2011-01-29 Sheriff Bot Unreviewed, rolling out r77050. http://trac.webkit.org/changeset/77050 https://bugs.webkit.org/show_bug.cgi?id=53371 Caused a crash in Chromium's test_shell_tests (Requested by rniwa on #webkit). * html/parser/HTMLTreeBuilder.cpp: (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext): (WebCore::HTMLTreeBuilder::FragmentParsingContext::document): (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished): * html/parser/HTMLTreeBuilder.h: 2011-01-28 Eric Seidel Reviewed by Darin Adler. HTML5 TreeBuilder regressed a Peacekeeper DOM test by 40% https://bugs.webkit.org/show_bug.cgi?id=48719 It's unclear exactly what the Peacekeeper benchmark is testing, because I haven't found a way to run it myself. However, I constructed a benchmark which shows at least one possible slow point. The HTML5 spec talks about creating a new document for every time we use the fragment parsing algorithm. Document() it turns out, it a huge bloated mess, and the constructor and destructor do a huge amount of work. To avoid constructing (or destructing) documents for each innerHTML call, this patch adds a shared dummy document used by all innerHTML calls. This patch brings us from 7x slower than Safari 5 on tiny-innerHTML to only 1.5x slower than Safari 5. I'm sure there is more work to do here. Saving a shared Document like this is error prone. Currently DummyDocumentFactory::releaseDocument() calls removeAllChildren() in an attempt to clear the Document's state. However it's possible that that call is not sufficient and we'll have future bugs here. * html/parser/HTMLTreeBuilder.cpp: (WebCore::DummyDocumentFactory::createDummyDocument): (WebCore::DummyDocumentFactory::releaseDocument): (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext): (WebCore::HTMLTreeBuilder::FragmentParsingContext::document): (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished): * html/parser/HTMLTreeBuilder.h: 2011-01-28 Johnny Ding Reviewed by Adam Barth. Gesture API: Don't use current gesture status to set "forceUserGesture" parameter when calling ScriptController::executeScript. The "forceUserGesture" parameter should be only set when you are definitely sure that the running script is from a hyper-link. https://bugs.webkit.org/show_bug.cgi?id=53244 Test: fast/events/popup-blocked-from-iframe-src.html * bindings/ScriptControllerBase.cpp: (WebCore::ScriptController::executeIfJavaScriptURL): 2011-01-28 Simon Fraser Reviewed by Gavin Barraclough. Add various clampToInt() methods to MathExtras.h https://bugs.webkit.org/show_bug.cgi?id=52910 Use clampToInteger() from MathExtras.h * css/CSSParser.cpp: (WebCore::CSSParser::parseCounter): 2011-01-28 Sheriff Bot Unreviewed, rolling out r77006 and r77020. http://trac.webkit.org/changeset/77006 http://trac.webkit.org/changeset/77020 https://bugs.webkit.org/show_bug.cgi?id=53360 "Broke Windows tests" (Requested by rniwa on #webkit). * ForwardingHeaders/runtime/WriteBarrier.h: Removed. * WebCore.exp.in: * bindings/js/DOMWrapperWorld.h: * bindings/js/JSAudioConstructor.cpp: (WebCore::JSAudioConstructor::JSAudioConstructor): * bindings/js/JSDOMBinding.cpp: (WebCore::markDOMNodesForDocument): (WebCore::markDOMObjectWrapper): (WebCore::markDOMNodeWrapper): * bindings/js/JSDOMGlobalObject.cpp: (WebCore::JSDOMGlobalObject::markChildren): (WebCore::JSDOMGlobalObject::setInjectedScript): (WebCore::JSDOMGlobalObject::injectedScript): * bindings/js/JSDOMGlobalObject.h: (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData): (WebCore::getDOMConstructor): * bindings/js/JSDOMWindowCustom.cpp: (WebCore::JSDOMWindow::setLocation): (WebCore::DialogHandler::dialogCreated): * bindings/js/JSDOMWindowShell.cpp: (WebCore::JSDOMWindowShell::JSDOMWindowShell): (WebCore::JSDOMWindowShell::setWindow): (WebCore::JSDOMWindowShell::markChildren): (WebCore::JSDOMWindowShell::unwrappedObject): * bindings/js/JSDOMWindowShell.h: (WebCore::JSDOMWindowShell::window): (WebCore::JSDOMWindowShell::setWindow): * bindings/js/JSDeviceMotionEventCustom.cpp: (WebCore::createAccelerationObject): (WebCore::createRotationRateObject): * bindings/js/JSEventListener.cpp: (WebCore::JSEventListener::JSEventListener): (WebCore::JSEventListener::markJSFunction): * bindings/js/JSEventListener.h: (WebCore::JSEventListener::jsFunction): * bindings/js/JSHTMLDocumentCustom.cpp: (WebCore::JSHTMLDocument::setAll): * bindings/js/JSImageConstructor.cpp: (WebCore::JSImageConstructor::JSImageConstructor): * bindings/js/JSImageDataCustom.cpp: (WebCore::toJS): * bindings/js/JSJavaScriptCallFrameCustom.cpp: (WebCore::JSJavaScriptCallFrame::scopeChain): (WebCore::JSJavaScriptCallFrame::scopeType): * bindings/js/JSNodeFilterCondition.cpp: (WebCore::JSNodeFilterCondition::markAggregate): (WebCore::JSNodeFilterCondition::acceptNode): * bindings/js/JSNodeFilterCondition.h: * bindings/js/JSNodeFilterCustom.cpp: * bindings/js/JSOptionConstructor.cpp: (WebCore::JSOptionConstructor::JSOptionConstructor): * bindings/js/JSSQLResultSetRowListCustom.cpp: (WebCore::JSSQLResultSetRowList::item): * bindings/js/ScriptCachedFrameData.cpp: (WebCore::ScriptCachedFrameData::restore): * bindings/js/ScriptObject.cpp: (WebCore::ScriptGlobalObject::set): * bindings/js/SerializedScriptValue.cpp: (WebCore::CloneDeserializer::putProperty): * bindings/scripts/CodeGeneratorJS.pm: * bridge/qt/qt_runtime.cpp: (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod): (JSC::Bindings::QtRuntimeMetaMethod::markChildren): (JSC::Bindings::QtRuntimeMetaMethod::connectGetter): (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter): * bridge/qt/qt_runtime.h: * bridge/runtime_root.cpp: (JSC::Bindings::RootObject::invalidate): * bridge/runtime_root.h: * dom/Document.h: 2011-01-28 Adam Barth Reviewed by Eric Seidel. XSSFilter should log to the console when it blocks something https://bugs.webkit.org/show_bug.cgi?id=53354 This patch refactors a bunch of methods in XSSFilter to return a bool indicating whether they blocked anything. Using this bool, we decide whether to log to the console. We're using the same log message as the XSSAuditor, but it seems likely we can improve this message in the future (especially by piping in the correct line number, which is now accessible via the parser). * html/parser/XSSFilter.cpp: (WebCore::HTMLNames::isNameOfInlineEventHandler): (WebCore::XSSFilter::filterToken): (WebCore::XSSFilter::filterTokenInitial): (WebCore::XSSFilter::filterTokenAfterScriptStartTag): (WebCore::XSSFilter::filterScriptToken): (WebCore::XSSFilter::filterObjectToken): (WebCore::XSSFilter::filterEmbedToken): (WebCore::XSSFilter::filterAppletToken): (WebCore::XSSFilter::filterMetaToken): (WebCore::XSSFilter::filterBaseToken): (WebCore::XSSFilter::eraseInlineEventHandlersIfInjected): * html/parser/XSSFilter.h: 2011-01-28 Adam Barth Reviewed by Daniel Bates. Wire up settings->xssAuditorEnabled to XSSFilter https://bugs.webkit.org/show_bug.cgi?id=53345 * html/parser/XSSFilter.cpp: (WebCore::XSSFilter::XSSFilter): (WebCore::XSSFilter::filterToken): * html/parser/XSSFilter.h: 2011-01-28 Adam Barth Reviewed by Daniel Bates. Teach XSSFilter about and tags https://bugs.webkit.org/show_bug.cgi?id=53339 I'm not 100% sure we need to block , but it seems prudent given how powerful that attribute is. We definitely need to block injection of because that can redirect script tags that use relative URLs. * html/parser/XSSFilter.cpp: (WebCore::XSSFilter::filterToken): (WebCore::XSSFilter::filterMetaToken): (WebCore::XSSFilter::filterBaseToken): * html/parser/XSSFilter.h: 2011-01-28 Adam Barth Reviewed by Daniel Bates. Teach XSSFilter about https://bugs.webkit.org/show_bug.cgi?id=53338 HTML5 is pretty light on information about how the tag works. According to this site: http://download.oracle.com/javase/1.4.2/docs/guide/misc/applet.html The "code" and "object" attributes are the essential attributes for determining which piece of Java to run. We might need to expand to the codebase and archive attributes at some point, but hopefully code and object will be sufficient. * html/parser/XSSFilter.cpp: (WebCore::XSSFilter::filterToken): (WebCore::XSSFilter::filterAppletToken): * html/parser/XSSFilter.h: 2011-01-28 Adam Barth Reviewed by Daniel Bates. Teach the XSSFilter about object and embed tags https://bugs.webkit.org/show_bug.cgi?id=53336 For and , we filter out attribute values that either indicate which piece of media to load or which plugin to load. In a perfect world, we'd only need to filter out the URLs of the media, but some plug-ins (like Flash) have lots of fun places you can hide the URL (e.g., the "movie" ). * html/parser/XSSFilter.cpp: (WebCore::XSSFilter::filterToken): (WebCore::XSSFilter::filterScriptToken): (WebCore::XSSFilter::filterObjectToken): (WebCore::XSSFilter::filterEmbedToken): (WebCore::XSSFilter::eraseAttributeIfInjected): * html/parser/XSSFilter.h: 2011-01-28 Oliver Hunt Fix Qt build. * bridge/qt/qt_runtime.cpp: (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod): (JSC::Bindings::QtRuntimeMetaMethod::markChildren): (JSC::Bindings::QtRuntimeMetaMethod::connectGetter): (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter): * bridge/qt/qt_runtime.h: 2011-01-28 Antti Koivisto Reviewed by Simon Fraser. CSS styles are shared based on uninitialized property values https://bugs.webkit.org/show_bug.cgi?id=53285 Null test. * dom/NamedNodeMap.cpp: (WebCore::NamedNodeMap::mappedMapsEquivalent): 2011-01-27 Oliver Hunt Reviewed by Geoffrey Garen. Convert markstack to a slot visitor API https://bugs.webkit.org/show_bug.cgi?id=53219 Update WebCore to the new marking apis, correct bindings codegen. * ForwardingHeaders/runtime/WriteBarrier.h: Added. * WebCore.exp.in: * bindings/js/DOMWrapperWorld.h: (WebCore::DOMWrapperWorld::globalData): * bindings/js/JSAudioConstructor.cpp: (WebCore::JSAudioConstructor::JSAudioConstructor): * bindings/js/JSDOMBinding.cpp: (WebCore::markDOMNodesForDocument): (WebCore::markDOMObjectWrapper): (WebCore::markDOMNodeWrapper): * bindings/js/JSDOMGlobalObject.cpp: (WebCore::JSDOMGlobalObject::markChildren): (WebCore::JSDOMGlobalObject::setInjectedScript): (WebCore::JSDOMGlobalObject::injectedScript): * bindings/js/JSDOMGlobalObject.h: (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData): (WebCore::getDOMConstructor): * bindings/js/JSDOMWindowCustom.cpp: (WebCore::JSDOMWindow::setLocation): (WebCore::DialogHandler::dialogCreated): * bindings/js/JSDOMWindowShell.cpp: (WebCore::JSDOMWindowShell::JSDOMWindowShell): (WebCore::JSDOMWindowShell::setWindow): (WebCore::JSDOMWindowShell::markChildren): (WebCore::JSDOMWindowShell::unwrappedObject): * bindings/js/JSDOMWindowShell.h: (WebCore::JSDOMWindowShell::window): (WebCore::JSDOMWindowShell::setWindow): * bindings/js/JSEventListener.cpp: (WebCore::JSEventListener::JSEventListener): (WebCore::JSEventListener::markJSFunction): * bindings/js/JSEventListener.h: (WebCore::JSEventListener::jsFunction): * bindings/js/JSHTMLDocumentCustom.cpp: (WebCore::JSHTMLDocument::setAll): * bindings/js/JSImageConstructor.cpp: (WebCore::JSImageConstructor::JSImageConstructor): * bindings/js/JSImageDataCustom.cpp: (WebCore::toJS): * bindings/js/JSJavaScriptCallFrameCustom.cpp: (WebCore::JSJavaScriptCallFrame::scopeChain): (WebCore::JSJavaScriptCallFrame::scopeType): * bindings/js/JSNodeFilterCondition.cpp: (WebCore::JSNodeFilterCondition::markAggregate): (WebCore::JSNodeFilterCondition::acceptNode): * bindings/js/JSNodeFilterCondition.h: * bindings/js/JSNodeFilterCustom.cpp: * bindings/js/JSOptionConstructor.cpp: (WebCore::JSOptionConstructor::JSOptionConstructor): * bindings/js/JSSQLResultSetRowListCustom.cpp: (WebCore::JSSQLResultSetRowList::item): * bindings/js/ScriptCachedFrameData.cpp: (WebCore::ScriptCachedFrameData::restore): * bindings/js/ScriptObject.cpp: (WebCore::ScriptGlobalObject::set): * bindings/js/SerializedScriptValue.cpp: (WebCore::CloneDeserializer::putProperty): * bindings/scripts/CodeGeneratorJS.pm: * dom/Document.h: 2011-01-28 Sam Weinig Reviewed by Anders Carlsson. Keyboard scrolling doesn’t work in WebKit2 * platform/mac/ScrollAnimatorMac.mm: (-[ScrollAnimationHelperDelegate convertSizeToBacking:]): (-[ScrollAnimationHelperDelegate convertSizeFromBacking:]): Add additional necessary delegate methods. 2011-01-29 Darin Adler Reviewed by Dan Bernstein. Re-land this patch with the missing null check that caused crashes in layout tests. Changing cursor style has no effect until the mouse moves https://bugs.webkit.org/show_bug.cgi?id=14344 rdar://problem/7563712 No tests added because we don't have infrastructure for testing actual cursor changes (as opposed to cursor style computation) at this time. We might add it later. * page/EventHandler.cpp: (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon): Added. * page/EventHandler.h: Ditto. * rendering/RenderObject.cpp: (WebCore::areNonIdenticalCursorListsEqual): Added. (WebCore::areCursorsEqual): Added. (WebCore::RenderObject::styleDidChange): Call dispatchFakeMouseMoveEventSoon if cursor styles changed. 2011-01-28 Justin Schuh Reviewed by Eric Seidel. We should hold RefPtrs to SVG font faces https://bugs.webkit.org/show_bug.cgi?id=53270 Test: svg/custom/use-multiple-on-nested-disallowed-font.html * css/CSSFontFaceSource.cpp: (WebCore::CSSFontFaceSource::getFontData): * css/CSSFontFaceSource.h: * svg/SVGFontFaceElement.cpp: (WebCore::SVGFontFaceElement::associatedFontElement): * svg/SVGFontFaceElement.h: 2011-01-28 Zhenyao Mo Reviewed by Kenneth Russell. uniformN*v should generate INVALID_VALUE of the array size is not a multiple of N https://bugs.webkit.org/show_bug.cgi?id=53306 * html/canvas/WebGLRenderingContext.cpp: (WebCore::WebGLRenderingContext::validateUniformMatrixParameters): 2011-01-28 Tom Sepez Reviewed by Eric Seidel. NULL pointer crash in TextIterator::handleTextBox() https://bugs.webkit.org/show_bug.cgi?id=53267 Test: fast/css/rtl-nth-child-first-letter-crash.html * editing/TextIterator.cpp: (WebCore::TextIterator::handleTextBox): 2011-01-28 Adrienne Walker Reviewed by Kenneth Russell. [chromium] Remove a spurious diagnostic CRASH check. https://bugs.webkit.org/show_bug.cgi?id=52379 * platform/graphics/chromium/LayerTilerChromium.cpp: (WebCore::LayerTilerChromium::invalidateRect): 2011-01-28 Dan Bernstein Reviewed by Sam Weinig. pop-up menus on Mac OS X Snow Leopard and later to have their items aligned in the direction corresponding to the writing direction of the