Imported WebKit commit 8eb048315f36fa33731f28694630fe4a3c2cbc99 (http://svn.webkit.org/repository/webkit/trunk@135602)

New snapshot that fixes various bugs

Change-Id: Icb6ce541a26a9f500d087821ce4b83a8d8a5474a
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

15 files changed, 81 insertions, 114 deletions

diff --git a/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp b/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp
index addc8063a..4bd7cde2c 100644
--- a/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp
+++ b/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp
@@ -325,7 +325,7 @@ FormControlState BaseMultipleFieldsDateAndTimeInputType::saveFormControlState()
 void BaseMultipleFieldsDateAndTimeInputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
     InputType::setValue(sanitizedValue, valueChanged, eventBehavior);
-    if (valueChanged || (sanitizedValue.isEmpty() && m_dateTimeEditElement && m_dateTimeEditElement->valueAsDateTimeFieldsState().hasAnyValue()))
+    if (valueChanged || (sanitizedValue.isEmpty() && m_dateTimeEditElement && m_dateTimeEditElement->anyEditableFieldsHaveValues()))
         updateInnerTextValue();
 }
 
diff --git a/Source/WebCore/html/DateTimeFieldsState.h b/Source/WebCore/html/DateTimeFieldsState.h
index a05ae59b5..2dd219546 100644
--- a/Source/WebCore/html/DateTimeFieldsState.h
+++ b/Source/WebCore/html/DateTimeFieldsState.h
@@ -74,7 +74,6 @@ public:
     bool hasSecond() const { return m_second != emptyValue; }
     bool hasWeekOfYear() const { return m_weekOfYear != emptyValue; }
     bool hasYear() const { return m_year != emptyValue; }
-    bool hasAnyValue() const { return hasAMPM() || hasDayOfMonth() || hasHour() || hasMillisecond() || hasMinute() || hasMonth() || hasSecond() || hasWeekOfYear() || hasYear(); }
 
     void setAMPM(AMPMValue ampm) { m_ampm = ampm; }
     void setDayOfMonth(unsigned dayOfMonth) { m_dayOfMonth = dayOfMonth; }
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index ac9e605e5..da2a4bfca 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -176,7 +176,7 @@ static NodeListInvalidationType invalidationTypeExcludingIdAndNameAttributes(Col
     
 
 HTMLCollection::HTMLCollection(Node* ownerNode, CollectionType type, ItemAfterOverrideType itemAfterOverrideType)
-    : HTMLCollectionCacheBase(ownerNode, rootTypeFromCollectionType(type), invalidationTypeExcludingIdAndNameAttributes(type),
+    : DynamicNodeListCacheBase(ownerNode, rootTypeFromCollectionType(type), invalidationTypeExcludingIdAndNameAttributes(type),
         WebCore::shouldOnlyIncludeDirectChildren(type), type, itemAfterOverrideType)
 {
     document()->registerNodeListCache(this);
@@ -364,16 +364,11 @@ ALWAYS_INLINE void DynamicNodeListCacheBase::setItemCache(Node* item, unsigned o
     setItemCache(item, offset);
     if (overridesItemAfter()) {
         ASSERT(item->isElementNode());
-        static_cast<const HTMLCollectionCacheBase*>(this)->m_cachedElementsArrayOffset = elementsArrayOffset;
+        static_cast<const HTMLCollection*>(this)->m_cachedElementsArrayOffset = elementsArrayOffset;
     } else
         ASSERT(!elementsArrayOffset);
 }
 
-ALWAYS_INLINE unsigned DynamicNodeListCacheBase::cachedElementsArrayOffset() const
-{
-    return overridesItemAfter() ? static_cast<const HTMLCollectionCacheBase*>(this)->m_cachedElementsArrayOffset : 0;
-}
-
 unsigned DynamicNodeListCacheBase::lengthCommon() const
 {
     if (isLengthCacheValid())
@@ -441,7 +436,7 @@ Node* DynamicNodeListCacheBase::itemBeforeOrAfterCachedItem(unsigned offset) con
         return 0;
     }
 
-    unsigned offsetInArray = cachedElementsArrayOffset();
+    unsigned offsetInArray = overridesItemAfter() ? static_cast<const HTMLCollection*>(this)->m_cachedElementsArrayOffset : 0;
     while ((currentItem = itemAfter(offsetInArray, currentItem))) {
         currentOffset++;
         if (currentOffset == offset) {
@@ -584,7 +579,7 @@ PassRefPtr<NodeList> HTMLCollection::tags(const String& name)
     return ownerNode()->getElementsByTagName(name);
 }
 
-void HTMLCollectionCacheBase::append(NodeCacheMap& map, const AtomicString& key, Element* element)
+void HTMLCollection::append(NodeCacheMap& map, const AtomicString& key, Element* element)
 {
     OwnPtr<Vector<Element*> >& vector = map.add(key.impl(), nullptr).iterator->value;
     if (!vector)
diff --git a/Source/WebCore/html/HTMLCollection.h b/Source/WebCore/html/HTMLCollection.h
index 46a8f3f52..98f361fe9 100644
--- a/Source/WebCore/html/HTMLCollection.h
+++ b/Source/WebCore/html/HTMLCollection.h
@@ -33,39 +33,7 @@
 
 namespace WebCore {
 
-class Document;
-class Element;
-class Node;
-class NodeList;
-
-class HTMLCollectionCacheBase : public DynamicNodeListCacheBase {
-public:
-    HTMLCollectionCacheBase(Node* ownerNode, NodeListRootType rootType, NodeListInvalidationType invalidationType,
-        bool shouldOnlyIncludeDirectChildren, CollectionType collectionType, ItemAfterOverrideType itemAfterOverrideType)
-        : DynamicNodeListCacheBase(ownerNode, rootType, invalidationType, shouldOnlyIncludeDirectChildren, collectionType, itemAfterOverrideType)
-    {
-    }
-
-protected:
-    typedef HashMap<AtomicStringImpl*, OwnPtr<Vector<Element*> > > NodeCacheMap;
-    Vector<Element*>* idCache(const AtomicString& name) const { return m_idCache.get(name.impl()); }
-    Vector<Element*>* nameCache(const AtomicString& name) const { return m_nameCache.get(name.impl()); }
-    void appendIdCache(const AtomicString& name, Element* element) const { append(m_idCache, name, element); }
-    void appendNameCache(const AtomicString& name, Element* element) const { append(m_nameCache, name, element); }
-
-    static void append(NodeCacheMap&, const AtomicString&, Element*);
-
-private:
-    using DynamicNodeListCacheBase::isRootedAtDocument;
-
-    mutable NodeCacheMap m_idCache;
-    mutable NodeCacheMap m_nameCache;
-    mutable unsigned m_cachedElementsArrayOffset;
-
-    friend class DynamicNodeListCacheBase;
-};
-
-class HTMLCollection : public ScriptWrappable, public RefCounted<HTMLCollection>, public HTMLCollectionCacheBase {
+class HTMLCollection : public ScriptWrappable, public RefCounted<HTMLCollection>, public DynamicNodeListCacheBase {
 public:
     static PassRefPtr<HTMLCollection> create(Node* base, CollectionType);
     virtual ~HTMLCollection();
@@ -104,8 +72,22 @@ protected:
 
     virtual void updateNameCache() const;
 
+    typedef HashMap<AtomicStringImpl*, OwnPtr<Vector<Element*> > > NodeCacheMap;
+    Vector<Element*>* idCache(const AtomicString& name) const { return m_idCache.get(name.impl()); }
+    Vector<Element*>* nameCache(const AtomicString& name) const { return m_nameCache.get(name.impl()); }
+    void appendIdCache(const AtomicString& name, Element* element) const { append(m_idCache, name, element); }
+    void appendNameCache(const AtomicString& name, Element* element) const { append(m_nameCache, name, element); }
+
 private:
     bool checkForNameMatch(Element*, bool checkName, const AtomicString& name) const;
+
+    static void append(NodeCacheMap&, const AtomicString&, Element*);
+
+    mutable NodeCacheMap m_idCache;
+    mutable NodeCacheMap m_nameCache;
+    mutable unsigned m_cachedElementsArrayOffset;
+
+    friend class DynamicNodeListCacheBase;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLFrameElementBase.cpp b/Source/WebCore/html/HTMLFrameElementBase.cpp
index 7adc9c8fd..2cfb2fb37 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.cpp
+++ b/Source/WebCore/html/HTMLFrameElementBase.cpp
@@ -66,22 +66,10 @@ bool HTMLFrameElementBase::isURLAllowed() const
             return false;
     }
 
-    if (Frame* parentFrame = document()->frame()) {
-        if (parentFrame->page()->subframeCount() >= Page::maxNumberOfFrames)
-            return false;
-    }
+    Frame* parentFrame = document()->frame();
+    if (parentFrame)
+        return parentFrame->isURLAllowed(completeURL);
 
-    // We allow one level of self-reference because some sites depend on that.
-    // But we don't allow more than one.
-    bool foundSelfReference = false;
-    for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) {
-            if (foundSelfReference)
-                return false;
-            foundSelfReference = true;
-        }
-    }
-    
     return true;
 }
 
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 6b2833729..5dac84963 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -555,9 +555,7 @@ void HTMLInputElement::subtreeHasChanged()
     // HTMLInputElement::handleBeforeTextInsertedEvent() has already called
     // sanitizeUserInputValue().
     // sanitizeValue() is needed because IME input doesn't dispatch BeforeTextInsertedEvent.
-    String value = innerTextValue();
-    if (isAcceptableValue(value))
-        setValueFromRenderer(sanitizeValue(convertFromVisibleValue(value)));
+    setValueFromRenderer(sanitizeValue(convertFromVisibleValue(innerTextValue())));
     updatePlaceholderVisibility(false);
     // Recalc for :invalid and hasUnacceptableValue() change.
     setNeedsStyleRecalc();
@@ -1411,11 +1409,6 @@ String HTMLInputElement::convertFromVisibleValue(const String& visibleValue) con
     return m_inputType->convertFromVisibleValue(visibleValue);
 }
 
-bool HTMLInputElement::isAcceptableValue(const String& proposedValue) const
-{
-    return m_inputType->isAcceptableValue(proposedValue);
-}
-
 String HTMLInputElement::sanitizeValue(const String& proposedValue) const
 {
     if (proposedValue.isNull())
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index 0471a3b67..422f40b97 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -164,8 +164,6 @@ public:
     // The value which is drawn by a renderer.
     String visibleValue() const;
     String convertFromVisibleValue(const String&) const;
-    // Returns true if the specified string can be set as the value of HTMLInputElement.
-    bool isAcceptableValue(const String&) const;
 
     const String& suggestedValue() const;
     void setSuggestedValue(const String&);
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp
index f1720b8d5..b809a1340 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp
@@ -88,28 +88,13 @@ bool HTMLPlugInImageElement::isImageType()
 // depending on <param> values. 
 bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url)
 {
-    ASSERT(document());
-    ASSERT(document()->frame());
-    if (document()->frame()->page()->subframeCount() >= Page::maxNumberOfFrames)
-        return false;
-
     KURL completeURL = document()->completeURL(url);
-    
+
     if (contentFrame() && protocolIsJavaScript(completeURL)
         && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))
         return false;
-    
-    // We allow one level of self-reference because some sites depend on that.
-    // But we don't allow more than one.
-    bool foundSelfReference = false;
-    for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) {
-            if (foundSelfReference)
-                return false;
-            foundSelfReference = true;
-        }
-    }
-    return true;
+
+    return document()->frame()->isURLAllowed(completeURL);
 }
 
 // We don't use m_url, or m_serviceType as they may not be the final values
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index d669cd61c..ad10269bc 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -689,11 +689,6 @@ String InputType::convertFromVisibleValue(const String& visibleValue) const
     return visibleValue;
 }
 
-bool InputType::isAcceptableValue(const String&)
-{
-    return true;
-}
-
 String InputType::sanitizeValue(const String& proposedValue) const
 {
     return proposedValue;
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 7f02245e6..6da537281 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -176,7 +176,6 @@ public:
     virtual String localizeValue(const String&) const;
     virtual String visibleValue() const;
     virtual String convertFromVisibleValue(const String&) const;
-    virtual bool isAcceptableValue(const String&);
     // Returing the null string means "use the default value."
     // This function must be called only by HTMLInputElement::sanitizeValue().
     virtual String sanitizeValue(const String&) const;
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index ce833512d..7498cc991 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -253,12 +253,6 @@ String NumberInputType::convertFromVisibleValue(const String& visibleValue) cons
     return element()->locale().convertFromLocalizedNumber(visibleValue);
 }
 
-bool NumberInputType::isAcceptableValue(const String& proposedValue)
-{
-    String standardValue = convertFromVisibleValue(proposedValue);
-    return standardValue.isEmpty() || isfinite(parseToDoubleForNumberType(standardValue));
-}
-
 String NumberInputType::sanitizeValue(const String& proposedValue) const
 {
     if (proposedValue.isEmpty())
@@ -268,7 +262,10 @@ String NumberInputType::sanitizeValue(const String& proposedValue) const
 
 bool NumberInputType::hasUnacceptableValue()
 {
-    return element()->renderer() && !isAcceptableValue(element()->innerTextValue());
+    if (!element()->renderer())
+        return false;
+    String standardValue = convertFromVisibleValue(element()->innerTextValue());
+    return !standardValue.isEmpty() && !isfinite(parseToDoubleForNumberType(standardValue));
 }
 
 bool NumberInputType::shouldRespectSpeechAttribute()
diff --git a/Source/WebCore/html/NumberInputType.h b/Source/WebCore/html/NumberInputType.h
index 073432780..11cca557b 100644
--- a/Source/WebCore/html/NumberInputType.h
+++ b/Source/WebCore/html/NumberInputType.h
@@ -57,7 +57,6 @@ private:
     virtual String localizeValue(const String&) const OVERRIDE;
     virtual String visibleValue() const OVERRIDE;
     virtual String convertFromVisibleValue(const String&) const OVERRIDE;
-    virtual bool isAcceptableValue(const String&) OVERRIDE;
     virtual String sanitizeValue(const String&) const OVERRIDE;
     virtual bool hasUnacceptableValue() OVERRIDE;
     virtual bool shouldRespectSpeechAttribute() OVERRIDE;
diff --git a/Source/WebCore/html/parser/HTMLParserIdioms.cpp b/Source/WebCore/html/parser/HTMLParserIdioms.cpp
index 97565724a..e5201ce13 100644
--- a/Source/WebCore/html/parser/HTMLParserIdioms.cpp
+++ b/Source/WebCore/html/parser/HTMLParserIdioms.cpp
@@ -150,14 +150,9 @@ double parseToDoubleForNumberType(const String& string)
     return parseToDoubleForNumberType(string, std::numeric_limits<double>::quiet_NaN());
 }
 
-// http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-integers
-bool parseHTMLInteger(const String& input, int& value)
+template <typename CharacterType>
+static bool parseHTMLIntegerInternal(const CharacterType* position, const CharacterType* end, int& value)
 {
-    // Step 1
-    // Step 2
-    const UChar* position = input.characters();
-    const UChar* end = position + input.length();
-
     // Step 3
     int sign = 1;
 
@@ -197,18 +192,31 @@ bool parseHTMLInteger(const String& input, int& value)
 
     // Step 9
     bool ok;
-    value = sign * charactersToIntStrict(digits.characters(), digits.length(), &ok);
+    if (digits.is8Bit())
+        value = sign * charactersToIntStrict(digits.characters8(), digits.length(), &ok);
+    else
+        value = sign * charactersToIntStrict(digits.characters16(), digits.length(), &ok);
     return ok;
 }
 
-// http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-non-negative-integers
-bool parseHTMLNonNegativeInteger(const String& input, unsigned int& value)
+// http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-integers
+bool parseHTMLInteger(const String& input, int& value)
 {
     // Step 1
     // Step 2
-    const UChar* position = input.characters();
-    const UChar* end = position + input.length();
+    unsigned length = input.length();
+    if (length && input.is8Bit()) {
+        const LChar* start = input.characters8();
+        return parseHTMLIntegerInternal(start, start + length, value);
+    }
+
+    const UChar* start = input.characters();
+    return parseHTMLIntegerInternal(start, start + length, value);
+}
 
+template <typename CharacterType>
+static bool parseHTMLNonNegativeIntegerInternal(const CharacterType* position, const CharacterType* end, unsigned& value)
+{
     // Step 3
     while (position < end) {
         if (!isHTMLSpace(*position))
@@ -244,8 +252,27 @@ bool parseHTMLNonNegativeInteger(const String& input, unsigned int& value)
 
     // Step 9
     bool ok;
-    value = charactersToUIntStrict(digits.characters(), digits.length(), &ok);
+    if (digits.is8Bit())
+        value = charactersToUIntStrict(digits.characters8(), digits.length(), &ok);
+    else
+        value = charactersToUIntStrict(digits.characters16(), digits.length(), &ok);
     return ok;
 }
 
+
+// http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-non-negative-integers
+bool parseHTMLNonNegativeInteger(const String& input, unsigned& value)
+{
+    // Step 1
+    // Step 2
+    unsigned length = input.length();
+    if (length && input.is8Bit()) {
+        const LChar* start = input.characters8();
+        return parseHTMLNonNegativeIntegerInternal(start, start + length, value);
+    }
+    
+    const UChar* start = input.characters();
+    return parseHTMLNonNegativeIntegerInternal(start, start + length, value);
+}
+
 }
diff --git a/Source/WebCore/html/shadow/DateTimeEditElement.cpp b/Source/WebCore/html/shadow/DateTimeEditElement.cpp
index e612d2f0b..d36ec1cc6 100644
--- a/Source/WebCore/html/shadow/DateTimeEditElement.cpp
+++ b/Source/WebCore/html/shadow/DateTimeEditElement.cpp
@@ -317,6 +317,15 @@ void DateTimeEditElement::addField(PassRefPtr<DateTimeFieldElement> field)
     appendChild(field);
 }
 
+bool DateTimeEditElement::anyEditableFieldsHaveValues() const
+{
+    for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex) {
+        if (!m_fields[fieldIndex]->isReadOnly() && m_fields[fieldIndex]->hasValue())
+            return true;
+    }
+    return false;
+}
+
 void DateTimeEditElement::blurByOwner()
 {
     if (DateTimeFieldElement* field = focusedField())
diff --git a/Source/WebCore/html/shadow/DateTimeEditElement.h b/Source/WebCore/html/shadow/DateTimeEditElement.h
index 94cb0ac80..17952acf5 100644
--- a/Source/WebCore/html/shadow/DateTimeEditElement.h
+++ b/Source/WebCore/html/shadow/DateTimeEditElement.h
@@ -86,6 +86,7 @@ public:
 
     virtual ~DateTimeEditElement();
     void addField(PassRefPtr<DateTimeFieldElement>);
+    bool anyEditableFieldsHaveValues() const;
     void blurByOwner();
     virtual void defaultEventHandler(Event*) OVERRIDE;
     void disabledStateChanged();