2011-09-05  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed update expected image for chromium Linux.
        The test was introduced at r94492.

        * platform/chromium-linux/fast/inline/absolute-positioned-inline-in-centred-block-expected.png: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94518 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-05  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed rebaseline for chromium: fast/repaint/block-layout-inline-children-float-positioned.html

        * platform/chromium-cg-mac-leopard/fast/repaint/block-layout-inline-children-float-positioned-expected.png:
        * platform/chromium-cg-mac/fast/repaint/block-layout-inline-children-float-positioned-expected.png:
        * platform/chromium-linux/fast/repaint/block-layout-inline-children-float-positioned-expected.txt: Removed.
        * platform/chromium-win/fast/repaint/block-layout-inline-children-float-positioned-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94517 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Logic from HTMLElement::deprecatedCreateContextualFragment moved into
Range::createContextualFragment function.
https://bugs.webkit.org/show_bug.cgi?id=67056

Patch by Kaustubh Atrawalkar <kaustubh@motorola.com> on 2011-09-05
Reviewed by Ryosuke Niwa.

Code Refactoring for deprecatedCreateContextualFragment.

Source/WebCore:

No new tests. Code Re-factoring.

* dom/Element.cpp:
* dom/Element.h:
* dom/Range.cpp:
(WebCore::insertIntoFragment):
(WebCore::Range::createDocumentFragmentForElement):
(WebCore::Range::createContextualFragment):
* dom/Range.h:
* editing/markup.cpp:
(WebCore::createFragmentFromMarkup):
* html/HTMLElement.cpp:
* html/HTMLElement.h:

Source/WebKit/qt:

* Api/qwebelement.cpp:
(QWebElement::appendInside):
(QWebElement::prependInside):
(QWebElement::prependOutside):
(QWebElement::appendOutside):
(QWebElement::encloseContentsWith):
(QWebElement::encloseWith):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94516 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-05  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed rebaseline for fast/inline/absolute-positioned-inline-in-centred-block

        * platform/chromium-cg-mac-leopard/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
        * platform/chromium-cg-mac/fast/inline/absolute-positioned-inline-in-centred-block-expected.png: Added.
        * platform/chromium-cg-mac/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
        * platform/chromium-linux-x86/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
        * platform/chromium-linux/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
        * platform/chromium-win-vista/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
        * platform/chromium-win-xp/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
        * platform/chromium-win/fast/inline/absolute-positioned-inline-in-centred-block-expected.png: Added.
        * platform/chromium-win/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94515 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r94452): 20 http/tests tests failing on Qt Linux Release
https://bugs.webkit.org/show_bug.cgi?id=67562

Patch by Mark Hahnenberg <mhahnenberg@apple.com> on 2011-09-04
Reviewed by Darin Adler.

Fixing the build (again which was broken by the dtoa patch.  Needed
to make sure WTF::double_conversion::initialize() is called for Qt
as well as adding a check for WinCE in dtoa/utils.h

* runtime/InitializeThreading.cpp:
(JSC::initializeThreadingOnce):
* wtf/dtoa/cached-powers.cc:
* wtf/dtoa/utils.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94514 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94510.
http://trac.webkit.org/changeset/94510
https://bugs.webkit.org/show_bug.cgi?id=66531

Causes layout test crashes.

Source/WebCore:

* dom/Document.cpp:
(WebCore::Document::webkitWillEnterFullScreenForElement):
(WebCore::Document::webkitDidExitFullScreenForElement):
* dom/NodeRenderingContext.cpp:
(WebCore::wrapWithRenderFullScreen):
(WebCore::NodeRendererFactory::createRendererIfNeeded):
* rendering/RenderFullScreen.cpp:
(RenderFullScreen::createFullScreenStyle):
* rendering/RenderFullScreen.h:

LayoutTests:

* plugins/fullscreen-plugins-dont-reload-expected.txt: Removed.
* plugins/fullscreen-plugins-dont-reload.html: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94513 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. Compile fix for r94511.

* dom/Range.cpp:
(WebCore::Range::processContents):
(WebCore::Range::processAncestorsAndTheirSiblings):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94512 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash in Range::processAncestorsAndTheirSiblings.
https://bugs.webkit.org/show_bug.cgi?id=67556

Reviewed by Ryosuke Niwa.

Source/WebCore:

Create a temporary RefPtr Node vector to keep all the ancestor's
childs so that we don't access removed child nodes.

Test: fast/dom/Range/range-delete-contents-event-fire-crash.html

* dom/Range.cpp:
(WebCore::Range::processContents):
(WebCore::Range::processAncestorsAndTheirSiblings):

LayoutTests:

Tests that we do not crash when removing contents of
a range from the document.

* fast/dom/Range/range-delete-contents-event-fire-crash-expected.txt: Added.
* fast/dom/Range/range-delete-contents-event-fire-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94511 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Don't detach elements from the render tree when entering fullscreen mode
https://bugs.webkit.org/show_bug.cgi?id=66531

Source/WebCore:

This prevents plugin instances from being destroyed and reinstantiated
when entering fullscreen mode.

Patch by Jeremy Apthorp <jeremya@google.com> on 2011-09-04
Reviewed by Darin Fisher.

Test: plugins/fullscreen-plugins-dont-reload.html

* dom/Document.cpp:
(WebCore::Document::webkitWillEnterFullScreenForElement):
(WebCore::Document::webkitDidExitFullScreenForElement):
* dom/NodeRenderingContext.cpp:
(WebCore::NodeRendererFactory::createRendererIfNeeded):
* rendering/RenderFullScreen.cpp:
(createFullScreenStyle):
(RenderFullScreen::wrapRenderer):
(RenderFullScreen::unwrapRenderer):
* rendering/RenderFullScreen.h:

LayoutTests:

Test that the plugin is not reloaded when entering fullscreen.

Patch by Jeremy Apthorp <jeremya@google.com> on 2011-09-04
Reviewed by Darin Fisher.

* plugins/fullscreen-plugins-dont-reload-expected.txt: Added.
* plugins/fullscreen-plugins-dont-reload.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94510 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL] Rename ewk_view_(single|tiled).c to ewk_view_(single|tiled).cpp
https://bugs.webkit.org/show_bug.cgi?id=66542

Use a C++ compiler for these files, so that they can include the C++-using
ewk_private.h.

Reviewed by Daniel Bates.

* CMakeListsEfl.txt:
* ewk/ewk_view_single.cpp: Renamed from Source/WebKit/efl/ewk/ewk_view_single.c.
(_ewk_view_single_on_del):
(_ewk_view_single_smart_add):
(_ewk_view_single_smart_backing_store_add):
(_ewk_view_single_smart_resize):
(_ewk_view_4b_move_region_up):
(_ewk_view_4b_move_region_down):
(_ewk_view_4b_move_line_left):
(_ewk_view_4b_move_line_right):
(_ewk_view_4b_move_region_left):
(_ewk_view_4b_move_region_right):
(_ewk_view_4b_move_region):
(_ewk_view_single_scroll_process_single):
(_ewk_view_single_smart_scrolls_process):
(_ewk_view_single_smart_repaints_process):
(_ewk_view_single_smart_zoom_weak_set):
(_ewk_view_single_smart_zoom_weak_smooth_scale_set):
(_ewk_view_single_smart_bg_color_set):
(ewk_view_single_smart_set):
(_ewk_view_single_smart_class_new):
(ewk_view_single_add):
* ewk/ewk_view_tiled.cpp: Renamed from Source/WebKit/efl/ewk/ewk_view_tiled.c.
(_ewk_view_tiled_render_cb):
(_ewk_view_tiled_updates_process_pre):
(_ewk_view_tiled_smart_backing_store_add):
(_ewk_view_tiled_contents_size_changed_cb):
(_ewk_view_tiled_smart_add):
(_ewk_view_tiled_smart_scrolls_process):
(_ewk_view_tiled_smart_repaints_process):
(_ewk_view_tiled_smart_contents_resize):
(_ewk_view_tiled_smart_zoom_set):
(_ewk_view_tiled_smart_zoom_weak_set):
(_ewk_view_tiled_smart_zoom_weak_smooth_scale_set):
(_ewk_view_tiled_smart_flush):
(_ewk_view_tiled_smart_pre_render_region):
(_ewk_view_tiled_smart_pre_render_relative_radius):
(_ewk_view_tiled_smart_pre_render_cancel):
(_ewk_view_tiled_smart_disable_render):
(_ewk_view_tiled_smart_enable_render):
(ewk_view_tiled_smart_set):
(_ewk_view_tiled_smart_class_new):
(ewk_view_tiled_add):
(ewk_view_tiled_unused_cache_get):
(ewk_view_tiled_unused_cache_set):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94509 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/10071256> Retain retired custom fonts until the next style recalc

Reviewed by Darin Adler.

Source/WebCore:

Test: fast/css/font-face-used-after-retired.html

During style recalc, existing renderers may reference their old style, including font data.
Allow them to do so safely by keeping retired custom font data around until after style recalc.

* css/CSSFontFace.cpp:
(WebCore::CSSFontFace::retireCustomFont): Added. Calls through to CSSFontSelector, if the font
face is still part of any segmented font face. Otherwise, deletes the custom font data.
* css/CSSFontFace.h:
* css/CSSFontFaceSource.cpp:
(WebCore::CSSFontFaceSource::pruneTable): Changed to call retireCustomFont() instead of deleting
retired font data.
* css/CSSFontSelector.cpp:
(WebCore::CSSFontSelector::retireCustomFont): Added. Calls through to the Document, if this is
still the active font selector for a document. Otherwise, deletes the custom font data.
* css/CSSFontSelector.h:
* css/CSSSegmentedFontFace.cpp:
(WebCore::CSSSegmentedFontFace::pruneTable): Changed to call retireCustomFont() instead of
deleting retired font data.
* dom/Document.cpp:
(WebCore::Document::~Document): Added a call to deleteRetiredCustomFonts(), in case the Document
is destroyed before getting a chance to recalc style after custom fonts have been retired.
(WebCore::Document::recalcStyle): Added a call to deleteRetiredCustomFonts() after style recalc.
(WebCore::Document::deleteRetiredCustomFonts): Added. Deletes all previously-retired custom font
data.
* dom/Document.h:
(WebCore::Document::retireCustomFont): Added.

LayoutTests:

* fast/css/font-face-used-after-retired-expected.txt: Added.
* fast/css/font-face-used-after-retired.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94508 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Add mutliple to WebPopupMenuInfo for Android
https://bugs.webkit.org/show_bug.cgi?id=67576

Reviewed by Darin Fisher.

This flag requests that the embedder allow multiple selection for the
popup menu.  (See also https://bugs.webkit.org/show_bug.cgi?id=67574.)

* public/WebPopupMenuInfo.h:
* src/ExternalPopupMenu.cpp:
(WebKit::ExternalPopupMenu::getPopupMenuInfo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94507 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Forgot to check in new results for fast/events/event-creation.html

* fast/events/event-creation-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94506 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Document.createEvent should support all the interfaces of Event we got
https://bugs.webkit.org/show_bug.cgi?id=67568

Reviewed by Anders Carlsson.

Source/WebCore:

Updated fast/events/event-creation.html

* dom/BeforeLoadEvent.h:
(WebCore::BeforeLoadEvent::create):
(WebCore::BeforeLoadEvent::BeforeLoadEvent):
Added empty create.

* dom/Document.cpp:
(WebCore::Document::createEvent):
Add missing interfaces.

* dom/HashChangeEvent.h:
(WebCore::HashChangeEvent::create):
(WebCore::HashChangeEvent::HashChangeEvent):
Added empty create.

* page/SpeechInputEvent.cpp:
(WebCore::SpeechInputEvent::create):
(WebCore::SpeechInputEvent::SpeechInputEvent):
(WebCore::SpeechInputEvent::~SpeechInputEvent):
* page/SpeechInputEvent.h:
Added empty create.

LayoutTests:

* fast/events/event-creation.html:
Converted to shouldBe style test, changed prototype check to us instanceof and constructor check,
added enumeration based catchall.

* fast/events/event-instanceof-expected.txt: Removed.
* fast/events/event-instanceof.html: Removed.
* fast/events/script-tests/event-instanceof.js: Removed.
Moved contents to fast/events/event-creation.html.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94505 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Add memory threshold values to WebKitPlatformSupport.h
https://bugs.webkit.org/show_bug.cgi?id=67575

Reviewed by Darin Fisher.

Source/WebCore:

Grab these memory thresholds from PlatformSupport rather than hard-coding them.

* bindings/v8/V8GCController.cpp:
(WebCore::V8GCController::checkMemoryUsage):
* platform/chromium/PlatformSupport.h:
* platform/qt/PlatformSupport.h:
(WebCore::PlatformSupport::lowMemoryUsageMB):
(WebCore::PlatformSupport::highMemoryUsageMB):
(WebCore::PlatformSupport::highUsageDeltaMB):

Source/WebKit/chromium:

Instead of hard-coding these values, we now grab them from
WebKitPlatformSupport because Android wishes to configure them on a
per-device basis.

One could view grabing these values from PlatformSupport as a bit of a
layering violation (because they feel like policy), but another view is
that the alternative implementation is to query the OS for various
memory parameters.  In either case, getting these values via
PlatformSupport is much easier and consistent with the other memory
related queries in PlatformSupport already.

* public/WebKitPlatformSupport.h:
(WebKit::WebKitPlatformSupport::lowMemoryUsageMB):
(WebKit::WebKitPlatformSupport::highMemoryUsageMB):
(WebKit::WebKitPlatformSupport::highUsageDeltaMB):
* src/PlatformSupport.cpp:
(WebCore::PlatformSupport::lowMemoryUsageMB):
(WebCore::PlatformSupport::highMemoryUsageMB):
(WebCore::PlatformSupport::highUsageDeltaMB):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94504 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-04  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed fix for chromium expectations.
        The expectations for http/tests/security/xssAuditor/dom-write-innerHTML.html
        were in conflict. The first was for LINUX the second was for DEBUG. I just added RELEASE flag for LINUX one.

        * platform/chromium/test_expectations.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94503 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[wx] Unreviewed build fix. Add new / moved files missing from last commit.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94502 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[wx] Enable wxWebKit to run using the wxGC Cairo backend on platforms other than GTK.
https://bugs.webkit.org/show_bug.cgi?id=67577

Reviewed by Kevin Ollivier.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94501 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ThunkGenerators does not convert positive double zero into integer zero
https://bugs.webkit.org/show_bug.cgi?id=67553

Reviewed by Gavin Barraclough.

This is an 0.5% speed-up on V8 and neutral elsewhere.

* jit/SpecializedThunkJIT.h:
(JSC::SpecializedThunkJIT::returnDouble):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94500 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r86268): Fix for qt_networkAccessAllowed()
https://bugs.webkit.org/show_bug.cgi?id=67570

Reviewed by Noam Rosenthal.

Source/WebCore:

No new tests as this change only removes dead code.
Support for Qt 4.6 has  been removed a while back.

* WebCore.pri:
* WebCore.pro:
* features.pri:
* platform/network/NetworkStateNotifier.h:
* platform/network/qt/NetworkStateNotifierQt.cpp:

Source/WebKit/qt:

Replace the ENABLE(QT_BEARER) guard with
!defined(QT_NO_BEARERMANAGEMENT) which is true by
default in Qt 4.7 or later versions.

* Api/qwebsettings.cpp:
(qt_networkAccessAllowed):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94499 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove the corresponding entry from the skipped list.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94498 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r94274): selection-change-closes-typing.html fails
https://bugs.webkit.org/show_bug.cgi?id=67377

Reviewed by Kent Tamura.

Source/WebCore:

The problem was that when the shadow DOM is updated by setInnerTextValue, WebKit layer detects the selection
change and calls confirmCompositionWithoutDisturbingSelection, which in turn modifies the shadow DOM by
inserting text.

Fixed the bug by not inserting text in confirmCompositionWithoutDisturbingSelection. It turned out that this
function is only used to cancel composition but never to confirming composition and restoring selection.

Test: platform/mac/editing/input/selection-change-closes-typing-2.html

* editing/Editor.cpp:
(WebCore::Editor::confirmCompositionWithoutDisturbingSelection):
(WebCore::Editor::confirmComposition):

LayoutTests:

Add a regression test to ensure the same bug doesn't exist in textarea element.

* platform/mac/editing/input/selection-change-closes-typing-2-expected.txt: Copied from
LayoutTests/platform/mac/editing/input/selection-change-closes-typing-expected.txt.
* platform/mac/editing/input/selection-change-closes-typing-2.html: Copied from
LayoutTests/platform/mac/editing/input/selection-change-closes-typing.html.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94497 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Test that document.all.tags() matches IE behavior with too few arguments
https://bugs.webkit.org/show_bug.cgi?id=66535

Patch by Mark Pilgrim <pilgrim@chromium.org> on 2011-09-03
Reviewed by Darin Adler.

* fast/dom/document-all-tags-expected.txt: Added.
* fast/dom/document-all-tags.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94496 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add platform-specific results for r94492

Unreviewed.

* platform/chromium-win/fast/repaint/block-layout-inline-children-float-positioned-expected.png:
* platform/gtk/fast/css/absolute-child-with-percent-height-inside-relative-parent-expected.txt: Added.
* platform/gtk/fast/css/bug4860-absolute-inline-child-inherits-alignment-expected.txt: Added.
* platform/gtk/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
* platform/gtk/fast/repaint/block-layout-inline-children-float-positioned-expected.txt:
* platform/mac/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
* platform/mac/fast/repaint/block-layout-inline-children-float-positioned-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94495 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[wx] Unreviewed build fix. Add wtf/dtoa directory to build.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94494 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add missing Event constructors to DOMWindow.idl
https://bugs.webkit.org/show_bug.cgi?id=67449

Reviewed by Anders Carlsson.

Source/WebCore:

Covered by existing tests.

* page/DOMWindow.idl:

LayoutTests:

* platform/mac/fast/dom/Window/window-properties-expected.txt:
* platform/mac/fast/dom/Window/window-property-descriptors-expected.txt:
* platform/mac/fast/dom/prototype-inheritance-expected.txt:
* platform/mac/fast/js/global-constructors-expected.txt:
Update results for new constructors.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94493 268f45cc-cd09-0410-ab3c-d52691b4dbfc

div align="center" rendering problem
https://bugs.webkit.org/show_bug.cgi?id=4860

Reviewed by David Hyatt.

Source/WebCore:

When an inline element with absolute position was the sole or first child of a render block with
centred alignment, it wasn't obeying its parent's alignment. However it would obey the
alignment if it was preceded by some text. The problem was that the element's render object
was getting skipped as leading white space, so it was not included in a normal line block in
a bidi run. Instead, its position was getting set by RenderBlockLineLayout::setStaticPositions()
which does not pay attention to alignment. Preceding the element with some text allowed the object
to get included in a Bidi run and so get a linebox which would get properly aligned.

The fix is to get RenderBlockLineLayout::setStaticPositions() to obey the alignment specified by
the object's container. This allows WebKit to get the same result on the test as Firefox and IE.
Opera has the same bug as unpatched WebKit.

Tests: fast/css/bug4860-absolute-block-child-does-not-inherit-alignment.html
       - Ensure positioned block elements inherit alignment.
       fast/css/bug4860-absolute-inline-child-inherits-alignment.html
       - Ensure positioned inline elements inherit alignment.
       fast/inline/absolute-positioned-inline-in-centred-block.html
       - Ensure positioned inline element that's the sole or first child of a rendered block
         obeys parents alignment.
       fast/inline/absolute-positioned-block-in-centred-block.html
       - As above, but a positioned block should not inherit alignment.

* rendering/RenderBlock.h:
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::updateLogicalWidthForAlignment):
(WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Move the alignment check to updateLogicalWidthForAlignment.
(WebCore::setStaticPositions): use startAlignedOffsetForLine and use startAlignedOffsetForBlock
(WebCore::RenderBlock::startAlignedOffsetForLine): New function, find the aligned offset using updateLogicalWidthForAlignment

LayoutTests:

* fast/css/bug4860-absolute-block-child-does-not-inherit-alignment-expected.png: Added.
* fast/css/bug4860-absolute-block-child-does-not-inherit-alignment-expected.txt: Added.
* fast/css/bug4860-absolute-block-child-does-not-inherit-alignment.html: Added.
* fast/css/bug4860-absolute-inline-child-inherits-alignment-expected.png: Added.
* fast/css/bug4860-absolute-inline-child-inherits-alignment-expected.txt: Added.
* fast/css/bug4860-absolute-inline-child-inherits-alignment.html: Added.
* fast/inline/absolute-positioned-block-in-centred-block-expected.png: Added.
* fast/inline/absolute-positioned-block-in-centred-block-expected.txt: Added.
* fast/inline/absolute-positioned-block-in-centred-block.html: Added.
* fast/inline/absolute-positioned-inline-in-centred-block-expected.png: Added.
* fast/inline/absolute-positioned-inline-in-centred-block-expected.txt: Added.
* fast/inline/absolute-positioned-inline-in-centred-block.html: Added.
* platform/chromium-linux/fast/repaint/block-layout-inline-children-float-positioned-expected.png:
* platform/chromium-linux/fast/repaint/block-layout-inline-children-float-positioned-expected.txt:
  Both of these two tests were based on the incorrect behaviour of ignoring the alignment specified
  by the container of an element absolute position when there was no text preceding the element.
  The updated results agree with Firefox and IE.
* fast/css/absolute-child-with-percent-height-inside-relative-parent-expected.txt:
* platform/chromium-win/fast/css/absolute-child-with-percent-height-inside-relative-parent-expected.png:
  This test expected the wrong alignment of the red block - it should be centred, not aligned to the left.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94492 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove two unused functions from Element.
https://bugs.webkit.org/show_bug.cgi?id=67492

Reviewed by Benjamin Poulain.

Removed openTagStartToString() and setCStringAttribute() as they are
not called from anywhere.

* dom/Element.cpp:
* dom/Element.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94491 268f45cc-cd09-0410-ab3c-d52691b4dbfc

32-bit build fix.

* TestWebKitAPI/mac/PlatformUtilitiesMac.mm:
(TestWebKitAPI::Util::toSTD):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94490 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt] Enable support for WebGL OES_standard_derivatives for Qt
https://bugs.webkit.org/show_bug.cgi?id=67430

Patch by Andrew Wason <rectalogic@rectalogic.com> on 2011-09-03
Reviewed by Noam Rosenthal.

Tested using https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/extensions/oes-standard-derivatives.html

Enable existing support for OES_standard_derivatives for Qt.

* platform/graphics/opengl/Extensions3DOpenGL.cpp:
(WebCore::Extensions3DOpenGL::ensureEnabled):
(WebCore::Extensions3DOpenGL::isEnabled):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94489 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move testStringByEvaluatingJavaScriptFromString() from DumpRenderTree to TestWebKitAPI
https://bugs.webkit.org/show_bug.cgi?id=67559

Reviewed by Darin Adler.

* DumpRenderTree/mac/DumpRenderTree.mm:
(dumpRenderTree): Moved testStringByEvaluatingJavaScriptFromString() from here and removed
the call to it.
* TestWebKitAPI/PlatformUtilities.h: Declared Util::toSTD(NSString *)
* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Added StringByEvaluatingJavaScriptFromString.mm.
* TestWebKitAPI/Tests/mac/StringByEvaluatingJavaScriptFromString.mm: Added.
(TestWebKitAPI::TEST): Added. Moved testStringByEvaluatingJavaScriptFromString() to here.
* TestWebKitAPI/mac/PlatformUtilitiesMac.mm:
(TestWebKitAPI::Util::toSTD): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94488 268f45cc-cd09-0410-ab3c-d52691b4dbfc

garden-o-matic results view should have a better results selector
https://bugs.webkit.org/show_bug.cgi?id=67542

Reviewed by Dimitri Glazkov.

This patch adds a basic grid-based results selector to the results
view.  Currently, this grid just shows how the tests fail on the
various bots.  A future patch will let you select which failure to view
and to mark the failures for rebaselining.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/base.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/base_unittests.js:
  - Add some more basic functions for manipulating dictionaries.
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/controllers.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/results.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/results_unittests.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94487 268f45cc-cd09-0410-ab3c-d52691b4dbfc

garden-o-matic results view should show Actual and Expected results for text failures
https://bugs.webkit.org/show_bug.cgi?id=67536

Reviewed by Eric Seidel.

In the past, we didn't show actual and expected text results (we just
showed the diff) because we didn't have the awesome six-by-two results
grid.  Now that we do, we can move show these results.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/base.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/base_unittests.js:
  - Fixed some typos that were preventing these unit tests from running.
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js:
(.):
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results_unittests.js:
  - Report -actual.txt and -expected.txt as possible results URLs.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94486 268f45cc-cd09-0410-ab3c-d52691b4dbfc

garden-o-matic shows "ghost" failures that are already fixed
https://bugs.webkit.org/show_bug.cgi?id=67535

Reviewed by Eric Seidel.

About 10% of writes fail to stick on test-results.appspot.com.  This
patch causes us to fetch the full_results.json blob directly from
build.chromium.org rather than relying upon AppEngine.

Unforuntately, we still need to get historical information from
AppEngine.  That will take several patches to fix becuase I need to
change the bots to write the full_results.json file to the
build-specific directory in addition to the zip file.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/base.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/model.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94485 268f45cc-cd09-0410-ab3c-d52691b4dbfc

DFG variable predictions only work for local variables, not temporaries
https://bugs.webkit.org/show_bug.cgi?id=67554

Reviewed by Gavin Barraclough.

This appears to be a slight speed-up in Kraken (0.3% but significant)
and neutral elsewhere.

* dfg/DFGGraph.h:
(JSC::DFG::Graph::predict):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94484 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94458.
http://trac.webkit.org/changeset/94458
https://bugs.webkit.org/show_bug.cgi?id=67558

Caused appcache test to fail on various bots (Requested by
rniwa on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-03

* Scripts/webkitpy/layout_tests/port/webkit.py:
* Scripts/webkitpy/layout_tests/port/webkit_unittest.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94483 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebSocket: Send ArrayBuffer as WebSocket binary message
https://bugs.webkit.org/show_bug.cgi?id=67477

Reviewed by Kent Tamura.

Source/WebCore:

Tests: http/tests/websocket/tests/hybi/send-arraybuffer.html
       http/tests/websocket/tests/hybi/workers/send-arraybuffer.html
       http/tests/websocket/tests/hybi/bufferedAmount-after-close.html (updated)

* bindings/js/JSWebSocketCustom.cpp:
(WebCore::JSWebSocket::send):
* bindings/v8/custom/V8WebSocketCustom.cpp:
(WebCore::V8WebSocket::sendCallback):
* websockets/ThreadableWebSocketChannel.h:
* websockets/ThreadableWebSocketChannelClientWrapper.cpp:
(WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
(WebCore::ThreadableWebSocketChannelClientWrapper::sendRequestResult):
(WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult):
* websockets/ThreadableWebSocketChannelClientWrapper.h:
Rename "sent" to "sendRequestResult" to clarify the meaning. Messages from the script may not
be sent immediately, thus the return value of WebSocketChannel::send() indicates whether the
message has been queued successfully, rather than whether the message has been sent or not.
* websockets/WebSocket.cpp:
(WebCore::WebSocket::send):
Case of sending "[object ArrayBuffer]" is covered by an existing test
http/tests/websocket/tests/{hybi,hixie76}/send-object.html.
* websockets/WebSocket.h:
* websockets/WebSocket.idl:
* websockets/WebSocketChannel.cpp:
(WebCore::WebSocketChannel::send):
* websockets/WebSocketChannel.h:
* websockets/WorkerThreadableWebSocketChannel.cpp:
(WebCore::WorkerThreadableWebSocketChannel::send):
(WebCore::workerContextDidSend):
(WebCore::WorkerThreadableWebSocketChannel::Peer::send):
(WebCore::WorkerThreadableWebSocketChannel::mainThreadSendArrayBuffer):
Construct an ArrayBuffer from the data on Vector<char>.
(WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
Copy the content into temporary buffer of Vector<char>, and send it to the main thread.
* websockets/WorkerThreadableWebSocketChannel.h:

LayoutTests:

* http/tests/websocket/tests/hybi/bufferedAmount-after-close-expected.txt:
* http/tests/websocket/tests/hybi/bufferedAmount-after-close.html:
Add tests to send ArrayBuffers.
* http/tests/websocket/tests/hybi/check-binary-messages_wsh.py:
Renamed from LayoutTests/http/tests/websocket/tests/hybi/send-blob_wsh.py, because this handler
is used from send-blob.html and send-arraybuffer.html.
* http/tests/websocket/tests/hybi/send-arraybuffer-expected.txt: Added.
* http/tests/websocket/tests/hybi/send-arraybuffer.html:
Added. Send three small binary messages as ArrayBuffers.
* http/tests/websocket/tests/hybi/send-blob.html:
* http/tests/websocket/tests/hybi/workers/resources/check-binary-messages_wsh.py:
Renamed from LayoutTests/http/tests/websocket/tests/hybi/workers/resources/send-blob_wsh.py.
* http/tests/websocket/tests/hybi/workers/resources/send-arraybuffer.js:
Added. Same as send-arraybuffer.html, except that this test is run on the worker.
* http/tests/websocket/tests/hybi/workers/resources/send-blob.js:
Removed the definition of unnecessary function startsWith().
* http/tests/websocket/tests/hybi/workers/send-arraybuffer-expected.txt: Added.
* http/tests/websocket/tests/hybi/workers/send-arraybuffer.html: Added

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94482 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94453.
http://trac.webkit.org/changeset/94453
https://bugs.webkit.org/show_bug.cgi?id=67557

Caused appcache test to fail on various bots (Requested by
rniwa on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-03

* Scripts/webkitpy/layout_tests/port/webkit.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94481 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Implement a CustomEvent constructor for V8
https://bugs.webkit.org/show_bug.cgi?id=67527

Patch by Kentaro Hara <haraken@google.com> on 2011-09-02
Reviewed by Sam Weinig.

Source/WebCore:

Test: fast/events/constructors/custom-event-constructor.html

* bindings/v8/OptionsObject.h:
(WebCore::OptionsObject::getKeyValue): Returns ScriptValue corresponding to a given key.
* bindings/v8/custom/V8EventConstructors.cpp: Added the CustomEvent constructor.
* dom/CustomEvent.idl: Added a 'V8CustomConstructor' attribute.

LayoutTests:

* platform/chromium/fast/events/constructors/custom-event-constructor-expected.txt: Updated the result.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94480 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove WebKitClient.h
https://bugs.webkit.org/show_bug.cgi?id=67539

Reviewed by Sam Weinig.

This API no longer has any callers.

* WebKit.gyp:
* public/WebKit.h:
* public/WebKitClient.h: Removed.
* src/WebKit.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94479 268f45cc-cd09-0410-ab3c-d52691b4dbfc

DFG JIT speculation failure does recovery of additions in reverse and
doesn't rebox
https://bugs.webkit.org/show_bug.cgi?id=67551

Reviewed by Sam Weinig.

* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94478 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ValueProfile does not make it safe to introspect cell values
after garbage collection
https://bugs.webkit.org/show_bug.cgi?id=67354

Reviewed by Gavin Barraclough.

ValueProfile buckets are now weak references, implemented using a
light-weight weak reference mechanism that this patch also adds (the
WeakReferenceHarvester).  If a cell stored in a ValueProfile bucket
is not marked, then the bucket is transformed into a Structure
pointer.  If the Structure is not marked either, then it is turned
into a ClassInfo pointer.

* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::~CodeBlock):
(JSC::CodeBlock::visitAggregate):
(JSC::CodeBlock::visitWeakReferences):
* bytecode/CodeBlock.h:
* bytecode/ValueProfile.h:
(JSC::ValueProfile::ValueProfile):
(JSC::ValueProfile::classInfo):
(JSC::ValueProfile::numberOfInt32s):
(JSC::ValueProfile::numberOfDoubles):
(JSC::ValueProfile::numberOfCells):
(JSC::ValueProfile::numberOfArrays):
(JSC::ValueProfile::probabilityOfArray):
(JSC::ValueProfile::WeakBucket::WeakBucket):
(JSC::ValueProfile::WeakBucket::operator!):
(JSC::ValueProfile::WeakBucket::isEmpty):
(JSC::ValueProfile::WeakBucket::isClassInfo):
(JSC::ValueProfile::WeakBucket::isStructure):
(JSC::ValueProfile::WeakBucket::asStructure):
(JSC::ValueProfile::WeakBucket::asClassInfo):
(JSC::ValueProfile::WeakBucket::getClassInfo):
* heap/Heap.cpp:
(JSC::Heap::harvestWeakReferences):
(JSC::Heap::markRoots):
* heap/Heap.h:
* heap/MarkStack.cpp:
(JSC::SlotVisitor::drain):
(JSC::SlotVisitor::harvestWeakReferences):
* heap/MarkStack.h:
(JSC::MarkStack::addWeakReferenceHarvester):
(JSC::MarkStack::MarkStack):
(JSC::MarkStack::appendUnbarrieredPointer):
* heap/SlotVisitor.h:
* heap/WeakReferenceHarvester.h: Added.
(JSC::WeakReferenceHarvester::WeakReferenceHarvester):
(JSC::WeakReferenceHarvester::~WeakReferenceHarvester):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94477 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94473.
http://trac.webkit.org/changeset/94473
https://bugs.webkit.org/show_bug.cgi?id=67547

Putting http://trac.webkit.org/changeset/94454 back in as
http://trac.webkit.org/changeset/94472 fixed the problem
(Requested by msaboff on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-02

* UIProcess/API/C/WKContext.cpp:
(WKContextGarbageCollectJavaScriptObjects):
* UIProcess/API/C/WKContext.h:
* UIProcess/WebContext.cpp:
(WebKit::WebContext::garbageCollectJavaScriptObjects):
* UIProcess/WebContext.h:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::garbageCollectJavaScriptObjects):
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94476 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Replace local implementation of string equals() methods with UString versions
https://bugs.webkit.org/show_bug.cgi?id=67342

In preparation to allowing StringImpl to be backed by 8 bit
characters when appropriate, we need to eliminate or change the
usage of StringImpl::characters(). Change the uses of characters()
that are used to implement redundant equals() methods.

Reviewed by Gavin Barraclough.

* runtime/Identifier.cpp:
(JSC::Identifier::equal):
* runtime/Identifier.h:
(JSC::Identifier::equal):
* wtf/text/AtomicString.cpp:
(WTF::CStringTranslator::equal): Moved an optimized method to here.
(WTF::operator==):
* wtf/text/StringImpl.cpp:
(WTF::equal):
* wtf/text/StringImpl.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94475 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Move updateLayers from LayerRendererChromium to CCLayerTreeHost
https://bugs.webkit.org/show_bug.cgi?id=67438

Reviewed by James Robinson.

Covered by existing tests.

Move functionality used by both CCLayerTreeHost and
LayerRendererChromium into CCLayerTreeHostCommon. Move update, paint,
and updateCompositorResource functions into CClayerTreeHost.

* WebCore.gypi:
* platform/graphics/chromium/LayerChromium.cpp:
(WebCore::sortLayers):
* platform/graphics/chromium/LayerChromium.h:
* platform/graphics/chromium/LayerRendererChromium.cpp:
(WebCore::LayerRendererChromium::textureMemoryReclaimLimit):
(WebCore::LayerRendererChromium::drawLayers):
(WebCore::LayerRendererChromium::drawLayersInternal):
* platform/graphics/chromium/LayerRendererChromium.h:
* platform/graphics/chromium/cc/CCLayerImpl.cpp:
(WebCore::sortLayers):
* platform/graphics/chromium/cc/CCLayerImpl.h:
* platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
(WebCore::CCLayerTreeHost::commitTo):
(WebCore::CCLayerTreeHost::updateLayers):
(WebCore::paintContentsIfDirty):
(WebCore::CCLayerTreeHost::paintLayerContents):
(WebCore::CCLayerTreeHost::updateCompositorResources):
* platform/graphics/chromium/cc/CCLayerTreeHost.h:
* platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp: Added.
(WebCore::CCLayerTreeHostCommon::isScaleOrTranslation):
(WebCore::CCLayerTreeHostCommon::calculateVisibleRect):
(WebCore::CCLayerTreeHostCommon::calculateVisibleLayerRect):
* platform/graphics/chromium/cc/CCLayerTreeHostCommon.h: Added.
(WebCore::CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility):
* platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
* platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
* platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
(WebCore::CCSingleThreadProxy::commitIfNeeded):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94474 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94454.
http://trac.webkit.org/changeset/94454
https://bugs.webkit.org/show_bug.cgi?id=67546

"Broke Windows and SnowLeopard, also no reply on the bug."
(Requested by jchaffraix on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-02

* UIProcess/API/C/WKContext.cpp:
* UIProcess/API/C/WKContext.h:
* UIProcess/WebContext.cpp:
* UIProcess/WebContext.h:
* WebProcess/WebProcess.cpp:
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94473 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-02  Michael Saboff  <msaboff@apple.com>

        Fixed release build by removing #ifndef NDEBUG to
        allow definition of gcController().

        Rubber-stamp by Sam Weinig.

        * WebProcess/WebProcess.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94472 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-02  Chris Marrin  <cmarrin@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=67510
        Crash can occur when doing a PlatformCAAnimation::copy() with no valueFunction

        Reviewed by Simon Fraser.

        Do a null check in two places to avoid sending nulls to CACF ValueFunction API.

        Test: animations/pause-crash.html

        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
        (PlatformCAAnimation::valueFunction):
        (PlatformCAAnimation::setValueFunction):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94471 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add JSC:RegExp functional tests
https://bugs.webkit.org/show_bug.cgi?id=67339

Source/JavaScriptCore:

Added new test driver program (testRegExp) and corresponding data file
along with build scripts changes.

Reviewed by Gavin Barraclough.

* JavaScriptCore.exp:
* JavaScriptCore.xcodeproj/project.pbxproj:
* testRegExp.cpp: Added.
(Options::Options):
(StopWatch::start):
(StopWatch::stop):
(StopWatch::getElapsedMS):
(RegExpTest::RegExpTest):
(GlobalObject::create):
(GlobalObject::className):
(GlobalObject::GlobalObject):
(main):
(cleanupGlobalData):
(testOneRegExp):
(scanString):
(parseRegExpLine):
(parseTestLine):
(runFromFiles):
(printUsageStatement):
(parseArguments):
(realMain):
* tests/regexp: Added.
* tests/regexp/RegExpTest.data: Added.

Tools:

New perl script to build JavaScriptCore and run the RegExp tests.

Reviewed by Gavin Barraclough.

* Scripts/run-regexp-tests: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94470 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Update baselines and expectations.

* platform/chromium-win-xp/fast/css/getComputedStyle/computed-style-expected.txt: Removed.
* platform/chromium-win-xp/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt: Removed.
* platform/chromium-win-xp/svg/css/getComputedStyle-basic-expected.txt: Removed.
* platform/chromium/test_expectations.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94469 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add JSC:RegExp functional test data generator
https://bugs.webkit.org/show_bug.cgi?id=67519

Add a data generator for regular expressions.  To enable, change the
#undef REGEXP_FUNC_TEST_DATA_GEN to #define.  Then compile and use
regular expressions.  The resulting data will be in /tmp/RegExpTestsData.

Reviewed by Gavin Barraclough.

* runtime/RegExp.cpp:
(JSC::regExpFlags):
(JSC::RegExpFunctionalTestCollector::clearRegExp):
(JSC::RegExpFunctionalTestCollector::get):
(JSC::RegExpFunctionalTestCollector::outputOneTest):
(JSC::RegExpFunctionalTestCollector::RegExpFunctionalTestCollector):
(JSC::RegExpFunctionalTestCollector::~RegExpFunctionalTestCollector):
(JSC::RegExpFunctionalTestCollector::outputEscapedUString):
(JSC::RegExp::~RegExp):
(JSC::RegExp::compile):
(JSC::RegExp::match):
(JSC::RegExp::matchCompareWithInterpreter):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94468 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore: Add a 'didDownloadData' method to ResourceLoader, SubresourceLoader,
SubresourceLoaderClient, DocumentThreadableLoader, ResourceHandleClient,
and ThreadableLoaderClient for the Chromium port only, so we can pass
these notifications from our ResourceHandle implementation through the
WebCore loader framework.
https://bugs.webkit.org/show_bug.cgi?id=67229

Patch by Bill Budge <bbudge@chromium.org> on 2011-09-02
Reviewed by Darin Fisher.

No new tests. Exposes no new functionality.

* WebCore.gypi:
* loader/DocumentThreadableLoader.h:
* loader/ResourceLoader.h:
* loader/SubresourceLoader.h:
* loader/SubresourceLoaderClient.h:
(WebCore::SubresourceLoaderClient::didDownloadData):
* loader/ThreadableLoaderClient.h:
(WebCore::ThreadableLoaderClient::didDownloadData):
* loader/ThreadableLoaderClientWrapper.h:
(WebCore::ThreadableLoaderClientWrapper::didDownloadData):
* loader/chromium: Added.
* loader/chromium/DocumentThreadableLoaderChromium.cpp: Added.
(WebCore::DocumentThreadableLoader::didDownloadData):
* loader/chromium/ResourceLoaderChromium.cpp: Added.
(WebCore::ResourceLoader::didDownloadData):
* loader/chromium/SubresourceLoaderChromium.cpp: Added.
(WebCore::SubresourceLoader::didDownloadData):
* platform/network/ResourceHandleClient.h:
(WebCore::ResourceHandleClient::didDownloadData):

Source/WebKit/chromium: Add a 'didDownloadData' method to ResourceHandleInternal and pass these
notifications to WebURLLoaderClients.
https://bugs.webkit.org/show_bug.cgi?id=67229

Patch by Bill Budge <bbudge@chromium.org> on 2011-09-02
Reviewed by Darin Fisher.

* src/AssociatedURLLoader.cpp:
(WebKit::AssociatedURLLoader::ClientAdapter::ClientAdapter):
(WebKit::AssociatedURLLoader::ClientAdapter::didDownloadData):
(WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
(WebKit::AssociatedURLLoader::ClientAdapter::didFinishLoading):
* src/ResourceHandle.cpp:
(WebCore::ResourceHandleInternal::didDownloadData):
* src/ResourceHandleInternal.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94466 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Assert that PlatformCALayerWinInternal::displayCallback() is only called on the main thread
https://bugs.webkit.org/show_bug.cgi?id=67541

Reviewed by Simon Fraser.

No new tests, covered by existing media tests.

* platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
(PlatformCALayerWinInternal::displayCallback): Assert that is function is only called on the main thread.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94465 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Enable RenderLayer::updateLayerPosition's cachedOffset optimization for more cases
https://bugs.webkit.org/show_bug.cgi?id=66901

Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/layers/assert-RenderLayer-update-positions.html
      Also covered by existing tests under the new ASSERT.

This change extends the range of callers making use of the cachedOffset optimization.

Most callers did not make use of cachedOffset as it did not work when called on a subtree.
This limitation is now gone thus we can enable it more widely.

The semantics of the optimization are changed a bit as we now return if it is enabled whereas
the old code would check if it was *disabled*. Also there were some renames done to match more
closely what was going on (s/cachedOffset/offsetFromRoot/ and s/cachedOffsetDisabled/hasLayerOffset/).

Note that this is an optimistic optimization: if cachedOffset is not used, then we have
done at least an extra traversal up to the root. I have found it to be a wash on file
cycler (alexa) but to be a nice improvement (~20%) on some table benchmarks (modifying
a cell, scrolling).

* page/FrameView.cpp:
(WebCore::FrameView::layout): Extended the use of cachedOffset to subtree layouts.
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::styleDidChange): Forbid the use cachedOffset in this
case as we have only a single layer to update.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::computeOffsetFromRoot): Added this function to get the offset from the root
layer at a certain point in the RenderLayer's tree. It gets the root layer's checking if no layer
in between would prevent convertToLayerCoords to work and return the position relative to
this layer.

(WebCore::RenderLayer::updateLayerPositions): Added a new ASSERT to make sure our cachedOffset
is always fine. Also added a comment about calling convertToLayerCoords.

(WebCore::RenderLayer::removeOnlyThisLayer): Added cachedOffset here too as we may have to
update several layers. We save the offset prior to being removed from the hierarchy for
correctness.

(WebCore::RenderLayer::paintChildLayerIntoColumns): Added a comment here about calling convertToLayerCoords.

* rendering/RenderLayer.h: Swapped the argument in updateLayerPositions to make
cachedOffset a mandatory field. Patched all the callers.

(WebCore::RenderLayer::canUseConvertToLayerCoords): Added this helper method to know when a
renderer prevents convertToLayerCoords from working. Added some FIXME around suspicious use
of convertToLayerCoords.

LayoutTests:

* fast/layers/crash-RenderLayer-update-positions-expected.txt: Added.
* fast/layers/crash-RenderLayer-update-positions.html: Added.
Test that some changes in the layers does not cause an ASSERT failure.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94464 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix the broken build due to dtoa patch
https://bugs.webkit.org/show_bug.cgi?id=67534

Patch by Mark Hahnenberg <mhahnenberg@apple.com> on 2011-09-02
Reviewed by Oliver Hunt.

Fixing the build.

* GNUmakefile.list.am:
* wtf/dtoa/bignum.cc:
* wtf/dtoa/fast-dtoa.cc:
* wtf/dtoa/utils.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94463 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][Symbian] REGRESSION(93235) Missing .def update
https://bugs.webkit.org/show_bug.cgi?id=67307

Patch by Jade Han <jade.han@nokia.com> on 2011-09-02
Reviewed by Laszlo Gombos.

* symbian/eabi/QtWebKitu.def:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94462 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove OldSpace classes
https://bugs.webkit.org/show_bug.cgi?id=67533

Reviewed by Gavin Barraclough.

Remove the unused OldSpace classes

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.gypi:
* JavaScriptCore.pro:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/Heap.cpp:
(JSC::Heap::writeBarrierSlowCase):
* heap/MarkedBlock.h:
* heap/OldSpace.cpp: Removed.
* heap/OldSpace.h: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94461 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Compile fix for mac build.

* wtf/CheckedArithmetic.h:
(WTF::operator+):
(WTF::operator-):
(WTF::operator*):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94460 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Need API for getting surrounding text from webkit in chromium
https://bugs.webkit.org/show_bug.cgi?id=66681

Patch by Peng Huang <penghuang@chromium.org> on 2011-09-02
Reviewed by Ryosuke Niwa.

Add getSelectionOffsetsAndTextInEditableContent() to Chromium's
WebViewImpl. This function is for supporting some input methods which
need input context around the edit caret.

* public/WebWidget.h:
(WebKit::WebWidget::getSelectionOffsetsAndTextInEditableContent):
* src/WebViewImpl.cpp:
(WebKit::WebViewImpl::getSelectionOffsetsAndTextInEditableContent):
* src/WebViewImpl.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94459 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reshuffle some code in WebKitDriver._read_block in preparation for reading stderr/stdout separately
https://bugs.webkit.org/show_bug.cgi?id=67530

Unreviewed.  Fixing typo from previous commit.

Turns out there was *no* unittesting of WebKitDriver.  Added a basic test of _read_block
which exercises the code I previously made a typo in.

* Scripts/webkitpy/layout_tests/port/webkit.py:
* Scripts/webkitpy/layout_tests/port/webkit_unittest.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94458 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Read out of bounds in sUnpremultiplyData_RGBA8888 / ImageBufferData::getData
https://bugs.webkit.org/show_bug.cgi?id=65352

Reviewed by Simon Fraser.

New test: fast/canvas/canvas-getImageData-large-crash.html

Source/JavaScriptCore:

This patch prevents overflows from happening in getImageData, createImageData, and canvas creation
calls that specify widths and heights that end up overflowing the ints that we store those values in
as well as derived values such as area and maxX / maxY of the bounding rects involved. Overflow of integer
arithmetic is detected via the use of the new Checked type that was introduced in r94207. The change to JSC
is just to add a new helper method described below.

* wtf/MathExtras.h:
(isWithinIntRange): Reports if a float's value is within the range expressible by an int.

Source/WebCore:

This patch prevents overflows from happening in getImageData, createImageData, and canvas creation
calls that specify widths and heights that end up overflowing the ints that we store those values in
as well as derived values such as area and maxX / maxY of the bounding rects involved. Overflow of integer
arithmetic is detected via the use of the new Checked type that was introduced in r94207.

* html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::convertLogicalToDevice): Removed dependency on ints, using FloatRects/Sizes instead.
(WebCore::HTMLCanvasElement::createImageBuffer): Moved the check for max canvas area and dimensions here.
  Added in check that prevents us from having canvases of sizes that will cause overflows.
(WebCore::HTMLCanvasElement::baseTransform): Updated use of convertLogicalToDevice.
* html/HTMLCanvasElement.h: Updated method signatures.
* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::createEmptyImageData): Added in check to prevent creating ImageData objects that will cause overflow when computing their size.
(WebCore::CanvasRenderingContext2D::createImageData): Avoid creating ImageData objects of size that will overflow later.
(WebCore::CanvasRenderingContext2D::getImageData): Added in check to prevent trying to get ImageData objects that will cause overflow when computing their size.
* platform/graphics/FloatRect.cpp:
(WebCore::FloatRect::isExpressibleAsIntRect): New method that tests whether a FloatRect can become an IntRect without overflow or having to be clamped.
* platform/graphics/FloatRect.h:
* platform/graphics/FloatSize.cpp:
(WebCore::FloatSize::isExpressibleAsIntSize): Same as FloatRect, but for FloatSize->IntSize.
* platform/graphics/FloatSize.h:
* platform/graphics/cg/ImageBufferCG.cpp: Added check for overflow.
(WebCore::ImageBuffer::ImageBuffer):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94457 268f45cc-cd09-0410-ab3c-d52691b4dbfc

NPN_SetException doesn't work with OOP plug-ins
https://bugs.webkit.org/show_bug.cgi?id=67524

Reviewed by Sam Weinig.

* DerivedSources.make:
Add PluginProcessConnection.messages.in.

* GNUmakefile.am:
Add generated files.

* Platform/CoreIPC/MessageID.h:
Add MessageClassPluginProcessConnection.

* PluginProcess/PluginProcess.cpp:
(WebKit::PluginProcess::initialize):
Set the set exception function.

* PluginProcess/WebProcessConnection.cpp:
(WebKit::ConnectionStack::current):
(WebKit::ConnectionStack::CurrentConnectionPusher::CurrentConnectionPusher):
(WebKit::ConnectionStack::CurrentConnectionPusher::~CurrentConnectionPusher):
Add a helper class for managing a stack of CoreIPC connections, along with a RAII
object to push/pop connections onto it.

(WebKit::connectionStack):
Add getter.

(WebKit::WebProcessConnection::setGlobalException):
Get the current connection and send a PluginProcessConnection::SetException message to it.

(WebKit::WebProcessConnection::didReceiveMessage):
(WebKit::WebProcessConnection::didReceiveSyncMessage):
Create connection pushers.

* PluginProcess/WebProcessConnection.h:
Add setGlobalException.

* WebKit2.pro:
* WebKit2.xcodeproj/project.pbxproj:
Add new files.

* WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
(WebKit::NetscapePlugin::setSetExceptionFunction):
New function for setting the 'setException' function.

(WebKit::NetscapePlugin::setException):
Call the 'setException' function.

* WebProcess/Plugins/PluginProcessConnection.cpp:
(WebKit::PluginProcessConnection::didReceiveSyncMessage):
Call the message receiver function.

(WebKit::PluginProcessConnection::setException):
Call the NPRuntimeObjectMap.

* WebProcess/Plugins/PluginProcessConnection.messages.in:
Add new messages file.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::createPlugin):
When not using the plug-in process, make sure to call NetscapePlugin::setSetExceptionFunction.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94456 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/9755843> anonymous RenderMathMLOperator sets itself as the renderer of its parent mfenced node

Reviewed by Darin Adler.

Source/WebCore:

Test: mathml/operator-hijacks-fenced-node.xhtml

* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::updateFromElement): Rather than unconditionally setting the
node’s renderer to this, just restore it to whatever it was before calling destroyLeftoverChildren().

LayoutTests:

* mathml/operator-hijacks-fenced-node-expected.txt: Added.
* mathml/operator-hijacks-fenced-node.xhtml: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94455 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add WKContextGarbageCollectJavaScriptObjects() which does a garbage collection in the WebProcess
https://bugs.webkit.org/show_bug.cgi?id=67526

Reviewed by Darin Adler.

* UIProcess/API/C/WKContext.cpp:
(WKContextGarbageCollectJavaScriptObjects):
* UIProcess/API/C/WKContext.h:
* UIProcess/WebContext.cpp:
(WebKit::WebContext::garbageCollectJavaScriptObjects): Send a message to WebProcess to garbage collect JS objects.
* UIProcess/WebContext.h:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::garbageCollectJavaScriptObjects): Call GCController::garbageCollectNow().
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in: Add GarbageCollectJavaScriptObjects message.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94454 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reshuffle some code in WebKitDriver._read_block in preparation for reading stderr/stdout separately
https://bugs.webkit.org/show_bug.cgi?id=67530

Reviewed by Adam Barth.

No functional change, just reshuffling code.

* Scripts/webkitpy/layout_tests/port/webkit.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94453 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Incorporate newer, faster dtoa library
https://bugs.webkit.org/show_bug.cgi?id=66346

Patch by Mark Hahnenberg <mhahnenberg@apple.com> on 2011-09-02
Reviewed by Oliver Hunt.

Source/JavaScriptCore:

Added new dtoa library at http://code.google.com/p/double-conversion/.
Replaced old call to dtoa.  The new library is much faster than the old one.
We still use the old dtoa for some stuff in WebCore as well as the old strtod,
but we can phase these out eventually as well.

* GNUmakefile.list.am:
* JavaScriptCore.exp:
* JavaScriptCore.gypi:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
* JavaScriptCore.vcproj/WTF/WTF.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* runtime/InitializeThreading.cpp:
* runtime/NumberPrototype.cpp:
(JSC::numberProtoFuncToExponential):
(JSC::numberProtoFuncToFixed):
(JSC::numberProtoFuncToPrecision):
* runtime/UString.cpp:
(JSC::UString::number):
* wtf/CMakeLists.txt:
* wtf/ThreadingPthreads.cpp:
(WTF::initializeThreading):
* wtf/ThreadingWin.cpp:
(WTF::initializeThreading):
* wtf/dtoa.cpp:
(WTF::dtoa):
* wtf/dtoa.h:
* wtf/dtoa/COPYING: Added.
* wtf/dtoa/LICENSE: Added.
* wtf/dtoa/README: Added.
* wtf/dtoa/bignum-dtoa.cc: Added.
* wtf/dtoa/bignum-dtoa.h: Added.
* wtf/dtoa/bignum.cc: Added.
* wtf/dtoa/bignum.h: Added.
(WTF::double_conversion::Bignum::Times10):
(WTF::double_conversion::Bignum::Equal):
(WTF::double_conversion::Bignum::LessEqual):
(WTF::double_conversion::Bignum::Less):
(WTF::double_conversion::Bignum::PlusEqual):
(WTF::double_conversion::Bignum::PlusLessEqual):
(WTF::double_conversion::Bignum::PlusLess):
(WTF::double_conversion::Bignum::EnsureCapacity):
(WTF::double_conversion::Bignum::BigitLength):
* wtf/dtoa/cached-powers.cc: Added.
* wtf/dtoa/cached-powers.h: Added.
* wtf/dtoa/diy-fp.cc: Added.
* wtf/dtoa/diy-fp.h: Added.
(WTF::double_conversion::DiyFp::DiyFp):
(WTF::double_conversion::DiyFp::Subtract):
(WTF::double_conversion::DiyFp::Minus):
(WTF::double_conversion::DiyFp::Times):
(WTF::double_conversion::DiyFp::Normalize):
(WTF::double_conversion::DiyFp::f):
(WTF::double_conversion::DiyFp::e):
(WTF::double_conversion::DiyFp::set_f):
(WTF::double_conversion::DiyFp::set_e):
* wtf/dtoa/double-conversion.cc: Added.
* wtf/dtoa/double-conversion.h: Added.
(WTF::double_conversion::DoubleToStringConverter::DoubleToStringConverter):
(WTF::double_conversion::StringToDoubleConverter::StringToDoubleConverter):
* wtf/dtoa/double.h: Added.
(WTF::double_conversion::double_to_uint64):
(WTF::double_conversion::uint64_to_double):
(WTF::double_conversion::Double::Double):
(WTF::double_conversion::Double::AsDiyFp):
(WTF::double_conversion::Double::AsNormalizedDiyFp):
(WTF::double_conversion::Double::AsUint64):
(WTF::double_conversion::Double::NextDouble):
(WTF::double_conversion::Double::Exponent):
(WTF::double_conversion::Double::Significand):
(WTF::double_conversion::Double::IsDenormal):
(WTF::double_conversion::Double::IsSpecial):
(WTF::double_conversion::Double::IsNan):
(WTF::double_conversion::Double::IsInfinite):
(WTF::double_conversion::Double::Sign):
(WTF::double_conversion::Double::UpperBoundary):
(WTF::double_conversion::Double::NormalizedBoundaries):
(WTF::double_conversion::Double::value):
(WTF::double_conversion::Double::SignificandSizeForOrderOfMagnitude):
(WTF::double_conversion::Double::Infinity):
(WTF::double_conversion::Double::NaN):
(WTF::double_conversion::Double::DiyFpToUint64):
* wtf/dtoa/fast-dtoa.cc: Added.
* wtf/dtoa/fast-dtoa.h: Added.
* wtf/dtoa/fixed-dtoa.cc: Added.
* wtf/dtoa/fixed-dtoa.h: Added.
* wtf/dtoa/strtod.cc: Added.
* wtf/dtoa/strtod.h: Added.
* wtf/dtoa/utils.h: Added.
(WTF::double_conversion::Max):
(WTF::double_conversion::Min):
(WTF::double_conversion::StrLength):
(WTF::double_conversion::Vector::Vector):
(WTF::double_conversion::Vector::SubVector):
(WTF::double_conversion::Vector::length):
(WTF::double_conversion::Vector::is_empty):
(WTF::double_conversion::Vector::start):
(WTF::double_conversion::Vector::operator[]):
(WTF::double_conversion::Vector::first):
(WTF::double_conversion::Vector::last):
(WTF::double_conversion::StringBuilder::StringBuilder):
(WTF::double_conversion::StringBuilder::~StringBuilder):
(WTF::double_conversion::StringBuilder::size):
(WTF::double_conversion::StringBuilder::position):
(WTF::double_conversion::StringBuilder::Reset):
(WTF::double_conversion::StringBuilder::AddCharacter):
(WTF::double_conversion::StringBuilder::AddString):
(WTF::double_conversion::StringBuilder::AddSubstring):
(WTF::double_conversion::StringBuilder::AddPadding):
(WTF::double_conversion::StringBuilder::Finalize):
(WTF::double_conversion::StringBuilder::is_finalized):
(WTF::double_conversion::BitCast):
* wtf/wtf.pri:

Source/WebCore:

No new tests.

Added new dtoa library at http://code.google.com/p/double-conversion/.
Replaced old call to dtoa.  The new library is much faster than the old one.
We still use the old dtoa for some stuff in WebCore as well as the old strtod,
but we can phase these out eventually as well.

* ForwardingHeaders/wtf/dtoa/double-conversion.h: Added.
* WebCore.vcproj/copyForwardingHeaders.cmd:
* css/CSSPrimitiveValue.cpp:
(WebCore::formatNumber):
* html/parser/HTMLParserIdioms.cpp:
(WebCore::serializeForNumberType):
* inspector/InspectorValues.cpp:
(WebCore::InspectorBasicValue::writeJSON):
* platform/graphics/Color.cpp:
(WebCore::Color::serialized):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94452 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add LayoutTest for the case where long strings are processed by the XSSAuditor.
https://bugs.webkit.org/show_bug.cgi?id=66580

Patch by Tom Sepez <tsepez@chromium.org> on 2011-09-02
Reviewed by Adam Barth.

* http/tests/security/xssAuditor/resources/xss-filter-bypass-long-string-reply.html: Added.
* http/tests/security/xssAuditor/xss-filter-bypass-long-string-expected.txt: Added.
* http/tests/security/xssAuditor/xss-filter-bypass-long-string.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94451 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Check for null context when reinitializing compositor
https://bugs.webkit.org/show_bug.cgi?id=67507

Reviewed by James Robinson.

* platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
(WebCore::CCSingleThreadProxy::recreateContextIfNeeded):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94450 268f45cc-cd09-0410-ab3c-d52691b4dbfc

DFG graph has no way of distinguishing or reconciling between static
and dynamic predictions
https://bugs.webkit.org/show_bug.cgi?id=67343

Reviewed by Gavin Barraclough.

PredictedType now stores the source of the prediction.  Merging predictions,
which was previously done with a bitwise or, is now done via the
mergePredictions (equivalent to |) and mergePrediction (equivalent to |=)
functions, which correctly handle combinations of static and dynamic.

This is performance-neutral, since all predictions are currently static and
so the code has no visible effects.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::set):
(JSC::DFG::ByteCodeParser::staticallyPredictArray):
(JSC::DFG::ByteCodeParser::staticallyPredictInt32):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::predict):
(JSC::DFG::Graph::predictGlobalVar):
* dfg/DFGNode.h:
(JSC::DFG::isArrayPrediction):
(JSC::DFG::isInt32Prediction):
(JSC::DFG::isDoublePrediction):
(JSC::DFG::isDynamicPrediction):
(JSC::DFG::mergePredictions):
(JSC::DFG::mergePrediction):
(JSC::DFG::makePrediction):
(JSC::DFG::Node::predict):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94449 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix 32bit build.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94448 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Some media layout tests fail because of ambiguous ordering of canplaythough event.
https://bugs.webkit.org/show_bug.cgi?id=67520

Reviewed by Eric Carlson.

The "canplaythrough" event can occur either before or after the "playing" event, causing layout tests
to fail for certain media engines (AVFoundation). The "canplaythrough" event check isn't adding anything
of value which isn't covered in other layout tests, so remove this event check.

* media/audio-play-event-expected.txt:
* media/audio-play-event.html:
* media/video-play-empty-events-expected.txt:
* media/video-play-empty-events.html:
* media/video-timeupdate-during-playback-expected.txt:
* media/video-timeupdate-during-playback.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94446 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Use bump allocator for initial property storage
https://bugs.webkit.org/show_bug.cgi?id=67494

Reviewed by Gavin Barraclough.

Switch to a bump allocator for the initial out of line
property storage.  This gives us slightly faster allocation
for short lived objects that need out of line storage at
the cost of an additional memcpy when the object survives
a GC pass.

No performance impact.

* JavaScriptCore.exp:
* heap/Heap.cpp:
(JSC::Heap::collect):
* heap/Heap.h:
(JSC::Heap::allocatePropertyStorage):
(JSC::Heap::inPropertyStorageNursary):
* heap/NewSpace.cpp:
(JSC::NewSpace::NewSpace):
* heap/NewSpace.h:
(JSC::NewSpace::resetPropertyStorageNursary):
(JSC::NewSpace::allocatePropertyStorage):
(JSC::NewSpace::inPropertyStorageNursary):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* runtime/JSObject.cpp:
(JSC::JSObject::allocatePropertyStorage):
* runtime/JSObject.h:
(JSC::JSObject::~JSObject):
(JSC::JSObject::putDirectInternal):
(JSC::JSObject::putDirectWithoutTransition):
(JSC::JSObject::putDirectFunctionWithoutTransition):
(JSC::JSObject::transitionTo):
(JSC::JSObject::visitChildrenDirect):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94445 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Added Subversion ignore for .pyc generated files.

* Scripts/webkitpy/layout_tests/models: Added property svn:ignore.
* Scripts/webkitpy/layout_tests/servers: Added property svn:ignore.
* Scripts/webkitpy/tool/servers: Added property svn:ignore.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94444 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Update expectations for tests with animations and reflections

* platform/chromium/test_expectations.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94443 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed.  Rolled DEPS.

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-02

* DEPS:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94442 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Enable testing on mac-ews
https://bugs.webkit.org/show_bug.cgi?id=67505

Reviewed by Eric Seidel.

This patch enables testing on the Mac EWS, which should help
contributors not turn the Mac bots red.

* Scripts/webkitpy/tool/commands/earlywarningsystem.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94441 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Update some chromium gpu baselines

* platform/chromium-gpu-cg-mac/compositing/images/content-image-change-expected.png: Added.
* platform/chromium-gpu-cg-mac/compositing/reflections/animation-inside-reflection-expected.png:
* platform/chromium-gpu-win/compositing/images/content-image-change-expected.png: Added.
* platform/chromium-gpu-win/compositing/reflections/animation-inside-reflection-expected.png:
* platform/chromium/test_expectations.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94440 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove plug-in paths from web process sandbox
https://bugs.webkit.org/show_bug.cgi?id=67518

Reviewed by Adam Roben.

Plug-ins are never accessed from the web process, so remove plug-in paths from the sandbox profile.

* WebProcess/com.apple.WebProcess.sb:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94439 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Assertion/crash when running netscape-plugin-property-access-exception.html test
https://bugs.webkit.org/show_bug.cgi?id=67517

Reviewed by Adam Roben.

Make sure to initialize the NPVariant in case the plug-in returns true from NP_GetProperty,
but doesn't set the result NPVariant to anything.

* Shared/Plugins/NPObjectMessageReceiver.cpp:
(WebKit::NPObjectMessageReceiver::getProperty):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94438 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=67451
Add a test for going back to a cached page after changing the device scale factor

Reviewed by Adam Roben.

New test DeviceScaleFactorOnBack.mm inherits from WebKitAgnosticTest.
* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/DeviceScaleFactorOnBack.mm: Added.
(TestWebKitAPI::DeviceScaleFactorOnBack::url):
(TestWebKitAPI::DeviceScaleFactorOnBack::didLoadURL):
(TestWebKitAPI::DeviceScaleFactorOnBack::createWindow):
(TestWebKitAPI::DeviceScaleFactorOnBack::initializeView):
(TestWebKitAPI::DeviceScaleFactorOnBack::runTest):
(TestWebKitAPI::TEST_F):

Added new function to WebKitAgnosticTest to goBack. Separated
waitForLoadToFinish() into its own function (instead of being a part of
loadAndWaitUntilFinished()) so that it can be called from goBack as
well. Also added initializeView() so we can set the cache model.
* TestWebKitAPI/mac/WebKitAgnosticTest.h:
(TestWebKitAPI::WebKitAgnosticTest::initializeView):
* TestWebKitAPI/mac/WebKitAgnosticTest.mm:
(TestWebKitAPI::WebKitAgnosticTest::WebKitAgnosticTest):
(TestWebKitAPI::WebKitAgnosticTest::runWebKit1Test):
(TestWebKitAPI::WebKitAgnosticTest::runWebKit2Test):
(TestWebKitAPI::WebKitAgnosticTest::loadURL):
(TestWebKitAPI::WebKitAgnosticTest::goBack):
(TestWebKitAPI::WebKitAgnosticTest::waitForLoadToFinish):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94437 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Flaky Test: http/tests/appcache/origin-usage.html
        https://bugs.webkit.org/show_bug.cgi?id=60928

        Reviewed by Joseph Pecoraro.

        Not sure if it was actually flaky anywhere, but it's failing for me on Lion consistently.

        * http/tests/appcache/origin-usage-expected.txt:
        * http/tests/appcache/origin-usage.html:
        Increase the range for success. It's OK because data is added in larger chunks anyway.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94436 268f45cc-cd09-0410-ab3c-d52691b4dbfc

The private browsing state isn't saved when it changes
https://bugs.webkit.org/show_bug.cgi?id=67508

Reviewed by Sam Weinig.

Source/WebKit2:

Store the new private browsing state so subsequent queries for it
will return the right value.

* PluginProcess/PluginControllerProxy.cpp:
(WebKit::PluginControllerProxy::privateBrowsingStateChanged):

LayoutTests:

Unskip private browsing plug-in tests, since WebKitTestRunner
now has layoutTestController.setPopupBlockingEnabled.

* platform/wk2/Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94435 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed; new baselines (Skia on Mac, next chunk of files)
Updated newer tests with reference images.
Deleted images with correct fallbacks.

* platform/chromium-mac/media/controls-after-reload-expected.txt: Added.
(remaining files omitted for brevity)

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94434 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove BeforeProcessEvent, it was never meant to be
https://bugs.webkit.org/show_bug.cgi?id=67493

Reviewed by Anders Carlsson.

BeforeProcessEvent was added, never hooked up, and never removed.
Now it is being removed.

* CodeGenerators.pri:
* DerivedSources.make:
* GNUmakefile.list.am:
* WebCore.gypi:
* WebCore.pro:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* dom/BeforeProcessEvent.cpp: Removed.
* dom/BeforeProcessEvent.h: Removed.
* dom/BeforeProcessEvent.idl: Removed.
* dom/DOMAllInOne.cpp:
* dom/Document.cpp:
(WebCore::Document::addListenerTypeIfNeeded):
* dom/Document.h:
* dom/EventNames.h:
* html/HTMLAttributeNames.in:
* html/HTMLScriptElement.cpp:
(WebCore::HTMLScriptElement::parseMappedAttribute):
* html/HTMLStyleElement.cpp:
(WebCore::HTMLStyleElement::parseMappedAttribute):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94433 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Build fix.

* DumpRenderTree/TestNetscapePlugIn/Tests/PrivateBrowsing.cpp:
(PrivateBrowsing::ScriptableObject::pluginTest):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94432 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Remove LayerRendererChromium references from the LayerChromium tree
https://bugs.webkit.org/show_bug.cgi?id=66430

Reviewed by James Robinson.

Source/WebCore:

Covered by existing tests.

Replace references to LayerRendererChromium in the LayerChromium tree
with references to LayerTreeHost. The LayerRendererChromium property
is no longer synced and instead is set recursively on the CCLayerImpl
tree during commit.

WebGLLayerChromium's paintRenderedResultsToCanvas function is
temporarily turned off for threaded compositing because it needs
access to the compositor context.

Previously, changing the layer renderer on a layer called cleanup
resources on that layer.  Now, call that explicitly clean up all
resources explicitly from the proxy when the layer renderer gets
created. This cleans up all of the ManagedTexture objects which may be
hanging onto stale GraphicsContext3D pointers.

* platform/graphics/chromium/LayerChromium.cpp:
(WebCore::LayerChromium::cleanupResourcesRecursive):
(WebCore::LayerChromium::setLayerTreeHost):
(WebCore::LayerChromium::pushPropertiesTo):
* platform/graphics/chromium/LayerChromium.h:
(WebCore::LayerChromium::layerTreeHost):
* platform/graphics/chromium/LayerRendererChromium.cpp:
(WebCore::LayerRendererChromium::drawLayers):
(WebCore::LayerRendererChromium::paintLayerContents):
* platform/graphics/chromium/RenderSurfaceChromium.cpp:
* platform/graphics/chromium/RenderSurfaceChromium.h:
* platform/graphics/chromium/TiledLayerChromium.cpp:
(WebCore::TiledLayerChromium::TiledLayerChromium):
(WebCore::TiledLayerChromium::updateTileSizeAndTilingOption):
(WebCore::TiledLayerChromium::setLayerTreeHost):
(WebCore::TiledLayerChromium::textureManager):
* platform/graphics/chromium/TiledLayerChromium.h:
* platform/graphics/chromium/VideoLayerChromium.cpp:
(WebCore::VideoLayerChromium::VideoLayerChromium):
(WebCore::VideoLayerChromium::cleanupResources):
(WebCore::VideoLayerChromium::setLayerTreeHost):
(WebCore::VideoLayerChromium::reserveTextures):
* platform/graphics/chromium/VideoLayerChromium.h:
* platform/graphics/chromium/WebGLLayerChromium.cpp:
(WebCore::WebGLLayerChromium::paintRenderedResultsToCanvas):
(WebCore::WebGLLayerChromium::setTextureUpdated):
(WebCore::WebGLLayerChromium::layerRendererContext):
* platform/graphics/chromium/WebGLLayerChromium.h:
* platform/graphics/chromium/cc/CCLayerImpl.cpp:
(WebCore::CCLayerImpl::setLayerRendererRecursive):
* platform/graphics/chromium/cc/CCLayerImpl.h:
* platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
(WebCore::CCLayerTreeHost::commitTo):
(WebCore::CCLayerTreeHost::didRecreateGraphicsContext):
* platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
(WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):

Source/WebKit/chromium:

Change references to LayerRendererChromium to CCLayerTreeHost.

* src/WebMediaPlayerClientImpl.cpp:
(WebKit::WebMediaPlayerClientImpl::acceleratedRenderingInUse):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94431 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move private browsing test to a PluginTest subclass
https://bugs.webkit.org/show_bug.cgi?id=67498

Reviewed by Darin Adler.

Tools:

* DumpRenderTree/DumpRenderTree.gypi:
* DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
* DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp:
(pluginGetProperty):
* DumpRenderTree/TestNetscapePlugIn/PluginObject.h:
* DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
(PluginTest::NPP_SetValue):
* DumpRenderTree/TestNetscapePlugIn/PluginTest.h:
* DumpRenderTree/TestNetscapePlugIn/Tests/PrivateBrowsing.cpp: Added.
(PrivateBrowsing::PrivateBrowsing):
(PrivateBrowsing::privateBrowsingEnabled):
(PrivateBrowsing::cachedPrivateBrowsingEnabled):
(PrivateBrowsing::ScriptableObject::hasProperty):
(PrivateBrowsing::ScriptableObject::getProperty):
(PrivateBrowsing::ScriptableObject::pluginTest):
(PrivateBrowsing::NPP_New):
(PrivateBrowsing::NPP_GetValue):
(PrivateBrowsing::NPP_SetValue):
* DumpRenderTree/TestNetscapePlugIn/main.cpp:
(NPP_New):
(NPP_SetValue):
* DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
* DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
* GNUmakefile.am:

LayoutTests:

Set the 'test' attribute to 'private-browsing'.

* plugins/private-browsing-mode-2.html:
* plugins/private-browsing-mode.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94430 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Unreviewed, update expectations after r94420.

* platform/chromium-win-xp/fast/css/getComputedStyle/computed-style-expected.txt: Copied from LayoutTests/platform/chromium-win/fast/css/getComputedStyle/computed-style-expected.txt.
* platform/chromium-win-xp/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt: Copied from LayoutTests/platform/chromium-win/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt.
* platform/chromium-win-xp/svg/css/getComputedStyle-basic-expected.txt: Copied from LayoutTests/platform/chromium-win/svg/css/getComputedStyle-basic-expected.txt.
* platform/chromium-win/fast/borders/border-image-repeat-expected.png: Added.
* platform/chromium-win/fast/borders/border-image-repeat-expected.txt: Added.
* platform/chromium-win/fast/css/getComputedStyle/computed-style-expected.txt:
* platform/chromium-win/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* platform/chromium-win/svg/css/getComputedStyle-basic-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94429 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Build fix.

        * platform/network/mac/CookieStorageMac.mm: (WebCore::setCookieStoragePrivateBrowsingEnabled):
        Can't use BUILDING_ON_SNOW_LEOPARD without defined() when not on Snow Leopard.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94428 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94421.
http://trac.webkit.org/changeset/94421
https://bugs.webkit.org/show_bug.cgi?id=67496

Broke a number of tests on Chromium builders (including the
"cr-linux" EWS bot) (Requested by apavlov on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-02

* accessibility/AXObjectCache.cpp:
(WebCore::nodeHasRole):
* accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
(webkit_accessible_get_name):
* dom/Document.cpp:
(WebCore::Document::buildAccessKeyMap):
(WebCore::Document::recalcStyleSelector):
* dom/Element.cpp:
(WebCore::Element::baseURI):
(WebCore::Element::formatForDebugger):
(WebCore::Element::spellcheckAttributeState):
* dom/NameNodeList.cpp:
(WebCore::NameNodeList::nodeMatches):
* editing/ApplyStyleCommand.cpp:
(WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
* editing/SplitElementCommand.cpp:
(WebCore::SplitElementCommand::doUnapply):
* editing/markup.cpp:
(WebCore::shouldIncludeWrapperForFullySelectedRoot):
(WebCore::createMarkup):
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::draggable):
(WebCore::HTMLAnchorElement::href):
(WebCore::HTMLAnchorElement::name):
(WebCore::HTMLAnchorElement::target):
(WebCore::HTMLAnchorElement::sendPings):
(WebCore::HTMLAnchorElement::handleClick):
* html/HTMLAppletElement.cpp:
(WebCore::HTMLAppletElement::createRenderer):
* html/HTMLAreaElement.cpp:
(WebCore::HTMLAreaElement::target):
* html/HTMLBodyElement.cpp:
(WebCore::HTMLBodyElement::aLink):
(WebCore::HTMLBodyElement::bgColor):
(WebCore::HTMLBodyElement::link):
(WebCore::HTMLBodyElement::text):
(WebCore::HTMLBodyElement::vLink):
(WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
* html/HTMLButtonElement.cpp:
(WebCore::HTMLButtonElement::value):
* html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::reset):
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::checkForNameMatch):
(WebCore::HTMLCollection::updateNameCache):
* html/HTMLDocument.cpp:
(WebCore::HTMLDocument::dir):
* html/HTMLElement.cpp:
(WebCore::HTMLElement::parseMappedAttribute):
(WebCore::HTMLElement::draggable):
(WebCore::HTMLElement::title):
(WebCore::setHasDirAutoFlagRecursively):
(WebCore::HTMLElement::directionalityIfhasDirAutoAttribute):
(WebCore::HTMLElement::adjustDirectionalityIfNeededAfterChildAttributeChanged):
(WebCore::HTMLElement::adjustDirectionalityIfNeededAfterChildrenChanged):
* html/HTMLEmbedElement.cpp:
(WebCore::HTMLEmbedElement::updateWidget):
(WebCore::HTMLEmbedElement::insertedIntoDocument):
(WebCore::HTMLEmbedElement::addSubresourceAttributeURLs):
* html/HTMLFormCollection.cpp:
(WebCore::HTMLFormCollection::getNamedFormItem):
(WebCore::HTMLFormCollection::updateNameCache):
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::autofocus):
(WebCore::HTMLFormControlElement::updateVisibleValidationMessage):
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::name):
(WebCore::HTMLFormElement::action):
(WebCore::HTMLFormElement::method):
(WebCore::HTMLFormElement::target):
* html/HTMLFrameElement.cpp:
(WebCore::HTMLFrameElement::noResize):
* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::setNameAndOpenURL):
(WebCore::HTMLFrameElementBase::location):
(WebCore::HTMLFrameElementBase::allowFullScreen):
* html/HTMLHtmlElement.cpp:
(WebCore::HTMLHtmlElement::insertedByParser):
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::altText):
(WebCore::HTMLImageElement::width):
(WebCore::HTMLImageElement::height):
(WebCore::HTMLImageElement::alt):
(WebCore::HTMLImageElement::draggable):
(WebCore::HTMLImageElement::src):
(WebCore::HTMLImageElement::addSubresourceAttributeURLs):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::finishParsingChildren):
(WebCore::HTMLInputElement::altText):
(WebCore::HTMLInputElement::reset):
(WebCore::HTMLInputElement::searchEventsShouldBeDispatched):
(WebCore::HTMLInputElement::isSpeechEnabled):
* html/HTMLLabelElement.cpp:
(WebCore::HTMLLabelElement::control):
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::process):
(WebCore::HTMLLinkElement::href):
(WebCore::HTMLLinkElement::rel):
(WebCore::HTMLLinkElement::target):
(WebCore::HTMLLinkElement::type):
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::imageElement):
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::attributeChanged):
(WebCore::HTMLMediaElement::insertedIntoDocument):
* html/HTMLMetaElement.cpp:
(WebCore::HTMLMetaElement::content):
(WebCore::HTMLMetaElement::httpEquiv):
(WebCore::HTMLMetaElement::name):
* html/HTMLMeterElement.cpp:
(WebCore::HTMLMeterElement::min):
(WebCore::HTMLMeterElement::max):
(WebCore::HTMLMeterElement::value):
(WebCore::HTMLMeterElement::low):
(WebCore::HTMLMeterElement::high):
(WebCore::HTMLMeterElement::optimum):
* html/HTMLNameCollection.cpp:
(WebCore::HTMLNameCollection::itemAfter):
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::updateWidget):
(WebCore::HTMLObjectElement::containsJavaApplet):
(WebCore::HTMLObjectElement::addSubresourceAttributeURLs):
* html/HTMLOptGroupElement.cpp:
(WebCore::HTMLOptGroupElement::groupLabelText):
* html/HTMLProgressElement.cpp:
(WebCore::HTMLProgressElement::max):
* html/HTMLScriptElement.cpp:
(WebCore::HTMLScriptElement::sourceAttributeValue):
(WebCore::HTMLScriptElement::charsetAttributeValue):
(WebCore::HTMLScriptElement::typeAttributeValue):
(WebCore::HTMLScriptElement::languageAttributeValue):
(WebCore::HTMLScriptElement::forAttributeValue):
(WebCore::HTMLScriptElement::eventAttributeValue):
* html/HTMLSourceElement.cpp:
(WebCore::HTMLSourceElement::media):
(WebCore::HTMLSourceElement::type):
* html/HTMLStyleElement.cpp:
(WebCore::HTMLStyleElement::media):
(WebCore::HTMLStyleElement::type):
* html/HTMLTableCellElement.cpp:
(WebCore::HTMLTableCellElement::abbr):
(WebCore::HTMLTableCellElement::axis):
(WebCore::HTMLTableCellElement::headers):
(WebCore::HTMLTableCellElement::scope):
(WebCore::HTMLTableCellElement::addSubresourceAttributeURLs):
* html/HTMLTableColElement.cpp:
(WebCore::HTMLTableColElement::width):
* html/HTMLTableElement.cpp:
(WebCore::HTMLTableElement::rules):
(WebCore::HTMLTableElement::summary):
(WebCore::HTMLTableElement::addSubresourceAttributeURLs):
* html/HTMLTableSectionElement.cpp:
(WebCore::HTMLTableSectionElement::align):
(WebCore::HTMLTableSectionElement::ch):
(WebCore::HTMLTableSectionElement::chOff):
(WebCore::HTMLTableSectionElement::vAlign):
* html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::maxLength):
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::strippedPlaceholder):
(WebCore::HTMLTextFormControlElement::isPlaceholderEmpty):
* html/HTMLTrackElement.cpp:
(WebCore::HTMLTrackElement::src):
(WebCore::HTMLTrackElement::kind):
(WebCore::HTMLTrackElement::srclang):
(WebCore::HTMLTrackElement::label):
(WebCore::HTMLTrackElement::isDefault):
(WebCore::HTMLTrackElement::load):
* html/HTMLVideoElement.cpp:
(WebCore::HTMLVideoElement::width):
(WebCore::HTMLVideoElement::height):
* html/StepRange.cpp:
(WebCore::StepRange::StepRange):
* html/shadow/TextControlInnerElements.cpp:
(WebCore::InputFieldSpeechButtonElement::startSpeechInput):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::buildObjectForFrame):
* loader/FormSubmission.cpp:
(WebCore::FormSubmission::create):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::updateFromElement):
* page/Frame.cpp:
(WebCore::Frame::matchLabelsAgainstElement):
* page/PageSerializer.cpp:
(WebCore::PageSerializer::serializeFrame):
* page/mac/FrameMac.mm:
(WebCore::Frame::matchLabelsAgainstElement):
* platform/chromium/ClipboardChromium.cpp:
(WebCore::writeImageToDataObject):
* platform/chromium/PasteboardChromium.cpp:
(WebCore::Pasteboard::writeImage):
* platform/gtk/PasteboardGtk.cpp:
(WebCore::getURLForImageNode):
* platform/mac/HTMLConverter.mm:
(fileWrapperForElement):
* platform/win/ClipboardWin.cpp:
(WebCore::writeImageToDataObject):
(WebCore::ClipboardWin::declareAndWriteDragImage):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::altDisplayString):
(WebCore::HitTestResult::absoluteImageURL):
(WebCore::HitTestResult::absoluteLinkURL):
* rendering/RenderDetails.cpp:
(WebCore::RenderDetails::isOpen):
* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::itemAccessibilityText):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::addPDFURLRect):
* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::computePreferredLogicalWidths):
* rendering/RenderTextControlSingleLine.cpp:
(WebCore::RenderTextControlSingleLine::autosaveName):
* rendering/RenderVideo.cpp:
(WebCore::RenderVideo::calculateIntrinsicSize):
* rendering/mathml/RenderMathMLFenced.cpp:
(WebCore::RenderMathMLFenced::updateFromElement):
* rendering/mathml/RenderMathMLFraction.cpp:
(WebCore::RenderMathMLFraction::updateFromElement):
* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::updateFromElement):
* svg/SVGFontData.cpp:
(WebCore::SVGFontData::applySVGGlyphSelection):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94427 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    REGRESSION (r94093): Private browsing doesn't start with a clean state on Snow Leopard
        https://bugs.webkit.org/show_bug.cgi?id=67356

        Reviewed by Darin Adler.

        * platform/network/mac/CookieStorageMac.mm: (WebCore::setCookieStoragePrivateBrowsingEnabled):
        Don't enable old-style private browsing when using sessions - it would take precedence over
        session cookie storage on Snow Leopard.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94426 268f45cc-cd09-0410-ab3c-d52691b4dbfc

BORDER attribute percent with the input image tag not working.
https://bugs.webkit.org/show_bug.cgi?id=66467

Patch by Mihnea Ovidenie <mihnea@adobe.com> on 2011-09-02
Reviewed by Simon Fraser.

Source/WebCore:

This patch fixes 2 issues regarding the border attribute of an input image element.
1. The border attribute, if specified, is now taken into account and the border of the input image element is displayed.
2. If the border attribute contains percent, the border is displayed.
The value of the border attribute for input image element is now parsed according to the rules for parsing non-negative integers.
This implies that when percent is specified in the border attribute, parsing takes place and the percent is ignored.
If after parsing, the value of the border is greater than zero, the border of the input image element is displayed.

* html/HTMLElement.cpp:
(WebCore::parseBorderWidthAttribute):
(WebCore::HTMLElement::applyBorderAttribute):
* html/HTMLElement.h:
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::parseMappedAttribute):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::parseMappedAttribute):
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::parseMappedAttribute):

LayoutTests:

Test border-width-percent was modified with tests for input image element.
Expected results for input-image-alt-test were regenerated since an image input element
takes border attribute into account.
Also, mark the test as failure for chromium.

* fast/borders/border-width-percent-expected.txt:
* fast/borders/border-width-percent.html:
* platform/chromium/test_expectations.txt:
* platform/mac/fast/dom/HTMLInputElement/input-image-alt-text-expected.png:
* platform/mac/fast/dom/HTMLInputElement/input-image-alt-text-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94425 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Implement the Event constructor for V8.
https://bugs.webkit.org/show_bug.cgi?id=66756

Patch by Kentaro Hara <haraken@google.com> on 2011-09-02
Reviewed by Adam Barth.

Source/WebCore:

The spec of the Event constructor is here:
http://dvcs.w3.org/hg/domcore/raw-file/tip/Overview.html#concept-event-constructor
This patch implements the Event constructor for V8 in V8EventConstructors.cpp,
similar to the implementation for JSC in JSEventConstructors.cpp.

* WebCore.gypi: Added V8EventConstructors.cpp.
* WebCore.pro: Ditto.
* bindings/scripts/CodeGeneratorV8.pm:
* bindings/v8/OptionsObject.cpp:
(WebCore::OptionsObject::getKeyDouble): Returns a value of type double corresponding to a given key.
* bindings/v8/OptionsObject.h:
(WebCore::OptionsObject::getKeyValue): Returns a value corresponding to a given key.
* bindings/v8/custom/V8EventConstructors.cpp: Added.
(WebCore::constructV8Event): AllowAllocation::current() means that a DOM object created by WebCore is going to be just wrapped into a V8 object. In this case, we skip the code of constructorCallback().
* dom/Event.idl: Added |V8CustomConstructor|.

LayoutTests:

* platform/chromium/test_expectations.txt: Unskip fast/events/constructors/event-constructors.html.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94424 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[v8] Use size_t instead of unsigned when iterating over Vector in V8DOMStringMap
https://bugs.webkit.org/show_bug.cgi?id=67484

Reviewed by Yury Semikhatsky.

No new tests, minor cleanup.

* bindings/v8/custom/V8DOMStringMapCustom.cpp:
(WebCore::V8DOMStringMap::namedPropertyEnumerator):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94423 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94404.
http://trac.webkit.org/changeset/94404
https://bugs.webkit.org/show_bug.cgi?id=67490

"Patch is wrong, new API needs two reviewers, we are already
working on how to add notifications elsewhere" (Requested by
xan_ on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-02

* bindings/gobject/GNUmakefile.am:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94422 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Use fastGetAttribute() and fastHasAttribute() where appropriate.
https://bugs.webkit.org/show_bug.cgi?id=67394

Reviewed by Darin Adler.

Change call sites that don't check the "style" or SVG animatable
attributes to use fastGetAttribute()/fastHasAttribute() instead
of getAttribute()/hasAttribute().

No new tests, this is a minor performance optimization.

* accessibility/AXObjectCache.cpp:
(WebCore::nodeHasRole):
* accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
(webkit_accessible_get_name):
* dom/Document.cpp:
(WebCore::Document::buildAccessKeyMap):
(WebCore::Document::recalcStyleSelector):
* dom/Element.cpp:
(WebCore::Element::baseURI):
(WebCore::Element::formatForDebugger):
(WebCore::Element::spellcheckAttributeState):
* dom/NameNodeList.cpp:
(WebCore::NameNodeList::nodeMatches):
* editing/ApplyStyleCommand.cpp:
(WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
* editing/SplitElementCommand.cpp:
(WebCore::SplitElementCommand::doUnapply):
* editing/markup.cpp:
(WebCore::shouldIncludeWrapperForFullySelectedRoot):
(WebCore::createMarkup):
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::draggable):
(WebCore::HTMLAnchorElement::href):
(WebCore::HTMLAnchorElement::name):
(WebCore::HTMLAnchorElement::target):
(WebCore::HTMLAnchorElement::sendPings):
(WebCore::HTMLAnchorElement::handleClick):
* html/HTMLAppletElement.cpp:
(WebCore::HTMLAppletElement::createRenderer):
* html/HTMLAreaElement.cpp:
(WebCore::HTMLAreaElement::target):
* html/HTMLBodyElement.cpp:
(WebCore::HTMLBodyElement::aLink):
(WebCore::HTMLBodyElement::bgColor):
(WebCore::HTMLBodyElement::link):
(WebCore::HTMLBodyElement::text):
(WebCore::HTMLBodyElement::vLink):
(WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
* html/HTMLButtonElement.cpp:
(WebCore::HTMLButtonElement::value):
* html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::reset):
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::checkForNameMatch):
(WebCore::HTMLCollection::updateNameCache):
* html/HTMLDocument.cpp:
(WebCore::HTMLDocument::dir):
* html/HTMLElement.cpp:
(WebCore::HTMLElement::parseMappedAttribute):
(WebCore::HTMLElement::draggable):
(WebCore::HTMLElement::title):
(WebCore::setHasDirAutoFlagRecursively):
(WebCore::HTMLElement::directionalityIfhasDirAutoAttribute):
(WebCore::HTMLElement::adjustDirectionalityIfNeededAfterChildAttributeChanged):
(WebCore::HTMLElement::adjustDirectionalityIfNeededAfterChildrenChanged):
* html/HTMLEmbedElement.cpp:
(WebCore::HTMLEmbedElement::updateWidget):
(WebCore::HTMLEmbedElement::insertedIntoDocument):
(WebCore::HTMLEmbedElement::addSubresourceAttributeURLs):
* html/HTMLFormCollection.cpp:
(WebCore::HTMLFormCollection::getNamedFormItem):
(WebCore::HTMLFormCollection::updateNameCache):
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::autofocus):
(WebCore::HTMLFormControlElement::updateVisibleValidationMessage):
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::name):
(WebCore::HTMLFormElement::action):
(WebCore::HTMLFormElement::method):
(WebCore::HTMLFormElement::target):
* html/HTMLFrameElement.cpp:
(WebCore::HTMLFrameElement::noResize):
* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::setNameAndOpenURL):
(WebCore::HTMLFrameElementBase::location):
(WebCore::HTMLFrameElementBase::allowFullScreen):
* html/HTMLHtmlElement.cpp:
(WebCore::HTMLHtmlElement::insertedByParser):
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::altText):
(WebCore::HTMLImageElement::width):
(WebCore::HTMLImageElement::height):
(WebCore::HTMLImageElement::alt):
(WebCore::HTMLImageElement::draggable):
(WebCore::HTMLImageElement::src):
(WebCore::HTMLImageElement::addSubresourceAttributeURLs):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::finishParsingChildren):
(WebCore::HTMLInputElement::altText):
(WebCore::HTMLInputElement::reset):
(WebCore::HTMLInputElement::searchEventsShouldBeDispatched):
(WebCore::HTMLInputElement::isSpeechEnabled):
* html/HTMLLabelElement.cpp:
(WebCore::HTMLLabelElement::control):
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::process):
(WebCore::HTMLLinkElement::href):
(WebCore::HTMLLinkElement::rel):
(WebCore::HTMLLinkElement::target):
(WebCore::HTMLLinkElement::type):
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::imageElement):
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::attributeChanged):
(WebCore::HTMLMediaElement::insertedIntoDocument):
* html/HTMLMetaElement.cpp:
(WebCore::HTMLMetaElement::content):
(WebCore::HTMLMetaElement::httpEquiv):
(WebCore::HTMLMetaElement::name):
* html/HTMLMeterElement.cpp:
(WebCore::HTMLMeterElement::min):
(WebCore::HTMLMeterElement::max):
(WebCore::HTMLMeterElement::value):
(WebCore::HTMLMeterElement::low):
(WebCore::HTMLMeterElement::high):
(WebCore::HTMLMeterElement::optimum):
* html/HTMLNameCollection.cpp:
(WebCore::HTMLNameCollection::itemAfter):
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::updateWidget):
(WebCore::HTMLObjectElement::containsJavaApplet):
(WebCore::HTMLObjectElement::addSubresourceAttributeURLs):
* html/HTMLOptGroupElement.cpp:
(WebCore::HTMLOptGroupElement::groupLabelText):
* html/HTMLProgressElement.cpp:
(WebCore::HTMLProgressElement::max):
* html/HTMLScriptElement.cpp:
(WebCore::HTMLScriptElement::sourceAttributeValue):
(WebCore::HTMLScriptElement::charsetAttributeValue):
(WebCore::HTMLScriptElement::typeAttributeValue):
(WebCore::HTMLScriptElement::languageAttributeValue):
(WebCore::HTMLScriptElement::forAttributeValue):
(WebCore::HTMLScriptElement::eventAttributeValue):
* html/HTMLSourceElement.cpp:
(WebCore::HTMLSourceElement::media):
(WebCore::HTMLSourceElement::type):
* html/HTMLStyleElement.cpp:
(WebCore::HTMLStyleElement::media):
(WebCore::HTMLStyleElement::type):
* html/HTMLTableCellElement.cpp:
(WebCore::HTMLTableCellElement::abbr):
(WebCore::HTMLTableCellElement::axis):
(WebCore::HTMLTableCellElement::headers):
(WebCore::HTMLTableCellElement::scope):
(WebCore::HTMLTableCellElement::addSubresourceAttributeURLs):
* html/HTMLTableColElement.cpp:
(WebCore::HTMLTableColElement::width):
* html/HTMLTableElement.cpp:
(WebCore::HTMLTableElement::rules):
(WebCore::HTMLTableElement::summary):
(WebCore::HTMLTableElement::addSubresourceAttributeURLs):
* html/HTMLTableSectionElement.cpp:
(WebCore::HTMLTableSectionElement::align):
(WebCore::HTMLTableSectionElement::ch):
(WebCore::HTMLTableSectionElement::chOff):
(WebCore::HTMLTableSectionElement::vAlign):
* html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::maxLength):
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::strippedPlaceholder):
(WebCore::HTMLTextFormControlElement::isPlaceholderEmpty):
* html/HTMLTrackElement.cpp:
(WebCore::HTMLTrackElement::src):
(WebCore::HTMLTrackElement::kind):
(WebCore::HTMLTrackElement::srclang):
(WebCore::HTMLTrackElement::label):
(WebCore::HTMLTrackElement::isDefault):
(WebCore::HTMLTrackElement::load):
* html/HTMLVideoElement.cpp:
(WebCore::HTMLVideoElement::width):
(WebCore::HTMLVideoElement::height):
* html/StepRange.cpp:
(WebCore::StepRange::StepRange):
* html/shadow/TextControlInnerElements.cpp:
(WebCore::InputFieldSpeechButtonElement::startSpeechInput):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::buildObjectForFrame):
* loader/FormSubmission.cpp:
(WebCore::FormSubmission::create):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::updateFromElement):
* page/Frame.cpp:
(WebCore::Frame::matchLabelsAgainstElement):
* page/PageSerializer.cpp:
(WebCore::PageSerializer::serializeFrame):
* page/mac/FrameMac.mm:
(WebCore::Frame::matchLabelsAgainstElement):
* platform/chromium/ClipboardChromium.cpp:
(WebCore::writeImageToDataObject):
* platform/chromium/PasteboardChromium.cpp:
(WebCore::Pasteboard::writeImage):
* platform/gtk/PasteboardGtk.cpp:
(WebCore::getURLForImageNode):
* platform/mac/HTMLConverter.mm:
(fileWrapperForElement):
* platform/win/ClipboardWin.cpp:
(WebCore::writeImageToDataObject):
(WebCore::ClipboardWin::declareAndWriteDragImage):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::altDisplayString):
(WebCore::HitTestResult::absoluteImageURL):
(WebCore::HitTestResult::absoluteLinkURL):
* rendering/RenderDetails.cpp:
(WebCore::RenderDetails::isOpen):
* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::itemAccessibilityText):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::addPDFURLRect):
* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::computePreferredLogicalWidths):
* rendering/RenderTextControlSingleLine.cpp:
(WebCore::RenderTextControlSingleLine::autosaveName):
* rendering/RenderVideo.cpp:
(WebCore::RenderVideo::calculateIntrinsicSize):
* rendering/mathml/RenderMathMLFenced.cpp:
(WebCore::RenderMathMLFenced::updateFromElement):
* rendering/mathml/RenderMathMLFraction.cpp:
(WebCore::RenderMathMLFraction::updateFromElement):
* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::updateFromElement):
* svg/SVGFontData.cpp:
(WebCore::SVGFontData::applySVGGlyphSelection):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94421 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=67431

Implement border-image-repeat. Similar to how border-image-slice was implemented, the parsing of the two
repeat values has been moved into separate functions. The value is represented as a Pair (similar to how we
handle border radius).

Reviewed by Beth Dakin.

Added fast/borders/border-image-repeat.html.

Source/WebCore:

* css/CSSBorderImageValue.cpp:
(WebCore::CSSBorderImageValue::CSSBorderImageValue):
(WebCore::CSSBorderImageValue::cssText):
* css/CSSBorderImageValue.h:
(WebCore::CSSBorderImageValue::create):
Modified the CSSBorderImageValue (you're living on borrowed time, my friend!) to have a CSSValue that
contains a Pair.

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::valueForRepeatRule):
(WebCore::valueForNinePieceImageRepeat):
(WebCore::valueForNinePieceImage):
(WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
Add support for the new properties. Break out the value retrieval for the image repeat rules into its
own function, valueForNinePieceImageRepeat.

* css/CSSParser.cpp:
(WebCore::CSSParser::parseValue):
(WebCore::BorderImageParseContext::BorderImageParseContext):
(WebCore::BorderImageParseContext::allowRepeat):
(WebCore::BorderImageParseContext::commitSlice):
(WebCore::BorderImageParseContext::commitSlash):
(WebCore::BorderImageParseContext::commitWidth):
(WebCore::BorderImageParseContext::commitRepeat):
(WebCore::BorderImageParseContext::commitBorderImage):
(WebCore::CSSParser::parseBorderImage):
Modified the parsing of border image to call into parseBorderImageRepeat for the repeat values.

(WebCore::isBorderImageRepeatKeyword):
(WebCore::CSSParser::parseBorderImageRepeat):
The new parsing code for border-image-repeat is here. It will build up a CSSValue containing a Pair and
return the result.

* css/CSSParser.h:
* css/CSSPropertyNames.in:
Add the new properties.

* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::applyProperty):
(WebCore::CSSStyleSelector::mapNinePieceImage):
(WebCore::CSSStyleSelector::mapNinePieceImageRepeat):
* css/CSSStyleSelector.h:
The mapping into the front end is done the same way as border-image-slice. Factor out the image repeat rules
portion into mapNinePieceImageRepeat.

* platform/graphics/Image.cpp:
(WebCore::Image::drawTiled):
* platform/graphics/Image.h:
Add the new 'space' value as a valid image tiling rule. It's not yet supported and, like the 'round' value,
is just mapped to 'repeat' for now.

* rendering/style/NinePieceImage.h:
(WebCore::NinePieceImage::copyRepeatFrom):
Helper for copying only the repeat rules from another NinePieceImage.

LayoutTests:

* fast/borders/border-image-repeat.html: Added.
* fast/css/getComputedStyle/computed-style-expected.txt:
* fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* platform/mac/fast/borders/border-image-repeat-expected.png: Added.
* platform/mac/fast/borders/border-image-repeat-expected.txt: Added.
* svg/css/getComputedStyle-basic-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94420 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore: [Qt] number input not rendering spin buttons properly in RTL direction
https://bugs.webkit.org/show_bug.cgi?id=67445

Properly render Qt's number input with RTL direction, and fix Plastique styling.

Patch by Jarred Nicholls <jarred@sencha.com> on 2011-09-02
Reviewed by Andreas Kling.

* platform/qt/RenderThemeQt.cpp:
(WebCore::RenderThemeQt::paintInnerSpinButton):

LayoutTests: [Qt] number input not rendering spin buttons properly in RTL direction
https://bugs.webkit.org/show_bug.cgi?id=67445

New baseline for Qt number input with RTL direction.

Patch by Jarred Nicholls <jarred@sencha.com> on 2011-09-02
Reviewed by Andreas Kling.

* platform/qt/fast/forms/input-appearance-number-rtl-expected.png:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94419 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore: Resetting media controls when the src is changed from a valid url to an
invalid url.
https://bugs.webkit.org/show_bug.cgi?id=64880

Patch by Arko Saha <nghq36@motorola.com> on 2011-09-02
Reviewed by Eric Carlson.

Test: media/media-controls-invalid-url.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::mediaLoadingFailed):

LayoutTests: Controls not reset when media element url changed from a valid url to an invalid url.
https://bugs.webkit.org/show_bug.cgi?id=64880

Patch by Arko Saha <nghq36@motorola.com> on 2011-09-02
Reviewed by Eric Carlson.

* media/media-controls-invalid-url-expected.txt: Added.
* media/media-controls-invalid-url.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94418 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WK2] Anchor elements doesn't get focus on TAB key press.
https://bugs.webkit.org/show_bug.cgi?id=66949

Patch by Ravi Phaneendra Kasibhatla <ravi.kasibhatla@motorola.com> on 2011-09-02
Reviewed by Adam Roben.

Setting the default property value of TabsToLinks to true
only for GTK platform since Win & Mac platforms doesn't want
it to be set to true by default.

* Shared/WebPreferencesStore.h:
Set the default value of key TabsToLinks to true for GTK platform only.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94417 268f45cc-cd09-0410-ab3c-d52691b4dbfc