2011-01-28 Johnny Ding <jnd@chromium.org>

[WebKit.git] / Source / WebCore / ChangeLog

2011-01-28  Johnny Ding  <jnd@chromium.org>

        Reviewed by Adam Barth.

        Gesture API: Don't use current gesture status to set "forceUserGesture" parameter when calling ScriptController::executeScript.
        The "forceUserGesture" parameter should be only set when you are definitely sure that the running script is from a hyper-link.
        https://bugs.webkit.org/show_bug.cgi?id=53244

        Test: fast/events/popup-blocked-from-iframe-src.html

        * bindings/ScriptControllerBase.cpp:
        (WebCore::ScriptController::executeIfJavaScriptURL):

2011-01-28  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Gavin Barraclough.

        Add various clampToInt() methods to MathExtras.h
        https://bugs.webkit.org/show_bug.cgi?id=52910

        Use clampToInteger() from MathExtras.h

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseCounter):

2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r77006 and r77020.
        http://trac.webkit.org/changeset/77006
        http://trac.webkit.org/changeset/77020
        https://bugs.webkit.org/show_bug.cgi?id=53360

        "Broke Windows tests" (Requested by rniwa on #webkit).

        * ForwardingHeaders/runtime/WriteBarrier.h: Removed.
        * WebCore.exp.in:
        * bindings/js/DOMWrapperWorld.h:
        * bindings/js/JSAudioConstructor.cpp:
        (WebCore::JSAudioConstructor::JSAudioConstructor):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::markDOMNodesForDocument):
        (WebCore::markDOMObjectWrapper):
        (WebCore::markDOMNodeWrapper):
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::markChildren):
        (WebCore::JSDOMGlobalObject::setInjectedScript):
        (WebCore::JSDOMGlobalObject::injectedScript):
        * bindings/js/JSDOMGlobalObject.h:
        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
        (WebCore::getDOMConstructor):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::setLocation):
        (WebCore::DialogHandler::dialogCreated):
        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
        (WebCore::JSDOMWindowShell::setWindow):
        (WebCore::JSDOMWindowShell::markChildren):
        (WebCore::JSDOMWindowShell::unwrappedObject):
        * bindings/js/JSDOMWindowShell.h:
        (WebCore::JSDOMWindowShell::window):
        (WebCore::JSDOMWindowShell::setWindow):
        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::createAccelerationObject):
        (WebCore::createRotationRateObject):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::JSEventListener):
        (WebCore::JSEventListener::markJSFunction):
        * bindings/js/JSEventListener.h:
        (WebCore::JSEventListener::jsFunction):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::setAll):
        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::JSImageConstructor):
        * bindings/js/JSImageDataCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
        (WebCore::JSJavaScriptCallFrame::scopeChain):
        (WebCore::JSJavaScriptCallFrame::scopeType):
        * bindings/js/JSNodeFilterCondition.cpp:
        (WebCore::JSNodeFilterCondition::markAggregate):
        (WebCore::JSNodeFilterCondition::acceptNode):
        * bindings/js/JSNodeFilterCondition.h:
        * bindings/js/JSNodeFilterCustom.cpp:
        * bindings/js/JSOptionConstructor.cpp:
        (WebCore::JSOptionConstructor::JSOptionConstructor):
        * bindings/js/JSSQLResultSetRowListCustom.cpp:
        (WebCore::JSSQLResultSetRowList::item):
        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::restore):
        * bindings/js/ScriptObject.cpp:
        (WebCore::ScriptGlobalObject::set):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::putProperty):
        * bindings/scripts/CodeGeneratorJS.pm:
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
        * bridge/qt/qt_runtime.h:
        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::invalidate):
        * bridge/runtime_root.h:
        * dom/Document.h:

2011-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by Eric Seidel.

        XSSFilter should log to the console when it blocks something
        https://bugs.webkit.org/show_bug.cgi?id=53354

        This patch refactors a bunch of methods in XSSFilter to return a bool
        indicating whether they blocked anything.  Using this bool, we decide
        whether to log to the console.  We're using the same log message as the
        XSSAuditor, but it seems likely we can improve this message in the
        future (especially by piping in the correct line number, which is now
        accessible via the parser).

        * html/parser/XSSFilter.cpp:
        (WebCore::HTMLNames::isNameOfInlineEventHandler):
        (WebCore::XSSFilter::filterToken):
        (WebCore::XSSFilter::filterTokenInitial):
        (WebCore::XSSFilter::filterTokenAfterScriptStartTag):
        (WebCore::XSSFilter::filterScriptToken):
        (WebCore::XSSFilter::filterObjectToken):
        (WebCore::XSSFilter::filterEmbedToken):
        (WebCore::XSSFilter::filterAppletToken):
        (WebCore::XSSFilter::filterMetaToken):
        (WebCore::XSSFilter::filterBaseToken):
        (WebCore::XSSFilter::eraseInlineEventHandlersIfInjected):
        * html/parser/XSSFilter.h:

2011-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by Daniel Bates.

        Wire up settings->xssAuditorEnabled to XSSFilter
        https://bugs.webkit.org/show_bug.cgi?id=53345

        * html/parser/XSSFilter.cpp:
        (WebCore::XSSFilter::XSSFilter):
        (WebCore::XSSFilter::filterToken):
        * html/parser/XSSFilter.h:

2011-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by Daniel Bates.

        Teach XSSFilter about <meta> and <base> tags
        https://bugs.webkit.org/show_bug.cgi?id=53339

        I'm not 100% sure we need to block <meta http-equiv>, but it seems
        prudent given how powerful that attribute is.  We definitely need to
        block injection of <base href> because that can redirect script tags
        that use relative URLs.

        * html/parser/XSSFilter.cpp:
        (WebCore::XSSFilter::filterToken):
        (WebCore::XSSFilter::filterMetaToken):
        (WebCore::XSSFilter::filterBaseToken):
        * html/parser/XSSFilter.h:

2011-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by Daniel Bates.

        Teach XSSFilter about <applet>
        https://bugs.webkit.org/show_bug.cgi?id=53338

        HTML5 is pretty light on information about how the <applet> tag works.
        According to this site:

        http://download.oracle.com/javase/1.4.2/docs/guide/misc/applet.html

        The "code" and "object" attributes are the essential attributes for
        determining which piece of Java to run.  We might need to expand to the
        codebase and archive attributes at some point, but hopefully code and
        object will be sufficient.

        * html/parser/XSSFilter.cpp:
        (WebCore::XSSFilter::filterToken):
        (WebCore::XSSFilter::filterAppletToken):
        * html/parser/XSSFilter.h:

2011-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by Daniel Bates.

        Teach the XSSFilter about object and embed tags
        https://bugs.webkit.org/show_bug.cgi?id=53336

        For <object> and <embed>, we filter out attribute values that either
        indicate which piece of media to load or which plugin to load.  In a
        perfect world, we'd only need to filter out the URLs of the media, but
        some plug-ins (like Flash) have lots of fun places you can hide the
        URL (e.g., the "movie" <param>).

        * html/parser/XSSFilter.cpp:
        (WebCore::XSSFilter::filterToken):
        (WebCore::XSSFilter::filterScriptToken):
        (WebCore::XSSFilter::filterObjectToken):
        (WebCore::XSSFilter::filterEmbedToken):
        (WebCore::XSSFilter::eraseAttributeIfInjected):
        * html/parser/XSSFilter.h:

2011-01-28  Oliver Hunt  <oliver@apple.com>

        Fix Qt build.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
        * bridge/qt/qt_runtime.h:

2011-01-28  Antti Koivisto  <antti@apple.com>

        Reviewed by Simon Fraser.

        CSS styles are shared based on uninitialized property values
        https://bugs.webkit.org/show_bug.cgi?id=53285
        
        Null test.

        * dom/NamedNodeMap.cpp:
        (WebCore::NamedNodeMap::mappedMapsEquivalent):

2011-01-27  Oliver Hunt  <oliver@apple.com>

        Reviewed by Geoffrey Garen.

        Convert markstack to a slot visitor API
        https://bugs.webkit.org/show_bug.cgi?id=53219

        Update WebCore to the new marking apis, correct bindings
        codegen. 

        * ForwardingHeaders/runtime/WriteBarrier.h: Added.
        * WebCore.exp.in:
        * bindings/js/DOMWrapperWorld.h:
        (WebCore::DOMWrapperWorld::globalData):
        * bindings/js/JSAudioConstructor.cpp:
        (WebCore::JSAudioConstructor::JSAudioConstructor):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::markDOMNodesForDocument):
        (WebCore::markDOMObjectWrapper):
        (WebCore::markDOMNodeWrapper):
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::markChildren):
        (WebCore::JSDOMGlobalObject::setInjectedScript):
        (WebCore::JSDOMGlobalObject::injectedScript):
        * bindings/js/JSDOMGlobalObject.h:
        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
        (WebCore::getDOMConstructor):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::setLocation):
        (WebCore::DialogHandler::dialogCreated):
        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
        (WebCore::JSDOMWindowShell::setWindow):
        (WebCore::JSDOMWindowShell::markChildren):
        (WebCore::JSDOMWindowShell::unwrappedObject):
        * bindings/js/JSDOMWindowShell.h:
        (WebCore::JSDOMWindowShell::window):
        (WebCore::JSDOMWindowShell::setWindow):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::JSEventListener):
        (WebCore::JSEventListener::markJSFunction):
        * bindings/js/JSEventListener.h:
        (WebCore::JSEventListener::jsFunction):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::setAll):
        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::JSImageConstructor):
        * bindings/js/JSImageDataCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
        (WebCore::JSJavaScriptCallFrame::scopeChain):
        (WebCore::JSJavaScriptCallFrame::scopeType):
        * bindings/js/JSNodeFilterCondition.cpp:
        (WebCore::JSNodeFilterCondition::markAggregate):
        (WebCore::JSNodeFilterCondition::acceptNode):
        * bindings/js/JSNodeFilterCondition.h:
        * bindings/js/JSNodeFilterCustom.cpp:
        * bindings/js/JSOptionConstructor.cpp:
        (WebCore::JSOptionConstructor::JSOptionConstructor):
        * bindings/js/JSSQLResultSetRowListCustom.cpp:
        (WebCore::JSSQLResultSetRowList::item):
        * bindings/js/ScriptCachedFrameData.cpp:
        (WebCore::ScriptCachedFrameData::restore):
        * bindings/js/ScriptObject.cpp:
        (WebCore::ScriptGlobalObject::set):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::putProperty):
        * bindings/scripts/CodeGeneratorJS.pm:
        * dom/Document.h:

2011-01-28  Sam Weinig  <sam@webkit.org>

        Reviewed by Anders Carlsson.

        Keyboard scrolling doesn’t work in WebKit2
        <rdar://problem/8909672>

        * platform/mac/ScrollAnimatorMac.mm:
        (-[ScrollAnimationHelperDelegate convertSizeToBacking:]):
        (-[ScrollAnimationHelperDelegate convertSizeFromBacking:]):
        Add additional necessary delegate methods.

2011-01-29  Darin Adler  <darin@apple.com>

        Reviewed by Dan Bernstein.

        Re-land this patch with the missing null check that caused crashes in layout tests.

        Changing cursor style has no effect until the mouse moves
        https://bugs.webkit.org/show_bug.cgi?id=14344
        rdar://problem/7563712

        No tests added because we don't have infrastructure for testing actual cursor
        changes (as opposed to cursor style computation) at this time. We might add it later.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon): Added.
        * page/EventHandler.h: Ditto.

        * rendering/RenderObject.cpp:
        (WebCore::areNonIdenticalCursorListsEqual): Added.
        (WebCore::areCursorsEqual): Added.
        (WebCore::RenderObject::styleDidChange): Call dispatchFakeMouseMoveEventSoon if
        cursor styles changed.

2011-01-28  Justin Schuh  <jschuh@chromium.org>

        Reviewed by Eric Seidel.

        We should hold RefPtrs to SVG font faces
        https://bugs.webkit.org/show_bug.cgi?id=53270

        Test: svg/custom/use-multiple-on-nested-disallowed-font.html

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::getFontData):
        * css/CSSFontFaceSource.h:
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::associatedFontElement):
        * svg/SVGFontFaceElement.h:

2011-01-28  Zhenyao Mo  <zmo@google.com>

        Reviewed by Kenneth Russell.

        uniformN*v should generate INVALID_VALUE of the array size is not a multiple of N
        https://bugs.webkit.org/show_bug.cgi?id=53306

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::validateUniformMatrixParameters):

2011-01-28  Tom Sepez  <tsepez@chromium.org>

        Reviewed by Eric Seidel.

        NULL pointer crash in TextIterator::handleTextBox()
        https://bugs.webkit.org/show_bug.cgi?id=53267

        Test: fast/css/rtl-nth-child-first-letter-crash.html

        * editing/TextIterator.cpp:
        (WebCore::TextIterator::handleTextBox):

2011-01-28  Adrienne Walker  <enne@google.com>

        Reviewed by Kenneth Russell.

        [chromium] Remove a spurious diagnostic CRASH check.
        https://bugs.webkit.org/show_bug.cgi?id=52379

        * platform/graphics/chromium/LayerTilerChromium.cpp:
        (WebCore::LayerTilerChromium::invalidateRect):

2011-01-28  Dan Bernstein  <mitz@apple.com>

        Reviewed by Sam Weinig.

        <rdar://problem/4761512> <select> can't display right-to-left (rtl) languages
        https://bugs.webkit.org/show_bug.cgi?id=19785

        Changed <select> pop-up menus on Mac OS X Snow Leopard and later to have their items aligned in the
        direction corresponding to the writing direction of the <select> element, with the checkmarks
        on the "start" side, and use the <option>'s writing direction rather than "natural". Made the
        pop-up button match the menu by adding a Chrome boolean function, selectItemAlignmentFollowsMenuWritingDirection(),
        which returns true for this pop-up behavior.

        * loader/EmptyClients.h:
        (WebCore::EmptyChromeClient::selectItemAlignmentFollowsMenuWritingDirection): Added.
        * manual-tests/pop-up-alignment-and-direction.html: Added.
        * page/Chrome.cpp:
        (WebCore::Chrome::selectItemAlignmentFollowsMenuWritingDirection): Added. Calls through to the
        client.
        * page/Chrome.h:
        * page/ChromeClient.h:
        * platform/PopupMenuStyle.h:
        (WebCore::PopupMenuStyle::PopupMenuStyle): Added hasTextDirectionOverride parameter and member
        variable initialization.
        (WebCore::PopupMenuStyle::hasTextDirectionOverride): Added this accessor.
        * platform/mac/PopupMenuMac.mm:
        (WebCore::PopupMenuMac::populate): Set the pop-up's layout direction and items' text alignment
        to match the menu's writing direction. Set items' writing direction and direction override
        according to their styles.
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::RenderMenuList): Removed unncesaary initialization of a smart pointer.
        (WebCore::RenderMenuList::adjustInnerStyle): If the alignment of items in the menu follows the
        menu's writing direction, use that alignment for the button as well. Also in this mode, use the
        item's writing direction and override setting.
        (WebCore::RenderMenuList::setTextFromOption): Store the option element's style.
        (WebCore::RenderMenuList::itemStyle): Pass the text direction override value.
        (WebCore::RenderMenuList::menuStyle): Ditto. Also use the button's direction, not the inner text's.
        * rendering/RenderMenuList.h:
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::menuStyle): Pass the text direction override value.

2011-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by Daniel Bates.

        Teach XSSFilter how to filter <script> elements
        https://bugs.webkit.org/show_bug.cgi?id=53279

        This patch adds the ability for the XSSFilter to block injected
        <script> elements.  Handling script elements is slightly subtle because
        these elements act very differently depending on whether they have a
        src attribute.
        
        In the "src case", which check whether the src attribute was present in
        the request.  In the "non-src case", we check whether the start tag and
        the body of the script element was included in the request.  Checking
        for the whole start tag means we miss out on some attribute splitting
        attacks inside of script tags, but that doesn't seem like that big a
        deal.

        This patch also introduces some amount of state into the XSSFilter
        because inline script elements span multiple tokens.  There's a lot of
        tuning and optimization left in these cases, some of which I've noted
        with FIXMEs.

        To test this patch, I played around with some of the existing
        XSSAuditor tests.  Hopefully I'll be able to run the test suite more
        systematically in the future.

        * html/parser/HTMLToken.h:
        (WebCore::HTMLToken::eraseCharacters):
        (WebCore::HTMLToken::eraseValueOfAttribute):
        * html/parser/XSSFilter.cpp:
        (WebCore::HTMLNames::hasName):
        (WebCore::HTMLNames::findAttributeWithName):
        (WebCore::HTMLNames::isNameOfScriptCarryingAttribute):
        (WebCore::XSSFilter::XSSFilter):
        (WebCore::XSSFilter::filterToken):
        (WebCore::XSSFilter::filterTokenAfterScriptStartTag):
        (WebCore::XSSFilter::filterScriptToken):
        (WebCore::XSSFilter::snippetForRange):
        (WebCore::XSSFilter::snippetForAttribute):
        * html/parser/XSSFilter.h:

2011-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by Daniel Bates.

        Sketch out new XSS filter design (disabled by default)
        https://bugs.webkit.org/show_bug.cgi?id=53205

        This patch adds a basic sketch of the new XSS filter design.  Rather
        than watching scripts as they execute, in this design, we watch tokens
        emitted by the tokenizer.  We then map the tokens directly back into
        input characters, which lets us skip all the complicated logic related
        to HTML entities and double-decoding of JavaScript URLs.

        This patch contains only the bare essentially machinery.  I'll add more
        in future patches and eventually remove the previous code once this
        code is up and running correctly.

        * Android.mk:
        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::HTMLDocumentParser):
        (WebCore::HTMLDocumentParser::pumpTokenizer):
        (WebCore::HTMLDocumentParser::sourceForToken):
        * html/parser/HTMLDocumentParser.h:
        * html/parser/XSSFilter.cpp: Added.
        * html/parser/XSSFilter.h: Added.

2011-01-28  Michael Saboff  <msaboff@apple.com>

        Reviewed by Geoffrey Garen.

        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
        https://bugs.webkit.org/show_bug.cgi?id=53271

        Reapplying this patch with the change that the second ASSERT in 
        RootObject::removeRuntimeObject was changed to use
        .uncheckedGet() instead of the failing .get().  The object in question
        could be in the process of being GC'ed.  The get() call will not return
        such an object while the uncheckedGet() call will return the (unsafe) 
        object.  This is the behavior we want.

        Precautionary change.
        Changed RootObject to use WeakGCMap instead of HashSet.
        Found will looking for another issue, but can't produce a test case
        that is problematic.  THerefore there aren't any new tests.

        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::invalidate):
        (JSC::Bindings::RootObject::addRuntimeObject):
        (JSC::Bindings::RootObject::removeRuntimeObject):
        * bridge/runtime_root.h:

2011-01-28  Adam Roben  <aroben@apple.com>

        Notify CACFLayerTreeHost when the context is flushed

        LegacyCACFLayerTreeHost was keeping this a secret, which meant that WebCore's animation
        timers were never starting.

        Fixes <http://webkit.org/b/53302> [Windows 7 Release Tests] changesets 76853, 76856, and
        76858 broke ~36 animations, compositing, and transitions tests

        Reviewed by Sam Weinig.

        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp:
        (WebCore::LegacyCACFLayerTreeHost::contextDidChange): Call up to the base class after we
        start our render timer.

2011-01-28  Antti Koivisto  <antti@apple.com>

        Reviewed by Dan Bernstein.

        Remove dead code that tried to map from CSS values to parser values
        https://bugs.webkit.org/show_bug.cgi?id=53318

        * css/CSSFunctionValue.cpp:
        * css/CSSFunctionValue.h:
        * css/CSSPrimitiveValue.cpp:
        * css/CSSPrimitiveValue.h:
        * css/CSSValue.h:
        * css/CSSValueList.cpp:
        * css/CSSValueList.h:

2011-01-28  Enrica Casucci  <enrica@apple.com>

        Reviewed by Adam Roben.

        Some drag and drop tests fail since r76824
        https://bugs.webkit.org/show_bug.cgi?id=53304

        There were '||' instead of '&&' in the checks for valid
        clipboard content.
        
        * platform/win/ClipboardWin.cpp:
        (WebCore::ClipboardWin::getData):
        (WebCore::ClipboardWin::types):
        (WebCore::ClipboardWin::files):

2011-01-28  Martin Robinson  <mrobinson@igalia.com>

        [GTK] AudioProcessingEvent.h and JSJavaScriptAudioNode.h: No such file or directory
        https://bugs.webkit.org/show_bug.cgi?id=52889

        Build fix for WebAudio. Include WebAudio source files on the source
        list when WebAudio is enabled.

        * GNUmakefile.am: Include missing source files.

2011-01-28  Sam Weinig  <sam@webkit.org>

        Reviewed by Maciej Stachowiak.

        Add basic rubber banding support
        <rdar://problem/8219429>
        https://bugs.webkit.org/show_bug.cgi?id=53277

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleGestureEvent):
        Pass gesture events to the FrameView.

        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::handleGestureEvent):
        * platform/ScrollAnimator.h:
        Add stubbed out implementation.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::ScrollView):
        (WebCore::ScrollView::overhangAmount):
        (WebCore::ScrollView::wheelEvent):
        * platform/ScrollView.h:
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::ScrollableArea):
        (WebCore::ScrollableArea::handleGestureEvent):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::constrainsScrollingToContentEdge):
        (WebCore::ScrollableArea::setConstrainsScrollingToContentEdge):
        Move constrains scrolling bit to ScrollableArea from ScrollView.

        (WebCore::ScrollableArea::contentsSize):
        (WebCore::ScrollableArea::overhangAmount):
        Add additional virtual functions for information needed by the animator.

        * platform/mac/ScrollAnimatorMac.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaX):
        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaY):
        (WebCore::elasticDeltaForTimeDelta):
        (WebCore::elasticDeltaForReboundDelta):
        (WebCore::reboundDeltaForElasticDelta):
        (WebCore::scrollWheelMultiplier):
        (WebCore::ScrollAnimatorMac::handleWheelEvent):
        (WebCore::ScrollAnimatorMac::handleGestureEvent):
        (WebCore::ScrollAnimatorMac::pinnedInDirection):
        (WebCore::ScrollAnimatorMac::allowsVerticalStretching):
        (WebCore::ScrollAnimatorMac::allowsHorizontalStretching):
        (WebCore::ScrollAnimatorMac::smoothScrollWithEvent):
        (WebCore::ScrollAnimatorMac::beginScrollGesture):
        (WebCore::ScrollAnimatorMac::endScrollGesture):
        (WebCore::ScrollAnimatorMac::snapRubberBand):
        (WebCore::roundTowardZero):
        (WebCore::roundToDevicePixelTowardZero):
        (WebCore::ScrollAnimatorMac::snapRubberBandTimerFired):
        Implement basic rubber banding.

2011-01-28  Dan Bernstein  <mitz@apple.com>

        Reviewed by Anders Carlsson.

        Changing unicode-bidi doesn’t force layout
        https://bugs.webkit.org/show_bug.cgi?id=53311

        Test: fast/dynamic/unicode-bidi.html

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::diff): Return a layout difference if unicode-bidi values differ.

2011-01-27  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by Kent Tamura.

        Change HTMLInputElement-derived parts of media element shadow DOM to use shadowPseudoId.
        https://bugs.webkit.org/show_bug.cgi?id=53122

        This is the first step in converting HTMLMediaElement to the new shadow DOM.

        Should not regress any existing tests. No observable change in behavior.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::pseudoId): Removed now-unnecessary hard-coded pseudo-element selectors.
        (WebCore::nameToPseudoTypeMap): Ditto.
        (WebCore::CSSSelector::extractPseudoType): Ditto.
        * css/CSSSelector.h: Ditto.
        * css/mediaControls.css: Added proper initial values, now that elements use the proper selector pipeline.
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlInputElement::MediaControlInputElement): Removed the switch statement,
            which is now replaced with virtual shadowPseudoId on each corresponding class.
        (WebCore::MediaControlInputElement::styleForElement): Changed to use element pipeline.
        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement): Changed to set
            display type in constructor.
        (WebCore::MediaControlMuteButtonElement::create): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlMuteButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteButtonElement): Added
            to disambiguate from the MediaControlMuteButtonElement.
        (WebCore::MediaControlVolumeSliderMuteButtonElement::create): Added.
        (WebCore::MediaControlVolumeSliderMuteButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlPlayButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElement): Added.
        (WebCore::MediaControlSeekForwardButtonElement::create): Added.
        (WebCore::MediaControlSeekForwardButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement): Added.
        (WebCore::MediaControlSeekBackButtonElement::create): Added.
        (WebCore::MediaControlSeekBackButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Added.
        (WebCore::MediaControlRewindButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlReturnToRealtimeButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlTimelineElement::shadowPseudoId): Added.
        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlVolumeSliderElement::shadowPseudoId): Added.
        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlFullscreenButtonElement::shadowPseudoId): Added.
        * rendering/MediaControlElements.h:
        (WebCore::MediaControlSeekForwardButtonElement::isForwardButton): Added.
        (WebCore::MediaControlSeekBackButtonElement::isForwardButton): Added.
        * rendering/RenderMedia.cpp:
        (WebCore::RenderMedia::createMuteButton): Changed to use new constructor.
        (WebCore::RenderMedia::createSeekBackButton): Ditto.
        (WebCore::RenderMedia::createSeekForwardButton): Ditto.
        (WebCore::RenderMedia::createVolumeSliderMuteButton): Ditto.
        * rendering/style/RenderStyleConstants.h: Removed constants that are no longer used.

2011-01-27  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by Eric Carlson.

        Split MediaControls out of RenderMedia.
        https://bugs.webkit.org/show_bug.cgi?id=53252

        Near-mechanical moving of stuff, no change in behavior, thus no new tests.

        * Android.mk: Added MediaControls to build system.
        * CMakeLists.txt: Ditto.
        * GNUmakefile.am: Ditto.
        * WebCore.gypi: Ditto.
        * WebCore.pro: Ditto.
        * WebCore.vcproj/WebCore.vcproj: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::defaultEventHandler): Changed to forward events to MediaControls.
        * html/shadow/MediaControls.cpp: Copied all controls-related methods from
            Source/WebCore/rendering/RenderMedia.cpp, pulled them into their own class called MediaControls. 
        * html/shadow/MediaControls.h: Ditto from Source/WebCore/rendering/RenderMedia.h.
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlTimelineElement::defaultEventHandler): Changed to use MediaControls.
        * rendering/RenderMedia.cpp:
        (WebCore::RenderMedia::RenderMedia): Moved relevant constructor initializers out to MediaControls.
        (WebCore::RenderMedia::destroy): Changed to use MediaControls.
        (WebCore::RenderMedia::styleDidChange): Ditto.
        (WebCore::RenderMedia::layout): Ditto.
        (WebCore::RenderMedia::updateFromElement): Ditto.
        * rendering/RenderMedia.h: Updated defs accordingly and removed player() accessor, which
            is only used by sub-class RenderVideo.
        (WebCore::RenderMedia::controls): Added.
        * rendering/RenderVideo.cpp:
        (WebCore::RenderVideo::~RenderVideo): Changed to access MediaPlayer* directly from mediaElement().
        (WebCore::RenderVideo::calculateIntrinsicSize): Ditto.
        (WebCore::RenderVideo::paintReplaced): Ditto.
        (WebCore::RenderVideo::updatePlayer): Ditto.
        (WebCore::RenderVideo::supportsAcceleratedRendering): Ditto.
        (WebCore::RenderVideo::acceleratedRenderingStateChanged): Ditto.

2011-01-28  Pavel Feldman  <pfeldman@chromium.org>

        Reviewed by Yury Semikhatsky.

        Web Inspector: allow remote debugging with front-end
        served from the cloud.
        https://bugs.webkit.org/show_bug.cgi?id=53303

        * inspector/front-end/inspector.js:

2011-01-28  Aparna Nandyal  <aparna.nand@wipro.com>

        Reviewed by Andreas Kling.

        Setting value of m_PressedPos to make scrolling smooth

        Page scroll popup menu "Scroll here" option not working when cliking above scroll slider/handler.
        https://bugs.webkit.org/show_bug.cgi?id=51349

        The value of m_PressedPos was getting set before moveThumb() call
        in all other scenarios except when "Scroll Here" option is used.
        Hence scrolling with this option was not as expected even in cases
        where scrolling was happening. The thumb would move in unexpected
        direction. m_PressedPos is now set to pressed position so delta is
        calculated.
        Unable to write a test case as the test needs to click on "Scroll
        Here" option of context sensitive menu and QTest is unable to do it.
        Besides no new functionality introduced.

        * platform/qt/ScrollbarQt.cpp:
        (WebCore::Scrollbar::contextMenu):

2011-01-28  Andrey Kosyakov  <caseq@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: [Extensions API] add JSON schema for extensions API
        https://bugs.webkit.org/show_bug.cgi?id=53236

        * inspector/front-end/ExtensionAPISchema.json: Added.

2011-01-27  Zhenyao Mo  <zmo@google.com>

        Reviewed by Kenneth Russell.

        Remove _LENGTH enumerants
        https://bugs.webkit.org/show_bug.cgi?id=53259

        * html/canvas/WebGLRenderingContext.cpp: Remove queries for *LENGTH.
        (WebCore::WebGLRenderingContext::getProgramParameter):
        (WebCore::WebGLRenderingContext::getShaderParameter):
        * html/canvas/WebGLRenderingContext.idl: Remove *LENGTH.

2011-01-28  Alexander Pavlov  <apavlov@chromium.org>

        Reviewed by Yury Semikhatsky.

        Web Inspector: syntax highlight inline JS and CSS in HTML resources
        https://bugs.webkit.org/show_bug.cgi?id=30831

        * inspector/front-end/SourceHTMLTokenizer.js:
        (WebInspector.SourceHTMLTokenizer):
        (WebInspector.SourceHTMLTokenizer.prototype.set line):
        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
        * inspector/front-end/SourceHTMLTokenizer.re2js:

2011-01-28  Alexander Pavlov  <apavlov@chromium.org>

        Reviewed by Yury Semikhatsky.

        Web Inspector: [STYLES] Up/Down-suggestion breaks an existing keyword
        https://bugs.webkit.org/show_bug.cgi?id=53295

        Select the current word suffix before switching to the next suggestion.

        * inspector/front-end/StylesSidebarPane.js:
        ():

2011-01-28  Alejandro G. Castro  <alex@igalia.com>

        Reviewed by Xan Lopez.

        [GTK] Fix dist compilation for the release
        https://bugs.webkit.org/show_bug.cgi?id=53290

        * GNUmakefile.am: Added inspector files to the extra dist.

2011-01-28  Ilya Sherman  <isherman@chromium.org>

        Reviewed by Andreas Kling.

        Const-correct HTMLSelectElement and WebSelectElement
        https://bugs.webkit.org/show_bug.cgi?id=53293

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::value): const.
        * html/HTMLSelectElement.h:

2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r76893.
        http://trac.webkit.org/changeset/76893
        https://bugs.webkit.org/show_bug.cgi?id=53287

        It made some tests crash on GTK and Qt debug bots (Requested
        by Ossy on #webkit).

        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::invalidate):
        (JSC::Bindings::RootObject::addRuntimeObject):
        (JSC::Bindings::RootObject::removeRuntimeObject):
        * bridge/runtime_root.h:

2011-01-27  Greg Coletta  <greg.coletta@nokia.com>

        Reviewed by Laszlo Gombos.

        Get rid of prefix header dependency for WebKit2 build system
        https://bugs.webkit.org/show_bug.cgi?id=50174

        Guard EmptyProtocalDefinitions.h to make sure it's not included twice.

        * platform/mac/EmptyProtocolDefinitions.h:

2011-01-27  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dan Bernstein.

        Recalc table sections if needed before calculating the first line
        box baseline.
        https://bugs.webkit.org/show_bug.cgi?id=53265

        When we try to calculate the baseline position of a table cell,
        we recurse through all the child sibling boxes (when children are
        non inline) and add their first linebox baseline values. If one of
        the children is a table with pending section recalc, we will access
        wrong table section values. We recalc table sections if it is needed.

        Test: fast/table/recalc-section-first-body-crash-main.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::firstLineBoxBaseline):

2011-01-27  Adrienne Walker  <enne@google.com>

        Reviewed by Kenneth Russell.

        [chromium] Add CRASH calls to further debug tiled compositor memcpy crash.
        https://bugs.webkit.org/show_bug.cgi?id=52379

        Test: LayoutTests/compositing (to verify these weren't triggered)

        * platform/graphics/chromium/LayerTilerChromium.cpp:
        (WebCore::LayerTilerChromium::invalidateRect):
        (WebCore::LayerTilerChromium::update):

2011-01-27  Alexander Pavlov  <apavlov@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: [STYLES] Cancelled suggestion of a property name results in a visual artifact
        https://bugs.webkit.org/show_bug.cgi?id=53242

        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertyTreeElement.prototype):

2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r76891.
        http://trac.webkit.org/changeset/76891
        https://bugs.webkit.org/show_bug.cgi?id=53280

        Makes every layout test crash (Requested by othermaciej on
        #webkit).

        * page/EventHandler.cpp:
        * page/EventHandler.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::styleDidChange):

2011-01-27  Ryosuke Niwa  <rniwa@webkit.org>

        Unreviewed, rolling out r76839.
        http://trac.webkit.org/changeset/76839
        https://bugs.webkit.org/show_bug.cgi?id=49744

        broke pixel tests

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::localCaretRect):

2011-01-27  Emil A Eklund  <eae@chromium.org>

        Reviewed by Darin Adler.

        contentEditable formatBlock crashes on divs with contenteditable="false"
        https://bugs.webkit.org/show_bug.cgi?id=53263

        Check if editableRootForPosition returns null for position.

        Test: editing/execCommand/format-block-contenteditable-false.html

        * editing/FormatBlockCommand.cpp:
        (WebCore::FormatBlockCommand::formatRange):

2011-01-27  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by Darin Adler.

        Remove RenderMedia members that aren't used.
        https://bugs.webkit.org/show_bug.cgi?id=53245

        Refactoring, no change in behavior, so no new tests.

        * rendering/RenderMedia.h: Removed unused member variables.

2011-01-27  Michael Saboff  <msaboff@apple.com>

        Reviewed by Darin Adler.

        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
        https://bugs.webkit.org/show_bug.cgi?id=53271

        Precautionary change.
        Changed RootObject to use WeakGCMap instead of HashSet.
        Found will looking for another issue, but can't produce a test case
        that is problematic.  THerefore there aren't any new tests.

        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::invalidate):
        (JSC::Bindings::RootObject::addRuntimeObject):
        (JSC::Bindings::RootObject::removeRuntimeObject):
        * bridge/runtime_root.h:

2011-01-27  Kenneth Russell  <kbr@google.com>

        Reviewed by James Robinson.

        Rename Typed Array slice() to subset()
        https://bugs.webkit.org/show_bug.cgi?id=53273

        * bindings/js/JSArrayBufferViewHelper.h:
        (WebCore::constructArrayBufferView):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArray):
        * html/canvas/Float32Array.cpp:
        (WebCore::Float32Array::subset):
        * html/canvas/Float32Array.h:
        * html/canvas/Float32Array.idl:
        * html/canvas/Int16Array.cpp:
        (WebCore::Int16Array::subset):
        * html/canvas/Int16Array.h:
        * html/canvas/Int16Array.idl:
        * html/canvas/Int32Array.cpp:
        (WebCore::Int32Array::subset):
        * html/canvas/Int32Array.h:
        * html/canvas/Int32Array.idl:
        * html/canvas/Int8Array.cpp:
        (WebCore::Int8Array::subset):
        * html/canvas/Int8Array.h:
        * html/canvas/Int8Array.idl:
        * html/canvas/TypedArrayBase.h:
        (WebCore::TypedArrayBase::subsetImpl):
        * html/canvas/Uint16Array.cpp:
        (WebCore::Uint16Array::subset):
        * html/canvas/Uint16Array.h:
        * html/canvas/Uint16Array.idl:
        * html/canvas/Uint32Array.cpp:
        (WebCore::Uint32Array::subset):
        * html/canvas/Uint32Array.h:
        * html/canvas/Uint32Array.idl:
        * html/canvas/Uint8Array.cpp:
        (WebCore::Uint8Array::subset):
        * html/canvas/Uint8Array.h:
        * html/canvas/Uint8Array.idl:

2011-01-27  Darin Adler  <darin@apple.com>

        Reviewed by Dan Bernstein.

        Changing cursor style has no effect until the mouse moves
        https://bugs.webkit.org/show_bug.cgi?id=14344
        rdar://problem/7563712

        No tests added because we don't have infrastructure for testing actual cursor
        changes (as opposed to cursor style computation) at this time. We might add it later.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon): Added.
        * page/EventHandler.h: Ditto.

        * rendering/RenderObject.cpp:
        (WebCore::areNonIdenticalCursorListsEqual): Added.
        (WebCore::areCursorsEqual): Added.
        (WebCore::RenderObject::styleDidChange): Call dispatchFakeMouseMoveEventSoon if
        cursor styles changed.

2011-01-27  Leo Yang  <leo.yang@torchmobile.com.cn>

        Reviewed by Dirk Schulze.

        SVG Use Cycle is not detected
        https://bugs.webkit.org/show_bug.cgi?id=52544

        We should check if SVGUseElement::buildInstanceTree finds problem
        for every child node. If it finds problem for any children we must
        return immediately because otherwise the foundProblem variable may
        be rewritten to false.

        Test: svg/custom/recursive-use2.svg

        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::buildInstanceTree):

2011-01-27  Zhenyao Mo  <zmo@google.com>

        Reviewed by Kenneth Russell.

        texSubImage2D's format/type needs to match the internalformat/type from the previous texImage2D call
        https://bugs.webkit.org/show_bug.cgi?id=53054

        Test: fast/canvas/webgl/tex-sub-image-2d-bad-args.html

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::texSubImage2DBase): Check format/type match.

2011-01-27  Yi Shen  <yi.4.shen@nokia.com>, Tor Arne Vestbø <tor.arne.vestbo@nokia.com>

        Reviewed by Andreas Kling.

        [Qt] Add fullscreen media control button for html video
        https://bugs.webkit.org/show_bug.cgi?id=51543

        Implement media control fullscreen button for QtWebKit html5 video.

        * css/mediaControlsQt.css:
        (video::-webkit-media-controls-fullscreen-button):
        * platform/qt/RenderThemeQt.cpp:
        (WebCore::RenderThemeQt::paintMediaFullscreenButton):

2011-01-27  Nate Chapin  <japhet@chromium.org>

        Reviewed by Adam Barth.

        Remove FrameLoader::url() and update callers to use
        Document::url().
        https://bugs.webkit.org/show_bug.cgi?id=41165

        Refactor, no new tests.

        * WebCore.exp.in:
        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv):
        (WebCore::Document::removePendingSheet):
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::CachedFrameBase):
        * history/PageCache.cpp:
        (WebCore::logCanCacheFrameDecision):
        (WebCore::PageCache::canCachePageContainingThisFrame):
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::isURLAllowed):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::allowedToLoadFrameURL):
        * inspector/InspectorAgent.cpp:
        (WebCore::InspectorAgent::inspectedURL):
        * inspector/InspectorResourceAgent.cpp:
        (WebCore::buildObjectForFrame):
        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::replaceDocument):
        (WebCore::DocumentWriter::deprecatedFrameEncoding):
        * loader/FrameLoader.cpp:
        * loader/FrameLoader.h:
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::updateForStandardLoad):
        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
        (WebCore::HistoryController::updateForSameDocumentNavigation):
        * loader/NavigationScheduler.cpp:
        (WebCore::ScheduledHistoryNavigation::fire):
        (WebCore::NavigationScheduler::scheduleLocationChange):
        (WebCore::NavigationScheduler::scheduleRefresh):
        * page/FrameView.cpp:
        (WebCore::FrameView::updateControlTints):
        * page/Location.cpp:
        (WebCore::Location::url):
        (WebCore::Location::setProtocol):
        (WebCore::Location::setHost):
        (WebCore::Location::setHostname):
        (WebCore::Location::setPort):
        (WebCore::Location::setPathname):
        (WebCore::Location::setSearch):
        (WebCore::Location::setHash):
        (WebCore::Location::reload):
        * page/Page.cpp:
        (WebCore::Page::goToItem):

2011-01-27  Stephen White  <senorblanco@chromium.org>

        Reviewed by Darin Adler.

        Fix performance regression in ImageQualityController::objectDestroyed().
        https://bugs.webkit.org/show_bug.cgi?id=52645

        In r72282, I inadvertently introduced this regression by using a
        linear search through the hash map on object destruction.  This was
        because the hash key consisted of both object pointer and layer id,
        but on object destruction we only know the object pointer, requiring
        a search to find all the layers. 
        By replacing the hash map with two nested hash maps, where the outer key
        is the object and the inner key is the layer, we can find all the
        relevant data for an object in one hash lookup.

        * rendering/RenderBoxModelObject.cpp:
        Replace the (object,layer)->size HashMap with object->layer and
        layer->size HashMaps.
        (WebCore::ImageQualityController::isEmpty):
        Implement isEmpty() for the outer HashMap.
        (WebCore::ImageQualityController::removeLayer):
        When a layer is removed, remove it from the inner hash map.
        (WebCore::ImageQualityController::set):
        Implement set():  if the inner map exists, set the layer->size tuple
        directly.  If not, create a new inner map, set the tuple, and insert
        it in the outer map.
        (WebCore::ImageQualityController::objectDestroyed):
        Look up the object in the outer map only.
        (WebCore::ImageQualityController::highQualityRepaintTimerFired):
        Cosmetic changes for the renamed now-outer hash map.
        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
        Do both outer and inner hash map lookups.  Call set() to add/update
        entries to the hash maps.  keyDestroyed() is now removeLayer().
        (WebCore::imageQualityController):
        Make the ImageQualityController a file-static global, so it can be
        created and destroyed on the fly.
        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
        If there is no ImageQualityController, don't call objectDestroyed().
        If it's empty, delete it.
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paintIntoRect):
        Also pass the Image* as the (void*) layer, since 0 is not a valid
        HashMap key.

2011-01-27  Adrienne Walker  <enne@google.com>

        Reviewed by James Robinson.

        [chromium] Tiled compositor crashes if compositing turned off mid-paint
        https://bugs.webkit.org/show_bug.cgi?id=53198

        * platform/graphics/chromium/LayerRendererChromium.cpp:
        (WebCore::LayerRendererChromium::drawLayers):
        * platform/graphics/chromium/LayerTilerChromium.cpp:
        (WebCore::LayerTilerChromium::update):
        (WebCore::LayerTilerChromium::draw):

2011-01-27  Carol Szabo <carol.szabo@nokia.com>

        Reviewed by David Hyatt.

        A corrupted counter tree is created when renderers are added to the
        tree bypassing RenderObject::addChild
        https://bugs.webkit.org/show_bug.cgi?id=51270

        No new tests. This patch reimplements the fix for bugs 43812 and
        51637 and hence all tests are already there as part of the original
        fixes for those bugs.

        * rendering/RenderCounter.cpp:
        (WebCore::findPlaceForCounter):
        Removed old workaround as this patch hopefully fixes the real
        problem.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::addChild):
        Removed call to counter updater as it was moved to a lower level.
        (WebCore::RenderObject::destroy):
        Moved attached counter nodes destruction to after the node is
        removed from the tree.
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        (WebCore::RenderObjectChildList::appendChildNode):
        (WebCore::RenderObjectChildList::insertChildNode):
        Added notifications to the Counter system such that the
        CounterForest reflects the changes to the RendererTree.
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::destroy):
        Applied the same changes as for RenderObject::destroy()
        since RenderObject::destroy() is not called from here.

2011-01-27  Adam Roben  <aroben@apple.com>

        Add WKCACFViewLayerTreeHost

        This is a class that derives from CACFLayerTreeHost and uses a WKCACFView to render.

        Fixes <http://webkit.org/b/53251> <rdar://problem/8925496> CACFLayerTreeHost should use
        WKCACFView for rendering

        * WebCore.vcproj/WebCore.vcproj: Added WKCACFViewLayerTreeHost.{cpp,h}.

        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        (WebCore::CACFLayerTreeHost::acceleratedCompositingAvailable): Make the test window have a
        non-zero size. WKCACFView will always say it can't render if you pass it a 0-sized window,
        so we need a non-empty window to perform a valid test.
        (WebCore::CACFLayerTreeHost::create): First try to create a WKCACFViewLayerTreeHost, then
        fall back to a LegacyCACFLayerTreeHost.
        (WebCore::CACFLayerTreeHost::flushPendingLayerChangesNow): Moved code to react to the
        context flush from here...
        (WebCore::CACFLayerTreeHost::contextDidChange): ...to here. Derived classes are required to
        call this function whenever changes are flushed to the context.

        * platform/graphics/ca/win/CACFLayerTreeHost.h: Added contextDidChange.

        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp:
        (WebCore::LegacyCACFLayerTreeHost::createRenderer):
        (WebCore::LegacyCACFLayerTreeHost::resize):
        Changed to use flushContext instead of flushing the context manually so that we will always
        notify the base class when the context gets flushed.

        (WebCore::LegacyCACFLayerTreeHost::flushContext): Added a call to contextDidChange so the
        base class will know what happened. Moved code to schedule a render from here...
        (WebCore::LegacyCACFLayerTreeHost::contextDidChange): ...to here.

        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.h: Added contextDidChange.

        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp: Added.
        (WebCore::WKCACFViewLayerTreeHost::create): If WebKitQuartzCoreAdditions, which provides
        WKCACFView, isn't present, bail. Otherwise allocate and return a new host.
        (WebCore::WKCACFViewLayerTreeHost::WKCACFViewLayerTreeHost): Initialize members.
        (WebCore::WKCACFViewLayerTreeHost::updateViewIfNeeded): Update the view if we previously
        marked that we needed to do so, and flush the context if our layer's bounds have changed.
        (WebCore::WKCACFViewLayerTreeHost::contextDidChangeCallback): Call through to
        contextDidChange.
        (WebCore::WKCACFViewLayerTreeHost::contextDidChange): Tell the WKCACFView to start rendering
        (if we didn't already), then call up to the base class.
        (WebCore::WKCACFViewLayerTreeHost::initializeContext): Set the context's user data, the
        view's layer, and hook up our "context did change" callback.
        (WebCore::WKCACFViewLayerTreeHost::resize): Mark that the view needs to be updated the next
        time we paint.
        (WebCore::WKCACFViewLayerTreeHost::createRenderer): Update our view and return whether it is
        able to render or not.
        (WebCore::WKCACFViewLayerTreeHost::destroyRenderer): Clear out all the info we passed down
        to the view.
        (WebCore::WKCACFViewLayerTreeHost::lastCommitTime): Call through to the view.
        (WebCore::WKCACFViewLayerTreeHost::flushContext): Ditto.
        (WebCore::WKCACFViewLayerTreeHost::paint): Update the view so it will draw at the right
        size, then call up to the base class.
        (WebCore::WKCACFViewLayerTreeHost::render): Invalidate the view using the passed-in dirty
        rects, then ask it to draw.

        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h: Copied from Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.h.

2011-01-27  Adam Roben  <aroben@apple.com>

        Move LegacyCACFLayerTreeHost into its own files

        More preparation for <http://webkit.org/b/53251> <rdar://problem/8925496> CACFLayerTreeHost
        should use WKCACFView for rendering

        Reviewed by Simon Fraser.

        * WebCore.vcproj/WebCore.vcproj: Added LegacyCACFLayerTreeHost.{cpp,h}.

        * platform/graphics/ca/win/CACFLayerTreeHost.cpp: Moved code from here to new files.

        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp: Added.
        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.h: Added.

2011-01-27  Patrick Gansterer  <paroga@webkit.org>

        Unreviewed WinCE build fix for r76824.

        * platform/wince/DragDataWinCE.cpp:
        (WebCore::DragData::dragDataMap):

2011-01-27  Adam Roben  <aroben@apple.com>

        Split CACFLayerTreeHost into base and derived classes

        The derived class, LegacyCACFLayerTreeHost, contains all the D3D-related code. A later patch
        will add a new derived class that replaces the D3D code with a different rendering API.

        For now, LegacyCACFLayerTreeHost lives in CACFLayerTreeHost.cpp. This keeps the diff a
        little smaller. A later patch will move it to its own source files.

        Preparation for <http://webkit.org/b/53251> <rdar://problem/8925496> CACFLayerTreeHost
        should use WKCACFView for rendering

        Reviewed by Simon Fraser.

        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        (WebCore::CACFLayerTreeHost::acceleratedCompositingAvailable): Clear the window before
        destroying the host, as that is now the API contract that clients must fulfill.
        (WebCore::LegacyCACFLayerTreeHost::create): Added. Simple creator.
        (WebCore::CACFLayerTreeHost::create): Now instantiates a LegacyCACFLayerTreeHost. Calls the
        new initialize function to perform initialization that has to happen after the vtable has
        been set up.

        (WebCore::LegacyCACFLayerTreeHost::LegacyCACFLayerTreeHost):
        (WebCore::CACFLayerTreeHost::CACFLayerTreeHost):
        (WebCore::LegacyCACFLayerTreeHost::initializeContext):
        (WebCore::CACFLayerTreeHost::initialize):
        Moved some initialization code from the CACFLayerTreeHost constructor into these new
        functions.

        (WebCore::LegacyCACFLayerTreeHost::~LegacyCACFLayerTreeHost): Added. Moved code here from
        ~CACFLayerTreeHost.
        (WebCore::CACFLayerTreeHost::~CACFLayerTreeHost): Rather than clearing the window at this
        point (which would be too late, since we won't be able to call into the derived class's
        virtual functions), just assert that it has already been cleared (or was never set in the
        first place).
        (WebCore::LegacyCACFLayerTreeHost::createRenderer): Renamed from
        CACFLayerTreeHost::createRenderer, and changed to use getters instead of accessing
        CACFLayerTreeHost's data members directly.

        (WebCore::LegacyCACFLayerTreeHost::destroyRenderer):
        (WebCore::CACFLayerTreeHost::destroyRenderer):
        Moved some code to the new LegacyCACFLayerTreeHost function.

        (WebCore::LegacyCACFLayerTreeHost::resize):
        (WebCore::LegacyCACFLayerTreeHost::renderTimerFired):
        Moved these functions to LegacyCACFLayerTreeHost.

        (WebCore::LegacyCACFLayerTreeHost::paint):
        (WebCore::CACFLayerTreeHost::paint):
        Moved some code to the new LegacyCACFLayerTreeHost function.

        (WebCore::LegacyCACFLayerTreeHost::render):
        (WebCore::LegacyCACFLayerTreeHost::renderSoon):
        Moved these functions to LegacyCACFLayerTreeHost.

        (WebCore::CACFLayerTreeHost::flushPendingLayerChangesNow): Moved code to flush the context
        from here...
        (WebCore::LegacyCACFLayerTreeHost::flushContext): ...to this new function.

        (WebCore::LegacyCACFLayerTreeHost::lastCommitTime): Moved code to get the last commit time
        to this new function...
        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted): ...from here.

        (WebCore::LegacyCACFLayerTreeHost::initD3DGeometry):
        (WebCore::LegacyCACFLayerTreeHost::resetDevice):
        Moved these functions to LegacyCACFLayerTreeHost.

        * platform/graphics/ca/win/CACFLayerTreeHost.h: Made some functions virtual, removed some
        members that have moved to LegacyCACFLayerTreeHost, grouped remaining members more
        logically, and added some getters used by LegacyCACFLayerTreeHost.

2011-01-27  Adam Roben  <aroben@apple.com>

        Move CACFLayerTreeHostClient to its own header file

        Rubber-stamped by Steve Falkenburg.

        * WebCore.vcproj/WebCore.vcproj: Added CACFLayerTreeHostClient.h. Also let VS have its way
        with the file.

        * platform/graphics/ca/win/CACFLayerTreeHost.cpp: Added new #include.

        * platform/graphics/ca/win/CACFLayerTreeHost.h: Removed CACFLayerTreeHostClient.

        * platform/graphics/ca/win/CACFLayerTreeHostClient.h: Added.

        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp: Moved some #includes here
        from the header file.

        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h: Replaced broader #includes
        with more specific ones, plus a forward-declaration.

2011-01-27  James Simonsen  <simonjam@chromium.org>

        Reviewed by Tony Chang.

        [Chromium] Simplify small caps logic in complex text on linux
        https://bugs.webkit.org/show_bug.cgi?id=53207

        Test: fast/text/atsui-multiple-renderers.html
              fast/text/atsui-small-caps-punctuation-size.html

        * platform/graphics/chromium/ComplexTextControllerLinux.cpp:
        (WebCore::ComplexTextController::nextScriptRun): Remove redundant logic. Case changes in a text run imply FontData changes.
        (WebCore::ComplexTextController::setupFontForScriptRun): Update comment to reflect above.

2011-01-27  Adam Barth  <abarth@webkit.org>

        In which I attempt to fix the EFL build.

        * CMakeLists.txt:

2011-01-25  Levi Weintraub  <leviw@chromium.org>

        Reviewed by Darin Adler.

        Adding border and padding to the calculation of the local caret rect for RenderBoxes.
        Corrected for mistake in r76625

        Undo moves caret to invalid position
        https://bugs.webkit.org/show_bug.cgi?id=49744

        Tests: editing/selection/caret-painting-after-paste-undo-rtl.html
               editing/selection/caret-painting-after-paste-undo.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::localCaretRect):

2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r76825.
        http://trac.webkit.org/changeset/76825
        https://bugs.webkit.org/show_bug.cgi?id=53256

        "caused crashes on GTK and chromium" (Requested by rniwa on
        #webkit).

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::ImageQualityController::keyDestroyed):
        (WebCore::ImageQualityController::objectDestroyed):
        (WebCore::ImageQualityController::highQualityRepaintTimerFired):
        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
        (WebCore::imageQualityController):
        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):

2011-01-27  Adam Barth  <abarth@webkit.org>

        Reviewed by Eric Seidel.

        Generalize the mechanism view-source uses to remember the source for an HTMLToken
        https://bugs.webkit.org/show_bug.cgi?id=53200

        Currently view-source tracks the source associated with each HTMLToken.
        We want to re-use this mechanism for the new XSS auditor.  This patch
        moves this code into its own class so it can be shared between the
        view-source parser and the general HTML parser.  This patch also add
        support for tracking the source of tokens that span document.write
        boundaries.

        No functional change.  This code change is somewhat tested by our
        view-source layout tests.

        * Android.mk:
        * GNUmakefile.am:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
            - Fun with updating build files.
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::pumpTokenizer):
            - Teach HTMLDocumentParser to track the source for HTMLTokens.
              Currently, this information isn't used, but it will be shortly.
              I ran the HTML parser benchmark and this change didn't have a
              measurable effect.
        * html/parser/HTMLDocumentParser.h:
            - Composite in the HTMLSourceTracker.
        * html/parser/HTMLSourceTracker.cpp: Added.
        (WebCore::HTMLSourceTracker::HTMLSourceTracker):
        (WebCore::HTMLSourceTracker::start):
        (WebCore::HTMLSourceTracker::end):
            - This function should eventualy be folded into HTMLTokenizer.
        (WebCore::HTMLSourceTracker::sourceForToken):
        * html/parser/HTMLSourceTracker.h: Added.
        * html/parser/HTMLToken.h:
            - Now HTMLTokens always have a start index of zero.  To do the job
              of the old start index, this patch introduces the notion of a
              baseOffset.  Unlike the start index (which was used as the base
              offset for all the other indicies), the baseOffset can change
              over the lifetime of the token.  We need the flexibility to
              change the offset for tokens that span document.write boundaries.
              Values are now normalized to zero-offset when stored.
        (WebCore::HTMLToken::clear):
        (WebCore::HTMLToken::setBaseOffset):
        (WebCore::HTMLToken::end):
        (WebCore::HTMLToken::beginAttributeName):
        (WebCore::HTMLToken::endAttributeName):
        (WebCore::HTMLToken::beginAttributeValue):
        (WebCore::HTMLToken::endAttributeValue):
        * html/parser/HTMLViewSourceParser.cpp:
            - Updates the HTMLViewSourceParser to use the new
              HTMLSourceTracker.
        (WebCore::HTMLViewSourceParser::pumpTokenizer):
        (WebCore::HTMLViewSourceParser::append):
        (WebCore::HTMLViewSourceParser::sourceForToken):
            - This function now just calls through to HTMLSourceTracker.
        * html/parser/HTMLViewSourceParser.h:
        * platform/text/SegmentedString.cpp:
        (WebCore::SegmentedString::currentColumn):
        (WebCore::SegmentedString::setCurrentPosition):
        * platform/text/SegmentedString.h:
        (WebCore::SegmentedString::numberOfCharactersConsumed):
            - We need to handle the general case now.  The "slow" version
              doesn't turn out to be any slower in practice anyway.

2011-01-27  Sam Weinig  <sam@webkit.org>

        Fix all the builds.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::paintOverhangAreas): Add parameters.

2011-01-27  Sam Weinig  <sam@webkit.org>

        Reviewed by Dave Hyatt.

        Add ability to do an unconstrained scroll on a ScrollView
        https://bugs.webkit.org/show_bug.cgi?id=53249

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::ScrollView):
        Initialize m_constrainsScrollingToContentEdge to true.

        (WebCore::ScrollView::setScrollOffset):
        Only constrain the offset if the m_constrainsScrollingToContentEdge is set.

        (WebCore::ScrollView::updateScrollbars):
        Simplify expression converting an IntSize to an IntPoint.
        
        (WebCore::ScrollView::paint):
        Paint the overhang if there is any.
        
        (WebCore::ScrollView::calculateOverhangAreasForPainting):
        Calculate the overhang in viewport coordinates for painting.

        * platform/ScrollView.h:
        (WebCore::ScrollView::constrainsScrollingToContentEdge):
        (WebCore::ScrollView::setConstrainsScrollingToContentEdge):
        Add bit to control whether the scroll position should be constrained
        to the content edge when set.

        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::usedTotalSize):
        (WebCore::ScrollbarThemeComposite::thumbPosition):
        (WebCore::ScrollbarThemeComposite::thumbLength):
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::paint):
        Improve calculations of thumb size and position to take overhang into account.

2011-01-27  Dirk Schulze  <krit@webkit.org>

        Reviewed by Nikolas Zimmermann.

        SVG animation of Paths with segments of different coordinate modes on begin and end
        https://bugs.webkit.org/show_bug.cgi?id=52984

        At the moment we just support SVG path animations, if the number of segments on the given start path
        is the same as the number of segments on the given end path. But a segment on a given position must be identical
        on both paths as well. Not only the segment type, also the coordinate mode of the segments must be identical.
        If MoveToRel is on the second position on the start path a MoveToRel must be on the second position
        of the end path too. According to the SVG spec, at least the coordinate mode can differ. Means, if we have MoveToRel
        in the start path, we can use MoveToAbs on the same position in the end path.

        This patch fixes the blending code to follow the spec here. It was necessary to track the current position of
        both paths, transform coordinates to the same coordinate mode and transform the resulting animation coordinate back
        to the coordinate mode of either the start or the end path. Which mode is taken depends on the progress of the
        animation.

        Tests: svg/animations/animate-path-animation-Cc-Ss.html
               svg/animations/animate-path-animation-Ll-Vv-Hh.html
               svg/animations/animate-path-animation-Qq-Tt.html
               svg/animations/animate-path-animation-cC-sS-inverse.html
               svg/animations/animate-path-animation-lL-vV-hH-inverse.html
               svg/animations/animate-path-animation-qQ-tT-inverse.html

        * svg/SVGPathBlender.cpp:
        (WebCore::blendFloatPoint):
        (WebCore::blendAnimatedFloat):
        (WebCore::SVGPathBlender::blendAnimatedDimensionalFloat):
        (WebCore::SVGPathBlender::blendAnimatedFloatPoint):
        (WebCore::SVGPathBlender::blendMoveToSegment):
        (WebCore::SVGPathBlender::blendLineToSegment):
        (WebCore::SVGPathBlender::blendLineToHorizontalSegment):
        (WebCore::SVGPathBlender::blendLineToVerticalSegment):
        (WebCore::SVGPathBlender::blendCurveToCubicSegment):
        (WebCore::SVGPathBlender::blendCurveToCubicSmoothSegment):
        (WebCore::SVGPathBlender::blendCurveToQuadraticSegment):
        (WebCore::SVGPathBlender::blendCurveToQuadraticSmoothSegment):
        (WebCore::SVGPathBlender::blendArcToSegment):
        (WebCore::coordinateModeOfCommand):
        (WebCore::isSegmentEqual):
        (WebCore::SVGPathBlender::blendAnimatedPath):
        (WebCore::SVGPathBlender::cleanup):
        * svg/SVGPathBlender.h:

2011-01-27  Cris Neckar  <cdn@chromium.org>

        Reviewed by Dimitri Glazkov.

        Clear the parent on a css keyframe's m_style when removing it from the stylesheet.
        https://bugs.webkit.org/show_bug.cgi?id=52320

        Test: fast/css/css-keyframe-style-crash.html

        * css/CSSRuleList.cpp:
        (WebCore::CSSRuleList::deleteRule):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::WebKitCSSKeyframesRule::~WebKitCSSKeyframesRule):

2011-01-27  Rob Buis  <rwlbuis@gmail.com>

        Reviewed by Kent Tamura.

        Color changes to option elements in a select multiple aren't drawn immediately
        https://bugs.webkit.org/show_bug.cgi?id=49790

        Redirect style changes on <option> element to the owner <select> element.

        Test: fast/repaint/select-option-background-color.html

        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::setRenderStyle):

2011-01-19  Stephen White  <senorblanco@chromium.org>

        Reviewed by Darin Adler.

        Fix performance regression in ImageQualityController::objectDestroyed().
        https://bugs.webkit.org/show_bug.cgi?id=52645

        In r72282, I inadvertently introduced this regression by using a
        linear search through the hash map on object destruction.  This was
        because the hash key consisted of both object pointer and layer id,
        but on object destruction we only know the object pointer, requiring
        a search to find all the layers. 
        By replacing the hash map with two nested hash maps, where the outer key
        is the object and the inner key is the layer, we can find all the
        relevant data for an object in one hash lookup.

        * rendering/RenderBoxModelObject.cpp:
        Replace the (object,layer)->size HashMap with object->layer and
        layer->size HashMaps.
        (WebCore::ImageQualityController::isEmpty):
        Implement isEmpty() for the outer HashMap.
        (WebCore::ImageQualityController::removeLayer):
        When a layer is removed, remove it from the inner hash map.
        (WebCore::ImageQualityController::set):
        Implement set():  if the inner map exists, set the layer->size tuple
        directly.  If not, create a new inner map, set the tuple, and insert
        it in the outer map.
        (WebCore::ImageQualityController::objectDestroyed):
        Look up the object in the outer map only.
        (WebCore::ImageQualityController::highQualityRepaintTimerFired):
        Cosmetic changes for the renamed now-outer hash map.
        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
        Do both outer and inner hash map lookups.  Call set() to add/update
        entries to the hash maps.  keyDestroyed() is now removeLayer().
        (WebCore::imageQualityController):
        Make the ImageQualityController a file-static global, so it can be
        created and destroyed on the fly.
        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
        If there is no ImageQualityController, don't call objectDestroyed().
        If it's empty, delete it.


2011-01-26  Enrica Casucci  <enrica@apple.com>

        Reviewed by Darin Adler and Adam Roben.

        WebKit2: add support for drag and drop on Windows
        https://bugs.webkit.org/show_bug.cgi?id=52775
        <rdar://problem/8514409>
        
        On Windows the access to the content being dragged is
        provided via the IDataObject interface that is made available
        to the window that registers itself as drop target.
        Since this interface cannot be accessed from the WebProcess,
        in every call to one of the methods of the IDropTarget interface
        we serialize the content of the drag clipboard and send it over to
        the WebProcess.
        The bulk of this patch consists in the refactoring needed in DragData
        and ClipboardWin classes to extract the data from the serialized object.
        
        * platform/DragData.cpp:
        * platform/DragData.h:
        * platform/win/ClipboardUtilitiesWin.cpp:
        (WebCore::getWebLocData):
        (WebCore::getURL):
        (WebCore::getPlainText):
        (WebCore::getTextHTML):
        (WebCore::getCFHTML):
        (WebCore::fragmentFromFilenames):
        (WebCore::containsFilenames):
        (WebCore::fragmentFromHTML):
        (WebCore::containsHTML):
        (WebCore::getClipboardData):
        * platform/win/ClipboardUtilitiesWin.h:
        * platform/win/ClipboardWin.cpp:
        (WebCore::Clipboard::create):
        (WebCore::ClipboardWin::ClipboardWin):
        (WebCore::ClipboardWin::getData):
        (WebCore::ClipboardWin::types):
        (WebCore::ClipboardWin::files):
        (WebCore::ClipboardWin::hasData):
        * platform/win/ClipboardWin.h:
        (WebCore::ClipboardWin::create):
        * platform/win/DragDataWin.cpp:
        (WebCore::DragData::DragData):
        (WebCore::DragData::containsURL):
        (WebCore::DragData::dragDataMap):
        (WebCore::DragData::asURL):
        (WebCore::DragData::containsFiles):
        (WebCore::DragData::asFilenames):
        (WebCore::DragData::containsPlainText):
        (WebCore::DragData::asPlainText):
        (WebCore::DragData::canSmartReplace):
        (WebCore::DragData::containsCompatibleContent):
        (WebCore::DragData::asFragment):

2011-01-27  Mario Sanchez Prada  <msanchez@igalia.com>

        Reviewed by Martin Robinson.

        [GTK] Space characters in source document interfere with reported caret offset
        https://bugs.webkit.org/show_bug.cgi?id=53033

        Calculate caret offset from rendered text instead of from node contents.

        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
        (objectAndOffsetUnignored): Calculate the caret offset based only
        on positions and ranges, instead of using the computed offset in
        the container node.

2011-01-26  Alexey Proskuryakov  <ap@apple.com>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=53197
        <rdar://problem/8895682> Make WebKit2 printing asynchronous

        * WebCore.exp.in: Export more PrintContext methods that we didn't use on Mac before.

        * page/PrintContext.cpp: (WebCore::PrintContext::spoolRect): Changed to make the same
        transformation as spoolPages does for consistency.

2011-01-27  David Grogan  <dgrogan@google.com>

        Reviewed by Jeremy Orlow.

        initial support for close() in indexeddb backend
        https://bugs.webkit.org/show_bug.cgi?id=53150

        Test: storage/indexeddb/transaction-after-close.html

        * storage/IDBDatabase.cpp:
        (WebCore::IDBDatabase::IDBDatabase):
        (WebCore::IDBDatabase::transaction):
        (WebCore::IDBDatabase::close):
        * storage/IDBDatabase.h:
        * storage/IDBDatabase.idl:
        * storage/IDBDatabaseBackendImpl.cpp:
        (WebCore::IDBDatabaseBackendImpl::transaction):
        (WebCore::IDBDatabaseBackendImpl::close):

2011-01-27  Dirk Schulze  <krit@webkit.org>

        Reviewed by Nikolas Zimmermann.

        SVG animation doesn't support calcMode discrete for number and color values.
        https://bugs.webkit.org/show_bug.cgi?id=53189

        Add support for calcMode discrete on number and color animation.

        Tests: svg/animations/animate-color-calcMode-discrete.html
               svg/animations/animate-number-calcMode-discrete.html

        * svg/SVGAnimateElement.cpp:
        (WebCore::SVGAnimateElement::calculateAnimatedValue):

2011-01-26  Zhenyao Mo  <zmo@google.com>

        Reviewed by Kenneth Russell.

        shaderSource needs to preserve original source
        https://bugs.webkit.org/show_bug.cgi?id=52833

        Test: fast/canvas/webgl/gl-getshadersource.html

        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::getShaderParameter): Intercept SHADER_SOURCE_LENGTH.
        (WebCore::WebGLRenderingContext::getShaderSource): Intercept the call.
        (WebCore::WebGLRenderingContext::shaderSource): Cache the source.
        * html/canvas/WebGLShader.cpp: Cache shader source.
        (WebCore::WebGLShader::WebGLShader):
        * html/canvas/WebGLShader.h: Ditto.
        (WebCore::WebGLShader::getSource):
        (WebCore::WebGLShader::setSource):

2011-01-27  Patrick Gansterer  <paroga@webkit.org>

        Unreviewed WinCE build fix for r76743.

        * platform/graphics/wince/FontWinCE.cpp:
        (WebCore::TextRunComponent::TextRunComponent):

2011-01-27  Pavel Podivilov  <podivilov@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: Closure and Global variable details automatically collapsing on each step through JavaScript code.
        https://bugs.webkit.org/show_bug.cgi?id=53234

        * inspector/front-end/ScopeChainSidebarPane.js:
        (WebInspector.ScopeChainSidebarPane):
        (WebInspector.ScopeChainSidebarPane.prototype.update):

2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r76789.
        http://trac.webkit.org/changeset/76789
        https://bugs.webkit.org/show_bug.cgi?id=53238

        Broke GTK layout tests (Requested by podivilov on #webkit).

        * inspector/front-end/ScopeChainSidebarPane.js:
        (WebInspector.ScopeChainSidebarPane):
        (WebInspector.ScopeChainSidebarPane.prototype.update):

2011-01-27  Yury Semikhatsky  <yurys@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: store all settings related to the agents on the frontend side
        https://bugs.webkit.org/show_bug.cgi?id=53174

        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.exp.in:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/ScriptDebugServer.cpp:
        * bindings/js/ScriptDebugServer.h:
        * bindings/js/ScriptProfiler.cpp:
        * bindings/js/ScriptProfiler.h:
        * bindings/v8/ScriptDebugServer.cpp:
        * bindings/v8/ScriptDebugServer.h:
        * bindings/v8/ScriptProfiler.cpp:
        * bindings/v8/ScriptProfiler.h:
        * inspector/Inspector.idl:
        * inspector/InspectorAgent.cpp: profiler and debugger enablement state is now stored
        on the front-end side and will be pushed to the backend when the frontend is loaded.
        (WebCore::InspectorAgent::InspectorAgent):
        (WebCore::InspectorAgent::disconnectFrontend):
        (WebCore::InspectorAgent::restoreDebugger):
        (WebCore::InspectorAgent::restoreProfiler):
        (WebCore::InspectorAgent::enableProfiler):
        (WebCore::InspectorAgent::disableProfiler):
        (WebCore::InspectorAgent::showAndEnableDebugger):
        (WebCore::InspectorAgent::enableDebugger):
        (WebCore::InspectorAgent::disableDebugger):
        * inspector/InspectorAgent.h:
        * inspector/InspectorConsoleAgent.cpp: XHR failures will be logged to the console only
        if the front-end was opened during current browser session and XHR logging is turned on
        there.
        (WebCore::InspectorConsoleAgent::setMonitoringXHREnabled):
        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
        * inspector/InspectorDebuggerAgent.cpp:
        * inspector/InspectorDebuggerAgent.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::identifierForInitialRequestImpl):
        (WebCore::InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl):
        * inspector/InspectorProfilerAgent.cpp:
        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
        * inspector/InspectorSettings.cpp: Removed.
        * inspector/InspectorSettings.h: Removed.
        * inspector/InspectorState.cpp:
        (WebCore::InspectorState::InspectorState):
        * inspector/InspectorState.h:
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessagesCleared):
        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher):
        (WebInspector.ConsoleView.prototype._handleContextMenuEvent.itemAction):
        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
        * inspector/front-end/Settings.js:
        (WebInspector.Settings):
        * inspector/front-end/inspector.js:

2011-01-27  Pavel Podivilov  <podivilov@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: Closure and Global variable details automatically collapsing on each step through JavaScript code.
        https://bugs.webkit.org/show_bug.cgi?id=53234

        * inspector/front-end/ScopeChainSidebarPane.js:
        (WebInspector.ScopeChainSidebarPane):
        (WebInspector.ScopeChainSidebarPane.prototype.update):

2011-01-27  Alexander Pavlov  <apavlov@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: [Elements panel] Tooltip for relative links incorrectly identifies current URL
        https://bugs.webkit.org/show_bug.cgi?id=53171

        * inspector/front-end/inspector.js:
        (WebInspector.completeURL): Taught to understand partial href's that start with "?" (contain GET parameters only)

2011-01-27  Yury Semikhatsky  <yurys@chromium.org>

        Reviewed by Pavel Feldman.

        [V8] Crash in WebCore::addMessageToConsole
        https://bugs.webkit.org/show_bug.cgi?id=53227

        * bindings/v8/V8Proxy.cpp: check that the Frame where the error
        occured still has a page before getting a console object from it.
        (WebCore::V8Proxy::reportUnsafeAccessTo):

2011-01-27  Hans Wennborg  <hans@chromium.org>

        Reviewed by Jeremy Orlow.

        IndexedDB: Remove IDBCallbacks::onSuccess() used for null values.
        https://bugs.webkit.org/show_bug.cgi?id=53178

        Remove the IDBCallbacks::onSuccess() function that was used for
        null values, and replace such calls with calls to
        IDBCallBacks::onSuccess(SerializedScriptValue::nullValue())
        instead.

        No new functionality, so no new tests.

        * storage/IDBCallbacks.h:
        * storage/IDBCursorBackendImpl.cpp:
        (WebCore::IDBCursorBackendImpl::updateInternal):
        (WebCore::IDBCursorBackendImpl::continueFunctionInternal):
        * storage/IDBIndexBackendImpl.cpp:
        (WebCore::IDBIndexBackendImpl::openCursorInternal):
        * storage/IDBObjectStoreBackendImpl.cpp:
        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
        * storage/IDBRequest.cpp:
        * storage/IDBRequest.h:

2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r76773.
        http://trac.webkit.org/changeset/76773
        https://bugs.webkit.org/show_bug.cgi?id=53230

        breaks multiple GTK media tests (Requested by philn-tp on
        #webkit).

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::mimeTypeCache):

2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r76770.
        http://trac.webkit.org/changeset/76770
        https://bugs.webkit.org/show_bug.cgi?id=53229

        Some inspector tests fail (Requested by yurys on #webkit).

        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.exp.in:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::isDebuggerAlwaysEnabled):
        * bindings/js/ScriptDebugServer.h:
        * bindings/js/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::isProfilerAlwaysEnabled):
        * bindings/js/ScriptProfiler.h:
        * bindings/v8/ScriptDebugServer.cpp:
        (WebCore::ScriptDebugServer::isDebuggerAlwaysEnabled):
        * bindings/v8/ScriptDebugServer.h:
        * bindings/v8/ScriptProfiler.cpp:
        (WebCore::ScriptProfiler::isProfilerAlwaysEnabled):
        * bindings/v8/ScriptProfiler.h:
        * inspector/Inspector.idl:
        * inspector/InspectorAgent.cpp:
        (WebCore::InspectorAgent::InspectorAgent):
        (WebCore::InspectorAgent::disconnectFrontend):
        (WebCore::InspectorAgent::restoreDebugger):
        (WebCore::InspectorAgent::restoreProfiler):
        (WebCore::InspectorAgent::ensureSettingsLoaded):
        (WebCore::InspectorAgent::enableProfiler):
        (WebCore::InspectorAgent::disableProfiler):
        (WebCore::InspectorAgent::showAndEnableDebugger):
        (WebCore::InspectorAgent::enableDebugger):
        (WebCore::InspectorAgent::disableDebugger):
        * inspector/InspectorAgent.h:
        (WebCore::InspectorAgent::settings):
        * inspector/InspectorConsoleAgent.cpp:
        (WebCore::InspectorConsoleAgent::setMonitoringXHREnabled):
        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::isDebuggerAlwaysEnabled):
        * inspector/InspectorDebuggerAgent.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::identifierForInitialRequestImpl):
        (WebCore::InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl):
        * inspector/InspectorProfilerAgent.cpp:
        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
        * inspector/InspectorSettings.cpp: Added.
        (WebCore::InspectorSettings::InspectorSettings):
        (WebCore::InspectorSettings::getBoolean):
        (WebCore::InspectorSettings::setBoolean):
        (WebCore::InspectorSettings::getLong):
        (WebCore::InspectorSettings::setLong):
        (WebCore::InspectorSettings::registerBoolean):
        (WebCore::InspectorSettings::registerLong):
        * inspector/InspectorSettings.h: Copied from Source/WebCore/bindings/v8/ScriptProfiler.h.
        * inspector/InspectorState.cpp:
        (WebCore::InspectorState::InspectorState):
        * inspector/InspectorState.h:
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.monitoringXHRStateChanged):
        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher):
        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
        * inspector/front-end/Settings.js:
        (WebInspector.Settings):
        * inspector/front-end/inspector.js:

2011-01-26  Philippe Normand  <pnormand@igalia.com>

        Reviewed by Martin Robinson.

        [GTK] LayoutTests/media/audio-mpeg4-supported.html fails
        https://bugs.webkit.org/show_bug.cgi?id=53125

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::mimeTypeCache): Add audio/x-m4a mimetype in the cache.

2011-01-26  Yury Semikhatsky  <yurys@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: store all settings related to the agents on the frontend side
        https://bugs.webkit.org/show_bug.cgi?id=53174

        * CMakeLists.txt:
        * GNUmakefile.am:
        * WebCore.exp.in:
        * WebCore.gypi:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/Inspector.idl:
        * inspector/InspectorAgent.cpp: profiler and debugger enablement state is now stored
        on the front-end side and will be pushed to the backend when the frontend is loaded.
        (WebCore::InspectorAgent::InspectorAgent):
        (WebCore::InspectorAgent::disconnectFrontend):
        (WebCore::InspectorAgent::restoreDebugger):
        (WebCore::InspectorAgent::restoreProfiler):
        (WebCore::InspectorAgent::enableProfiler):
        (WebCore::InspectorAgent::disableProfiler):
        (WebCore::InspectorAgent::showAndEnableDebugger):
        (WebCore::InspectorAgent::enableDebugger):
        (WebCore::InspectorAgent::disableDebugger):
        * inspector/InspectorAgent.h:
        * inspector/InspectorConsoleAgent.cpp: XHR failures will be logged to the console only
        if the front-end was opened during current browser session and XHR logging is turned on
        there.
        (WebCore::InspectorConsoleAgent::setMonitoringXHREnabled):
        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::identifierForInitialRequestImpl):
        (WebCore::InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl):
        * inspector/InspectorProfilerAgent.cpp:
        (WebCore::InspectorProfilerAgent::enable):
        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
        * inspector/InspectorProfilerAgent.h:
        * inspector/InspectorSettings.cpp: Removed.
        * inspector/InspectorSettings.h: Removed.
        * inspector/InspectorState.cpp:
        (WebCore::InspectorState::InspectorState):
        * inspector/InspectorState.h:
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessagesCleared):
        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher):
        (WebInspector.ConsoleView.prototype._handleContextMenuEvent.itemAction):
        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
        * inspector/front-end/Settings.js:
        (WebInspector.Settings):
        * inspector/front-end/inspector.js:

2011-01-27  Dan Bernstein  <mitz@apple.com>

        Reviewed by Sam Weinig.

        REGRESSION (r76743): Uneven spacing in right-to-left justified text
        https://bugs.webkit.org/show_bug.cgi?id=53225

        Fixes failure in fast/text/atsui-spacing-features.html

        There was an inconsistency between rendering code and font code in the interpretation of
        'after expansion' and 'trailing expansion'. Changed all code to interpret these in terms of
        visual order rather than logical.

        * platform/graphics/Font.cpp:
        (WebCore::Font::expansionOpportunityCount): Added a text direction parameter and changed to
        iterate in visual order accordingly.
        * platform/graphics/Font.h:
        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::WidthIterator): Pass the run direction to expansionOpportunityCount().
        (WebCore::WidthIterator::advance): For right-to-left runs, evaluate the trailing expansion
        condition with respect to the first character, which is the trailing character in visual order.
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::ComplexTextController): Pass the run direction to
        expansionOpportunityCount().
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Ditto.

2011-01-26  Adam Roben  <aroben@apple.com>

        Don't create the Direct3D device before it's first needed

        We only need the device once we decide to render. There's no point in creating it before
        then.

        Reviewed by Sam Weinig.

        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        (WebCore::CACFLayerTreeHost::setWindow): Removed the call to createRenderer() from here.
        We already have code to create it when we first try to draw.
        (WebCore::CACFLayerTreeHost::createRenderer): Flush the context after we set our layer's
        bounds so that the bounds will take effect the next time we render (which could be just
        after this function returns).

2011-01-26  Adam Roben  <aroben@apple.com>

        Add assertions that CACFLayerTreeHost gains and loses an HWND only once

        CACFLayerTreeHost doesn't support any other use pattern.

        Reviewed by Sam Weinig.

        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        (WebCore::CACFLayerTreeHost::CACFLayerTreeHost): Initialize new member.
        (WebCore::CACFLayerTreeHost::setWindow): Assert that we transition from not having a window,
        to having a window, to not having a window just once over the lifetime of this object.

        * platform/graphics/ca/win/CACFLayerTreeHost.h: Added m_state.

2011-01-26  Adam Roben  <aroben@apple.com>

        Notify layers that their animations have started when we flush the context, not when we
        render

        r76372 separated context flushing from rendering, but this bit of code got left behind.

        Reviewed by Sam Weinig.

        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        (WebCore::CACFLayerTreeHost::render): Moved code to notify the layers from here to
        notifyAnimationsStarted.
        (WebCore::CACFLayerTreeHost::flushPendingLayerChangesNow): Added a call to
        notifyAnimationsStarted after we flush the context.
        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted): Added. Code came from render. Changed
        to call PlatformCALayer::animationStarted rather than calling through to the client
        directly.

        * platform/graphics/ca/win/CACFLayerTreeHost.h: Added notifyAniamtionsStarted.

2011-01-26  Adam Roben  <aroben@apple.com>

        Small cleanup in MediaPlayerPrivateFullscreenWindow

        Reviewed by Sam Weinig.

        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
        (WebCore::MediaPlayerPrivateFullscreenWindow::~MediaPlayerPrivateFullscreenWindow): Moved
        code here from close(), since this was the only place that called it after the following
        change to createWindow.
        (WebCore::MediaPlayerPrivateFullscreenWindow::createWindow): Replaced code that handled the
        case where we had already created the window with an assertion that we have not already done
        so. Our single caller (FullscreenVideoController) did not require this behavior.

        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h: Removed layerView.

2011-01-26  Sam Weinig  <sam@webkit.org>

        Reviewed by Adam Roben.

        Move ScrollView scroll wheel code to ScrollAnimator.

        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::handleWheelEvent):
        * platform/ScrollAnimator.h:
        Moved implementation of handleWheelEvent from ScrollView::wheelEvent.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::wheelEvent):
        Call down to the ScrollableArea.

        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::handleWheelEvent):
        Call down to the ScrollAnimator.

        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::scrollPosition):
        (WebCore::ScrollableArea::minimumScrollPosition):
        (WebCore::ScrollableArea::maximumScrollPosition):
        (WebCore::ScrollableArea::visibleContentRect):
        (WebCore::ScrollableArea::visibleHeight):
        (WebCore::ScrollableArea::visibleWidth):
        Add functions needed to implement wheel event in the animator.

2011-01-26  David Kilzer  <ddkilzer@apple.com>

        <http://webkit.org/b/53192> Add experimental support for HTTP pipelining in CFNetwork
        <rdar://problem/8821760>

        Reviewed by Antti Koivisto.

        This adds support for HTTP pipelining in CFNetwork, but does not
        enable it.  To enable it post-SnowLeopard, use this command:

            defaults write BUNDLE.ID WebKitEnableHTTPPipelining -bool YES

        Once enabled, it is possible to force the same load priority
        (high) to be sent to CFNetwork to allow WebCore to handle the
        scheduling:

            defaults write BUNDLE.ID WebKitForceHTTPPipeliningPriorityHigh -bool YES

        * WebCore.exp.in: Export _wkGetHTTPPipeliningPriority and
        _wkSetHTTPPipeliningPriority.

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
        Copy the priority to preflightRequest.

        * loader/ResourceLoadScheduler.cpp:
        (WebCore::ResourceLoadScheduler::scheduleLoad): Refactored code
        at the end of the method to use an early return.

        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::load): Set the priority on the
        ResourceRequest object based on the priority of the
        CachedResourceRequest before calling
        ResourceLoadScheduler::scheduleSubresourceLoad().

        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading): Create a ResourceRequest
        object and set its priority to ResourceLoadPriorityLow before
        passing it to ResourceLoadScheduler::scheduleSubresourceLoad().

        * platform/mac/WebCoreSystemInterface.h:
        (wkGetHTTPPipeliningPriority): Added.
        (wkSetHTTPPipeliningPriority): Added.
        * platform/mac/WebCoreSystemInterface.mm:
        (wkGetHTTPPipeliningPriority): Added.
        (wkSetHTTPPipeliningPriority): Added.

        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::adopt): Set m_priority when
        adopting a CrossThreadResourceRequestData.
        (WebCore::ResourceRequestBase::copyData): Set m_priority when
        creating a CrossThreadResourceRequestData.
        (WebCore::ResourceRequestBase::priority): Added.
        (WebCore::ResourceRequestBase::setPriority): Added.
        (WebCore::equalIgnoringHeaderFields): Priorities must match when
        comparing two ResourceRequest objects.

        * platform/network/ResourceRequestBase.h:
        (WebCore::ResourceRequestBase::ResourceRequestBase): Set default
        priority of new objects to ResourceLoadPriorityLow.
        (WebCore::ResourceRequestBase::priority): Added declaration.
        (WebCore::ResourceRequestBase::setPriority): Added declaration.
        (WebCore::isHTTPPipeliningEnabled): Added.
        (WebCore::shouldUseHTTPPipeliningPriority): Added.

        * platform/network/cf/ResourceRequestCFNet.cpp: Updated so that
        Mac OS X and Windows share code.
        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Always
        set the HTTP connection count per host, but return an
        'unlimited' value when using HTTP pipelining.  This method used
        to be defined in ResourceRequestMac.mm for Mac OS X.
        (WebCore::readBooleanPreference): Added.  Helper method for
        reading boolean user defaults.
        (WebCore::isHTTPPipeliningEnabled): Returns value of user
        default key WebKitEnableHTTPPipelining, or false if not set.
        (WebCore::shouldUseHTTPPipeliningPriority): Returns value of
        user default key WebKitForceHTTPPipeliningPriorityHigh, or false
        if not set.
        * platform/network/cf/ResourceRequestCFNet.h: Updated so that
        Mac OS X and Windows share code.  Fixed indentation.
        (WebCore::mapHTTPPipeliningPriorityToResourceLoadPriority): Added.
        (WebCore::mapResourceLoadPriorityToHTTPPipeliningPriority): Added.

        * platform/network/mac/ResourceRequestMac.mm:
        (WebCore::ResourceRequest::doUpdatePlatformRequest): Update
        HTTP pipelining priority on NSMutableFURLRequest object.
        (WebCore::ResourceRequest::doUpdateResourceRequest): Update
        m_priority from the NSURLRequest object.
        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Removed.
        Code is now shared with Windows in ResourceRequestCFNet.cpp.

2011-01-26  Beth Dakin  <bdakin@apple.com>

        Reviewed by Darin Adler.

        Fix for <rdar://problem/8895140> Adopt WKScrollbar metrics 
        when using WKScrollbars.

        New WebKitSystemInterface Functionality.
        * WebCore.exp.in:
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:

        Some of the terrible static arrays are now only needed in the 
        old non-WK code, so they are if-def'd now.
        * platform/mac/ScrollbarThemeMac.mm:
        
        Just patching this function in a better way than I did
        before.
        (WebCore::updateArrowPlacement):
        
        Call into WK for the right values.
        (WebCore::ScrollbarThemeMac::scrollbarThickness):
        (WebCore::ScrollbarThemeMac::hasThumb):
        (WebCore::ScrollbarThemeMac::minimumThumbLength):
        
        Return false if there are no buttons.
        (WebCore::ScrollbarThemeMac::hasButtons):

        Return an empty IntRect if there are not buttons.
        (WebCore::buttonRepaintRect):

2011-01-26  Sam Weinig  <sam@webkit.org>

        Reviewed by Maciej Stachowiak.

        Add events to represent the start/end of a gesture scroll
        https://bugs.webkit.org/show_bug.cgi?id=53215

        * WebCore.exp.in: 
        Add new file.

        * WebCore.xcodeproj/project.pbxproj:
        Add new file.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleGestureEvent):
        * page/EventHandler.h:
        Add entry point for handling gesture events.

        * platform/PlatformGestureEvent.h: Added.
        (WebCore::PlatformGestureEvent::PlatformGestureEvent):
        (WebCore::PlatformGestureEvent::type):
        (WebCore::PlatformGestureEvent::position):
        (WebCore::PlatformGestureEvent::globalPosition):
        (WebCore::PlatformGestureEvent::timestamp):
        Add platform agnostic representation of a gesture event.

2011-01-26  Dan Bernstein  <mitz@apple.com>

        Reviewed by Dave Hyatt.

        <rdar://problem/8446709> Allow inter-ideograph justification for CJK
        https://bugs.webkit.org/show_bug.cgi?id=53184

        Tests: fast/text/justify-ideograph-complex.html
               fast/text/justify-ideograph-simple.html
               fast/text/justify-ideograph-vertical.html

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawTextInternal): Corrected the type of the third parameter
        passed to the TextRun constructor and added the trailingExpansionBehavior parameter.
        * platform/graphics/Font.cpp:
        (WebCore::Font::expansionOpportunityCount): Added. Returns the number of expansion opportunities
        for text justification. On entry, isAfterExpansion says whether an expansion opportunity exists
        before the first character. On return, isAfterExpansion says whether an expansion opportunity
        exists after the last character.
        * platform/graphics/Font.h: 
        * platform/graphics/GlyphBuffer.h:
        (WebCore::GlyphBuffer::expandLastAdvance): Added.
        * platform/graphics/TextRun.h:
        (WebCore::TextRun::TextRun): Added a TrailingExpansionBehavior parameter to the constructors.
        Renamed padding to expansion.
        (WebCore::TextRun::expansion): Renamed padding() to this.
        (WebCore::TextRun::allowsTrailingExpansion): Added this accessor.
        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::WidthIterator): Initialize m_isAfterExpansion. Use Font::expansionOpportunityCount()
        and adjust the count if it includes a trailing expansion opportunity but the run disallows trailing
        expansion.
        (WebCore::WidthIterator::advance): Apply expansion before and after CJK ideographs.
        (WebCore::WidthIterator::advanceOneCharacter): Changed to not clear the GlyphBuffer so that advance()
        can expand the last advance if it is followed by a CJK ideograph.
        * platform/graphics/WidthIterator.h: Renamed m_padding to m_expansion and m_padPerSpace
        to m_expansionPerOpportunity.
        * platform/graphics/chromium/FontChromiumWin.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/chromium/FontLinux.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/efl/FontEfl.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/gtk/FontGtk.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/haiku/FontHaiku.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::ComplexTextController): Initialize m_isAfterExpansion. Use
        Font::expansionOpportunityCount() and adjust the count if it includes a trailing expansion
        opportunity but the run disallows trailing expansion.
        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Moved the definition and initialization
        of hasExtraSpacing outside the loop. Apply expansion before and after CJK ideographs.
        * platform/graphics/mac/ComplexTextController.h: Renamed m_padding to m_expansion and m_padPerSpace
        to m_expansionPerOpportunity.
        * platform/graphics/mac/FontMac.mm:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/qt/FontQt.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/win/FontWin.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/win/UniscribeController.cpp:
        (WebCore::UniscribeController::UniscribeController): Updated for rename.
        * platform/graphics/wince/FontWinCE.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * platform/graphics/wx/FontWx.cpp:
        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
        * rendering/EllipsisBox.cpp:
        (WebCore::EllipsisBox::paint): Pass a TrailingExpansionBehavior to the TextRun constructor.
        (WebCore::EllipsisBox::selectionRect): Ditto.
        (WebCore::EllipsisBox::paintSelection): Ditto.
        * rendering/InlineBox.h:
        (WebCore::InlineBox::InlineBox): Renamed m_toAdd to m_expansion.
        (WebCore::InlineBox::expansion): Renamed toAdd() to this.
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::selectionRect): Pass a TrailingExpansionBehavior to the TextRun constructor.
        (WebCore::InlineTextBox::paint): Ditto.
        (WebCore::InlineTextBox::paintSelection): Ditto.
        (WebCore::InlineTextBox::paintCompositionBackground): Ditto.
        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker): Ditto.
        (WebCore::InlineTextBox::paintTextMatchMarker): Ditto.
        (WebCore::InlineTextBox::computeRectForReplacementMarker): Ditto.
        (WebCore::InlineTextBox::offsetForPosition): Ditto.
        (WebCore::InlineTextBox::positionForOffset): Ditto.
        * rendering/InlineTextBox.h:
        (WebCore::InlineTextBox::setExpansion): Renamed setSpaceAdd() to this.
        (WebCore::InlineTextBox::trailingExpansionBehavior): Added. Trailing expansion is allowed if this
        is not the last leaf box on the line.
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Keep expansion opportunity counts
        in a vector instead of computing them twice. Discard the trailing expansion opportunity in the
        last text box.
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::paintObject): Pass a TrailingExpansionBehavior to the TextRun constructor.
        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths): Ditto.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::updateFromElement): Ditto.
        (WebCore::RenderListBox::paintItemForeground): Ditto. Also corrected the type of the second parameter.
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::getAvgCharWidth): Ditto.
        (WebCore::RenderTextControl::paintPlaceholder): Ditto.
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::constructTextRun): Ditto.

2011-01-26  Andy Estes  <aestes@apple.com>

        Rubber-stamped by Darin Adler.

        Inline HTMLObjectElement::hasValidClassId().

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::hasValidClassId):

2011-01-26  Evan Martin  <evan@chromium.org>

        Reviewed by Tony Chang.

        [chromium] crash on getBoundingClientRect in complex text
        https://bugs.webkit.org/show_bug.cgi?id=53199

        Use the correct array bound; we want the number of characters processed by
        the shaper, not the longest continuous script run length.

        Test: platform/chromium-linux/fast/text/international/complex-text-rectangle.html

        * platform/graphics/chromium/ComplexTextControllerLinux.cpp:
        (WebCore::ComplexTextController::nextScriptRun):
        * platform/graphics/chromium/ComplexTextControllerLinux.h:
        (WebCore::ComplexTextController::numCodePoints):

2011-01-26  Emil A Eklund  <eae@chromium.org>

        Reviewed by Alexey Proskuryakov.

        Remove cached document reference from CSSStyleSheet and XSLStyleSheet.
        https://bugs.webkit.org/show_bug.cgi?id=52084

        Test: fast/dom/css-delete-doc.html

        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::insertRule):
        (WebCore::CSSMediaRule::deleteRule):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::CSSStyleSheet):
        (WebCore::CSSStyleSheet::document):
        * css/CSSStyleSheet.h:
        * xml/XSLStyleSheet.h:
        (WebCore::XSLStyleSheet::parentStyleSheet):
        * xml/XSLStyleSheetLibxslt.cpp:
        (WebCore::XSLStyleSheet::XSLStyleSheet):
        (WebCore::XSLStyleSheet::cachedResourceLoader):
        (WebCore::XSLStyleSheet::setParentStyleSheet):
        (WebCore::XSLStyleSheet::ownerDocument):
        * xml/XSLStyleSheetQt.cpp:
        (WebCore::XSLStyleSheet::XSLStyleSheet):
        (WebCore::XSLStyleSheet::cachedResourceLoader):
        (WebCore::XSLStyleSheet::ownerDocument):

2011-01-25  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by Kent Tamura.

        Reduce ref-count churn in shadowPseudoId.
        https://bugs.webkit.org/show_bug.cgi?id=53136

        Refactoring, so no new tests.

        * dom/Element.h:
        (WebCore::Element::shadowPseudoId): Changed signature to use const AtomicString&
        * html/ValidationMessage.cpp:
        (WebCore::ElementWithPseudoId::shadowPseudoId): Ditto.
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::shadowPseudoId): Ditto, plus moved from the header file.
        * html/shadow/SliderThumbElement.h: Ditto.
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlMuteButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlVolumeSliderMuteButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlPlayButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlSeekForwardButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlSeekBackButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlRewindButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlReturnToRealtimeButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlTimelineElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlVolumeSliderElement::shadowPseudoId): Ditto.
        (WebCore::MediaControlFullscreenButtonElement::shadowPseudoId): Ditto.
        * rendering/MediaControlElements.h: Ditto.

2011-01-26  Dave Hyatt  <hyatt@apple.com>

        Reviewed by Dan Bernstein.

        https://bugs.webkit.org/show_bug.cgi?id=46421, make multi-column layout work with vertical text.

        Added new tests in fast/multicol/vertical-lr and fast/multicol/vertical-rl.

        * css/html.css:
        Update p, blockquote and h1-h6 to respect directionality so that column layout tests that use those
        elements work properly.

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
        Fix a flipping bug with the computation of lineTopIncludingMargins where it could be incorrectly shrunk
        in some cases (causing lines to all stack on top of one another).

        * rendering/InlineTextBox.h:
        (WebCore::InlineTextBox::calculateBoundaries):
        Fix calculateBoundaries to be physical rather than logical.

        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::addForcedColumnBreak):
        * rendering/LayoutState.h:
        Rename childY to childLogicalOffset.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::layoutBlock):
        (WebCore::RenderBlock::addOverflowFromChildren):
        (WebCore::RenderBlock::addOverflowFromFloats):
        (WebCore::RenderBlock::collapseMargins):
        (WebCore::RenderBlock::estimateLogicalTopPosition):
        (WebCore::RenderBlock::layoutBlockChild):
        (WebCore::RenderBlock::markForPaginationRelayoutIfNeeded):
        (WebCore::RenderBlock::paintColumnRules):
        (WebCore::RenderBlock::paintColumnContents):
        (WebCore::RenderBlock::paintFloats):
        (WebCore::RenderBlock::selectionGaps):
        (WebCore::RenderBlock::removeFloatingObjectsBelow):
        (WebCore::RenderBlock::addOverhangingFloats):
        (WebCore::RenderBlock::hitTestFloats):
        (WebCore::RenderBlock::hitTestColumns):
        (WebCore::RenderBlock::calcColumnWidth):
        (WebCore::RenderBlock::desiredColumnWidth):
        (WebCore::RenderBlock::columnRectAt):
        (WebCore::RenderBlock::layoutColumns):
        (WebCore::RenderBlock::adjustPointToColumnContents):
        (WebCore::RenderBlock::adjustRectForColumns):
        (WebCore::RenderBlock::flipForWritingModeIncludingColumns):
        (WebCore::RenderBlock::adjustForColumns):
        (WebCore::RenderBlock::adjustForBorderFit):
        (WebCore::RenderBlock::nextPageLogicalTop):
        (WebCore::RenderBlock::applyBeforeBreak):
        (WebCore::RenderBlock::applyAfterBreak):
        (WebCore::RenderBlock::adjustForUnsplittableChild):
        (WebCore::RenderBlock::adjustLinePositionForPagination):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::logicalRightOffsetForContent):
        (WebCore::RenderBlock::logicalLeftOffsetForContent):
        (WebCore::RenderBlock::leftForFloatIncludingMargin):
        (WebCore::RenderBlock::topForFloatIncludingMargin):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutInlineChildren):
        (WebCore::RenderBlock::determineStartPosition):
        Reworking of all the RenderBlock column functions to support flipping and vertical modes.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::offsetFromContainer):
        (WebCore::RenderBox::flipForWritingModeIncludingColumns):
        Patch offsetFromContainer to be aware of flipped block writing modes when dealing with column layouts.

        * rendering/RenderBox.h:
        (WebCore::RenderBox::clientLogicalBottom):
        Fix a bug in clientLogicalBottom where it didn't add in the right border/padding.
        
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::layoutBlock):
        Better terminology for pagination.

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetFromContainer):
        (WebCore::RenderInline::mapLocalToContainer):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintChildLayerIntoColumns):
        (WebCore::RenderLayer::hitTestChildLayerColumns):
        (WebCore::RenderLayer::localBoundingBox):
        (WebCore::RenderLayer::boundingBox):
        Patch painting in RenderLayers to be vertical-text-aware.
    
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::mapLocalToContainer):
        Add code to be flipped block-aware with columns.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::layout):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::layout):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        Fix pagination to use better terminology.
        
        * rendering/RenderText.cpp:
        (WebCore::RenderText::absoluteQuads):
        (WebCore::RenderText::absoluteQuadsForRange):
        Fix a bug where vertical text wasn't taken into account.

2011-01-26  Dimitri Glazkov  <dglazkov@chromium.org>

        Unreviewed, rolling out r76719.
        http://trac.webkit.org/changeset/76719
        https://bugs.webkit.org/show_bug.cgi?id=53122

        Broke a bunch of media tests in Chromium/Qt/GTK.

2011-01-26  Tony Chang  <tony@chromium.org>

        Reviewed by Ryosuke Niwa.

        [gtk] strip NUL characters when copying text/html on GTK+
        https://bugs.webkit.org/show_bug.cgi?id=52508

        Putting NUL characters in the text/html clipboard doesn't work in
        WebKit GTK+ (the pasted value is truncated at the NUL).  Since we're
        already stripping this character for plain text (for Windows), strip
        it in text/html too.

        * editing/MarkupAccumulator.h: mark function as virtual
        * editing/markup.cpp:
        (WebCore::StyledMarkupAccumulator::appendString):
        (WebCore::StyledMarkupAccumulator::takeResults): strip nulls

2011-01-26  Mario Sanchez Prada  <msanchez@igalia.com>

        Reviewed by Martin Robinson.

        [GTK] Reliable crash with getTextAtOffset()
        https://bugs.webkit.org/show_bug.cgi?id=53131

        Properly calculate length in bytes for a UTF8 substring.

        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
        (utf8Substr): Use character instead of bytes as units to
        calculate the length in bytes for the UTF8 string.

2011-01-25  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by Kent Tamura.

        Change HTMLInputElement-derived parts of media element shadow DOM to use shadowPseudoId.
        https://bugs.webkit.org/show_bug.cgi?id=53122

        This is the first step in converting HTMLMediaElement to the new shadow DOM.

        Should not regress any existing tests. No observable change in behavior.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::pseudoId): Removed now-unnecessary hard-coded pseudo-element selectors.
        (WebCore::nameToPseudoTypeMap): Ditto.
        (WebCore::CSSSelector::extractPseudoType): Ditto.
        * css/CSSSelector.h: Ditto.
        * css/mediaControls.css: Added proper initial values, now that elements use the proper selector pipeline.
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlInputElement::MediaControlInputElement): Removed the switch statement,
            which is now replaced with virtual shadowPseudoId on each corresponding class.
        (WebCore::MediaControlInputElement::styleForElement): Changed to use element pipeline.
        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement): Changed to set
            display type in constructor.
        (WebCore::MediaControlMuteButtonElement::create): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlMuteButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteButtonElement): Added
            to disambiguate from the MediaControlMuteButtonElement.
        (WebCore::MediaControlVolumeSliderMuteButtonElement::create): Added.
        (WebCore::MediaControlVolumeSliderMuteButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlPlayButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElement): Added.
        (WebCore::MediaControlSeekForwardButtonElement::create): Added.
        (WebCore::MediaControlSeekForwardButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement): Added.
        (WebCore::MediaControlSeekBackButtonElement::create): Added.
        (WebCore::MediaControlSeekBackButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Added.
        (WebCore::MediaControlRewindButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlReturnToRealtimeButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId): Added.
        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlTimelineElement::shadowPseudoId): Added.
        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlVolumeSliderElement::shadowPseudoId): Added.
        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement): Changed to not take PseudoId as
            constructor argument.
        (WebCore::MediaControlFullscreenButtonElement::shadowPseudoId): Added.
        * rendering/MediaControlElements.h:
        (WebCore::MediaControlSeekForwardButtonElement::isForwardButton): Added.
        (WebCore::MediaControlSeekBackButtonElement::isForwardButton): Added.
        * rendering/RenderMedia.cpp:
        (WebCore::RenderMedia::createMuteButton): Changed to use new constructor.
        (WebCore::RenderMedia::createSeekBackButton): Ditto.
        (WebCore::RenderMedia::createSeekForwardButton): Ditto.
        (WebCore::RenderMedia::createVolumeSliderMuteButton): Ditto.
        * rendering/style/RenderStyleConstants.h: Removed constants that are no longer used.

2011-01-26  Kenneth Russell  <kbr@google.com>

        Reviewed by James Robinson.

        Fix multisampling support in DrawingBuffer
        https://bugs.webkit.org/show_bug.cgi?id=53154

        In DrawingBuffer's multisampling code path, fixed enum usage and a
        bug where it would incorrectly redefine the depth and stencil
        buffers. Hooked up multisampling code path in Chromium port.

        Tested manually with some accelerated 2D canvas content.
        Multisampling isn't being switched on for the accelerated 2D
        canvas at the current time because it will increase fill rate
        requirements and cause a large number of rebaselines.

        * platform/graphics/Extensions3D.h:
        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBuffer::publishToPlatformLayer):
        * platform/graphics/chromium/Extensions3DChromium.h:
        * platform/graphics/gpu/DrawingBuffer.cpp:
        (WebCore::DrawingBuffer::create):
        (WebCore::DrawingBuffer::reset):
        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::supports):

2011-01-26  Tony Chang  <tony@chromium.org>

        Unreviewed.

        [chromium] revert r68310 because of race conditions detected by tsans
        https://bugs.webkit.org/show_bug.cgi?id=53185

        Causes stability problems for Chromium, http://crbug.com/70589

        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
        (WebCore::SQLiteFileSystem::registerSQLiteVFS):

2011-01-26  Justin Schuh  <jschuh@chromium.org>

        Reviewed by Adam Barth.

        Make fireEventsAndUpdateStyle use stack local vectors. 
        https://bugs.webkit.org/show_bug.cgi?id=46760

        Test: animations/animation-add-events-in-handler.html

        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle):

2011-01-26  Nate Chapin  <japhet@chromium.org>

        Reviewed by Adam Barth.

        Remove m_URL from FrameLoader and depend on Document::url()
        instead. FrameLoader::url() will be removed in a followup patch.
        https://bugs.webkit.org/show_bug.cgi?id=41165

        Refactor only, no new tests.

        * WebCore.exp.in:
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::updateURLForPushOrReplaceState):
        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::begin):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::iconURL):
        (WebCore::FrameLoader::didOpenURL):
        (WebCore::FrameLoader::didExplicitOpen):
        (WebCore::FrameLoader::receivedFirstData):
        (WebCore::FrameLoader::url):
        (WebCore::FrameLoader::setOutgoingReferrer):
        (WebCore::FrameLoader::startIconLoader):
        (WebCore::FrameLoader::commitIconURLToIconDatabase):
        (WebCore::FrameLoader::finishedParsing):
        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
        (WebCore::FrameLoader::checkIfRunInsecureContent):
        (WebCore::FrameLoader::updateFirstPartyForCookies):
        (WebCore::FrameLoader::loadInSameDocument):
        (WebCore::FrameLoader::commitProvisionalLoad):
        (WebCore::FrameLoader::open):
        (WebCore::FrameLoader::shouldScrollToAnchor):
        * loader/FrameLoader.h: Rename setURL() to setOutgoingReferrer().

2011-01-25  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Antti Koivisto.

        Crashes loading pages when cancelling subresource loads through WebKit
        https://bugs.webkit.org/show_bug.cgi?id=53123
        <rdar://problem/8914361>
        
        Fix a crash that happened when cancelling subresource loads through WebKit.
        
        When a load is cancelled synchronously (via the WebKit client), CachedResourceLoader::requestResource 
        can be called recursively on the same function, either leading to infinite recursion, or deleting 
        an object when it is not done being used.
        
        The fix for this was to call checkForPendingPreloads and servePendingRequests asynchronously when 
        CachedResourceLoader::loadDone was called synchronously (due to the load being cancelled synchronously).

        Test: fast/loader/willSendRequest-null-for-preload.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::setRequest): Only dispatch didReceiveServerRedirectForProvisionalLoadForFrame 
            if our new URL is non-null.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::CachedResourceLoader): Initialize our timer.
        (WebCore::CachedResourceLoader::loadDone): If the CachedResource we were passed in was 0, that means this 
            function was called synchronously
            from CachedResourceRequest::load, and we don't want to call into checkForPendingPreloads synchronously, 
            so put it on a 0-delay timer to make the calls to checkForPendingPreloads and servePendingRequests asynchronous.
        (WebCore::CachedResourceLoader::loadDonePendingActionTimerFired): Call checkForPendingPreloads and servePendingRequests.
        (WebCore::CachedResourceLoader::checkForPendingPreloads): m_pendingPreloads is now a Deque instead of a Vector, 
            so use Deque methods.
        * loader/cache/CachedResourceLoader.h: Add the timer, the timer callback function, and make m_pendingPreloads a Deque.

2011-01-25  Pavel Podivilov  <podivilov@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: evaluate in console may not work when window.console is substituted or deleted.
        https://bugs.webkit.org/show_bug.cgi?id=53072

        Test: inspector/console-substituted.html

        * inspector/InjectedScriptSource.js:
        (.):

2011-01-26  Carlos Garcia Campos  <cgarcia@igalia.com>

        Reviewed by Martin Robinson.

        [cairo] Use CAIRO_OPERATOR_DARKEN when available
        https://bugs.webkit.org/show_bug.cgi?id=53084

        Use CAIRO_OPERATOR_DARKEN for CompositePlusDarker instead of
        CAIRO_OPERATOR_SATURATE when building with cairo version >= 1.10.

        * platform/graphics/cairo/CairoUtilities.cpp:
        (WebCore::toCairoOperator):

2011-01-26  Pavel Feldman  <pfeldman@chromium.org>

        Reviewed by Yury Semikhatsky.

        Web Inspector: visualize \n in strings as unicode cr
        symbol in stack variables sidebar.
        https://bugs.webkit.org/show_bug.cgi?id=53162

        * inspector/front-end/ObjectPropertiesSection.js:
        (WebInspector.ObjectPropertyTreeElement.prototype.update):

2011-01-26  Andrey Kosyakov  <caseq@chromium.org>

        Reviewed by Pavel Feldman.

        Web Inspector: size is wrong for cached resources in Network panel
        - Set the size for 304/not modified resources from cached resource.
        - Add response headers size to resource transfer size.
        https://bugs.webkit.org/show_bug.cgi?id=52886

        * inspector/InspectorResourceAgent.cpp:
        (WebCore::InspectorResourceAgent::didReceiveResponse):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource):
        (WebInspector.Resource.prototype.get transferSize):
        (WebInspector.Resource.prototype.set responseHeaders):
        (WebInspector.Resource.prototype._headersSize):
        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType):

2011-01-26  Carol Szabo  <carol.szabo@nokia.com>

        Reviewed by Simon Hausmann.

        Fixed TiledBacking store to take into account new dirty regions caused by
        paint time layouts.

        Flawed rendering design for QtWebKit resulting in artifacts being displayed
        https://bugs.webkit.org/show_bug.cgi?id=49184

        There are no new tests as this patch aims at fixing flicker that
        happen randomly, mostly on slow hardware, thus are hard to reproduce
        consistently in an automated test.

        This patch does not fully address the said bug but it is a step in the
        right direction. A full solution to the bug, as currently perceived,
        requires either a Qt GUI API change, a performance hit for QtWebKit,
        or a hack, until a full solution is provided this patch is progress.

        * platform/graphics/TiledBackingStore.cpp:
        (WebCore::TiledBackingStore::updateTileBuffers):
        Changed to take into account newly dirtied areas created during
        tile update initiated layouts during the same update.

2011-01-26  Patrick Gansterer  <paroga@webkit.org>

        Reviewed by Andreas Kling.

        [SKIA] Remove "current path" of GraphicsContext
        https://bugs.webkit.org/show_bug.cgi?id=53124

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::clipPath):
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        * platform/graphics/skia/PathSkia.cpp:
        (WebCore::Path::strokeBoundingRect):
        * platform/graphics/skia/PlatformContextSkia.cpp:
        * platform/graphics/skia/PlatformContextSkia.h:

2011-01-26  Zalan Bujtas <zbujtas@gmail.com>

        Reviewed by Andreas Kling.

        [Qt] Path::normalAngleAtLength() returns incorrect value on ACID3.

        QPainterPath returns angle values with the origo being at the top left corner,
        we need to account for this in normalAngleAtLength().
        This Regressed with r66979.

        No new tests as this is already covered by ACID3.

        * platform/graphics/qt/PathQt.cpp:
        (WebCore::Path::normalAngleAtLength):

2011-01-26  Pavel Feldman  <pfeldman@chromium.org>

        Reviewed by Yury Semikhatsky.

        Web Inspector: live edit does not update source snippet.
        https://bugs.webkit.org/show_bug.cgi?id=53097

        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):

2011-01-26  Pavel Feldman  <pfeldman@chromium.org>

        Reviewed by Yury Semikhatsky.

        Web Inspector: Incorrect on-hover evaluation of a variable named 'profile'.
        https://bugs.webkit.org/show_bug.cgi?id=53018

        * inspector/InjectedScript.cpp:
        (WebCore::InjectedScript::evaluate):
        (WebCore::InjectedScript::evaluateOnCallFrame):
        (WebCore::InjectedScript::getCompletions):
        (WebCore::InjectedScript::getCompletionsOnCallFrame):
        * inspector/InjectedScript.h:
        * inspector/InjectedScriptSource.js:
        (.):
        * inspector/Inspector.idl:
        * inspector/InspectorDebuggerAgent.cpp:
        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
        (WebCore::InspectorDebuggerAgent::getCompletionsOnCallFrame):
        * inspector/InspectorDebuggerAgent.h:
        * inspector/InspectorRuntimeAgent.cpp:
        (WebCore::InspectorRuntimeAgent::evaluate):
        (WebCore::InspectorRuntimeAgent::getCompletions):
        * inspector/InspectorRuntimeAgent.h:
        * inspector/front-end/ConsoleView.js:
        (WebInspector.ConsoleView.prototype.completions):
        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
        (WebInspector.ConsoleView.prototype._enterKeyPressed):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame.updatingCallbackWrapper):
        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
        * inspector/front-end/SourceFrame.js:
        (WebInspector.SourceFrame.prototype._showPopup):
        * inspector/front-end/WatchExpressionsSidebarPane.js:
        (WebInspector.WatchExpressionsSection.prototype.update):

2011-01-26  Hironori Bono  <hbono@chromium.org>

        Reviewed by Kent Tamura.

        A speculative fix for Bug 52422 - [chromium] More crash in
        FontFallbackList::determinePitch(const Font* font)
        https://bugs.webkit.org/show_bug.cgi?id=52422

        My previous change may not work on non-US Windows whose system fonts
        have localized aliases matching to the system locale because of a
        font-name mismatch in createFontIndirectAndGetWinName(). This change
        tries all the fonts installed in a PC and returns the first font that we
        can create without errors.

        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
        (WebCore::GetLastResortFallbackFontProcData::GetLastResortFallbackFontProcData):
        Added a struct used for getLastResortFallbackFontProc().
        (WebCore::getLastResortFallbackFontProc): Added a callback for EnumFontFamilies().
        (WebCore::FontCache::getLastResortFallbackFont): Use EnumFontFamilies() to find a last-resort font.

2011-01-26  James Robinson  <jamesr@chromium.org>

        Reviewed by Nate Chapin.

        Add a DOMTimeStamp parameter to the requestAnimationFrame callback
        https://bugs.webkit.org/show_bug.cgi?id=53142

        This adds a DOMTimeStamp parameter to the requestAnimationFrame callback to more
        closely match mozilla's proposal.  This is useful if the page has multiple imperative animations
        and wants to ensure that they all remain synchronized.  If each callback used Date.now() to
        update its animation state, they would potentially be out of sync with each other.  If they use
        the timestamp then all callbacks for the same "frame" will update to the same state.

        Test: fast/animation/request-animation-frame-timestamps.html

        * bindings/scripts/CodeGeneratorV8.pm:
        * bindings/scripts/test/V8/V8TestCallback.cpp:
        (WebCore::V8TestCallback::callbackWithClass2Param):
        * dom/Document.cpp:
        (WebCore::Document::serviceScriptedAnimations):
        * dom/Document.h:
        * dom/RequestAnimationFrameCallback.h:
        * dom/RequestAnimationFrameCallback.idl:
        * page/FrameView.cpp:
        (WebCore::FrameView::serviceScriptedAnimations):
        * page/FrameView.h:

2011-01-25  Yuzo Fujishima  <yuzo@google.com>

        Unreviewed attempt to fix compilation error for Chromium Clang.

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::advance):

2011-01-25  Ned Holbrook  <nholbrook@apple.com>

        Reviewed by Dan Bernstein.

        ComplexTextController incorrectly conflates string length and range of indexes
        https://bugs.webkit.org/show_bug.cgi?id=52760

        Test: fast/text/offsetForPosition-complex-fallback.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::offsetForPosition):
        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
        (WebCore::ComplexTextController::ComplexTextRun::setIsNonMonotonic):
        (WebCore::ComplexTextController::advance):
        * platform/graphics/mac/ComplexTextController.h:
        (WebCore::ComplexTextController::ComplexTextRun::create):
        (WebCore::ComplexTextController::ComplexTextRun::indexEnd):
        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):

2011-01-25  Sam Weinig  <sam@webkit.org>

        Reviewed by David Hyatt.

        Scrollbars don't work correctly for top-to-bottom text in an overflow: scroll area
        https://bugs.webkit.org/show_bug.cgi?id=53048

        Test: fast/overflow/overflow-rtl-vertical-origin.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollPosition):
        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
        Take the scroll origin into account when calculating scrollbars in more places.

2011-01-25  Steve Falkenburg  <sfalken@apple.com>

        Windows production build fix.
        Use correct configuration-specific path in makefile.

        * WebCore.vcproj/WebCore.make:

2011-01-25  Kent Tamura  <tkent@chromium.org>

        Reviewed by Dimitri Glazkov.

        Radio button group state is not restored correctly
        https://bugs.webkit.org/show_bug.cgi?id=50442

        Fixes a bug that radio button states are not restored correctly in
        a case that non-first radio button in a group is checked.

        If "checked" attribute is present, the radio button is checked and
        other radio buttons in the group are unchecked. This behavior
        disturbs form state restoring. This patch changes this behavior so
        that the "checked" attribute handling is delayed after form state
        restoring.

        Test: fast/forms/state-restore-radio-group.html

        * html/HTMLFormControlElement.h:
         Make finishParsingChildren() protected so that HTMLInpuElement can call it.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::HTMLInputElement):
         - Add createdByParser parameter.
         - Initialize m_stateRestored and m_parsingInProgress.
        (WebCore::HTMLInputElement::create): Sync with the constructor.
        (WebCore::HTMLInputElement::restoreFormControlState):
         Set m_stateRestored in order to refer it in finishParsingChildren().
        (WebCore::HTMLInputElement::parseMappedAttribute):
         Don't call setChecked() during parsing. Move setNeedsValidityCheck()
         to setChecked().
        (WebCore::HTMLInputElement::finishParsingChildren):
         Call setChecked() if form state is not restored.
        (WebCore::HTMLInputElement::setChecked):
         Move setNeedsValidityCheck() from parseMappedAttribute() because
         finishParsingChildren() also needs to call setNeedsValidityCheck().
        * html/HTMLInputElement.h:
         - Remove the default value of HTMLFormElement* of the HTMLInputElement
           constructor, and add createdByParser parameter.
         - Introduce m_parsingInProgress and m_stateRestored.
        * html/HTMLIsIndexElement.cpp:
        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
         Sync with the HTMLInputElement constructor change.
        * html/HTMLTagNames.in: Add constructorNeedsCreatedByParser flag.
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlInputElement::MediaControlInputElement):
         Sync with the HTMLInputElement constructor change.
        * rendering/ShadowElement.cpp:
        (WebCore::ShadowInputElement::ShadowInputElement): ditto.
        * rendering/ShadowElement.h:
        (WebCore::ShadowElement::ShadowElement): ditto.

2011-01-25  Kent Tamura  <tkent@chromium.org>

        Reviewed by Dimitri Glazkov.

        HTMLFormElement::checkValidity() returns incorrect result if 'invalid' events are canceled.
        https://bugs.webkit.org/show_bug.cgi?id=52565

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::validateInteractively):
          Check checkInvalidControlsAndCollectUnhandled() result instead of
          checking emptiness of unhandled invalid controls list.
        (WebCore::HTMLFormElement::checkValidity): ditto.
        (WebCore::HTMLFormElement::checkInvalidControlsAndCollectUnhandled):
          Renamed from collectUnhandledInvalidControls().
          Returns true if there is any invalid control regardless of event canceling.
        * html/HTMLFormElement.h: Rename collectUnhandledInvalidControls() to
          checkInvalidControlsAndCollectUnhandled().

2011-01-25  Kent Tamura  <tkent@chromium.org>

        Reviewed by Dimitri Glazkov.

        Range and number inputs should reject increment and decrement by
        keyboard or mouse wheel if they are disabled or read-only
        https://bugs.webkit.org/show_bug.cgi?id=53151

        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::handleKeydownEvent): Check disabled() and readOnly().
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::handleKeydownEventForSpinButton): ditto.
        (WebCore::TextFieldInputType::handleWheelEventForSpinButton): ditto.

2011-01-25  Kent Tamura  <tkent@chromium.org>

        Reviewed by Dimitri Glazkov.

        API to support localized numbers for <input type=number>
        https://bugs.webkit.org/show_bug.cgi?id=45730

        Introduce platform/text/LocalizedNumber.h, and
        LocalizedNumberNone.cpp, which is an empty implementation of the
        functions in LocalizedNumber.h.  We use LocalizedNumberNone.cpp in
        all platforms for now.

        A string in a type=number field is parsed as a localized number
        first. If the parsing fails, it is parsed as the HTML5 number.

        We introduce HTMLInputElement::visibleValue(). It represents a value
        which should be drawn by a renderer. HTMLInputElement::value() always
        returns a number formatted for HTML5, and visibleValue() may return a
        localized number.

        No new tests because this doesn't change any behavior.

        * Android.mk: Add LocalizedNumber.h and/or LocalizedNumberNone.cpp.
        * CMakeLists.txt: ditto.
        * GNUmakefile.am: ditto.
        * WebCore.gypi: ditto.
        * WebCore.pro: ditto.
        * WebCore.vcproj/WebCore.vcproj: ditto.
        * WebCore.xcodeproj/project.pbxproj: ditto.
        * dom/InputElement.h: Add visibleValue().
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::visibleValue): Added.  Just call InputType::visibleValue().
        * html/HTMLInputElement.h: Declare visibleValue().
        * html/InputType.cpp:
        (WebCore::InputType::visibleValue): Add the default implementation of
          visibleValue(), which returns HTMLInputElement::value().
        * html/InputType.h: Add declarations.
        * html/NumberInputType.cpp:
        (WebCore::isHTMLNumberCharacter): Renamed from isNumberCharacter().
        (WebCore::isNumberCharacter): Calls isLocalizedNumberCharacter() and isHTMLNumberCharacter().
        (WebCore::NumberInputType::visibleValue):
          Returns a localized number string produced by formatLocalizedNumber().
        (WebCore::NumberInputType::isAcceptableValue): Calls parseLocalizedNumber().
        (WebCore::NumberInputType::sanitizeValue): Calls parseLocalizedNumber().
        * html/NumberInputType.h: Add declarations.
        * platform/text/LocalizedNumber.h: Added.
        * platform/text/LocalizedNumberNone.cpp: Added.
        (WebCore::parseLocalizedNumber):
        (WebCore::formatLocalizedNumber):
        (WebCore::isLocalizedNumberCharacter):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::updateFromElement):
          Calls InputElement::visibleValue() instead of value().
        * wml/WMLInputElement.h:
        (WebCore::WMLInputElement::visibleValue): Added. It just calls value().

2011-01-25  Alexey Proskuryakov  <ap@apple.com>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=53143
        Add IntRectHash

        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/IntRectHash.h: Added.

        * platform/graphics/IntSizeHash.h: Don't do "using WebCore::IntSize"!

2011-01-25  Ilya Sherman  <isherman@chromium.org>

        Reviewed by Ryosuke Niwa.

        Remove trailing whitespace in HTMLInputElement.cpp
        https://bugs.webkit.org/show_bug.cgi?id=53152

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateCheckedRadioButtons):
        (WebCore::HTMLInputElement::applyStep):
        (WebCore::HTMLInputElement::updateFocusAppearance):
        (WebCore::HTMLInputElement::mapToEntry):
        (WebCore::HTMLInputElement::setAutofilled):
        (WebCore::HTMLInputElement::willMoveToNewOwnerDocument):
        (WebCore::HTMLInputElement::didMoveToNewOwnerDocument):

2011-01-25  Mike Reed  <reed@google.com>

        Reviewed by James Robinson.

        DrawingBufer::reset() today checks if the new size is the same as its
        m_size, and if so, returns immediately. This does not match the
        semantics of <canvas>, which wants to clear its contents anytime the
        size is specified.
        https://bugs.webkit.org/show_bug.cgi?id=53149

        Test: Covered by existing <canvas> tests using gpu.

        * platform/graphics/chromium/DrawingBufferChromium.cpp:
        (WebCore::DrawingBuffer::DrawingBuffer):
        * platform/graphics/gpu/DrawingBuffer.cpp:
        (WebCore::DrawingBuffer::reset):

2011-01-25  Cris Neckar  <cdn@chromium.org>

        Reviewed by Adam Barth.

        Add a hashset of DOMURLs to ScriptExecutionContext to track back references.
        https://bugs.webkit.org/show_bug.cgi?id=53038

        Test: fast/dom/window-domurl-crash.html

        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
        (WebCore::ScriptExecutionContext::createdDomUrl):
        (WebCore::ScriptExecutionContext::destroyedDomUrl):
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::domUrls):
        * html/DOMURL.cpp:
        (WebCore::DOMURL::DOMURL):
        (WebCore::DOMURL::~DOMURL):
        (WebCore::DOMURL::contextDestroyed):
        * html/DOMURL.h:
        (WebCore::DOMURL::scriptExecutionContext):

2011-01-23  Antti Koivisto  <antti@apple.com>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=52983
        Eliminate m_tagHistory pointer from CSSSelector

        Keep the component selectors in the array in CSSSelectorList instead
        of maintaining a linked list between them. This allows eliminating
        m_tagHistory pointer, shrinking CSSSelector by 25% (selection performance
        seems to improve some too due to better locality).

        * WebCore.xcodeproj/project.pbxproj:
        
            Make CSSSelector.h a private header.
        
        * css/CSSGrammar.y:
        
            Use CSSParserSelector during parsing to keep the tag history in 
            a linked list. This is flattened to an array after parsing.
            Use accessors for setting selector values.
            Use OwnPtr in selector vector.
            
        * css/CSSPageRule.cpp:
        (WebCore::CSSPageRule::CSSPageRule):
        * css/CSSPageRule.h:
        (WebCore::CSSPageRule::create):
        
            Simplify.
    
        * css/CSSParser.cpp:
        (WebCore::CSSParser::~CSSParser):
        (WebCore::CSSParser::createFloatingSelector):
        (WebCore::CSSParser::sinkFloatingSelector):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::updateSpecifiersWithElementName):
        (WebCore::CSSParser::createPageRule):
        * css/CSSParser.h:
        (WebCore::CSSParser::reusableSelectorVector):
        
            CSSSelector -> CSSParserSelector.
            Use OwnPtr in selector vector.
            
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::CSSParserSelector):
        (WebCore::CSSParserSelector::~CSSParserSelector):
        * css/CSSParserValues.h:
        (WebCore::CSSParserSelector::releaseSelector):
        (WebCore::CSSParserSelector::setTag):
        (WebCore::CSSParserSelector::setValue):
        (WebCore::CSSParserSelector::setAttribute):
        (WebCore::CSSParserSelector::setArgument):
        (WebCore::CSSParserSelector::setSimpleSelector):
        (WebCore::CSSParserSelector::setMatch):
        (WebCore::CSSParserSelector::setRelation):
        (WebCore::CSSParserSelector::setForPage):
        (WebCore::CSSParserSelector::pseudoType):
        (WebCore::CSSParserSelector::isUnknownPseudoElement):
        (WebCore::CSSParserSelector::isSimple):
        (WebCore::CSSParserSelector::tagHistory):
        (WebCore::CSSParserSelector::setTagHistory):
        
            Linked list used during parsing.
            Avoid recursive destruction.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::extractPseudoType):
        (WebCore::CSSSelector::operator==):
        (WebCore::CSSSelector::selectorText):
        (WebCore::CSSSelector::setSimpleSelector):
        * css/CSSSelector.h:
        (WebCore::CSSSelector::CSSSelector):
        (WebCore::CSSSelector::~CSSSelector):
        (WebCore::CSSSelector::tagHistory):
        (WebCore::CSSSelector::tag):
        (WebCore::CSSSelector::value):
        (WebCore::CSSSelector::setTag):
        (WebCore::CSSSelector::isLastInTagHistory):
        (WebCore::CSSSelector::setNotLastInTagHistory):
        (WebCore::CSSSelector::RareData::RareData):
        (WebCore::CSSSelector::RareData::~RareData):
        (WebCore::CSSSelector::createRareData):
        (WebCore::CSSSelector::setValue):
        
            Remove m_tagHistory.
            Keep m_value in the union with the rare data pointer instead.
            Make m_value and m_tag private, implement accessors.
            Add a new bit to indicate end of the tag history (multipart selector).
            Eliminate complex destruction. Selectors are now deleted as an array or by a CSSParserSelector chain.
            
        * css/CSSSelectorList.cpp:
        (WebCore::CSSSelectorList::adoptSelectorVector):
        
            Flatten everything to an array.
        
        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
        * css/CSSSelectorList.h:
        (WebCore::CSSSelectorList::hasOneSelector):
        (WebCore::CSSSelectorList::next):
        
            Skip over the subparts of multipart selectors to find the next selector.
    
        * css/CSSStyleRule.h:
        (WebCore::CSSStyleRule::adoptSelectorVector):
        
            CSSSelector -> CSSParserSelector.
            
        * css/CSSStyleSelector.cpp:
        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
        (WebCore::CSSRuleSet::addRule):
        (WebCore::collectIdsAndSiblingRulesFromList):
        (WebCore::CSSStyleSelector::matchPageRulesForList):
        * dom/Node.cpp:
        (WebCore::Node::querySelector):
        * dom/SelectorNodeList.cpp:
        (WebCore::createSelectorNodeList):
        
            Use accessors.

2011-01-25  James Simonsen  <simonjam@chromium.org>

        Reviewed by Tony Chang.