebCore::PageURLRecord::PageURLRecord::iconRecord):
        (WebCore::PageURLRecord::retain):
        (WebCore::PageURLRecord::release):
        (WebCore::PageURLRecord::retainCount):

        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::copy): Added a deep copy method for the purposes of handing icon data across the thread boundary into the icon database
        * platform/SharedBuffer.h:

        * platform/graphics/svg/SVGImageEmptyClients.h:
        (WebCore::SVGEmptyFrameLoaderClient::registerForIconNotification):

        * platform/win/TemporaryLinkStubs.cpp:
        (WebCore::callOnMainThread): Only other IconDatabase utilizing platform - keep their build going

2007-09-07  David Kilzer  <ddkilzer@apple.com>

        Reviewed by Timothy Hatcher.

        Housekeeping.  No test required.

        * bindings/objc/WebScriptObjectInternal.h: Removed unused file.
        * bindings/objc/WebScriptObjectPrivate.h: Updated copyright statement.

2007-09-07  Justin Garcia  <justin.garcia@apple.com>
        
        Rolling out my changes from r25421 while I investigate the layout test failures
        they caused.
        
        * editing/Selection.cpp:
        (WebCore::Selection::validate):
        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::next):
        (WebCore::VisiblePosition::previous):
        (WebCore::VisiblePosition::lastEditablePositionAtOrBefore):
        (WebCore::VisiblePosition::firstEditablePositionAtOrAfter):
        * editing/VisiblePosition.h:
        * editing/visible_units.cpp:
        (WebCore::endOfWord):
        (WebCore::previousWordPosition):
        (WebCore::nextWordPosition):
        (WebCore::startOfLine):
        (WebCore::endOfLine):
        (WebCore::previousSentencePosition):
        (WebCore::nextSentencePosition):

2007-09-05  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Darin Adler, Maciej Stachowiak, Mark Rowe, Tim Hatcher.
        
        Fixed <rdar://problem/5326009> Make non-browser WebKit clients have no 
        memory cache, or a very tiny one

        Added a client callback to notify WebKit when the first navigation has
        taken place. "Navigation" here means a transition from one page to 
        another that ends up in the back/forward list.
        
        WebKit Mac uses this notification to grow its cache model under certain
        circumstances.
        
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::addBackForwardItemClippedAtTarget):
        * loader/FrameLoaderClient.h:

        * platform/graphics/svg/SVGImageEmptyClients.h:
        (WebCore::SVGEmptyFrameLoaderClient::didPerformFirstNavigation): Ah, 
        SVGEmptyFrameLoaderClient, my old friend. 

2007-09-07  Adele Peterson  <adele@apple.com>

        Reviewed by Dave Harrison.

        Fix for <rdar://problem/5428427> Wrong characters are re-converted after doing reconversion with Kotoeri

        Revert change for<rdar://problem/5279521> and add nil checks for the result of TextIterator::rangeFromLocationAndLength
        TextIterator::exitNode shouldn't require the m_lastTextNode to be true, but we can't change that without making the logic in _web_attributedStringFromRange match.
        We'll get that for free when we switch to use TextIterator in _web_attributedStringFromRange.

        * editing/ApplyStyleCommand.cpp: (WebCore::ApplyStyleCommand::applyBlockStyle): Added nil checks.
        * editing/IndentOutdentCommand.cpp: (WebCore::IndentOutdentCommand::indentRegion): ditto.
        * editing/TextIterator.cpp: (WebCore::TextIterator::exitNode): Re-added check for m_lastTextNode before emitting newline.

2007-09-07  Ada Chan  <adachan@apple.com>

        <rdar://problem/5395928> Need to be able to handle context menu item selection by index
        
        Reviewed by Beth.

        * platform/ContextMenu.h: Added method to retrieve context menu item by index
        * platform/win/ContextMenuWin.cpp:
        (WebCore::ContextMenu::ContextMenu): call setPlatformDescription() since that will handle
        adding the MNS_NOTIFYBYPOS style to the context menu.
        (WebCore::contextMenuItemByIdOrPosition): helper method so we don't have to duplicate code
        between itemWithAction() and itemAtIndex().
        (WebCore::ContextMenu::itemWithAction):
        (WebCore::ContextMenu::itemAtIndex):
        (WebCore::ContextMenu::setPlatformDescription): add MNS_NOTIFYBYPOS style to the context menu
        so we will get notified by menu position through WM_MENUCOMMAND when the item is selected.

2007-09-07  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Darin.
        
        <rdar://problem/5057506> Double-clicking after ToDo content doesn't select the paragraph break
        
        * editing/Selection.cpp:
        (WebCore::Selection::validate):
        Moved the code that moves across a paragraph boundary
        when expanding selections by word granularity from
        endOfWord to here.
        In the word and paragraph granularity cases, if the 
        end of the selection is at the end of the last paragraph 
        in the last cell of a block table, expand it so that 
        it ends at the start of the paragraph after the table, 
        instead of just after the table, so that ToDo content 
        gets the same double/tripled click behavior that normal 
        paragraphs get (added two testcases).
        When expanding the selection to include paragraph
        breaks, pass VisiblePosition::next true so that it
        doesn't change editability.
        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::next): Renamed the bool because it's now also
        used to keep non-editable positions non-editable.
        (WebCore::VisiblePosition::previous): Ditto.
        (WebCore::VisiblePosition::lastPositionWithSameEditabilityAtOrBefore):
        Renamed this function and made it also work with non-editable positions.
        (WebCore::VisiblePosition::firstPositionWithSameEditabilityAtOrAfter):
        Ditto.
        * editing/VisiblePosition.h:
        * editing/visible_units.cpp:
        (WebCore::endOfWord): Called the renamed function.
        (WebCore::previousWordPosition): Ditto.
        (WebCore::nextWordPosition): Ditto.
        (WebCore::startOfLine): Ditto.
        (WebCore::endOfLine): Ditto.
        (WebCore::previousSentencePosition): Ditto.
        (WebCore::nextSentencePosition): Ditto.

2007-09-07  Brady Eidson  <beidson@apple.com>

        Reviewed by Sam

        <rdar://problem/5089241> - ASSERT and other funky effects in IconLoader with large 404 pages

        There were two problems:
        1 - I originally didn't expect SubresourceLoader to keep pulling in data after it received a 404 response,
            but if the server sends back a complex 404 page, the loader did just that.  That could result in the 
            IconLoader "finishing" twice
        2 - In this case, the long messy 404 page would be committed to the database as image data.  This would 
            result in wasted space on disk, wasted space in RAM, and wasting processor time trying to parse 50k+
            of HTML as image data

        Fix is two parts - 1, monitor the "m_loadIsInProgress" flag and 2, make ::finishLoading() take an actual 
        SharedBuffer argument that is what should be committed to the database so the ResourceHandle is unnecessary

        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::didReceiveResponse): If the response is not valid, commit null data 
        (WebCore::IconLoader::didFail): If we've already finished loading once (the 404 response), don't
          finish again!
        (WebCore::IconLoader::didFinishLoading): Ditto
        (WebCore::IconLoader::finishLoading): Take a SharedBuffer argumnt as the actual data to commit
        * loader/icon/IconLoader.h: Add a SharedBuffer arg to ::finishLoading()

2007-09-07  Brady Eidson  <beidson@apple.com>

        Reviewed by Darin

        Inline the in-header definitions for non-Mac platforms

        * platform/AutodrainedPool.h:
        (WebCore::AutodrainedPool::AutodrainedPool):
        (WebCore::AutodrainedPool::~AutodrainedPool):
        (WebCore::AutodrainedPool::cycle):

2007-09-07  Brady Eidson  <beidson@apple.com>

        Reviewed by Darin

        Add some AutoreleasePool and Threading utilities in preparation for the multi-threaded
        fix for <rdar://problem/5434431>

        AutodrainedPool wraps an NSAutoreleasePool and tracks a "cycle" count.  This allows clients
        in WebCore to simply call ::cycle() and after a preset number of iterations the pool will drain
        and recreate the underlying NSAutoreleasePool
   
        Threading utilities include C++ wrappers for pthread mutexes and conditions, as well as a generic
        "callOnMainThread()" function for any non-main thread to use.

        * platform/AutodrainedPool.h: Added.  
        (WebCore::AutodrainedPool::AutodrainedPool): Empty implementations for all non-mac platforms
        (WebCore::AutodrainedPool::~AutodrainedPool): ditto
        (WebCore::AutodrainedPool::cycle): ditto
        * platform/mac/AutodrainedPool.mm: Added.
        (WebCore::AutodrainedPool::AutodrainedPool): 
        (WebCore::AutodrainedPool::~AutodrainedPool):
        (WebCore::AutodrainedPool::cycle): Keep track of number of cycles, and drain/recreate the pool if the
          cycle limit is hit

        * platform/Threading.h: Added.
        (WebCore::Mutex::Mutex): C++ wrapper for pthread_mutex
        (WebCore::Mutex::~Mutex):
        (WebCore::Mutex::lock):
        (WebCore::Mutex::tryLock):
        (WebCore::Mutex::unlock):
        (WebCore::MutexLocker::MutexLocker): Handles automatically locking/unlocking a Mutex (for early returns
          from a function, for example)
        (WebCore::MutexLocker::~MutexLocker):
        (WebCore::ThreadCondition::ThreadCondition): C++ wrapper for pthread_condition
        (WebCore::ThreadCondition::~ThreadCondition):
        (WebCore::ThreadCondition::wait):
        (WebCore::ThreadCondition::signal):
        (WebCore::ThreadCondition::broadcast):
        * platform/mac/Threading.mm: Added.
        (-[WebCoreFunctionWrapper initWithFunction:]): Obj-C implementation of "callOnMainThread"
        (-[WebCoreFunctionWrapper _call]):
        (WebCore::callOnMainThread):

2007-09-07  George Staikos  <staikos@kde.org>

        Fix typo.

        * loader/ProgressTracker.h:
        (WebCore::ProgressTracker::totalPageAndResourceBytesToLoad):

2007-09-07  Qing Zhao  <qing@staikos.net>

        Reviewed by Anders and George.

        Add accessors for these two variables.

        * loader/ProgressTracker.h:
        (WebCore::ProgressTracker::totalPageAndResourseBytesToLoad):
        (WebCore::ProgressTracker::totalBytesReceived):

2007-09-06  Tristan O'Tierney  <tristan@apple.com>

        Reviewed by Maciej Stachowiak.
        
        <rdar://problem/5333496> Back button stopped working on sfgate.com (14957)
        
        This fix is specifically targted to address sfgate.com and reuters.com with minimal
        impact to other areas of the frameloader.  It does not cause any regression tests to fail.
        I've added two layout tests: One to detect this particular bug, and one to address
        a secondary issue: if an iframe navigation occurs during onload by a timeout an
        additional history item is added, similarly to firefox.  We tried to match firefox
        more than IE with this fix but did gain a little bit of IE compatability.

        Tests: http/tests/navigation/onload-navigation-iframe-timeout.html
               http/tests/navigation/onload-navigation-iframe.html

        * dom/Document.h:
        (WebCore::Document::processingLoadEvent):
        Return the m_processingLoadEvent boolean so FrameLoader knows
        that the document is in the middle of calling <body onload>
        
        * html/HTMLFrameOwnerElement.cpp:
        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
        * html/HTMLFrameOwnerElement.h:
        (WebCore::HTMLFrameOwnerElement::createdByParser):
        (WebCore::HTMLFrameOwnerElement::setCreatedByParser):
        Added support for a new member variable of frame elements: m_createdByParser.
        This lets us specifically target the fix to only iframes created via JS
        and not in-document.
        
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::FrameLoader):
        Initialize m_navigationDuringLoad to false
        
        (WebCore::FrameLoader::provisionalLoadStarted):
        Determine if the load we're about to start is occuring during
        an onload.
        
        (WebCore::FrameLoader::updateHistoryForStandardLoad):
        If the current frameloader is for a child frame, and the navigation is occuring
        during an onload update the current history item rather than adding a new one.
        
        * loader/FrameLoader.h:
        Added a new member variable, m_navigationDuringLoad to track
        the navigation status during the on load, rather than trying to determine
        the status after (which is nearly impossible due to a new runloop spin).

2007-09-06  David Kilzer  <ddkilzer@apple.com>

        Reviewed by Darin.

        The implementation of BackForwardList::clearPageCache() was removed in r21793.
        It's now safe to remove it from the header.

        * history/BackForwardList.h: Removed clearPageCache().

2007-09-06  Anders Carlsson  <andersca@apple.com>

        Reviewed by Ada.

        <rdar://problem/5457844>
        Crash when using mouse wheel with plug-ins disabled.

        Null check the widget.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleWheelEvent):

2007-09-06  Anders Carlsson  <andersca@apple.com>

        Reviewed by Mitz.

        Small tweak.
        
        * plugins/win/PluginStreamWin.cpp:
        (WebCore::PluginStreamWin::startStream):

2007-09-06  Anders Carlsson  <andersca@apple.com>

        Reviewed by Adam and Steve.

        <rdar://problem/5459321>
        ADOBE: Safari 3 on Windows is passing bogus values in stream->headers in NPP_NewStream, causing Flash Player to crash.
        
        Serialize the headers into a stream and pass it to NPP_NewStream in stream->headers.
        
        * plugins/win/PluginStreamWin.cpp:
        (WebCore::PluginStreamWin::startStream):
        * plugins/win/PluginStreamWin.h:

2007-09-06  Darin Adler  <darin@apple.com>

        Reviewed by Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15153
          REGRESSION: Assertion failure in FrameView::scheduleRelayout() (m_frame->view() == this)

        Back out the willRemove() part of the previous patch.
        It was incorrect and not needed to fix the bug anyway.

        * dom/Document.cpp: (WebCore::Document::detach): Remove willRemove().

        * loader/FrameLoader.cpp: (WebCore::FrameLoader::clear): Put the willRemove() call
        back here where it was originally before the previous fix.

        * history/CachedPage.cpp: (WebCore::CachedPage::clear):
        * page/Frame.cpp:
        (WebCore::Frame::setView):
        (WebCore::Frame::setDocument):
        Added FIXMEs about the fact that we call detach() on the document but not willRemove().

2007-09-05  Timothy Hatcher  <timothy@apple.com>

        Reviewed by Darin.

        Changed the blocked exception log message to match AppKit's blocked exception message.

        * platform/mac/BlockExceptions.mm:
        (ReportBlockedObjCException):

2007-09-06  Darin Adler  <darin@apple.com>

        Reviewed by Hyatt.

        - <rdar://problem/5457865> REGRESSION (9A527): Safari crashes when opening a page
          that immediately redirects to a PDF

        I don't know how to make an automated test that trips over this.

        The immediate cause of this regression was making a back/forward list entry in
        this case. Earlier, the quick redirect would not results in a separate entry.
        That's possibly a bug too, but it's better to fix the crash first.

        The page cache was putting the document into a strange state: Still attached but
        with the renderer set to 0. There was no good reason to do this, so got rid of it.
        Moved the responsibility to the caller of not calling detach() when moving into
        the page cache. This is more of a frame loader thing than a document thing.

        * dom/Document.cpp: (WebCore::Document::detach): Added assertions that this is
        only called on a document that's attached and not in the page cache. Also moved
        the call to willRemove in here, so that callers can't make the mistake of not
        calling that function. Removed the incorrectly-positioned code that made this
        function do less if it was called on a document in the page cache.

        * history/CachedPage.cpp: (WebCore::CachedPage::clear): Removed the code to handle
        a document with a renderer of 0. There was no need to put the document into this
        state. Any document in the page cache will always be "attached".

        * loader/FrameLoader.cpp: (WebCore::FrameLoader::clear): Added a check to prevent
        from calling an unnecessary cancelParsing() on a document that's in the page cache
        and guard the call to detach() with a check of attached(), like all other calls to
        detach() on DOM objects.

        * page/Frame.cpp:
        (WebCore::Frame::setView): Added a missing check of attached(), like all other
        calls to detach() on DOM objects. Also added code to not call detach() on the
        document when it's in the page cache.
        (WebCore::Frame::setDocument): This call site already had the attached() check,
        but was missing the page cache check.

2007-09-05  David Harrison  <harrison@apple.com>

        Reviewed by Darin.

        Follow up on my fix for <rdar://problem/5306171>.
        My first patch (r25373) broke svg/custom/stroke-width-click.svg.

        * editing/TextIterator.cpp:
        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
        Add currPos.isNotNull() check because positions in non-html content (like svg)
        do not have visible positions, and we don't want to emit for them either.

2007-09-06  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Adam Roben.

        - fix http://bugs.webkit.org/show_bug.cgi?id=14685
          <rdar://problem/5349755> text-align affects <select> button but not its drop-down menu

        * platform/PlatformString.h:
        (WebCore::String::defaultWritingDirection):
        * platform/StringImpl.cpp:
        (WebCore::StringImpl::defaultWritingDirection): Moved textDirectionForParagraph()
        from RenderMenuList.cpp here.
        * platform/StringImpl.h:
        * platform/win/PopupMenuWin.cpp:
        (WebCore::PopupMenu::itemWritingDirectionIsNatural): Changed to return 'true'.
        (WebCore::PopupMenu::paint): Changed to use natural directionality for menu
        items.
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::adjustInnerStyle): Use defaultWritingDirection.

2007-09-06  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Oliver Hunt.

        - fixed <rdar://problem/5455457> REGRESSION (9A527-9A535): Colloquy crash on launch in WebCoreScriptDebugger initWithDelegate (with announce.js plug-in installed)

        * page/mac/FrameMac.mm:
        (WebCore::Frame::windowScriptObject): Ensure that -[WebView
        windowScriptObject] and -[WebFrame windowObject] return null until
        the windowScriptObjectAvailable: delegate method is sent.

2007-09-05  David Harrison  <harrison@apple.com>

        Reviewed by Kevin Decker.

        <rdar://problem/5306171> Mail: The first return after an attachment in multipart/mixed message is lost

        Test added: editing/selection/toString-1.html
        
        Source changes:
        * editing/TextIterator.cpp:
        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
        - Remove outdated and erroneous check for m_lastTextNode.
        - Fix VisiblePosition check to look for line diff. Simple position diff gives the
        wrong answer when the start is table/0 and the current is the first position
        inside the content of the table.

2007-09-04  Marvin Decker  <marv.decker@gmail.com>

        Reviewed by Maciej Stachowiak.

        http://bugs.webkit.org/show_bug.cgi?id=15072
        Bug 15072: Fix ImageDecoder.cpp to not copy incoming data

        Change ImageDecoder::setData to take a SharedBuffer*.

        * platform/graphics/cairo/ImageSourceCairo.cpp:
        (WebCore::ImageSource::setData):
        * platform/image-decoders/ImageDecoder.h:
        (WebCore::RGBA32Buffer::bytes):
        (WebCore::RGBA32Buffer::height):
        (WebCore::ImageDecoder::setData):
        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::setData):
        (WebCore::GIFImageDecoder::frameCount):
        (WebCore::GIFImageDecoder::decode):
        (WebCore::GIFImageDecoder::decodingHalted):
        (WebCore::GIFImageDecoder::initFrameBuffer):
        * platform/image-decoders/gif/GIFImageDecoder.h:
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (WebCore::JPEGImageDecoder::setData):
        (WebCore::JPEGImageDecoder::decode):
        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageDecoder::setData):
        (WebCore::PNGImageDecoder::decode):
        (WebCore::PNGImageDecoder::headerAvailable):
        (WebCore::PNGImageDecoder::rowAvailable):
        * platform/image-decoders/png/PNGImageDecoder.h:

2007-09-04  David Hyatt  <hyatt@apple.com>

        Fix for <rdar://problem/5271213>, resizing iChat window is slower than in
        Tiger. This patch implements a fast scaling mode that can be used by
        WebViews, e.g., during window resizing.

        Reviewed by John Sullivan

        * WebCore.exp:
        * WebCore.xcodeproj/project.pbxproj:
        * page/Frame.cpp:
        (WebCore::FramePrivate::FramePrivate):
        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::inLowQualityImageInterpolationMode):
        (WebCore::Page::setInLowQualityImageInterpolationMode):
        * page/Page.h:
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawImage):
        * platform/graphics/GraphicsContext.h:
        (WebCore::GraphicsContext::setUseLowQualityImageInterpolation):
        (WebCore::GraphicsContext::useLowQualityImageInterpolation):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::setUseLowQualityImageInterpolation):
        (WebCore::GraphicsContext::useLowQualityImageInterpolation):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paint):

2007-09-04  Brady Eidson  <beidson@apple.com>

        Reviewed by Adam

        Some SQLite tweaks for debugging
        -In debug builds, track the thread that opened the database and enforce that any statements
         that operate on the SQLDatabase do so from the thread that opened it
        -Track whether or not a transaction is in progress for the SQLDatabase to find cases where
         someone opens a new transaction while there is still one outstanding (a SQLite logic error)

        * loader/icon/SQLDatabase.cpp:
        (WebCore::SQLDatabase::SQLDatabase): 
        (WebCore::SQLDatabase::open): Track the opening thread.  Also, return false if the DB failed to
          open instead of trying to run a PRAGMA on it!
        (WebCore::SQLDatabase::close): Reset the opening thread
        * loader/icon/SQLDatabase.h:
        (WebCore::SQLDatabase::transactionInProgress): 
        (WebCore::SQLDatabase::sqlite3Handle): For access to the raw sqlite3* handle to do a thread
          safety check

        * loader/icon/SQLStatement.cpp:
        (WebCore::SQLStatement::prepare): Use the new sqlite3Handle accessor
        (WebCore::SQLStatement::step): Ditto

        * loader/icon/SQLTransaction.cpp:
        (WebCore::SQLTransaction::SQLTransaction): Removed the c'tor form that could automatically
          begin the transaction - never used and shouldn't be in practice!
        (WebCore::SQLTransaction::begin): Maintain the transaction-in-progress flag on the DB
        (WebCore::SQLTransaction::commit): Ditto
        (WebCore::SQLTransaction::rollback): Ditto
        * loader/icon/SQLTransaction.h:

2007-09-04  David Harrison  <harrison@apple.com>

        Reviewed by Maciej and John.

        <rdar://problem/5452675> CrashTracer: [USER] 10 crashes in Mail at com.apple.WebCore: WebCore::Node::nodeIndex const + 6

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        Adjust pos to pos.downstream() after the refNode is calculated, but before the insertion. Doing it earlier
        undid the logic of positionAvoidingSpecialElementBoundary(). The downstream is still needed just to set the
        ending selection.

2007-09-04  Antti Koivisto  <antti@apple.com>

        Reviewed by Maciej.
        
        Fix <rdar://problem/5452112>
        REGRESSION: Initially focused textfield on www.mac.com login page has no insertion point, and doesn't accept typed characters
        
        Use updateLayoutIgnorePendingStylesheets() instead of updateLayout(). We need to have rendering to set input focus.

        Test: fast/forms/focus-style-pending.html

        * dom/Element.cpp:
        (WebCore::Element::focus):

2007-09-04  Girish Ramakrishnan  <girish@trolltech.com>

        Reviewed by Simon.

        Fixed Qt build on Windows

        * html/HTMLFormElement.cpp:
        (WebCore::pathGetFilename):

2007-09-03  David Harrison  <harrison@apple.com>

        Reviewed by Kevin Decker.

        <rdar://problem/5456785> REGRESSION (r15963-r15970): Heading text not placed in VoiceOver Item Chooser (15132)

        * bridge/mac/WebCoreAXObject.mm:
        (-[WebCoreAXObject title]):
        For headings, return the text under the element instead of nil.

2007-08-20  Oleg Sukhodolsky <son.two@gmail.com>

        Reviewed by Mark.

        WebKitQt/WebCoreSupport should not be added to INCLUDEPATH for gdk-port

        * WebCore.pro:

2007-09-03  Mark Rowe  <mrowe@apple.com>

        Reviewed by Tim Hatcher.

        <rdar://problem/5452164> Production build with in symbols directory has no debug info

        Enable debug symbol generation on all build configurations.  Production builds are stripped
        of symbols by Xcode during deployment post-processing.

        * Configurations/Base.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:

2007-09-02  Brady Eidson  <beidson@apple.com>

        Reviewed by John Sullivan and Mark Rowe

        Groundwork for support for monitoring IconDatabase in-memory statistics

        * WebCore.exp:
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::pageURLMappingCount): Stub for now
        (WebCore::IconDatabase::retainedPageURLCount): Ditto
        (WebCore::IconDatabase::iconRecordCount): Ditto
        (WebCore::IconDatabase::iconRecordCountWithData): Ditto
        * loader/icon/IconDatabase.h:

2007-09-02  Mark Rowe  <mrowe@apple.com>

        Reviewed by Antti.

        <rdar://problem/5454704> WebKit seems to get too-narrow widths for "Monotype Corsiva", so lays out incorrectly

        * platform/mac/FontDataMac.mm:
        (WebCore::FontData::determinePitch): Work around NSFont incorrectly reporting Monotype Corsiva as fixed pitch.

2007-09-01  Darin Adler  <darin@apple.com>

        - rolled out fix for bug 12988 because it broke getElementById in a layout test
          I'm working on a new fix.

        * dom/Document.cpp: Rolled out.

2007-09-01  Oliver Hunt  <oliver@apple.com>

        Reviewed by Sam.

        <rdar://problem/5344848> IME is incorrectly used for key events when on non-editable regions

        Adding a new EditorClient method so it is possible to inform WebKit of focus changes.
        Also added new virtual method Node::shouldUseInputMethod to allow us to trivially check
        whether an input method should be used when processing input for the currently focused
        Node.

        * bridge/EditorClient.h:
        * dom/Node.cpp:
        (WebCore::Node::shouldUseInputMethod):
        * dom/Node.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::shouldUseInputMethod):
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::shouldUseInputMethod):
        * html/HTMLTextAreaElement.h:
        * page/FocusController.cpp:
        (WebCore::FocusController::setFocusedNode):
        * platform/graphics/svg/SVGImageEmptyClients.h:
        (WebCore::SVGEmptyEditorClient::setInputMethodState):

2007-09-01  Rob Buis  <buis@kde.org>

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=12988
        First element (in document order) is not returned when other duplicate ID-ed elements were created first

        Reset the element id cache when id's are added or removed and there
        are duplicates for that id.

        Tests: fast/dom/duplicate-ids-document-order.html

        * dom/Document.cpp:
        (WebCore::Document::getElementById):
        (WebCore::Document::addElementById):
        (WebCore::Document::removeElementById):

2007-09-01  Rob Buis  <buis@kde.org>

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=15083
        Some symbols in WebKit do not need to be exported

        Do not export these symbols.

        * dom/QualifiedName.cpp:
        (WebCore::hashComponents):
        * dom/XMLTokenizer.cpp:
        (WebCore::toString):
        (WebCore::getTokenizer):
        * history/HistoryItem.cpp:
        (WebCore::defaultNotifyHistoryItemChanged):
        * platform/Arena.cpp:
        (WebCore::CeilingLog2):
        * platform/graphics/Color.cpp:
        (WebCore::calcHue):
        * platform/graphics/Path.cpp:
        (WebCore::pathLengthApplierFunction):
        * platform/graphics/cg/PathCG.cpp:
        (WebCore::CGPathToCFStringApplierFunction):
        (WebCore::CFStringFromCGPath):
        * rendering/RenderText.cpp:
        (WebCore::isSpaceAccordingToStyle):

2007-08-31  Alice Liu  <alice.liu@apple.com>

        Reviewed by Tim Hatcher.

        Fixed <rdar://problem/5420682> Mail crashes at WebCore::InsertLineBreakCommand::doApply() after dropping a selected image over container's close box

        * editing/DeleteButtonController.cpp:
        (WebCore::DeleteButtonController::show):
        Factored out the code in ::show() that created and styled the elements of the Deletion UI

        (WebCore::DeleteButtonController::createDeletionUI):
        Neglecting to move the append of the deletionUI elements into the same clause that handles the creation
        of them ended up creating multiple elements at were repeatedly appended to the target, resulting in a 
        bloated table deletion UI which was slow to show and hide. 

        * editing/DeleteButtonController.h:
        (WebCore::DeleteButtonController::enabled):
        Restore this function to how it used to be pre-r25305, sans asserts

        * editing/EditCommand.cpp:
        Add disable/enable sandwich when undoing/redoing commands too
        (WebCore::EditCommand::unapply):
        (WebCore::EditCommand::reapply):

2007-08-31  Antti Koivisto  <antti@apple.com>

        Reviewed by Anders.

        Fix <rdar://problem/5452943>
        REGRESSION (r25283): Reproducible crash in HTMLObjectElement::getInstance under guard malloc
        
        Calling updateLayoutIgnorePendingStylesheets() may do arbitrary things to render tree so
        no RenderObjects can be cached over it.

        * html/HTMLEmbedElement.cpp:
        (WebCore::findWidgetRenderer):
        (WebCore::HTMLEmbedElement::getInstance):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::getInstance):

2007-08-31  Anders Carlsson  <andersca@apple.com>

        Reviewed by Mitz.

        <rdar://problem/5443936>
        Crash after QT movie completes playback at apple.com/imac
        
        If the plug-in or one of its children have focus, set it to NULL to prevent the web view window from getting the focus, 
        which can cause a layout to happen while in HTMLObjectElement::detach. (This is what we do on the Mac).
        
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginViewWin::setParent):

2007-08-30  Adele Peterson  <adele@apple.com>

        Reviewed by Justin.

        Fix for <rdar://problem/5450600> REGRESSION: can't paste in textfield if its in a body that has user-select:none set (affects widgets)

        Test: editing/pasteboard/paste-plaintext-user-select-none.html

        * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplacementFragment::insertFragmentForTestRendering):
          Copy the user-select style from the current selection node and apply it so it is considered during the test rendering.
          This is important since we recently changed user-select to be inherited.  When we consider valid VisiblePositions for the test rendering,
          we need to have the correct user-select value that will actually be used for the real insertion.

2007-08-31  Anders Carlsson  <andersca@apple.com>

        Reviewed by Oliver.

        <rdar://problem/5423939>
        http://bugs.webkit.org/show_bug.cgi?id=15013
        ASSERTION FAILED !m_inDestructor in WebCore::Shared<WebCore::PluginStreamWin>::ref() on Windows
        
        Protect the stream in case it's destroyed by the plug-in.
        
        * plugins/win/PluginStreamWin.cpp:
        (WebCore::PluginStreamWin::didReceiveData):

a2007-08-31  Darin Adler  <darin@apple.com>

        Reviewed by Anders.

        - http://bugs.webkit.org/show_bug.cgi?id=15122

        * editing/htmlediting.cpp: (WebCore::avoidIntersectionWithNode):
        Change assertion so that it only fires when actually modifying the selection.
        This isn't nearly as helpful, because the old assertion could catch potential
        problems in more cases, but it's not obvious how to do better.

2007-08-30  Oliver Hunt  <oliver@apple.com>

        Reviewed by Adam.
        
        <rdar://problem/5430772> REGRESSION(303-310A5) list items do not show with mouse over on istweb.apple.com/quack.apple.com
        
        VC++ treats bitfields as signed members, so Node::m_styleChange would be
        sign extended if it was assigned the value FullStyleChange.  This caused
        style recalculation to stop propagating.  
        
        We work around this VC++ oddity by storing the enum as an unsigned, and
        casting back to StyleChangeType in the getter.
                
        Test: fast/css/hover-affects-child.html

        * dom/Node.h:
        (WebCore::Node::styleChangeType):

2007-08-29  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Darin.

        <rdar://problem/5368833> 
        REGRESSION: Pasting a triple-clicked line of quoted text at the top of a message adds an extra, quoted line

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::insertParagraphSeparator): Added an option for
        using a plain div to hold the new paragraph, instead of a clone of the previous
        block.
        * editing/CompositeEditCommand.h:
        * editing/InsertParagraphSeparatorCommand.cpp: Ditto.
        (WebCore::InsertParagraphSeparatorCommand::InsertParagraphSeparatorCommand): Ditto.
        (WebCore::InsertParagraphSeparatorCommand::doApply): Ditto.
        * editing/InsertParagraphSeparatorCommand.h:
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply): Use a default block element when creating
        new paragraphs, so that empty paragraphs don't contain the block style of the previous
        one.
        Don't expand collapsed brs at the end of inserted content, this was the root of the bug.
        We'd copy <blockquote>hello<br></blockquote><br class="Apple-interchange-newline">
        and get an extra paragraph.  The removed code used to make sure that if the copied 
        selection ends with a paragraph break that is represented in the copied markup by a 
        regular br (not an interchange newline br), that that paragraph break appears in the 
        pasted content, but shouldMergeEnd, which was introduced after this code was written, 
        now takes care of that.
        (WebCore::ReplaceSelectionCommand::shouldRemoveEndBR): Inserted content should always
        displace placeholder brs, even if that inserted content ends with a br.
        * editing/markup.cpp:
        (WebCore::needInterchangeNewlineAfter): This code failed to add an interchange newline
        if the user copied <div>hello</div><br>, only don't add an interchange newline when
        copying ^hello<br>^<br>, because then the copied paragraph break will already be 
        represented in the copied markup by a br.
        (WebCore::createMarkup):

2007-08-30  David Harrison  <harrison@apple.com>

        Reviewed by Darin.

        <rdar://problem/5423900> Seed: safari crashes on submit feedback page in -[WebCoreAXObject isAttachment]

        * bridge/mac/WebCoreAXObject.mm:
        (-[WebCoreAXObject isAttachment]):
        Add nil check since element could be detached.

2007-08-30  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Dave Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=13282
          <rdar://problem/5126392> REGRESSION (NativePopUp): Rightmost character cut off in pop-up menu

        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::updateOptionsWidth): When measuring option text, use
        the same WebCore run rounding behavior that is used to draw it in the popup button.

2007-08-30  Riku Voipio  <riku.voipio@iki.fi>

        Reviewed by Dave Kilzer.

        Better ARM defines.

        * platform/DeprecatedString.h: Update comments to reflect the
        change and update test to fit changes to Platform.h.

2007-08-30  Darin Adler  <darin@apple.com>

        Reviewed by Tim Hatcher.

        - fix http://bugs.webkig.org/show_bug.cgi?id=14981
          DEBUG builds of WebKit hang videwing Yahoo! Mail messages
          with ~5 MB text attachment

        * rendering/InlineFlowBox.cpp: (WebCore::InlineFlowBox::checkConsistency):
        * rendering/RenderFlow.cpp: (WebCore::RenderFlow::checkConsistency):
        * rendering/RenderText.cpp: (WebCore::RenderText::checkConsistency):
        Put the actual consistency check inside an ifdef. If you need it you can
        turn it on. There's still some function call overhead in builds that don't
        have NDEBUG defined, but that's worth it so we can turn this on and off
        without recompiling the world.

        - small code style improvement to recently changed function

        * editing/TextIterator.cpp: (WebCore::plainTextToMallocAllocatedBuffer):
        Use a typedef and make_pair to make the code dealing with the pair simpler to read.

2007-08-30  Simon Hausmann  <hausmann@kde.org>

        Reviewed by Zack.

        Fix Qt/Gdk build. gcc on Linux at least doesn't like initializing
        variables between jumps with goto ("jump to label foo crosses
        initialization of bar").

        * editing/TextIterator.cpp:
        (WebCore::plainTextToMallocAllocatedBuffer):

2007-08-30  Darin Adler  <darin@apple.com>

        Reviewed by Antti.
 
        - fix <rdar://problem/5423270> CrashTracer: [USER] 1 crash in Safari at com.apple.WebCore:
          WebCore::plainTextToMallocAllocatedBuffer + 762

        * editing/TextIterator.cpp: (WebCore::plainTextToMallocAllocatedBuffer):
        Check for a malloc failure and exit the function if it failed.

2007-08-29  Anders Carlsson  <andersca@apple.com>

        Reviewed by Oliver.

        <rdar://problem/5404329>
        Plugin content starves WM_TIMER events on UI thread (affects idle behavior of app) on http://www.vincent-vella.com/, http://www.sagmeister.com/
        
        Add a tiny delay to invalidation timer to prevent it from starving other timers.
        
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginViewWin::invalidateRect):

2007-08-29  Darin Adler  <darin@apple.com>

        Reviewed by Adele.

        * editing/htmlediting.cpp: (WebCore::avoidIntersectionWithNode):
        Fix an assert that was firing for me all the time when doing editing operations.

2007-08-29  Anders Carlsson <andersca@apple.com>

        Reviewed by Adam.

        <rdar://problem/5386098>
        Repro hang with some Flash plugin content (http://dougmccune.com/blog/2007/07/25/coming-to-flexcamp-at-adobe/)
        
        In some cases, Flash ends up starving the main loop by sending a lot of WM_USER + 1 messages. Throttle these
        messages so they won't end up hanging the web browser.
        
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginMessageThrottlerWin::PluginMessageThrottlerWin):
        (WebCore::PluginMessageThrottlerWin::~PluginMessageThrottlerWin):
        (WebCore::PluginMessageThrottlerWin::appendMessage):
        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
        (WebCore::PluginMessageThrottlerWin::allocateMessage):
        (WebCore::PluginMessageThrottlerWin::isInlineMessage):
        (WebCore::PluginMessageThrottlerWin::freeMessage):
        (WebCore::PluginViewWndProc):
        (WebCore::PluginViewWin::wndProc):
        (WebCore::PluginViewWin::determineQuirks):
        * plugins/win/PluginViewWin.h:
        (WebCore::):
        (WebCore::PluginViewWin::pluginWndProc):

2007-08-29  Beth Dakin  <bdakin@apple.com>

        Reviewed by Hyatt.

        Fix for <rdar://problem/5436800> REGRESSION: PLT is 1.5% slower due 
        to r24593 and r25098

        In r25098, we only called setCreatedByParser for XML! This patch 
        calls it for HTML too, and takes care of the performance 
        regression.

        * html/HTMLElementFactory.cpp:
        (WebCore::styleConstructor):

2007-08-29  Antti Koivisto  <antti@apple.com>

        Reviewed by Mitz.
        
        Fix <rdar://problem/5425951>
        REGRESSION: change to updateLayoutIgnorePendingStylesheets causes SAP Portal page to render wrong
        
        If new nodes have been added or style recalc has been done with style sheets still pending, some nodes 
        may not have had their real style calculated yet. Normally this state gets cleaned when style sheets arrive 
        but in updateLayoutIgnorePendingStylesheets() we need to do full style recalc to get up-to-date style immediatly.
        
        Added a document flag to track if there are any nodes that did not have their real style calculated due to
        pending stylesheets.

        Test: fast/dynamic/style-access-late-stylesheet-load.html

        * css/CSSStyleSelector.cpp:
        (WebCore::CSSStyleSelector::styleForElement):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::recalcStyle):
        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
        * dom/Document.h:
        (WebCore::Document::setHasNodesWithPlaceholderStyle):

2007-08-29  Alice Liu  <alice.liu@apple.com>

        Reviewed by Maciej.

        We disable the DeleteButton UI before applying any editing commands.
        This patch simply moves those disable/enable calls to a more correct place, closer to the actual application of the editing command. 

        * editing/EditCommand.cpp:
        (WebCore::EditCommand::apply):
        (WebCore::applyCommand):

2007-08-28  Alice Liu  <alice.liu@apple.com>

        fixed <rdar://problem/5420682> Mail crashes at WebCore::InsertLineBreakCommand::doApply() 
                                       after dropping a selected image over container's close box

        Reviewed by Darin and Maciej.

        * editing/DeleteButtonController.cpp:
        (WebCore::DeleteButtonController::show):
        (WebCore::DeleteButtonController::hide):
        * editing/DeleteButtonController.h:
        (WebCore::DeleteButtonController::enabled):
        General changes made to DeleteButtonController: when hiding, it's not necessary to clear out 
        the m_containerElement and m_target, especially since to fix this bug we need to keep 
        their values around.  It's sufficient to just detach the container from target.

        * editing/EditCommand.cpp:
        (WebCore::EditCommand::EditCommand):
        Move the selection out of the deletion UI since we don't want to expose the deletion UI to any editing.

        * editing/Editor.cpp:
        (WebCore::Editor::rangeForPoint):
        Move the range out of the deletion UI since we don't want to expose the deletion UI to any editing.

        * editing/htmlediting.cpp:
        * editing/htmlediting.h:
        (WebCore::avoidIntersectionWithNode):
        Moved function that operates on Range from markup.cpp to here
        Added new implementation for function that operates on Selection

        * editing/markup.cpp:
        (WebCore::createMarkup):
        Moved function out of this file to htmlediting.cpp, and renamed to avoidIntersectionWithNode

2007-08-29  David Hyatt  <hyatt@apple.com>

        Fix for 5441281, remove our dependency on cursor rects and drag margins
        in AppKit for a large performance boost on the PLT and iBench.

        Reviewed by darin

        * platform/mac/WidgetMac.mm:
        (WebCore::safeRemoveFromSuperview):
        (WebCore::Widget::addToSuperview):
        Suppress the resetting of drag margins when views are added and removed.

        (WebCore::Widget::setCursor):
        Just use NSCursor's set method to immediately set the cursor.  We no longer
        rely on NSScrollView/NSClipView setDocumentCursor, since that is implemented
        using cursor rects.

2007-08-29  Rick  <rick@writhe.org.uk>

        Reviewed by Tim Hatcher.

        Fix http://bugs.webkit.org/show_bug.cgi?id=14853
        Bug 14853: Incorrect implementation of ArrayImpl's equality operator

        * platform/ArrayImpl.cpp:
        (WebCore::ArrayImpl::operator==):
        Fixed typo so that correct variable is used in equality comparison.

2007-08-29  Peter Kasting  <zerodpx@gmail.com>

        Reviewed by Maciej.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15096
        Move the GIF frame duration minimum check into the various
        ImageSource*.cpp backends and use the same values as
        ImageSourceCG.cpp.

        * platform/graphics/cairo/ImageSourceCairo.cpp:
        (WebCore::ImageSource::frameDurationAtIndex):
        * platform/graphics/qt/ImageSourceQt.cpp:
        (WebCore::ImageSource::frameDurationAtIndex):
        * platform/image-decoders/gif/GIFImageReader.cpp:
        (GIFImageReader::read):

2007-08-29  Peter Kasting  <zerodpx@gmail.com>

        Reviewed by Maciej.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15097
        Make PNGImageDecoder.cpp size its frame buffer vector in its
        constructor, so it never throws decoded image data away no matter
        what order its functions are called in.

        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageDecoder::PNGImageDecoder):
        (WebCore::PNGImageDecoder::frameBufferAtIndex):
        (WebCore::PNGImageDecoder::decode):
        (WebCore::PNGImageDecoder::rowAvailable):
        (WebCore::PNGImageDecoder::pngComplete):

2007-08-29  Peter Kasting  <zerodpx@gmail.com>

        Reviewed by Maciej.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15104
        Don't double-compensate for sizeof(unsigned) when making a buffer
        overflow check in the GIF decoder.  Now interlaced GIFs don't
        sometimes get nothing/garbage in some of the bottom rows.

        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::haveDecodedRow):

2007-08-28  Sam Weinig  <sam@webkit.org>

        Reviewed by Darin.

        Update fix landed in r25249 to account for XMLHttpRequest, which can also be EventTargets.

        Tests: http/tests/security/listener/xss-XMLHttpRequest-addEventListener.html
               http/tests/security/listener/xss-XMLHttpRequest-shortcut.html

        * bindings/js/JSXMLHttpRequest.cpp:
        (KJS::JSXMLHttpRequest::putValueProperty): Use the Window object associated with document's frame, not the active Window.
        (KJS::JSXMLHttpRequestPrototypeFunction::callAsFunction): ditto
        * xml/XMLHttpRequest.h:
        (WebCore::XMLHttpRequest::document): Expose Document member so bindings can access the correct frame.

2007-08-28  Anders Carlsson  <andersca@apple.com>

        Reviewed by Darin.

        <rdar://problem/5424866> Bottom portion of any Web Clip widget appears transparent

        Restore the previous behavior, creating plug-ins on attach, for WebKit plug-ins. Netscape plug-ins
        are still created during the first layout.
        
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::getInstance):
        Only call layout if the renderer doesn't have a widget.
        
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::getInstance):
        Likewise.
        
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::shouldUsePlugin):
        Update for enum change.
        
        * loader/FrameLoaderTypes.h:
        Add ObjectContentNetscapePlugin and ObjectContentOtherPlugin.
        
        * page/mac/WebCoreFrameBridge.h:
        Get rid of the enum here, we can use the one in FrameLoaderTypes.h
        
        * rendering/RenderPartObject.cpp:
        (WebCore::RenderPartObject::updateWidget):
        Only create the plug-in if it's not a Netscape plug-in.
        
        (WebCore::RenderPartObject::layout):
        Fix indentation.
        
2007-08-28  David Harrison  <harrison@apple.com>

        Reviewed by Darin.

        <rdar://problem/5415006> Command Left in a To Do causes caret to disappear

        The selection was ending up inside non-editable content at the To Do Options
        arrow image, rather then at the editable position just to the left of that image.
        The problem was that startPositionForLine looked only at line boxes, and there
        is no linebox for the editable position at the far left of a To Do, which is
        a table. Addressed by having startPositionForLine use table offset 0 instead
        of the first VisiblePosition inside the table.
        
        Found and fixed the similar case with option-left (move by word position).
        
        Test cases:
        * editing/selection/mixed-editability-8.html: Added.
        * editing/selection/mixed-editability-9.html: Added.

        Source changes:
        * editing/SelectionController.cpp:
        (WebCore::SelectionController::modifyMovingLeftBackward):
        
        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::next):
        (WebCore::VisiblePosition::previous):
        (WebCore::VisiblePosition::stayInEditableContentLeft):
        (WebCore::VisiblePosition::stayInEditableContentRight):
        Factored stayInEditableContentLeft() and stayInEditableContentRight()
        out of previous() and next().
        
        * editing/VisiblePosition.h:
        Declare stayInEditableContentLeft() and stayInEditableContentRight().

        * editing/visible_units.cpp:
        (WebCore::previousWordPosition):
        (WebCore::nextWordPosition):
        (WebCore::startOfLine):
        (WebCore::endOfLine):
        (WebCore::previousSentencePosition):
        (WebCore::nextSentencePosition):
        Call stayInEditableContentLeft() or stayInEditableContentRight(), as 
        appropriate, so prevent crossing from editable content into
        uneditable content.
        
        (WebCore::startPositionForLine):
        Use table offset 0 instead of the first VisiblePosition in the table.
        
2007-08-28  Mark Rowe  <mrowe@apple.com>

        Reviewed by Darin Adler.

        <rdar://problem/5443453> Decreasing history expiration time from 1 year to 1 week can lead to long hang while icon database syncs

        Perform the sync inside a SQLite transaction.  This drops the time taken for the sync from over 90s to under half a second in the
        extreme case of over 90,000 URLs being pruned.

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::syncDatabase):

2007-08-28  Mark Rowe  <mrowe@apple.com>

        Reviewed by Darin Adler.

        <rdar://problem/5437983> Loading history containing 100,000 entries adds 20s to Safari's startup

        Add a new constructor for HistoryItem that initializes the alternate title.  This prevents WebHistoryItem
        in WebKit from having explicitly set the display title, which triggers a history item changed notification
        to be posted, for each history item loaded.

        * WebCore.exp:
        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::HistoryItem):
        * history/HistoryItem.h:

2007-08-28  Anders Carlsson  <andersca@apple.com>

        Reviewed by Darin.

        <rdar://problem/5298296> XMLHttpRequest readyState 3 & responseText buffer issues
        
        Add a shouldContentSniff flag to ResourceLoader and ResourceHandle and have XMLHttpRequest 
        pass in false when creating its subresource loader.
        
        * WebCore.exp:
        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::MainResourceLoader):
        (WebCore::MainResourceLoader::loadNow):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::ResourceLoader):
        (WebCore::ResourceLoader::load):
        * loader/ResourceLoader.h:
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::SubresourceLoader):
        (WebCore::SubresourceLoader::create):
        * loader/SubresourceLoader.h:
        * loader/mac/NetscapePlugInStreamLoaderMac.mm:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        * platform/network/ResourceHandle.cpp:
        (WebCore::ResourceHandle::ResourceHandle):
        (WebCore::ResourceHandle::create):
        * platform/network/ResourceHandle.h:
        * platform/network/ResourceHandleInternal.h:
        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::start):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::send):

2007-08-27  Steve Falkenburg  <sfalken@apple.com>

        Added getter for committedFirstRealDocumentLoad.
        
        Reviewed by Maciej.

        * loader/FrameLoader.h: Added committedFirstRealDocumentLoad.
        (WebCore::FrameLoader::committedFirstRealDocumentLoad): Added.

2007-08-27  Antti Koivisto  <antti@apple.com>

        Reviewed by Maciej.
        
        Fix <rdar://problem/5433144>
        REGRESSION: Unable to click "Select" link at Expedia for car rentals
        
        javascript: URLs need special handling when serializing. Escaping them like
        normal attribute values can do bad things. Try hard to not escape anything,
        escape quote characters only if really necessary. Try to match Firefox.

        Test: fast/innerHTML/javascript-url.html

        * editing/markup.cpp:
        (WebCore::urlAttributeToQuotedString):
        (WebCore::startMarkup):

2007-08-27  David Hyatt  <hyatt@apple.com>

        Fix for 5441224, micro-optimizations to improve the PLT by 1%.

        Reviewed by Darin

        * css/CSSStyleSelector.cpp:
        (WebCore::CSSStyleSelector::canShareStyleWithElement):
        * platform/mac/FontMac.mm:
        (WebCore::Font::drawGlyphs):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::requiresLayer):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::isBody):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::renderArena):
        (WebCore::RenderObject::isRoot):

2007-08-27  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15091
          Crash in RenderBlock::skipWhitespace during layout <rdar://problem/5439631> 

        Test: fast/replaced/applet-disabled-positioned.html

        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::createRenderer): Changed to call
        RenderObject::createObject(), which accounts for style.

2007-08-26  Antti Koivisto  <antti@apple.com>

        Reviewed by Darin.
        
        Fix for <rdar://problem/5433726>
        Mail crash at WebCore::Frame::styleForSelectionStart() when deleting a selection in a HTML message (http://www.yahoo.com/)

        Test: editing/style/temporary-span-crash.html

        * page/Frame.cpp:
        (WebCore::Frame::styleForSelectionStart):
        Temporary span created here might not have renderer if document has style sheet that makes it display:none.
        Set display:inline explicitly in spans style attribute. This temporary span does not need to get its display 
        value from actual document style sheets. Null check the renderer too to be sure.


2007-08-24  Sam Weinig  <sam@webkit.org>

        Reviewed by Adele.

        Fix for <rdar://problem/5426142>

        Use the EventTarget's frame when creating the EventListener.

        Tests: http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener.html
               http/tests/security/listener/xss-JSTargetNode-onclick-shortcut.html
               http/tests/security/listener/xss-window-onclick-addEventListener.html
               http/tests/security/listener/xss-window-onclick-shortcut.html

        * bindings/js/JSEventTargetNode.cpp:
        (WebCore::JSEventTargetNode::setListener):
        (WebCore::JSEventTargetNodePrototypeFunction::callAsFunction):
        * bindings/js/kjs_window.cpp:
        (KJS::WindowFunc::callAsFunction):

2007-08-25  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Sam Weinig.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15077
          REGRESSION: Cannot drag selected text out of a background window

        * manual-tests/drag-out-of-background-window.html: Added.
        * page/EventHandler.cpp:
        (WebCore::EventHandler::eventMayStartDrag): Added missing coordinate
        conversion.

2007-08-25  Rob Buis  <buis@kde.org>

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=14848
        DOM table rules are not updated when changed

        On a dynamic rules attr change, mark the table cells and
        their ancestors (up to and including the table tag) as
        changed.

        Tests: fast/table/rules-attr-dynchange1.html
               fast/table/rules-attr-dynchange2.html

        * html/HTMLTableElement.cpp:
        (WebCore::isTableCellAncestor):
        (WebCore::setTableCellsChanged):
        (WebCore::HTMLTableElement::parseMappedAttribute):

2007-08-25  Adele Peterson  <adele@apple.com>

        Reviewed by Mitz.

        Fix for http://bugs.webkit.org/show_bug.cgi?id=15073
        <rdar://problem/5426557> REGRESSION: Can no longer drag text from textareas
        
        Test: fast/forms/drag-out-of-textarea.html

        * rendering/RenderTextControl.cpp: (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
          Only restricts hit testing if the placeholder text is visible.
        * rendering/RenderTextControl.h: (WebCore::RenderTextControl::placeholderIsVisible): Added. 

2007-08-25  Peter Kasting <zerodpx@gmail.org>

        Reviewed by Sam Weinig.

        Part 2 of http://bugs.webkit.org/show_bug.cgi?id=14967.
        Eliminate all remaining implicit conversions of wtf::Vector<T> to T*.  Where code was
        previously checking that the Vector's data pointer was non-NULL, check !Vector::isEmpty()
        instead.

        * bindings/js/kjs_navigator.cpp:
        (KJS::PluginBase::cachePluginDataIfNecessary):
        * loader/mac/LoaderNSURLExtras.m:
        (suggestedFilenameWithMIMEType):
        * page/FrameView.cpp:
        (WebCore::FrameView::~FrameView):
        (WebCore::FrameView::pauseScheduledEvents):
        (WebCore::FrameView::resumeScheduledEvents):
        (WebCore::FrameView::dispatchScheduledEvents):
        * platform/mac/PlugInInfoStoreMac.mm:
        (WebCore::PlugInInfoStore::createPluginInfoForPluginAtIndex):

2007-08-25  Mitz Pettel  <mitz@webkit.org>

        Rubber-stamped by Adam Roben

        - remove unused file

        * platform/win/MouseEventWin.cpp: Removed.

2007-08-25  Jasper Bryant-Greene  <m@ni.ac.nz>

        Reviewed by Oliver Hunt.

        Set paintingDisabled to true in Cairo's GraphicsContext constructor
        when passed a null PlatformGraphicsContext.

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::GraphicsContext):

2007-08-25  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Dave Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15056
          REGRESSION (r21472): Digg Podcasts Episodes Render "Digg" counter incorrectly

        Covered by fast/parser/residual-style-close-across-n-blocks.html

        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): If the
        residual style was closed before anything else in the block (so it does
        not apply to anything inside the block) avoid creating an empty element for
        it inside the block.

2007-08-25  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Dave Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=14972
          Moving cursor down in contentEditable section fails if styled line-height:1em

        Test: editing/selection/move-by-line-003.html

        * rendering/RenderText.cpp:
        (WebCore::RenderText::positionForCoordinates): Changed hit testing so that each
        line is tested for hits between its overflow top and the next line's overflow top.
        This matches RenderBlock::positionForCoordinates.

2007-08-25  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Justin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=14792
          <rdar://problem/5367763> REGRESSION: Copy inserts carriage return in middle of selection

        Test: editing/pasteboard/newlines-around-floating-or-positioned.html

        * editing/TextIterator.cpp:
        (WebCore::shouldEmitNewlinesBeforeAndAfterNode): Do not emit newlines around
        floating or positioned blocks. This behavior seems to match WinIE's.

2007-08-23  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Darin.
        
        <rdar://problem/5432254> GoogleDocs: A hang occurs when applying list style to selected table
        
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::handleGeneralDelete): If the position
        that marked the start of the range to delete has been removed from the
        document, and it was inside the node that holds the position that marks
        the end of the range to delete, don't remove any children of that node,
        because we don't know how many to remove.  For example, if the end is
        [a, 5] and the start was in some descendant of a and was removed, don't
        remove any of the children of a.  We will now refuse to remove some content
        incorrectly, but that's less dangerous than removing content incorrectly.
        Long term we need to update these positions as we remove content from the 
        document, but that seems like a more risky change.  Added a testcase.
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::modifyRange): If the end of the selection to 
        modify is just after a table, and if the start of the selection is inside 
        that table, the last paragraph that we'll want modify is the last one inside 
        the table, not the paragraph that contains the table itself. Adjust 
        startOfLastParagraph here to avoid infinite recursion.

2007-08-24  Anders Carlsson  <andersca@apple.com>

        Reviewed by Geoff.

        <rdar://problem/5430165>
        REGRESSION: Dynamically loaded images fail to load

        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::HTMLImageLoader):
        Initialize the m_elementIsProtected member.

        (WebCore::HTMLImageLoader::~HTMLImageLoader):
        Assert that the element is not protected.
        
        (WebCore::HTMLImageLoader::setLoadingImage):
        If the image is not null, protect the element. Otherwise, unprotect it.
        
        (WebCore::HTMLImageLoader::dispatchLoadEvent):
        Unprotect the element here.

        (WebCore::HTMLImageLoader::protectElement):
        (WebCore::HTMLImageLoader::unprotectElement):
        New methods which protect and unprotect the element.
        
        * html/HTMLImageLoader.h:

2007-08-24  Kevin McCullough  <kmccullough@apple.com>

        - Updated ChangeLog

2007-08-24  Beth Dakin  <bdakin@apple.com>

        Reviewed by Hyatt and Adele.

        Fix for <rdar://problem/5417203> Google Gmail 1.0 widget - unread 
        count is missing

        * rendering/FixedTableLayout.cpp:
        (WebCore::FixedTableLayout::calcWidthArray): Calc pref widths for 
        our cells, if needed.

2007-08-24  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Darin.

        <rdar://problem/5437038> 1 credential object leaked for each call to credentialWithUser:password:persistence
        - Use initWithUser instead of credentialWithUser because credentialWithUser leaks.

        * platform/network/mac/AuthenticationMac.mm:
        (WebCore::mac):
        * platform/network/mac/ResourceHandleMac.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]):
        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]):

2007-08-24  Jon Honeycutt  <jhoneycutt@apple.com>

        Reviewed by Darin.

        <rdar://problem/5433236> Print preview of empty txt file crashes Safari
        Fix: Adjust computePageRectsForFrame to always return at least one 
        page rect, even if document height is zero.

        * WebCore.vcproj/WebCore.vcproj:
        * bridge/win/FrameWin.h: Added Vector& parameter to 
        computePagesRectsForFrame; changed its return type to void.
        * bridge/win/FrameWin.cpp:
        (WebCore::computePageRectsForFrame): Reordered the loop that inserts
        rects into the vector.

2007-08-24  Antti Koivisto  <antti@apple.com>

        Reviewed by Oliver

        Fix <rdar://problem/5393758>
        Crash in WebCore::FontData::platformInit
        
        Null check glyph page. 
        
        If font has somehow failed to initialize it is possible to have null glyph page. Based on
        crash dumps this seems to occasionally happen when running Mail under guard malloc. 
        
        No test case, I don't know how to get to this state.

        * platform/FontData.cpp:
        (WebCore::FontData::FontData):
        * platform/mac/FontDataMac.mm:
        (WebCore::FontData::platformInit):

2007-08-24  George Wright  <george.wright@collabora.co.uk>

        Reviewed by Oliver.

        http://bugs.webkit.org/show_bug.cgi?id=15071
        [cairo] SVG skews are incorrect

        Fix Cairo implementation of AffineTransform::shear so that shearing is
        done in the correct direction.

        * platform/graphics/cairo/AffineTransformCairo.cpp:
        (WebCore::AffineTransform::shear):

2007-08-23  Anders Carlsson  <andersca@apple.com>

        Reviewed by Steve.

        If necessary, re-set the window proc after each call to NPP_SetWindow. This is to ensure that
        our window proc is always run even if a plug-in subclasses the window and replaces the window proc.
        
        Also, make sure that the default window proc is of type ASCII so we can eliminate the 
        * plugins/win/PluginViewWin.cpp:
        (WebCore::registerPluginView):
        (WebCore::PluginViewWndProc):
        (WebCore::PluginViewWin::setNPWindowRect):
        (WebCore::PluginViewWin::stop):
        (WebCore::PluginViewWin::determineQuirks):
        (WebCore::PluginViewWin::PluginViewWin):
        (WebCore::PluginViewWin::init):
        * plugins/win/PluginViewWin.h:
        (WebCore::):
        (WebCore::PluginViewWin::pluginWndProc):

2007-08-23  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Adele.

        <rdar://problem/5156801> REGRESSION: Crash at DeleteSelectionCommand::doApply() when deleting table content

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::handleGeneralDelete): Use a RefPtr
        for node.  If the node to be removed contains the selection, and if
        the next node to be removed (nextNode) is inside the deletion UI,
        removing node will remove nextNode from the document.  nextNode is
        a RefPtr, but node isn't and when nextNode falls out of scope the node
        that node points to will be destroyed and we'll end up using a stale pointer.
        Long term we should probably just disable the deletion UI before editing 
        operations because the undo of the removal of node in the situation 
        described above relies on the presence of the deletion UI, but it isn't 
        present because its added and removed in a non-undoable way.

2007-08-23  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=14899
          !d->m_view->needsLayout() in Frame::paint() (Causes assert)

        WebKit copies the width and height attributes of an <embed> to its
        nearest <object> ancestor. This used to be done in updateWidget(), but
        that could lead to the document being dirty right after layout and
        before painting. The patch moves the copying of the attributes to when
        the <embed> is inserted into the document or its attributes change.

        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::insertedIntoDocument):
        (WebCore::HTMLEmbedElement::attributeChanged):
        * html/HTMLEmbedElement.h:
        * manual-tests/bugzilla-14899.html: Added.
        * rendering/RenderPartObject.cpp:
        (WebCore::RenderPartObject::updateWidget):

2007-08-22  Anders Carlsson  <andersca@apple.com>

        Reviewed by Darin and Oliver.

        <rdar://problem/5422410>
        http://bugs.webkit.org/show_bug.cgi?id=15019
        REGRESSION (r25124-r25140): New posts and hot topics won't show at mobile01.com

        Remove the call to checkCallImplicitClose(). Calling it in loadPlugin is bad for two reasons:
        
        1. It could cause onload to be dispatched even when the page has subresources that are still
        loading, such as images.
        
        2. Now that loadPlugin is called during layout, it could cause onload to be dispatched during
        layout, which can execute javascript and do pretty much anything while the render tree is in an
        inconsistent state.
        
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadPlugin):

2007-08-22  Anders Carlsson  <andersca@apple.com>

        Reviewed by Adam.

        <rdar://problem/5430584>
        http://bugs.webkit.org/show_bug.cgi?id=15053        
        WebKit does not check Windows Registry HKEY_CURRENT_USER for NPAPI plugin locations
        
        * plugins/win/PluginDatabaseWin.cpp:
        (WebCore::addPluginsFromRegistry):
        (WebCore::PluginDatabaseWin::getPluginsInPaths):

2007-08-22  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Adam.
        
        <rdar://problem/5418891> CrashTracer: [USER] 1 crash in Mail at -[WebViewEditor webView:shouldInsertText:replacingDOMRange:givenAction:]

        * editing/BreakBlockquoteCommand.cpp:
        (WebCore::BreakBlockquoteCommand::doApply): We're reusing the topBlockquote
        variable.  Null it out first.  If there is no new topBlockquote and we don't null
        it out first, we'll assume that there was a new one and crash.

2007-08-22  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Adele.

        - rdar:5423067 Reapplyingthe change but only when the text area is in focus.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::setValue):

2007-08-21  David Hyatt  <hyatt@apple.com>

        Fix for <rdar://problem/5249757> Painting of JPGs in WebKit is too slow.

        Use a new Leopard API for fast tiling of images.  We only use this API
        when the whole image is being tiled and when the current CGImageRef to tile
        has a size that matches the size of the whole image.

        We can optimize border-image in the future by adding a cache of the 9
        sub-images.

        Reviewed by darin

        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::Image::drawPattern):

2007-08-22  Kevin McCullough  <kmccullough@apple.com>

        - Rolling back since I need to update some layouttests this change breaks.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::setValue):

2007-08-21  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Geof, Adam, Hyatt, Maciej and Oliver.

        - In order to match the behavior of the other major browsers, selection is moved to the end of the text value when a change occurs to the contents of a text area instead of remembering the location of the selection.
        - <rdar://problem/5423067> gmail is super annoying when trying to add a new name to the TO, CC or BCC fields

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::setValue):

2007-08-21  Adam Roben  <aroben@apple.com>

        Build fix for Mac

        Keep FrameView::layoutIfNeededRecursive Windows- and Gtk-only for now
        (sadly). This will have to wait until we merge ScrollView and FrameView.

        Reviewed by NOBODY.

        * page/FrameView.cpp:
        * page/FrameView.h:

2007-08-21  Adam Roben  <aroben@apple.com>

        Fix an ASSERT when using Find in Page

        Reviewed by Darin.

        No test possible.

        * bridge/win/FrameWin.cpp:
        (WebCore::imageFromSelection): Make sure to update layout before
        painting so we don't hit an ASSERT in painting code (Frame::selectionImage
        in FrameMac.mm does this as well).

2007-08-21  Adam Roben  <aroben@apple.com>

        Made FrameView::layoutIfNeededRecursive available to all platforms

        Currently it's only used on Gtk+ and Windows.

        Reviewed by Darin.

        * page/FrameView.cpp: Removed #ifdef.
        * page/FrameView.h: Ditto.

2007-08-21  Adele Peterson  <adele@apple.com>

        Build fix for release build.

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::calcEffectiveWidth):
        (WebCore::AutoTableLayout::layout):

2007-08-21  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15010
          <rdar://problem/5423956> REGRESSION (r25000-r25065): Table rendering broken by a recent nightly

        Test: fast/table/max-width-integer-overflow.html

        Avoid integer overflows when dealing with maximum widths by
        1) using floating point arithmetic when summing or multiplying column max widths
        2) capping max widths at INT_MAX / 2

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::calcPrefWidths):
        (WebCore::AutoTableLayout::calcEffectiveWidth):
        (WebCore::AutoTableLayout::layout):

2007-08-20  John Sullivan  <sullivan@apple.com>

        Reviewed by Adam Roben

        WebCore part of fix for: 
        <rdar://problem/5417777> WebKit focus ring color no longer matches system focus rings
        
        Adele wrote the first version of this patch. No test cases added because I made sure the 
        layout tests are unaffected. Two additional bug fixes were made in passing, but neither 
        of them had any effect on any known real-world case, and both were too difficult to write 
        test cases for to be worthwhile.

        * WebCore.exp:
        added symbols for these new functions so WebKit can call them
        
        * WebCore.xcodeproj/project.pbxproj:
        updated for new file
        
        * platform/graphics/mac/ColorMac.h: Added.
        New file to hold the increasing amount of Mac-specific color stuff.
        
        * platform/graphics/Color.h:
        removed #if PLATFORM(MAC) code, which is now in ColorMac.h
        
        * platform/graphics/mac/ColorMac.mm:
        (WebCore::makeRGBAFromNSColor):
        new static function to convert an NSColor object to an RGBA32 struct
        (WebCore::colorFromNSColor):
        new public function to convert an NSColor object to a WebCore-style Color object
        (WebCore::focusRingColor):
        Uses (cached) systemFocusRingColor instead of hardwired values, unless usesTestModeFocusRingColor is true,
        in which case it uses the old hardwired color
        (WebCore::usesTestModeFocusRingColor):
        returns value of global var
        (WebCore::setUsesTestModeFocusRingColor):
        sets value of global var
        (+[WebCoreControlTintObserver controlTintDidChange]):
        Uses [NSColor keyboardFocusIndicatorColor] to set systemFocusRingColor; don't compile if COLORMATCH_EVERYTHING
        is set since we don't know what it would take to satisfy this state.

        * bindings/objc/DOMRGBColor.mm:
        now includes ColorMac.h to account for moved declarations
        * bridge/mac/WebCoreAXObject.mm:
        ditto
        
        * page/mac/FrameMac.mm:
        (WebCore::convertAttributesToUnderlines):
        now uses new colorFromNSColor. The old code was swapping G & B, but it didn't matter in practice because
        this function is only used to convert the color of an input manager's marked text underline, which is always black
        
        * page/mac/WebCoreFrameBridge.mm:
        (-[WebCoreFrameBridge setBaseBackgroundColor:]):
        now uses new colorFromNSColor. The old code was swapping G & B, but it didn't matter in practice because
        this function is only called with a grayscale color perhaps containing an alpha value
                
        * rendering/RenderView.cpp:
        (WebCore::RenderView::paintBoxDecorations):
        just updated a comment

2007-08-20  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Dave Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15023
          REGRESSION (r21113-r21143): JavaScript tooltip rendering bug

        Test: fast/repaint/layer-visibility.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::setHasVisibleContent): Cache the layer's
        rects when it changes to visible.

2007-08-20  Kevin Decker <kdecker@apple.com>

        Reviewed by Anders.

        Fixed: <rdar://problem/5325262> REGRESSION (Tiger-Leopard): PictureTalk plug-in doesn't work

        The problem was that this particular plug-in handles "text/ptf", but WebCore wasn't giving the plug-in a chance to load
        any type with "text/"

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument): Allow plug-ins to once again use "text/" MIME types, but only if the MIME
        type is not "text/plain". Disallowing plug-ins to use text/plain prevents plug-ins from hijacking a fundamental type 
        that the browser is expected to handle, and also serves as an optimization to prevent loading the plug-in database in 
        the common case.

2007-08-20  Adam Roben  <aroben@apple.com>

        Remove workarounds for <rdar://problem/5386894> now that it's been fixed

        Reviewed by Darin.

        Tests: fast/loader/local-svg-parsed-as-svg.svg
               fast/loader/local-xhtml-parsed-as-xhtml.xhtml

        * platform/network/cf/ResourceResponseCFNet.cpp:
        (WebCore::ResourceResponse::doUpdateResourceResponse): Removed hackish
        workaround.

2007-08-20  Anders Carlsson  <andersca@apple.com>

        Reviewed by Adam.

        <rdar://problem/5412988>
        Crash when visiting http://www.rockonflash.com/blog/?p=58
        
        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginViewWin::updateWindow):
        Just return if the plugin view hasn't been inserted in the hierarchy yet.

2007-08-20  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Zack.

        Do not define svg as ImageMIMEType if we can use ksvg2.

        * platform/MIMETypeRegistry.cpp:
        (WebCore::initialiseSupportedImageMIMETypes):

2007-08-19  Adam Roben  <aroben@apple.com>

        Gtk+ build fix.

        * platform/gdk/TemporaryLinkStubs.cpp: Removed const.

2007-08-19  Adam Roben  <aroben@apple.com>

        Fix <rdar://5395835> REGRESSION (r24527): Context menu for edit fields is missing "Font & Writing Direction"

        The problem was that ContextMenuItem::setSubMenu was just copying the
        HMENU from the ContextMenu passed in on Windows, but that HMENU was
        later getting destroyed when the ContextMenu went out of scope.

        I added a new ContextMenu::releasePlatformDescription method that is
        used in setSubMenu instead. I think an ultimately better design would
        be for setSubMenu to take ownership of the ContextMenu that's passed in
        (as should insertItem and appendItem), but I decided to be conservative
        and just make the changes needed to fix the bug.

        Reviewed by Darin.

        No test possible.

        * platform/ContextMenu.h: Added releasePlatformDescription.
        * platform/gdk/TemporaryLinkStubs.cpp: Added stub implementation.
        * platform/mac/ContextMenuMac.mm:
        (WebCore::ContextMenu::releasePlatformDescription): Implemented, though
        it's never called on this platform.
        * platform/qt/ContextMenuQt.cpp:
        (WebCore::ContextMenu::releasePlatformDescription): Ditto.
        * platform/win/ContextMenuItemWin.cpp:
        (WebCore::ContextMenuItem::setSubMenu): Call releasePlatformDescription
        since we need to take ownership of the HMENU.
        * platform/win/ContextMenuWin.cpp:
        (WebCore::ContextMenu::releasePlatformDescription): Implemented.

2007-08-18  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Darin.

        - fixed <rdar://problem/5198272> REGRESSION: PLT 1.5% slower due to r21367 (change to start frames with empty documents)
        
        There were three main cuases of extra time due to creating the initial empty document:
        
        1) Creating an extra WebHTMLView and swapping it for a new one for each frame created.
        2) Parsing the minimal markup for the initial document's contents.
        3) Clearing the Window object an extra time and dispatching the corresponding delegate method.
        
        The WebCore part of the fixes addresses 2 and 3.
        
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::init): Don't parse "<html><body>" for the initial
        empty document; it turns out not to be needed.
        (WebCore::FrameLoader::dispatchWindowObjectAvailable): Don't 
        dispatch the delegate if we haven't created a ScriptInterpreter yet.
        * bindings/js/kjs_proxy.cpp:
        (WebCore::KJSProxy::initScriptIfNeeded): Dispatch the window object
        delegate when we first create the interpreter, since that is now done
        lazily.
        * loader/FrameLoader.h:
        (WebCore::FrameLoader::committingFirstRealLoad): Helper for WebKit
        to know when to reuse a WebHTMLView.

2007-08-19  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Adam Roben.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15008
          ASSERTION FAILED: !firstLineBox() == !lastLineBox() setting content on image

        Test: fast/images/text-content-crash-2.html

        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::setImage): Added a check that the renderer is an
        image.
        (WebCore::HTMLImageLoader::updateFromElement): Ditto.
        (WebCore::HTMLImageLoader::notifyFinished): Ditto.

2007-08-17  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Darin.

        - WebCore part of fix to scrollbar suppression hack for Leopard

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::transitionToCommitted): Suppress scrollbars earlier, so it happens
        before any potential view swap.

2007-08-17  Antti Koivisto  <antti@apple.com>

        Reviewed by Hyatt.
        
        Fix <rdar://problem/5403773>
        CrashTracer: [USER] 88 crashes in Safari at com.apple.WebCore: WebCore::RenderTableSection::paint + 846

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removePositionedObjects):
        
        Fix crash in http://www.infobae.com/interior/home.html
        Positioned objects removed from m_positionedObjects would in some cases not get added back to any 
        positioned objects list. Adding objects happens in block layout but since layout was not invalidated 
        correctly in removePositionedObjects() it would not get invoked. As a result some positioned objects 
        would stay in layout dirty state leading to crashes and other bad things.
        
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint):
        
        Add needLayout() guard to eliminate this class of crashes from release builds. 
        Assert commented out for now since one existing layout test can't handle it.

2007-08-17  Kevin Decker <kdecker@apple.com>

        Code change by Darin, landed and reviewed by me.

        Fixed: <rdar://problem/5252836> Adobe Help Viewer: Japanese characters in the Help Tree structure are shown as garbage
        Added fast/encoding/namespace-tolerance.html test.

        * loader/TextResourceDecoder.cpp:
        (WebCore::TextResourceDecoder::checkForHeadCharset): Slightly loosen the charset decoder heuristic by tweaking it
        to ignore namespaces. This restores compatibility to documents which (1) use namespace prefixes on HTML elements
        (2) specify a non-latin charset and (3) contain non-latin characters.
        
        Added fast/encoding/namespace-tolerance.html test.
        
2007-08-17  Anders Carlsson  <andersca@apple.com>

        Reviewed by Dave Hyatt.
        
        <rdar://problem/5379040>
        REGRESSION (Tiger-Leopard): ADOBE: Safari calls NPP_SetWindow with bad values sometimes

        Instantiate plug-ins during the first layout instead of doing so when creating the renderer.
        This ensures that the plug-in widget will have a correct initial size.
        
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::getInstance):
        Force a layout if the plug-in doesn't have an instance.
        
        (WebCore::HTMLEmbedElement::attach):
        Pass true to updateWidget, causing it to only create a widget if it won't be a plug-in.
        
        * html/HTMLIFrameElement.cpp:        
        (WebCore::HTMLIFrameElement::attach):
        Pass false to updateWidget, this will only create subframes anyway.
        
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::getInstance):
        Force a layout if the plug-in doesn't have an instance.
        
        (WebCore::HTMLObjectElement::attach):
        Pass true to updateWidget, causing it to only create a widget if it won't be a plug-in.
        
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadPlugin):
        Get the size from the renderer and pass it to the client.
        
        * loader/FrameLoaderClient.h:
        * page/mac/WebCoreFrameBridge.h:
        * platform/graphics/svg/SVGImageEmptyClients.h:
        (WebCore::SVGEmptyFrameLoaderClient::createPlugin):
        Update declarations.
        
        * rendering/RenderPart.cpp:
        (WebCore::RenderPart::setWidget):
        No need to mark the renderer as dirty here.
        
        * rendering/RenderPartObject.h:
        * rendering/RenderPartObject.cpp:
        (WebCore::RenderPartObject::updateWidget):
        Add a parameter, onlyCreateNonPlugins. If this is true the widget 
        will only be created if it's not a plug-in.
        
        (WebCore::RenderPartObject::layout):
        Call updateWidget here if m_widget is 0, causing the plug-in to be instantiated.
        
2007-08-17  Oliver Hunt  <oliver@apple.com>

        Reviewed by Maciej.

        http://bugs.webkit.org/show_bug.cgi?id=14189
        <rdar://problem/5319511> REPRODUCIBLE CRASH: Canvas createPattern(canvas, ...) crashes on Windows (14189)

        Ensure that we actually retain the CG pattern correctly.

        Credit to Henry Mason <hmason@mac.com> for finding the cause of this.

        * html/CanvasPattern.cpp:
        (WebCore::CanvasPattern::~CanvasPattern):
        (WebCore::CanvasPattern::createPattern):
        * html/CanvasPattern.h:
        (WebCore::CanvasPattern::platformImage):

2007-08-16  Geoffrey Garen  <ggaren@apple.com>

        Build fix. (Maybe?)
        
        * loader/Cache.cpp:
        (WebCore::Cache::pruneLiveResources):
        (WebCore::Cache::pruneDeadResources):

2007-08-16  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Harrison.

        <rdar://problem/5378473> 
        REGRESSION: Undoing a deletion that is part of an open typing command fails to reinsert the caret
        
        We recently made Undo of a series of deletes select all of the 
        characters that were deleted, not just the most recently deleted
        character.  But the code that did this set a new starting selection 
        after every delete, even those that were part of an open typing 
        command that started with character insertions or forward deletes, 
        operations that when undone, remove the starting selection being 
        set from the document.
        
        After this change we only set a new starting selection if the open typing
        command was opened by a backward delete. The new behavior matches TextEdit.  
        We don't do something similar or forward deletes because TextEdit opens 
        and closes a new typing command on forward delete (added a FIXME about this).

        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::TypingCommand): Initialize 
        m_openedByBackwardDelete.
        (WebCore::TypingCommand::forwardDeleteKeyPressed): Added a FIXME about
        how in TextEdit, forward deletes open and close a new typing command.
        (WebCore::TypingCommand::doApply): Set m_openedByBackwardDelete
        appropriately.
        (WebCore::TypingCommand::deleteKeyPressed): Only set the starting
        selection if this delete is the first one in an open typing command
        or one in a series of deletes that opened the typing command.
        * editing/TypingCommand.h: Added m_openedByBackwardDelete.

2007-08-13  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Dave Hyatt.
        
        Tweaked the cache eviction model to better balance between live and 
        dead resources.
        
        For the sake of avoiding evictions during the PLT, the old model 
        required the sum of dead and live resources to grow to twice the cache 
        capacity before evicting, and would then evict dead or live down to 0 
        if necessary. This was a too-high high water mark, which would nullify 
        much of the value of eviction, and a too-low low water mark, which 
        would nullify much of the value of the LRU-SP strategy.
        
        This patch changes the model in 3 ways.
        
        1. The new model for dead resources is a flexible window with a fixed 
        minimum and maximum. The dead resource window is big when live resource 
        pressure is small, and vice versa. This has the immediate advantage of
        cutting the high water mark by up to 50%. It also enables the following
        tunable optimizations in future patches:
            a. A dead resource limit of 0 for clients who want that. (Just set
            the fixed maximum to 0.)
            b. A much higher low water mark. (Just set the fixed minimum to, 
            say, 25% of the cache's capacity.)
            c. A much lower high water mark for users who browse simple pages
            in one tab. (Just set the fixed maximum to, say, 50% of the cache's
            capacity.)
        
        I plan to make the changes that actually take advantage of these 
        tunable optimizations in another check-in.

        The new model won't hurt the PLT because it will notice the PLT's low
        live resource size, and up the dead resource capacity in response. For
        the same reason, the new model should establish a good balance in 
        real-world use.
        
        2. Live resource eviction is now based on size(), not encodedSize().
        So, a page with lots of large, encoded images will start evicting 
        resources, if necessary, even before all the images paint. This allows 
        you to more accurately stipulate an exact high water mark.
        
        3. When pruning, prune to a small percentage below capacity, to avoid
        just having to prune again immediately.

        Layout tests pass. PLT shows no regression.

        * history/PageCache.cpp:
        (WebCore::PageCache::releaseAutoreleasedPagesNow): Updated for rename.

        * loader/Cache.cpp: Implemented the algorithm explained above.
        * loader/Cache.h: Removed explicit tracking of decoded data size, since
        it was unused.

        * loader/CachedResource.cpp: ditto on tracking of decoded data size

2007-08-16  Darin Adler  <darin@apple.com>

        Reviewed by Tim Hatcher.

        - fix <rdar://problem/5415029> In Mail, a crash occurs at WebCore::Node::isDescendantOf()
          when attempting to delete a selection in a table

        The bug was caused by createMarkup trying to operate on a range that
        has an endpoint in the delete button DOM, because it removes that DOM
        during its operation! Still working on a regression test -- it's hard
        to make the kind of bad selection that's needed with the DOM, so I might
        have to use the eventSender.

        * editing/DeleteButtonController.h: Made some of the identifiers private.
        We can make them public if we need to use them. Added a getter function
        for the container element so we can figure out if a given node is inside
        the DOM added for the delete button.

        * editing/markup.cpp:
        (WebCore::moveEndpointsBeforeNode): Added. General purpose helper function
        that moves endpoints of a range to before a given node -- we do this before
        removing the delete button, so the endpoint is where the delete button was,
        rather than having an endpoint that's not in the document.
        (WebCore::createMarkup): Always return empty string, not null string.
        Get the document by calling ownerDocument on the range rather than getting
        the document of the commonAncestorContainer. That's because we need to
        get at the delete button before calling commonAncestorContainer. Call
        moveEndpointsBeforeNode to move the range endpoints out of the delete
        button interface before calling disable() which will remove it from the
        DOM if it's in there. Added an early return for the case where commonAncestor
        is non-0. If this happens, we would crash later because pastEndNode would
        not be in the tree. This change alone would prevent the crash, but we'd get
        bad markup, so we need the moveEndpointsBeforeNode fix. Added null checks
        for the frame to the range version as in the single-node version so this
        won't crash immediately on documents that are not in a frame. For the
        single-node version, added a check if a ndoe of 0 and a node inside the
        delete button user interface, and return the empty string for those cases.

2007-08-16  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Maciej.
        
        <rdar://problem/5378847> After creating and removing a ToDo, the caret disappears as soon as I start to type
        
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::input): A whitespace text node inserted by Mail
        when a ToDo is removed is completely removed by deleteInsignificantWhitespace,
        and since it contains the text insertion position, insertion fails.
        Save the position before the node where text insertion will occur,
        and if that node is removed, use the saved position for insertion.

2007-08-16  Darin Adler  <darin@apple.com>

        Reviewed by Adele.

        - fix <rdar://problem/5413488> REGRESSION: every DOM element is about 40
          bytes bigger because it has a Timer

        Moved the timer to the document from the element.

        * dom/Document.h: Made frame() inline. Added updateFocusApperanceSoon(),
        cancelFocusAppearanceUpdate(), m_updateFocusAppearanceTimer,
        clearXMLVersion(), and updateFocusAppearanceTimerFired(). Also made
        everything that was previously protected be private instead.
        * dom/Document.cpp:
        (WebCore::Document::Document): Initialize m_updateFocusAppearanceTimer.
        (WebCore::Document::updateFocusAppearanceSoon): Added. Starts timer.
        (WebCore::Document::cancelFocusAppearanceUpdate): Added. Stops timer.
        (WebCore::Document::updateFocusAppearanceTimerFired): Added. If the
        focused node is a focusable element, then calls
        updateFocusAppearance(false) on it.

        * dom/Element.h: Removed default value of the boolean parameter to
        updateFocusAppareance. Removed needsFocusAppearanceUpdate(),
        setNeedsFocusAppearanceUpdate(), updateFocusAppearanceTimerFired(),
        stopUpdateFocusAppearanceTimer(), m_updateFocusAppearanceTimer, and
        m_needsFocusAppearanceUpdate. Added
        updateFocusAppearanceSoonAfterAttach() and cancelFocusAppearanceUpdate().
        * dom/Element.cpp:
        (WebCore::ElementRareData::ElementRareData): Added initializer for
        m_needsFocusAppearanceUpdateSoonAfterAttach.
        (WebCore::Element::Element): Removed initializers for
        m_updateFocusAppearanceTimer and m_needsFocusAppearanceUpdate.
        (WebCore::Element::attach): Updated code that starts the focus
        appearance timer to instead call updateFocusAppearanceSoon() on the
        document.
        (WebCore::Element::detach): Replaced call to
        stopUpdateFocusAppearanceTimer with call to cancelFocusAppearanceUpdate.
        (WebCore::Element::focus): Added check for node that's already focused,
        to match the logic that's in the derived classes. This makes it safe for
        us to remove the override in the derived classes. Also replaced the code
        that called setNeedsFocusAppearanceUpdate(true) with code to set the
        rare data flag m_needsFocusAppearanceUpdateSoonAfterAttach and added a
        call to cancelFocusAppearanceUpdate() in the case where there's no focus
        appearance update.
        (WebCore::Element::blur): Replaced call to
        stopUpdateFocusAppearanceTimer with call to cancelFocusAppearanceUpdate.
        (WebCore::Element::cancelFocusAppearanceUpdate): Added. Sets
        m_needsFocusAppearanceUpdateSoonAfterAttach to false, and then calls
        cancelFocusAppearanceUpdate() on the document, but only if the element
        is the focused node of the document.

        * html/HTMLDocument.cpp:
        (WebCore::HTMLDocument::HTMLDocument): Replaced code that sets
        m_xmlVersion directly with a call to a new inline clearXMLVersion()
        function.
        (WebCore::HTMLDocument::setCookie): Replaced use of m_policyBaseURL with
        policyBaseURL().
        (WebCore::HTMLDocument::createTokenizer): Replaced uses of m_frame with
        frame().
        (WebCore::HTMLDocument::determineParseMode): Replaced code that sets
        pMode and hMode directly with calls to setParseMode and setHTMLMode.
        Replaced use of m_styleSelector with styleSelector().

        * html/HTMLInputElement.h: Removed now-unneed override of focus().
        Removed default value of the boolean parameter to updateFocusAppareance.
        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::updateFocusAppearance):
        Pass the restorePreviousSelection boolean through -- while it's ignored,
        it no longer has a default value.

        * html/HTMLTextAreaElement.h: Removed now-unneed override of focus().
        Removed default value of the boolean parameter to updateFocusAppareance.
        * html/HTMLTextAreaElement.cpp: Ditto.

        * WebCore.exp: Removed the Document::frame() symbol, since it's now inline.

2007-08-15  Antti Koivisto  <antti@apple.com>

        Reviewed by Maciej.
        
        Fix <rdar://problem/5388936>
        Crash while setting display:none for a table cell with selection
        
        Super class destroy() could (through some selection code in removeChild()) trigger section recalc 
        in middle of RenderTableCell::destroy(), cleaning section dirty bit. This would later crash in 
        layout since cell grid would still have refence to the dead cell.
        
        Ensure table sections are dirty when leaving destroy method.
        
        I can't figure out tests for row and section changes but they look like
        they could crash in similar way as cell.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::destroy):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::destroy):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::destroy):

2007-08-15  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Geoff.

        <rdar://problem/5389696> leak of 32-byte NSData object (and more?) in WebIconDatabase code path with each refresh of http://www.apple.com
        
        * platform/graphics/BitmapImage.h: Use RetainPtr for m_nsImage and m_tiffRep
        * platform/graphics/mac/ImageMac.mm:
        (WebCore::BitmapImage::initPlatformData): No need to do anything now
        (WebCore::BitmapImage::invalidatePlatformData): Simplify
        (WebCore::BitmapImage::getTIFFRepresentation): Use RetainPtr to avoid leaks
        (WebCore::BitmapImage::getNSImage): Use RetainPtr to avoid leaks

2007-08-15  Darin Adler  <darin@apple.com>

        Reviewed by Anders.

        - fix <rdar://problem/5094895> REGRESSION (r19094): JavaScript timers don't
          work inside showModalDialog; caret also doesn't blink

        * platform/Timer.h: Added fireTimersInNestedEventLoop.
        * platform/Timer.cpp:
        (WebCore::TimerBase::fireTimers): Added code to exit if the timersReadyToFire
        is cleared. This indicates that someone fired the timers in the nested event
        loop, so we should not fire any more timers ourselves.
        (WebCore::TimerBase::fireTimersInNestedEventLoop): Added. Sets timersReadyToFire
        to 0 so we won't return early and do nothing if the shared timer first. Then
        calls updateSharedTimer() so the shared timer will get scheduled as needed based
        on any pending timers.

        * page/Chrome.cpp: (WebCore::Chrome::runModal): Call
        fireTimersInNestedEventLoop before calling runModal on the client.

        * manual-tests/modal-dialog.html: Added a test that uses a timeout.
        * manual-tests/show-modal-dialog-test.html: Fixed a typo.

2007-08-15  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Darin.
        
        http://bugs.webkit.org/show_bug.cgi?id=14971
        REGRESSION: cannot select reporter's e-mail in bugzilla

        * page/EventHandler.cpp:
        (WebCore::EventHandler::canMouseDragExtendSelect): Allow drag-selecting inside
        a -webkit-user-select:ignore region.

2007-08-15  Beth Dakin  <bdakin@apple.com>

        Reviewed by Hyatt.

        Rolling back in. I made a silly mistake in XMLTokenizer that caused 
        this patch to crash SVG tests. It's fixed now!

        Refactor of change for <rdar://problem/5404899> REGRESSION: Mail 
        crash in WebCore::FontFallbackList::fontDataAt() after dragging 
        image into text multiple times

        The original fix that I made last night prevents the pending style 
        sheet count from being incremented until the element is in the 
        document. This fix prevents the style sheet from loading at all 
        until it is in the document.

        Here is the fix.
        * dom/StyleElement.cpp:
        (WebCore::StyleElement::insertedIntoDocument): Call process.
        (WebCore::StyleElement::removedFromDocument): This can be reverted 
        to its original state before my patch last night.
        (WebCore::StyleElement::process): childrenChanged is now called 
        process. Return early if your not in the document.
        (WebCore::StyleElement::createSheet): Revert change from last 
        night. The inDocument check is now in caller childrenChanged.
        * dom/StyleElement.h: insertedIntoDocument() must now accept an 
        element in addition to a document.

        This is an optimization to prevent calling updateStyleSelector() 
        too frequently.
        * dom/XMLTokenizer.cpp:
        (WebCore::XMLTokenizer::startElementNs):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::HTMLStyleElement):
        (WebCore::HTMLStyleElement::finishedParsing):
        (WebCore::HTMLStyleElement::insertedIntoDocument):
        (WebCore::HTMLStyleElement::childrenChanged):
        (WebCore::HTMLStyleElement::sheetLoaded):
        * html/HTMLStyleElement.h:
        * ksvg2/svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::SVGStyleElement):
        (WebCore::SVGStyleElement::finishedParsing):
        (WebCore::SVGStyleElement::insertedIntoDocument):
        (WebCore::SVGStyleElement::childrenChanged):
        (WebCore::SVGStyleElement::sheetLoaded):
        * ksvg2/svg/SVGStyleElement.h:
        (WebCore::SVGStyleElement::setCreatedByParser):

        This is a name change. Document::stylesheetLoaded() 
        is now Document::removePendingSheet()
        * dom/Document.cpp:
        (WebCore::Document::removePendingSheet):
        * dom/Document.h:
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::sheetLoaded):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::~HTMLLinkElement):
        (WebCore::HTMLLinkElement::setDisabledState):
        (WebCore::HTMLLinkElement::process):
        (WebCore::HTMLLinkElement::sheetLoaded):
        * page/Frame.cpp:
        (WebCore::UserStyleSheetLoader::~UserStyleSheetLoader):
        (WebCore::UserStyleSheetLoader::setCSSStyleSheet):

        This is another name change. closeRenderer() is now 
        finishedParsing()
        * dom/Node.h:
        (WebCore::Node::finishedParsing):
        * dom/XMLTokenizer.cpp:
        (WebCore::XMLTokenizer::endElementNs):
        (WebCore::):
        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::finishedParsing):
        * html/HTMLAppletElement.h:
        * html/HTMLGenericFormElement.cpp:
        (WebCore::HTMLFormControlElementWithState::finishedParsing):
        * html/HTMLGenericFormElement.h:
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::finishedParsing):
        * html/HTMLObjectElement.h:
        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::insertNode):
        (WebCore::HTMLParser::popOneBlockCommon):
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::finishedParsing):
        * html/HTMLScriptElement.h:
        (WebCore::HTMLStyleElement::setCreatedByParser):
        * ksvg2/svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::finishedParsing):
        * ksvg2/svg/SVGAnimationElement.h:
        * ksvg2/svg/SVGElement.cpp:
        (WebCore::SVGElement::finishedParsing):
        * ksvg2/svg/SVGElement.h:

2007-08-15  David Harrison  <harrison@apple.com>

        Reviewed by Antti Koivisto.

        <rdar://problem/5411803> Bumpercar crashes when loading a partial URL (FrameLoader::receivedMainResourceError())

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::receivedError):
        Nil check for the FrameLoader.

2007-08-14  Steve Falkenburg  <sfalken@apple.com>

        <rdar://problem/5411482> Windows user agent language always returns "en"
        
        Implement defaultLanguage().

        Reviewed by Oliver.

        * WebCore.vcproj/WebCore.vcproj: Added Language.cpp.
        * platform/win/Language.cpp: Added.
        (WebCore::localeInfo): Added.
        (WebCore::defaultLanguage): Added.
        * platform/win/TemporaryLinkStubs.cpp: Remove defaultLanguage stub.

2007-08-14  Sam Weinig  <sam@webkit.org>

        Reviewed by Geoff and Oliver.

        Fix for <rdar://problem/5267870>
        Mangleme: Reproducible assertion failure in -[WebCoreFrameBridge installInFrame:]

        - Change embed/plugin code path to detach the frame on willRemove instead of detach.
          This matches what frame and iframe do.

        Test: http/tests/misc/embedCrasher.html

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::willRemove):
        * html/HTMLPlugInElement.h:

2007-08-14  Adele Peterson  <adele@apple.com>

        Reviewed by Maciej.

        Fix for <rdar://problem/5370059> REGRESSION: Cannot type into edit fields on a form (sccsheriff.org)

        This change makes -webkit-user-select an inherited css property.  For "user-select: none" we were already 
        acting like it was an inheritable property, where we let user-select:text on the children override its parent's user-select:none.
        By making user-select really inherited (instead of inherited for some values), we eliminate the need for crawling up the tree to see 
        if an ancestor has user-select ignore set.

        * page/EventHandler.cpp: (WebCore::EventHandler::canMouseDownStartSelect):
          Now that user-select is inherited, you don't need to walk up the render tree looking for ancestors with user-select:ignore set.

        * css/CSSStyleSelector.cpp: Eliminate SELECT_AUTO.
        (WebCore::CSSStyleSelector::adjustRenderStyle):
        (WebCore::CSSStyleSelector::applyProperty):
        * css/CSSComputedStyleDeclaration.cpp: (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):

        * rendering/RenderStyle.h:
        (WebCore::): Eliminate SELECT_AUTO.  Make userSelect inherited.
        (WebCore::RenderStyle::userSelect):
        (WebCore::RenderStyle::setUserSelect):
        (WebCore::RenderStyle::initialUserSelect):
        * rendering/RenderStyle.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
        (WebCore::StyleRareInheritedData::operator==):
        (WebCore::RenderStyle::diff):

2007-08-15  Peter Kasting  <zerodpx@gmail.org>

        Reviewed by Darin.
        
        http://bugs.webkit.org/show_bug.cgi?id=14967 part 1 - Eliminate most implicit
        conversions of wtf::Vector<T> to T* by explicitly calling .data()

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::saveState):
        * platform/KURL.cpp:
        (WebCore::KURL::KURL):
        (WebCore::KURL::init):
        (WebCore::KURL::decode_string):
        (WebCore::KURL::parse):
        (WebCore::KURL::encode_string):
        * platform/cf/KURLCFNet.cpp:
        (WebCore::KURL::KURL):
        * platform/mac/KURLMac.mm:
        (WebCore::KURL::KURL):
        * rendering/RenderFrameSet.cpp:
        (WebCore::RenderFrameSet::layOutAxis):

2007-08-14  Ricci Adams  <iccir@apple.com>

        Reviewed by Darin, Hyatt.

        - fix <rdar://problem/5407795> -apple-line-clamp should never display less than one line

        * rendering/RenderFlexibleBox.cpp:(WebCore::RenderFlexibleBox::layoutVerticalBox): Use
        max to make sure it never computes a minimum of less than one line.

2007-08-14  Brady Eidson  <beidson@apple.com>

        Reviewed by Darin, John, Maciej, Oliver, and Tim

        <rdar://problem/5394708> - Crash on launch with corrupt icon database

        The main part of the fix is to not disable SQLite's default level of protection - to leave the sync options at their normal,
        mostly safe levels.  

        But in case lightning strikes at the exact right moment and someone ends up with a corrupt database, add some support code to
        detect that condition and recover from it.  

        This is mainly accomplished by exposing the "PRAGMA integrity_check;" facilities of sqlite through IconDatabase SPI as well as
        running that integrity check if a journal file is detected at launch (a strong indication that the last quit was not clean).
        There's also a method exposed to allow clients to tell the icon database "I suspect something bad happened, please check integrity"

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::checkIntegrityBeforeOpening): Allow clients to suggest an integrity check
        (WebCore::IconDatabase::open): Add a check to see if the journal file for the database exists.  If it does, run the integrity
          check.  Also run the check if a client has suggested it to be necessary.
          If the integrity-check fails, we sadly have to destroy the database and recreate from scratch.
          Also - quite importantly - do not adjust the default sync preferences for the SQLDatabase.  They were an optimization that 
          might have been valid at one time but no longer affects any benchmarks we care about.
        (WebCore::IconDatabase::checkIntegrity): Perform the SQLite integrity_check pragma
        * loader/icon/IconDatabase.h:

        * loader/icon/IconDatabaseNone.cpp:
        (WebCore::IconDatabase::checkIntegrity): Keep IconDatabaseNone users building
        (WebCore::IconDatabase::checkIntegrityBeforeOpening): Ditto

        * loader/icon/SQLDatabase.cpp:
        (WebCore::SQLDatabase::open): Make a copy of the path string so we don't accidentally mutate anyone else's string on ::close()

        * platform/FileSystem.h: Added. Begin a long-needed platform file system abstraction
        * platform/mac/FileSystemMac.mm: Added.
        (WebCore::fileExists): Check if a file exists
        (WebCore::deleteFile): Delete a file

        * platform/gdk/TemporaryLinkStubs.cpp:
        (WebCore::fileExists):
        (WebCore::deleteFile):
        * platform/qt/TemporaryLinkStubs.cpp:
        (WebCore::fileExists):
        (WebCore::deleteFile):
        * platform/win/TemporaryLinkStubs.cpp:
        (WebCore::fileExists):
        (WebCore::deleteFile):

        * WebCore.exp:
        * WebCore.xcodeproj/project.pbxproj:

2007-08-14  Jon Honeycutt  <jhoneycutt@apple.com>

        Reviewed by Steve.

        Build fix for Windows.

        * html/HTMLFormElement.cpp:

2007-08-14  George Staikos  <staikos@kde.org>

        Only connect the menu signal once.

        * platform/qt/ContextMenuQt.cpp:
        (WebCore::ContextMenu::ContextMenu):
        (WebCore::ContextMenu::insertItem):

2007-08-14  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Tim.

        <rdar://problem/5408255> REGRESSION: In Mail, clicking the containing element's UI closebox doesn't delete element

        * editing/DeleteButtonController.cpp:
        (WebCore::DeleteButtonController::show): Use -webkit-user-select:ignore for
        the deletion UI.

2007-08-14  Antti Koivisto  <antti@apple.com>

        Reviewed by Darin.
        
        Fix <rdar://problem/5143183>
        Air Mail postmark shows up wrong in Firefox due to use of CSS background-position-x/y
        
        Safari was using non-standard background-position-x/y properties when serializing style, both normal 
        and computed. As a result Safari generated CSS would not render correctly in Firefox. 
        
        Use standard background-position property instead.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::):
        * css/CSSMutableStyleDeclaration.cpp:
        (WebCore::CSSMutableStyleDeclaration::cssText):

2007-08-14  Sam Weinig  <sam@webkit.org>

        Reviewed by Brady and Dr. Harrison.

        Fix typo.  'whitespace' property is spelled 'white-space'.

        * page/inspector/inspector.css:

2007-08-13  Beth Dakin  <bdakin@apple.com>

        Reviewed by Maciej.

        Fix for <rdar://problem/5404899> REGRESSION: Mail crash in 
        WebCore::FontFallbackList::fontDataAt() after dragging image into 
        text multiple times

        We were crashing because style information was not up-to-date. This 
        patch fixes the problem in two ways:

        Style information was not up to date at the time of the crash 
        because the document thought there was still a pending style sheet. 
        The pending style sheet counter was incremented when a call to 
        cloneNode from Mail cloned a style node with an imported style 
        sheet. Because Mail disables the cache, the style sheet did not 
        load immediately for the cloned node, and we do not check again to 
        see if it has loaded in time to decrement the pending style sheet 
        counter before the crash point. The fix here is only to increment 
        the pending style sheet counter for elements that are already in 
        the document.
        * dom/StyleElement.cpp:
        (WebCore::StyleElement::insertedIntoDocument): If we have a CSS 
        style sheet that is currently loading, increment the pending style 
        sheet counter. This should keep the counter accurate in the case 
        where a style node is cloned and then immediately inserted into the 
        document.
        (WebCore::StyleElement::removedFromDocument): If we have a CSS 
        style sheet that is currently loading, decrement the pending style 
        sheet count. This is required to keep the correct balance, given 
        the change above.
        (WebCore::StyleElement::createSheet): Only addPendingSheet() and 
        checkLoaded() if we are in the document.

        Here is Darin's original fix. It seems worth keeping this fix too. 
        Font style information should not cause a crash if there are still 
        pending style sheets. This is good belt-and-suspenders in case 
        there is another way to run into this bug with a wacky timing 
        issue.
        * css/CSSStyleSelector.cpp:
        (WebCore::CSSStyleSelector::styleForElement): Update the font.

2007-08-13  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=14635
        rdar://problem/5340188
        Uploading file with non-ASCII character in path fails

        File upload cannot be tested in DumpRenderTree.

        * html/HTMLFormElement.cpp:
        (WebCore::pathGetFilename): A cross-platform helper that extracts a file name from a path.
        (WebCore::HTMLFormElement::formData): Use the above helper instead of code that doesn't
        work on Windows.

2007-08-13  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=14951
        REGRESSION: page interpreted as UTF-8 because of stray <?xml> after <head>

        Test: fast/encoding/misplaced-xml-declaration.html

        * loader/TextResourceDecoder.cpp:
        (WebCore::TextResourceDecoder::checkForHeadCharset): Only honor XML declaration
        at the very beginning of the file.

2007-08-13  Oliver Hunt  <oliver@apple.com>

        rs=sam

        Correct accidentally modified code.

        * platform/mac/FontDataMac.mm:
        (WebCore::FontData::platformInit):

2007-08-13  Adele Peterson  <adele@apple.com>

        Reviewed by Brady.

        Fix for http://bugs.webkit.org/show_bug.cgi?id=14746
        <rdar://problem/5401041> REGRESSION: Form state not saved for forms that submit via HTTPS even if they do not contain a password field

        * loader/FrameLoader.cpp: (WebCore::FrameLoader::saveDocumentState): Restore our old behavior that will save form state for secure forms.
          This will also match Firefox behavior.

        * dom/Document.cpp: Removed secureFormAdded(), secureFormRemoved(), hasSecureForm() which are no longer used.
        * dom/Document.h:
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::attach):
        (WebCore::HTMLFormElement::parseMappedAttribute):

2007-08-13  Oliver Hunt  <oliver@apple.com>

        Reviewed by Maciej.

        <rdar://problem/5386183> REGRESSION (9A504-9A508): Underline of inline hole is too thin 
        on Japanese DotMac page
        
        Hack the line metrics for the Hiragino font families so that they always allow space for
        the marked text underline.
        
        * platform/mac/FontDataMac.mm:
        (WebCore::FontData::platformInit):

2007-08-13  David Hyatt  <hyatt@apple.com>

        Reviewed by aroben
 
        <rdar://problem/5400446> messed up content on calendar.yahoo.com and my.yahoo.com

        Fix some more bad assumptions about <html> being the first child of the document now that we
        properly support HTML5's model (where a comment node preceding <html> will in fact be its sibling).

        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::handleError):
        (WebCore::HTMLParser::createHead):

2007-08-13  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Darin.
        
        <rdar://problem/5333725> -webkit-user-select: none makes selection difficult
        
        Let users create selections if they mouse down in a -webkit-user-select:none
        region, just (continue to) disallow selection endpoints in those regions, and
        don't paint those regions as selected if they are fully enclosed by a selection. 
        For example, in xxyyyxx where x is -webkit-user-select:none, a user can mouse down
        between the first two xs and drag across yyy to the second two xs to create a 
        selection xx^yyy^xx.
        
        * editing/SelectionController.cpp:
        (WebCore::SelectionController::selectAll): Allow selectAll inside a root
        that has -webkit-user-select:none, because it may contain content that
        is selectable (VisiblePosition and Selection creation will keep Selection
        endpoints out of -webkit-user-select:none regions).
        * page/EventHandler.cpp:
        (WebCore::EventHandler::selectClosestWordFromMouseEvent): Use canMouseDownStartSelect
        instead of the ambiguously named shouldSelect().
        (WebCore::EventHandler::handleMousePressEventTripleClick): Ditto.
        (WebCore::EventHandler::handleMousePressEventSingleClick): Ditto.
        (WebCore::EventHandler::updateSelectionForMouseDrag): Use canMouseDragExtendSelect.
        (WebCore::EventHandler::selectCursor): Paint an ibeam in -webkit-user-select:none regions,
        because you can click in those regions to create a selection.
        (WebCore::EventHandler::canMouseDownStartSelect): Now fires the selectStart event, and
        returns true in -webkit-user-select: none regions.
        (WebCore::EventHandler::canMouseDragExtendSelect): This is identical to 
        canMouseDownStartSelect because of 12823, even though it seems strange that we would fire 
        the selectStart event here.
        * page/EventHandler.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::draggableNode): Only -webkit-user-select:ignore regions will
        prevent selection creation.
        * rendering/RenderObject.h:

2007-08-13  Anders Carlsson  <andersca@apple.com>

        Reviewed by Maciej.

        <rdar://problem/5360748>
        REGRESSION (r21002-r21003): Flash widget sniffer doesn't work (affects iWeb)

        Don't check whether the document is being parsed or not, because the node list
        could be accessed after the document has finished parsing.
        
        * dom/Node.cpp:
        (WebCore::Node::registerNodeList):

2007-08-13  Lars Knoll  <lars@trolltech.com>

        Reviewed by Simon.

        no need to update regions that are not visible on the webpage.

        * platform/qt/ScrollViewQt.cpp:
        (WebCore::ScrollView::updateContents):

2007-08-12  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Darin and Sam.
        
        <rdar://problem/5395213> cross-domain access to individual components of location object should be denied.

        * bindings/js/kjs_window.cpp:
        (KJS::Location::put): Add the appropriate cross-domain access checks.

2007-08-12  Darin Adler  <darin@apple.com>

        Reviewed by John Sullivan.

        - fix <rdar://problem/5403724> REGRESSION: text inputs are not scrolled to make inline input visible (14912)

        * editing/Editor.h: Made setIgnoreMarkedTextSelectionChange no longer inline.
        It now has a side effect of revealing the selection when you set it to false.
        Added private revealSelectionAfterEditingOperation helper.
        * editing/Editor.cpp:
        (WebCore::Editor::deleteRange): Calls revealSelectionAfterEditingOperation instead
        of calling m_frame->revealSelection directly.
        (WebCore::Editor::replaceSelectionWithFragment): Ditto.
        (WebCore::Editor::insertOrderedList): Ditto.
        (WebCore::Editor::insertUnorderedList): Ditto.
        (WebCore::Editor::increaseSelectionListLevel): Ditto.
        (WebCore::Editor::increaseSelectionListLevelOrdered): Ditto.
        (WebCore::Editor::increaseSelectionListLevelUnordered): Ditto.
        (WebCore::Editor::decreaseSelectionListLevel): Ditto.
        (WebCore::Editor::insertLineBreak): Ditto.
        (WebCore::Editor::insertParagraphSeparator): Ditto.
        (WebCore::Editor::replaceMarkedText): Ditto.
        (WebCore::Editor::revealSelectionAfterEditingOperation): Added. Calls revealSelection,
        unless we are in the ignoreMarkedTextSelectionChange state. If we are in that state,
        we're in the middle of a composite editing operation and we shouldn't try to scroll
        to reveal the selection until the operation is done.
        (WebCore::Editor::setIgnoreMarkedTextSelectionChange): Made no longer inline. If
        changing the state from true to false, then calls revealSelectionAfterEditingOperation.

        * WebCore.exp: Add new entry point for no-longer-inline setter function.

2007-08-12  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Maciej Stachowiak, Dave Hyatt.
        
        Changed the dead resource LRU-SP algorithm to measure an object's
        total size, not just its encoded size. This will allow us to make 
        better decisions about what data to evict when the cache is small. For 
        example, the PLT can now run with a 16MB cache without fully evicting
        any resources.
        
        (Previously, we had assumed that decoded size would be an OK estimate
        of encoded size, but that is not true of GIF, whose decoded size can be 
        orders of magnitude greater than its encoded size.)
        
        Subtly, destroying a resource's decoded data now increases its recency 
        by moving it to the head of a smaller LRU list. This is slightly odd,
        but, since all resources get the same treatment, it shouldn't hurt 
        the eviction algorithm.

        * history/PageCache.cpp:
        (WebCore::PageCache::releaseAutoreleasedPagesNow): Make sure that a
        dead resource eviction doesn't happen until we've released all of our
        dead pages. Otherwise, the cache will make terrible decisions about 
        what to evict because all of our dead resources will seem live.

        * loader/Cache.cpp:
        (WebCore::Cache::Cache):
        (WebCore::Cache::pruneLiveResources):
        (WebCore::Cache::pruneDeadResources): Removed call to 
        removeFromLiveDecodedResourcesList because this happens automatically
        now as a part of the process of changing the resource's decoded size.
        (WebCore::Cache::lruListFor): *** The key change. *** Compute the 
        appropriate LRU list based on total size, not encoded size.
        (WebCore::Cache::dumpLRULists): Added debug logging function to help
        visualize the cache.

        * loader/Cache.h:
        (WebCore::Cache::setDeadResourcePruneEnabled):
        (WebCore::Cache::deadResourcePruneEnabled):

        * loader/CachedImage.cpp: Moved decoded size tracking code from here
        up into the base class. Currently, only CachedImage has a use for that
        functionality, but other subclasses might need it in the future, and
        the base class is already responsible for similar code related to 
        encoded size tracking.
        (WebCore::CachedImage::decodedSizeChanged):
        * loader/CachedImage.h:

        * loader/CachedResource.cpp:
        (WebCore::CachedResource::CachedResource):
        (WebCore::CachedResource::setDecodedSize): Move us in the LRU-SP list
        just like setEncodedSize does, since decoded size counts now, too.
        (WebCore::CachedResource::setEncodedSize): Changed slightly to match
        the style of setDecodedSize.

        * loader/CachedResource.h:
        (WebCore::CachedResource::decodedSize):

2007-08-11  Mitz Pettel  <mitz@webkit.org>

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=13670
          <rdar://problem/5399619> Table misrender when one of the TDs has width=100%

        Tests: fast/table/100-percent-cell-width.html
               fast/table/percent-widths-stretch.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::calcPrefWidths): Changed the value used instead of
        0% to avoid division by zero from 1% to less than 0.01%. Removed code that
        added 0.5px to non-percent widths when calculating the scaling factor. The
        latter change is covered by the percent-widths-stretch test, where the new
        results match both WinIE 7 and Firefox 3.

2007-08-11  Darin Adler  <darin@apple.com>

        Reviewed by Antti.

        - fix <rdar://problem/5266535> REGRESSION: <img> inside <map> no longer allowed in strict mode
          (breaks chemicalelements.com)

        Test: fast/parser/strict-img-in-map.html

        * html/HTMLMapElement.cpp: (WebCore::HTMLMapElement::checkDTD): Removed FIXME saying this
        code is strange, since this code matches the HTML 4 specification almost exactly. Made
        <img> elements allowed even in strict mode and added small comments to clarify what comes
        from the DTD and what is non-standard.

2007-08-11  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Anders.

        Implement passing events to a subframe. The code is copied from
        the windows port and passSubframeEventToSubframe was removed as it
        is not called and it is not avilable in the windows port as well.

        * page/gdk/EventHandlerGdk.cpp:
        (WebCore::EventHandler::passMousePressEventToSubframe):
        (WebCore::EventHandler::passMouseMoveEventToSubframe):
        (WebCore::EventHandler::passMouseReleaseEventToSubframe):

2007-08-11  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Lars.

        GdkEventKey::string is not supposed to be used. The length
        of this string is zero for non ascii characters. Use the
        gdk_unicode_to_keyval to convert the keyval to a UChar and construct
        a String. This change makes it possible to input non ascii
        characters.

        * platform/gdk/KeyEventGdk.cpp:
        (WebCore::keyIdentifierForGdkKeyCode):
        (WebCore::singleCharacterString):
        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):

2007-08-11  Andrew Wellington  <proton@wiretapped.net>

        Reviewed by Mark Rowe.
        
        Fix http://bugs.webkit.org/show_bug.cgi?id=14645
        getPropertyValue should be case insensitive
        
        When we get the propertyID for a given string we convert to lowercase.
        
        This also applies to setProperty, removeProperty and others.
        
        * css/CSSStyleDeclaration.cpp:
        (WebCore::propertyID):

2007-08-11  Mark Rowe  <mrowe@apple.com>

        Build fix.  Change "#ifdef PLATFORM(GDK)" to "#if PLATFORM(GDK)".

        * page/FrameView.cpp:
        * page/FrameView.h:

2007-08-11  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Adam.

        Copy the WebFrame::layoutIfNeededRecursive method of the windows port
        to FrameView to be used by the Gtk+ port. Simplify the implementation due
        moving it to the FrameView class.

        Implement the ScrollView::children() method for the Gtk+ port and make it
        available to the FrameView as children() is used within the layoutIfNeededRecursive method.

        * page/FrameView.cpp:
        (WebCore::FrameView::layoutIfNeededRecursive):
        * page/FrameView.h:
        * platform/ScrollView.h:
        * platform/gdk/ScrollViewGdk.cpp:

2007-08-11  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Adam.

        To fix text selection make the PlatformMouseEvent set the pressed
        button even when moving the mouse.
        
        Add building of the WebKit::DragClient stubs as they are needed to
        make text selection work.

        * WebCore.pro:
        * platform/gdk/MouseEventGdk.cpp:
        (WebCore::PlatformMouseEvent::PlatformMouseEvent):

2007-08-10  Anders Carlsson  <andersca@apple.com>

        Reviewed by Darin and Maciej.

        <rdar://problem/5360748>
        REGRESSION(r21002-r21003) Flash widget sniffer doesn't work
        
        Add a per-document NodeList counter. When parsing, only call notifyNodeListsChildrenChanged
        if the document has node lists. Also, make sure to reset the cache when the node list count has 
        been 0 and a new node list is registered to avoid any stale cache information.
        
        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::addChild):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        * dom/Document.h:
        (WebCore::Document::addNodeList):
        (WebCore::Document::removeNodeList):
        (WebCore::Document::hasNodeLists):
        * dom