path: root/Source/WebCore/ChangeLog

2012-05-27  David Kilzer  <ddkilzer@apple.com>

        Use xcrun to find gperf path on platforms that use Xcode
        <http://webkit.org/b/87587>

        Reviewed by Dan Bernstein.

        * WebCore.xcodeproj/project.pbxproj:
        (Generate Derived Sources): Set GPERF environment variable using
        xcrun.
        * css/makeprop.pl: Use GPERF environment variable if set, else
        "gperf".
        * css/makevalues.pl: Ditto.
        * make-hash-tools.pl: Ditto.

2012-05-27  Li Yin  <li.yin@intel.com>

        [FileAPI] FileReader should fire progress event when blob has been completely read into memory
        https://bugs.webkit.org/show_bug.cgi?id=87585

        Reviewed by Kentaro Hara.

        From Spec: http://www.w3.org/TR/FileAPI/#dfn-progress-event
        One progress event will fire when blob has been completely read into memory.
        Firefox, Opera and IE follows the spec.
        Webkit based browser doesn't do that, it only fires progress event at interval of 50ms.
        WebKit should add the behavior to make the conformance with the spec.

        Tests: fast/files/file-reader-event-listener.html

        * fileapi/FileReader.cpp:
        (WebCore::FileReader::didFinishLoading):

2012-05-26  Li Yin  <li.yin@intel.com>

        [FileAPI] The result attribute of FileReader shuold use null to replace empty string
        https://bugs.webkit.org/show_bug.cgi?id=87578

        Reviewed by Kentaro Hara.

        From Spec: http://www.w3.org/TR/FileAPI/#filedata-attr
        Before read method has been called or an error in reading has occurred,
        the result attribute should be null, not empty string.

        Currently, Firefox, Opera and IE 10 follows the spec, but Webkit based 
        browser don't.
        WebKit should change the returned value empty string into null to keep 
        conformance with the spec.

        Tests: fast/files/read-file-async.html
               fast/files/blob-slice-test.html
               fast/files/read-blob-async.html
               fast/files/workers/worker-read-blob-async.html
               fast/files/workers/worker-read-file-async.html

        * fileapi/FileReader.cpp:
        (WebCore::FileReader::stringResult):

2012-05-26  Andy Estes  <aestes@apple.com>

        Fix the build when NETSCAPE_PLUGIN_API is disabled by marking a
        parameter as unused.

        * plugins/PluginData.cpp:
        (WebCore::PluginData::initPlugins):

2012-05-26  Nate Chapin  <japhet@chromium.org>

        Cancel CachedResource loads when the last client is removed.
        https://bugs.webkit.org/show_bug.cgi?id=35377

        Reviewed by Darin Adler.

        Test: http/tests/cache/cancel-in-progress-load.html

        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::errorLoadingResource):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::allClientsRemoved):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::allClientsRemoved):
        * loader/cache/CachedRawResource.cpp:
        (WebCore):
        * loader/cache/CachedRawResource.h:
        (WebCore::CachedRawResource::shouldIgnoreHTTPStatusCodeErrors):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::allClientsRemoved):
        (WebCore):
        * loader/cache/CachedResource.h:
        (CachedResource):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::allClientsRemoved):

2012-05-26  Simon Fraser  <simon.fraser@apple.com>

        fast/block/inline-children-root-linebox-crash.html asserts after r118567
        https://bugs.webkit.org/show_bug.cgi?id=87544

        Reviewed by Darin Adler.
        
        RenderInline::offsetFromContainer() set offsetDependsOnPoint to true based
        on the container's flipped writing mode. However, offsetFromContainer() would
        then overwrite that, since it only checked for columns.
        
        Fix by having RenderInline::offsetFromContainer() check for flipping on
        the container. This fixes the assertion.
        
        The new testcase exercises fixes another issue; unlike mapLocalToAbsolute(),
        RenderGeometryMap::absoluteRect() didn't pass the rect center point through
        the mapping, which resulted in a different result in some flipping cases.

        Test: compositing/geometry/flipped-blocks-inline-mapping.html

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::absoluteRect):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetFromContainer):
        (WebCore::RenderInline::pushMappingToContainer):

2012-05-26  Geoffrey Garen  <ggaren@apple.com>

        WebKit should be lazy-finalization-safe (esp. the DOM) v2
        https://bugs.webkit.org/show_bug.cgi?id=87581

        Reviewed by Oliver Hunt.

        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::destroy):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::destroy):
        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::destroy):
        * bindings/js/JSNodeCustom.cpp:
        (WebCore::JSNodeOwner::finalize):
        * bindings/js/JSWorkerContextBase.cpp:
        (WebCore::JSWorkerContextBase::destroy):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObject::destroy):
        (WebCore::JSTestActiveDOMObjectOwner::finalize):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetter::destroy):
        (WebCore::JSTestCustomNamedGetterOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructor::destroy):
        (WebCore::JSTestEventConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTarget::destroy):
        (WebCore::JSTestEventTargetOwner::finalize):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestException::destroy):
        (WebCore::JSTestExceptionOwner::finalize):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterface::destroy):
        (WebCore::JSTestInterfaceOwner::finalize):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListener::destroy):
        (WebCore::JSTestMediaQueryListListenerOwner::finalize):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructor::destroy):
        (WebCore::JSTestNamedConstructorOwner::finalize):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObj::destroy):
        (WebCore::JSTestObjOwner::finalize):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterface::destroy):
        (WebCore::JSTestSerializedScriptValueInterfaceOwner::finalize):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcFallbackObjectImp::destroy):
        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::QtRuntimeMethod::destroy):
        * bridge/qt/qt_runtime_qt4.cpp:
        (JSC::Bindings::QtRuntimeMethod::destroy):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::destroy):
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::destroy):
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::destroy):
        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::finalize): Use static_cast instead of jsCast because
        jsCast does Structure-based validation, and our Structure is not guaranteed
        to be alive when we get finalized.

2012-05-26  Simon Fraser  <simon.fraser@apple.com>

        Clip rects assertion when hovering div with transform
        https://bugs.webkit.org/show_bug.cgi?id=87580

        Reviewed by Eric Seidel.
        
        Hit testing used to use temporary clip rects in composited documents,
        until r118562. Now that we cache clip rects for hit testing, we need
        to clear the cache on descendant layers when a layer gains or loses
        a transform.

        Test: fast/layers/clip-rects-assertion.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateTransform):

2012-05-25  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/11439771> WebProcess sends many synchronous messages to the UI process while scrolling beneath ScrollView::contentsToScreen()
        https://bugs.webkit.org/show_bug.cgi?id=87571

        Reviewed by Anders Carlsson.

        fakeMouseEventTimerFired() uses the last known mouse position for the fake mouse event, but
        calls contentsToScreen() to compute a corresponding position in screen coordinates. Avoid
        this by also recording the last known mouse position in screen coordinates, and using that
        value.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear): Added resetting m_currentMouseGlobalPosition.
        (WebCore::EventHandler::handleMousePressEvent): Added updating m_currentMouseGlobalPosition
        when updating m_currentMousePosition.
        (WebCore::EventHandler::handleMouseDoubleClickEvent): Ditto.
        (WebCore::EventHandler::handleMouseMoveEvent): Ditto.
        (WebCore::EventHandler::handleMouseReleaseEvent): Ditto.
        (WebCore::EventHandler::fakeMouseMoveEventTimerFired): Changed to use m_currentMouseGlobalPosition
        in the fake event instead of calling contentsToScreen().
        * page/EventHandler.h: Added m_currentMouseGlobalPosition data member.

2012-05-25  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Remove ImageGStreamerCG implementation
        https://bugs.webkit.org/show_bug.cgi?id=87559

        The ImageGStreamerCG abstraction is being removed until I manage to
        port my gst-mac WebKit branch over to the WebKit2 mac port. No
        need to update the XCode project because this file is not
        referenced there anyway.

        Reviewed by Martin Robinson.

        * platform/graphics/gstreamer/ImageGStreamer.h:
        (ImageGStreamer):
        * platform/graphics/gstreamer/ImageGStreamerCG.mm: Removed.

2012-05-26  Rob Buis  <rwlbuis@webkit.org>

        Bug 15799: textPath element does not re-render when referenced path changes
        https://bugs.webkit.org/show_bug.cgi?id=15799

        Reviewed by Nikolas Zimmermann.

        Support textPath updating to changes on the referenced path. To make this possible
        use the target reference functionality also used by SVGFEImageElement.

        Tests: svg/custom/textPath-change-id-expected.svg
               svg/custom/textPath-change-id-pattern-expected.svg
               svg/custom/textPath-change-id-pattern.svg
               svg/custom/textPath-change-id.svg
               svg/custom/textPath-change-id2-expected.svg
               svg/custom/textPath-change-id2-pattern-expected.svg
               svg/custom/textPath-change-id2-pattern.svg
               svg/custom/textPath-change-id2.svg
               svg/custom/textPath-change-reference-expected.svg
               svg/custom/textPath-change-reference-pattern-expected.svg
               svg/custom/textPath-change-reference-pattern.svg
               svg/custom/textPath-change-reference-using-baseval-expected.svg
               svg/custom/textPath-change-reference-using-baseval-pattern-expected.svg
               svg/custom/textPath-change-reference-using-baseval-pattern.svg
               svg/custom/textPath-change-reference-using-baseval.svg
               svg/custom/textPath-change-reference.svg
               svg/custom/textPath-change-reference2-expected.svg
               svg/custom/textPath-change-reference2-pattern-expected.svg
               svg/custom/textPath-change-reference2-pattern.svg
               svg/custom/textPath-change-reference2-using-baseval-expected.svg
               svg/custom/textPath-change-reference2-using-baseval-pattern-expected.svg
               svg/custom/textPath-change-reference2-using-baseval-pattern.svg
               svg/custom/textPath-change-reference2-using-baseval.svg
               svg/custom/textPath-change-reference2.svg
               svg/custom/textPath-insert-path-expected.svg
               svg/custom/textPath-insert-path-pattern-expected.svg
               svg/custom/textPath-insert-path-pattern.svg
               svg/custom/textPath-insert-path.svg
               svg/custom/textPath-modify-child-expected.svg
               svg/custom/textPath-modify-child-pattern-expected.svg
               svg/custom/textPath-modify-child-pattern.svg
               svg/custom/textPath-modify-child.svg
               svg/custom/textPath-path-change-expected.svg
               svg/custom/textPath-path-change-pattern-expected.svg
               svg/custom/textPath-path-change-pattern.svg
               svg/custom/textPath-path-change-using-svg-dom-expected.svg
               svg/custom/textPath-path-change-using-svg-dom-pattern-expected.svg
               svg/custom/textPath-path-change-using-svg-dom-pattern.svg
               svg/custom/textPath-path-change-using-svg-dom.svg
               svg/custom/textPath-path-change.svg
               svg/custom/textPath-path-change2-expected.svg
               svg/custom/textPath-path-change2-pattern-expected.svg
               svg/custom/textPath-path-change2-pattern.svg
               svg/custom/textPath-path-change2.svg
               svg/custom/textPath-remove-path-expected.svg
               svg/custom/textPath-remove-path-pattern-expected.svg
               svg/custom/textPath-remove-path-pattern.svg
               svg/custom/textPath-remove-path.svg
               svg/custom/textPath-set-id-expected.svg
               svg/custom/textPath-set-id.svg
               svg/custom/textPath-startoffset-expected.svg
               svg/custom/textPath-startoffset-pattern-expected.svg
               svg/custom/textPath-startoffset-pattern.svg
               svg/custom/textPath-startoffset.svg

        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::~SVGTextPathElement):
        (WebCore):
        (WebCore::SVGTextPathElement::clearResourceReferences):
        (WebCore::SVGTextPathElement::svgAttributeChanged):
        (WebCore::SVGTextPathElement::buildPendingResource):
        (WebCore::SVGTextPathElement::insertedInto):
        (WebCore::SVGTextPathElement::removedFrom):
        * svg/SVGTextPathElement.h:

2012-05-26  Nikolas Zimmermann  <nzimmermann@rim.com>

        Avoid updateFromElement() usage in SVG
        https://bugs.webkit.org/show_bug.cgi?id=87573

        Stop relying on updateFromElement() - instead rely on addChild/removeChild, which
        allows us to optimize the resources re-fetching. When a child is added to the tree
        we don't need to remove existing resources from the SVGResourcesCache - the renderer
        can't be in the cache yet. Similary, remove the entry from the cache earlier: as soon
        as the renderer is removed from the tree, instead of waiting for willBeDestroyed().

        No new tests, refactoring only.

        * rendering/svg/RenderSVGBlock.cpp:
        * rendering/svg/RenderSVGBlock.h:
        (RenderSVGBlock):
        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::addChild):
        (WebCore):
        (WebCore::RenderSVGContainer::removeChild):
        * rendering/svg/RenderSVGContainer.h:
        (RenderSVGContainer):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::addChild):
        (WebCore::RenderSVGInline::removeChild):
        * rendering/svg/RenderSVGInline.h:
        (RenderSVGInline):
        * rendering/svg/RenderSVGModelObject.cpp:
        * rendering/svg/RenderSVGModelObject.h:
        (RenderSVGModelObject):
        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::registerResource):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::addChild):
        (WebCore):
        (WebCore::RenderSVGRoot::removeChild):
        * rendering/svg/RenderSVGRoot.h:
        (RenderSVGRoot):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::addChild):
        (WebCore::RenderSVGText::removeChild):
        * rendering/svg/SVGResourcesCache.cpp:
        (WebCore::SVGResourcesCache::clientStyleChanged):
        (WebCore::rendererCanHaveResources):
        (WebCore):
        (WebCore::SVGResourcesCache::clientWasAddedToTree):
        (WebCore::SVGResourcesCache::clientWillBeRemovedFromTree):
        * rendering/svg/SVGResourcesCache.h:
        (SVGResourcesCache):
        * svg/SVGStyledElement.cpp:
        * svg/SVGStyledElement.h:
        (SVGStyledElement):

2012-05-25  Nat Duca  <nduca@chromium.org>

        [chromium] Instrument V8 GC with TraceEvent
        https://bugs.webkit.org/show_bug.cgi?id=87530

        Reviewed by Kentaro Hara.

        We sometimes get performance issues where performance stalls can
        be attributed to badly timed GC operations, especially ones that
        happen just before a frame running. This adds tracing calls around
        GC so that we can better understand these kinds of hangs.

        * bindings/v8/V8GCController.cpp:
        (WebCore::V8GCController::gcPrologue):
        (WebCore::V8GCController::gcEpilogue):

2012-05-25  Garrett Casto  <gcasto@chromium.org>

        Allow WebTextFieldDecoratorClient to see applied decorations.
        https://bugs.webkit.org/show_bug.cgi?id=86557

        Reviewed by Kent Tamura.

        * html/shadow/TextFieldDecorationElement.cpp:
        (WebCore::TextFieldDecorationElement::fromShadowRoot): A function
        that will extract a TextFielDecorationElement from a ShadowRoot, if
        there is one.
        * html/shadow/TextFieldDecorationElement.h:
        (WebCore):
        (TextFieldDecorator):

2012-05-25  Tony Chang  <tony@chromium.org>

        implement new negative flexing algorithm
        https://bugs.webkit.org/show_bug.cgi?id=86528

        Reviewed by Ojan Vafai.

        Rather than just scale by the negative flexibility, we also take the
        flex-basis (preferred size) into consideration.  That means items with
        a larger preferred size will shrink faster.

        Test: css3/flexbox/flex-algorithm.html (new test cases added)

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild): Handle overflow.
        (WebCore::RenderFlexibleBox::layoutFlexItems):
        (WebCore::RenderFlexibleBox::computeNextFlexLine): Sum weighted negative flex.
        (WebCore::RenderFlexibleBox::freezeViolations):
        (WebCore::RenderFlexibleBox::resolveFlexibleLengths): Shrink by weighted amount.
        Also handle large values by making sure the flex values are finite.
        * rendering/RenderFlexibleBox.h:

2012-05-25  Mihai Parparita  <mihaip@chromium.org>

        Allow synchronous XHRs to be disabled in documents
        https://bugs.webkit.org/show_bug.cgi?id=87540

        Reviewed by Eric Seidel.

        Test: fast/xmlhttprequest/xmlhttprequest-sync-disabled.html

        Synchronous XMLHttpRequests are a problematic API, since they result
        in blocked UI threads. Some clients may wish to always disable them;
        give them a setting to do so (see also r103629 for other cases where
        synchronous XHRs are disabled).

        * page/Settings.cpp:
        (WebCore):
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::setSyncXHRInDocumentsEnabled):
        (WebCore::Settings::syncXHRInDocumentsEnabled):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setSyncXHRInDocumentsEnabled):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open):

2012-05-25  Kinuko Yasuda  <kinuko@chromium.org>

        [chromium] Deprecate FileUtilities::getFileSize and getFileModifiedTime in favor of getFileMetadata
        https://bugs.webkit.org/show_bug.cgi?id=87492

        Reviewed by Adam Barth.

        No new tests: existing tests (http/tests/local/fileapi/* and fast/files/*) should pass.

        * platform/chromium/FileSystemChromium.cpp:
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-05-25  Abhishek Arya  <inferno@chromium.org>

        Crash in RenderTableSection::paintCell.
        https://bugs.webkit.org/show_bug.cgi?id=87445

        Reviewed by Eric Seidel and Julien Chaffraix.

        Fix the crash by preventing table parts from being set
        as layout root. This prevents us from accessing removed
        table cells which can happen if RenderTableSection::layout
        is called directly without calling RenderTable::layout first
        (in case of cell recalc).

        Add ASSERTs to RenderTableSection::layout to prevent
        layout to happen when we are already pending cell recalc
        or our table is pending section recalc. In those cases,
        RenderTable::layout should be called first to relayout
        the entire table.

        Test: tables/table-section-overflow-clip-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::objectIsRelayoutBoundary):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layout):

2012-05-25  Philip Rogers  <pdr@google.com>

        Fix for self-closing <use> tags
        https://bugs.webkit.org/show_bug.cgi?id=87504

        Reviewed by Adam Barth.

        This change causes self-closing non-html tags to behave the same
        as tags immediately followed by the closing tag.

        Test: svg/custom/svg-self-closing-use.html

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::attachLater):
        (WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement):
        (WebCore::HTMLConstructionSite::insertForeignElement):
        * html/parser/HTMLConstructionSite.h:
        (HTMLConstructionSite):

2012-05-25  Dan Bernstein  <mitz@apple.com>

        Make the ICU-based implementation of NonSharedCharacterBreakIterator work in configurations
        that do not have COMPARE_AND_SWAP enabled.

        Reviewed by Jessie Berlin.

        * platform/text/TextBreakIteratorICU.cpp:
        (WebCore::compareAndSwapNonSharedCharacterBreakIterator): Added this helper. It uses
        weakCompareAndSwap when COMPARE_AND_SWAP is enabled, and uses a mutex to do the atomic
        compare and swap otherwise.
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Changed to use
        compareAndSwapNonSharedCharacterBreakIterator().
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.

2012-05-25  Tommy Widenflycht  <tommyw@google.com>

        MediaStream API: Make sure IceCallback is valid for PeerConnection00
        https://bugs.webkit.org/show_bug.cgi?id=87480

        Reviewed by Adam Barth.

        Existing tests have been extended to cover this change.

        * Modules/mediastream/PeerConnection00.cpp:
        (WebCore::PeerConnection00::create):
        * Modules/mediastream/PeerConnection00.h:
        * Modules/mediastream/PeerConnection00.idl:

2012-05-25  Mike West  <mkwst@chromium.org>

        Inline script and style blocked by Content Security Policy should provide more detailed console errors.
        https://bugs.webkit.org/show_bug.cgi?id=86848

        Reviewed by Adam Barth.

        This change adds a URL and line number for context to each call to
        `ContentSecurityPolicy::allowInline*`, and pipes it through to the
        console message generation in `CSPDirectiveList::reportViolation`.

        Line numbers are not added for injected scripts (`document.write(...)`,
        `document.body.appendChild`, and etc.).

        Tests: http/tests/security/contentSecurityPolicy/injected-inline-script-allowed.html
               http/tests/security/contentSecurityPolicy/injected-inline-script-blocked.html
               http/tests/security/contentSecurityPolicy/injected-inline-style-allowed.html
               http/tests/security/contentSecurityPolicy/injected-inline-style-blocked.html

        * bindings/ScriptControllerBase.cpp:
        (WebCore::ScriptController::executeIfJavaScriptURL):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::ScriptElement):
        (WebCore::ScriptElement::executeScript):
        * dom/ScriptElement.h:
        (ScriptElement):
        * dom/StyleElement.cpp:
        (WebCore::StyleElement::StyleElement):
        (WebCore::StyleElement::createSheet):
        * dom/StyleElement.h:
        (StyleElement):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::StyledElement):
        (WebCore):
        (WebCore::StyledElement::style):
        (WebCore::StyledElement::styleAttributeChanged):
        * dom/StyledElement.h:
        (StyledElement):
        * page/ContentSecurityPolicy.cpp:
        (CSPDirectiveList):
        (WebCore::CSPDirectiveList::reportViolation):
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
        (WebCore::CSPDirectiveList::allowInlineScript):
        (WebCore::CSPDirectiveList::allowInlineStyle):
        (WebCore::CSPDirectiveList::allowEval):
        (WebCore):
        (WebCore::isAllowedByAllWithCallStack):
        (WebCore::isAllowedByAllWithContext):
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
        (WebCore::ContentSecurityPolicy::allowInlineScript):
        (WebCore::ContentSecurityPolicy::allowInlineStyle):
        * page/ContentSecurityPolicy.h:
        (WTF):

2012-05-25  Tim Horton  <timothy_horton@apple.com>

        ENABLE_CSS3_FLEXBOX is insufficient to disable all web-facing bits of the feature
        https://bugs.webkit.org/show_bug.cgi?id=87537
        <rdar://problem/11524921>

        Reviewed by Simon Fraser.

        Allow the feature flag to disable more web-facing parts of the CSS3 flexbox
        implementation (primarily fallout from hiding it from computed style).

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getPropertyValue):
        (WebCore::StylePropertySet::asText):
        * css/StylePropertyShorthand.cpp:
        (WebCore::shorthandForProperty):
        * css/StylePropertyShorthand.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::CSSPropertyAnimation::ensurePropertyMap):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::createObject):
        * rendering/style/RenderStyleConstants.h:

2012-05-25  Adrienne Walker  <enne@google.com>

        [chromium] Add setting for painting debug info onto tiles
        https://bugs.webkit.org/show_bug.cgi?id=75763

        Reviewed by James Robinson.

        Add a compile-time CCSetting to paint debug information onto tiles. This
        can help to understand paint counts and layer indices. This setting is
        off by default.

        * platform/graphics/chromium/ContentLayerChromium.cpp:
        (WebCore::ContentLayerPainter::create):
        (WebCore::ContentLayerPainter::paint):
        (WebCore::ContentLayerPainter::ContentLayerPainter):
        (WebCore::ContentLayerChromium::createTextureUpdater):
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        (WebCore::UpdatableTile::UpdatableTile):
        (WebCore::UpdatableTile::setUpdateFrame):
        (WebCore::UpdatableTile::incrementPaintCount):
        (WebCore::UpdatableTile::updateFrame):
        (WebCore::UpdatableTile::paintCount):
        (WebCore::TiledLayerChromium::TiledLayerChromium):
        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
        (WebCore::TiledLayerChromium::paintDebugTileInfo):
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (WebCore::CCSettings::CCSettings):

2012-05-25  Ami Fischman  <fischman@chromium.org>

        [chromium] Default media controls should render only the currentTime-containing buffered range
        https://bugs.webkit.org/show_bug.cgi?id=85925

        Reviewed by Eric Carlson.

        Test: http/tests/media/video-buffered-range-contains-currentTime.html

        * rendering/RenderMediaControlsChromium.cpp:
        (WebCore::paintMediaSlider):

2012-05-25  Simon Fraser  <simon.fraser@apple.com>

        Build fix: add TransformationMatrix ctor from an AffineTransform.

        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::TransformationMatrix::TransformationMatrix):
        (WebCore):
        * platform/graphics/transforms/TransformationMatrix.h:
        (TransformationMatrix):

2012-05-24  Ryosuke Niwa  <rniwa@webkit.org>

        createContextualFragment and insertAdjacentHTML should throw syntax error
        https://bugs.webkit.org/show_bug.cgi?id=87454

        Reviewed by Darin Adler.

        Before this patch, createContextualFragment threw NOT_SUPPORTED_ERR and insertAdjacentHTML didn't throw any errors.
        Make them throw SYNTAX_ERR to be consistent with the spec and Firefox:
        http://html5.org/specs/dom-parsing.html#parsing
        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-xhtml-syntax.html#xml-fragment-parsing-algorithm

        Also reduced the code duplication.

        Test: fast/dom/xhtml-fragment-parsing-exceptions.xhtml

        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setInnerHTML): Explicitly pass AllowScriptingContent. 
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkup):
        (WebCore::createFragmentForInnerOuterHTML): Takes ExceptionCode now.
        (WebCore::createContextualFragment): Share code with createFragmentForInnerOuterHTML
        and propagate the exception code.
        * editing/markup.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::setInnerHTML): Explicitly pass AllowScriptingContent.
        (WebCore::HTMLElement::setOuterHTML): Ditto.
        (WebCore::HTMLElement::insertAdjacentHTML): Ditto; also rename ignoredEc to ignoredEC
        per Darin's comment on the bug 87339.

2012-05-25  John Knottenbelt  <jknotten@chromium.org>

        Body scrollWidth() and scrollHeight() should be page scale-invariant
        https://bugs.webkit.org/show_bug.cgi?id=87494

        RenderView::documentRect() is calculating the "scaled" document rect by applying
        the current transformation matrix to the unscaledDocumentRect() and then
        returning the rounded-out IntRect result.

        This rounding out is incorrect because it allows the scaled rectangle to
        represent an area that is not actually covered by the document.

        We fix this by applying the current transform to the document rect
        as a FloatRect and then explicitly converting to IntRect, which
        takes the floor of the resulting rectangle coordinates instead of
        rounding them out.

        This is evidenced by the document.body.scrollWidth() and
        document.body.scrollHeight() changing under page scale factor when
        they are expected to remain invariant.

        Reviewed by James Robinson.

        Test: fast/dom/window-scroll-scaling.html

        * rendering/RenderView.cpp:
        (WebCore::RenderView::documentRect):

2012-05-25  Dan Bernstein  <mitz@apple.com>

        characterBreakIterator() is not safe to use reentrantly or from multiple threads
        https://bugs.webkit.org/show_bug.cgi?id=87521

        Reviewed by Darin Adler.

        Replaced characterBreakIterator() with a NonSharedCharacterBreakIterator class, which
        obtains a unique TextBreakIterator. Replaced the global shared instance with a single-entry
        cache.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::parserAppendData): Changed to use NonSharedCharacterBreakIterator.

        * platform/graphics/StringTruncator.cpp:
        (WebCore::centerTruncateToBuffer): Ditto.
        (WebCore::rightTruncateToBuffer): Ditto.

        * platform/text/String.cpp:
        (WebCore::numGraphemeClusters): Ditto.
        (WebCore::numCharactersInGraphemeClusters): Ditto.

        * platform/text/TextBreakIterator.h: Removed the declaration of characterBreakIterator().
        (NonSharedCharacterBreakIterator): Added. An instance of this class has a character break
        iterator instance that is unique to it for the lifetime of the instance.
        (WebCore::NonSharedCharacterBreakIterator::operator TextBreakIterator*): Added.

        * platform/text/TextBreakIteratorICU.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Added. Tries
        to swap the m_iterator member variable with the cached instance. If that fails, initializes
        m_iterator to a new character break iterator.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Added. Tries
        to put the m_iterator member variable back in the cache. If that fails, meaning there is
        already something in the cache, destroys m_iterator.

        * platform/text/gtk/TextBreakIteratorGtk.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Same as in
        TextBreakIteratorICU.cpp.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.
        (WebCore::cursorMovementIterator): Moved the old implementation of characterBreakIterator()
        here.

        * platform/text/qt/TextBreakIteratorQt.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Same as in
        TextBreakIteratorICU.cpp.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.
        (WebCore::cursorMovementIterator): Moved the old implementation of characterBreakIterator()
        here.

        * platform/text/wince/TextBreakIteratorWinCE.cpp:
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Same as in
        TextBreakIteratorICU.cpp.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Ditto.
        (WebCore::cursorMovementIterator): Moved the old implementation of characterBreakIterator()
        here.

2012-05-25  Simon Fraser  <simon.fraser@apple.com>

        Terrible performance on http://alliances.commandandconquer.com/ and http://www.lordofultima.com/
        https://bugs.webkit.org/show_bug.cgi?id=84410

        Reviewed by Dave Hyatt.
        
        First part of fixing O(N^2) issues when walking the RenderLayer tree
        for computeCompositingRequirements().
        
        For each layer that goes into the OverlapMap, we were computing an absolute
        layer bounds, which requires walking back to the root of the tree.
        Optimize this when possible by storing a stack of offsets as we walk
        the tree, and using this stack to do the mapping.
        
        The stack of offsets and transforms is managed by RenderGeometryMap.
        When visiting a RenderLayer, RenderLayerCompositor pushes onto
        the geometry map stack data about offsets and transforms between
        the current layer and its stacking-parent. RenderGeometryMap handles
        the case where the previous renderer pushed is between the current
        renderer and its container. RenderGeometryMap can also handle callers
        pushing renderers with multiple containers between them.
        
        RenderGeometryMap stores some flags about whether the set of mapping
        steps in the stack involve transforms, fixed position, or special non-uniform
        mappings like CSS columns. In some cases, it falls back to mapping via
        renderers.

        Once constructed, the RenderGeometryMap stack can be used to map multiple
        rects or points efficiently. Stacks consisting of simple offsets are
        collapsed to a single offset.
        
        Mappings between renderers and their containers are pushed by pushMappingToContainer()
        methods, which are similar to mapLocalToContainer() methods. Having this code
        in RenderObjects was deemed preferable to handling columns, transforms etc. all in
        RenderLayer code.

        Tested by assertions in RenderGeometryMap code that its mapping matches
        mapping via localToAbsolute() calls.
        
        RenderLayerCompositor::updateCompositingLayers() creates a RenderGeometryMap,
        and pushes and pops layer renderers as it visits them. The geometry map is used
        by RenderLayerCompositor::addToOverlapMap() when computing absolute layer bounds.
        
        Futher optimizations in RenderGeometryMap are possible, especially with stacks that
        have many offsets and a few transforms.

        Tests: compositing/geometry/composited-in-columns.html
               compositing/geometry/flipped-writing-mode.html

        * CMakeLists.txt: Add RenderGeometryMap
        * GNUmakefile.list.am: Ditt
        * Target.pri: Ditto
        * WebCore.gypi: Ditto
        * WebCore.vcproj/WebCore.vcproj: Ditto
        * WebCore.xcodeproj/project.pbxproj: Ditto
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::absoluteContentBox):
        (WebCore::RenderBox::pushMappingToContainer):
        (WebCore::RenderBox::offsetFromContainer):
        * rendering/RenderBox.h:
        * rendering/RenderGeometryMap.cpp: Added.
        (RenderGeometryMapStep):
        (WebCore::RenderGeometryMapStep::RenderGeometryMapStep):
        (WebCore::RenderGeometryMapStep::mapPoint):
        (WebCore::RenderGeometryMapStep::mapQuad):
        (WebCore::RenderGeometryMap::RenderGeometryMap):
        (WebCore::RenderGeometryMap::~RenderGeometryMap):
        (WebCore::RenderGeometryMap::absolutePoint):
        (WebCore::RenderGeometryMap::absoluteRect):
        (WebCore::RenderGeometryMap::mapToAbsolute):
        (WebCore::RenderGeometryMap::pushMappingsToAncestor):
        (WebCore::RenderGeometryMap::push):
        (WebCore::RenderGeometryMap::pushView):
        (WebCore::RenderGeometryMap::popMappingsToAncestor):
        (WebCore::RenderGeometryMap::stepInserted):
        (WebCore::RenderGeometryMap::stepRemoved):
        * rendering/RenderGeometryMap.h: Added.
        (RenderGeometryMap):
        (WebCore::RenderGeometryMap::hasNonUniformStep):
        (WebCore::RenderGeometryMap::hasTransformStep):
        (WebCore::RenderGeometryMap::hasFixedPositionStep):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetFromContainer):
        (WebCore::RenderInline::pushMappingToContainer):
        * rendering/RenderInline.h:
        (RenderInline):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateCompositingLayers):
        (WebCore::RenderLayerCompositor::addToOverlapMap):
        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::mapLocalToContainer):
        (WebCore::RenderObject::pushMappingToContainer):
        (WebCore::RenderObject::offsetFromContainer):
        (WebCore::RenderObject::container):
        * rendering/RenderObject.h:
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::offsetFromContainer):
        * rendering/RenderTableCell.h:
        (RenderTableCell):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::pushMappingToContainer):
        * rendering/RenderView.h:
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::pushMappingToContainer):
        * rendering/svg/RenderSVGForeignObject.h:
        (RenderSVGForeignObject):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::pushMappingToContainer):
        * rendering/svg/RenderSVGInline.h:
        (RenderSVGInline):
        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::pushMappingToContainer):
        * rendering/svg/RenderSVGModelObject.h:
        (RenderSVGModelObject):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::pushMappingToContainer):
        * rendering/svg/RenderSVGRoot.h:
        (RenderSVGRoot):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::pushMappingToContainer):
        * rendering/svg/RenderSVGText.h:
        (RenderSVGText):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::pushMappingToContainer):
        * rendering/svg/SVGRenderSupport.h:
        (SVGRenderSupport):

2012-05-25  Simon Fraser  <simon.fraser@apple.com>

        Cache absolute clip rects on RenderLayer for compositing overlap testing
        https://bugs.webkit.org/show_bug.cgi?id=87212

        Reviewed by Dave Hyatt.
        
        Enhance the cache of ClipRects on RenderLayers to store three
        different types of ClipRects, rather than just one.
        
        We need to compute clip rects relative to different layers
        for different purposes. For painting, we compute relative to
        the compositing layer which is acting as a painting root.
        For hit testing, we compute relative to the root, except
        for transformed layers. For composting overlap testing, we
        compute relative to the root ("absolute"). At other times, we do one-off
        computation which we never want to cache ("temporary clip rects").
        
        This change allows us to cache rects for hit testing, and for
        compositing overlap testing. This has huge performance benefits
        on some pages (bug 84410).
        
        This change also makes ClipRects not arena-allocated, so we
        can use RefPtr<ClipRect>.

        No testable behavior change.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::willBeDestroyed): No need for the
        explicit clipRects teardown, since clipRects don't need a live
        RenderObject for arena-based destruction.

        * rendering/RenderLayer.cpp: Remove arena-related new and delete.
        (WebCore::RenderLayer::RenderLayer): No need to explicitly initialize m_clipRects,
        since it's an OwnPtr now.
        (WebCore::RenderLayer::~RenderLayer): No explicit clipRect teardown required.
        (WebCore::RenderLayer::clippingRootForPainting): Renamed to make its purpose
        more obvious.
        (WebCore::RenderLayer::paintLayer): Use the TemporaryClipRects type when necessary.
        (WebCore::RenderLayer::paintLayerContents): Ditto
        (WebCore::RenderLayer::hitTestLayer): No longer need to use temporary clipRects when
        hit testing since we cache clip rects for hit testing.
        (WebCore::RenderLayer::updateClipRects): Take a ClipRectsType and pass it through.
        (WebCore::RenderLayer::calculateClipRects): Ditto
        (WebCore::RenderLayer::parentClipRects): Ditto
        (WebCore::RenderLayer::backgroundClipRect): Ditto
        (WebCore::RenderLayer::calculateRects): Take ClipRectsType, which obviates temporaryClipRects.
        (WebCore::RenderLayer::childrenClipRect): Use clippingRootForPainting().
        (WebCore::RenderLayer::selfClipRect): Ditto
        (WebCore::RenderLayer::localClipRect): Ditto
        (WebCore::RenderLayer::clearClipRectsIncludingDescendants): Take a type of clip rect to clear
        (include all). Allows us to just clear painting clip rects.
        (WebCore::RenderLayer::clearClipRects):

        * rendering/RenderLayer.h:
        (WebCore::ClipRects::create): We don't use RefCounted<> in order to use a bit in
        the refCount for a flag. Add create() method.
        (WebCore::ClipRects::deref): No longer arena-allocated.
        (WebCore::ClipRectsCache::ClipRectsCache): Struct that holds a small
        array of the 3 types of clipRects (and, in debug, the layer relative
        to which they were computed).
        (WebCore::RenderLayer::clipRects):

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateCompositedBounds): Use AbsoluteClipRects; rootLayer
        is always the RenderView's layer here.
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Use TemporaryClipRects.
        (WebCore::RenderLayerBacking::setRequiresOwnBackingStore): When this variable changes,
        we need to invalidate painting clipRects, since it affects the ancestor relative to which
        those rects are computed.

        * rendering/RenderLayerBacking.h:
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateBacking): When the composited state
        of a layer changes, we have to clear all descendant clip rects, since this
        can affect the layers relative to which clip rects are computed.
        (WebCore::RenderLayerCompositor::addToOverlapMap): Use AbsoluteClipRects.
        (WebCore::RenderLayerCompositor::computeCompositingRequirements): No need
        to call updateLayerPosition(), since that should have always happened after
        layout. That call cleared clip rects, so removing it is very beneficial.
        (WebCore::RenderLayerCompositor::clippedByAncestor): Use TemporaryClipRects.

        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeLayers): Use TemporaryClipRects.

2012-05-25  Dean Jackson  <dino@apple.com>

        Unreviewed, rolling out r112155.
        http://trac.webkit.org/changeset/112155
        https://bugs.webkit.org/show_bug.cgi?id=79389
        Hitch (due to style recalc?) when starting CSS3 animation

        This caused a number of issues, including:
        https://bugs.webkit.org/show_bug.cgi?id=87146
        https://bugs.webkit.org/show_bug.cgi?id=84194
        <rdar://problem/11506629>
        <rdar://problem/11267408>
        <rdar://problem/11531859>

        * dom/Element.cpp:
        (WebCore::Element::recalcStyle):

2012-05-25  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=87525
        
        For the new multi-column layout, create a flow thread and make sure the children get put inside it.

        Reviewed by Eric Seidel.

        * rendering/RenderMultiColumnBlock.cpp:
        (WebCore::RenderMultiColumnBlock::RenderMultiColumnBlock):
        (WebCore::RenderMultiColumnBlock::addChild):
        (WebCore):
        * rendering/RenderMultiColumnBlock.h:
        (WebCore):
        (RenderMultiColumnBlock):
        (WebCore::RenderMultiColumnBlock::flowThread):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::RenderMultiColumnFlowThread::~RenderMultiColumnFlowThread):
        (WebCore):
        * rendering/RenderMultiColumnFlowThread.h:
        (RenderMultiColumnFlowThread):
        * rendering/RenderMultiColumnSet.h:
        * rendering/RenderObject.h:
        (RenderObject):
        (WebCore::RenderObject::isRenderMultiColumnSet):

2012-05-25  Emil A Eklund  <eae@chromium.org>

        Change RenderBoxModelObject to compute relativePositionOffset as size
        https://bugs.webkit.org/show_bug.cgi?id=87447

        Reviewed by Eric Seidel.

        Compute relativePositionOffset as size instead of doing one axis at a
        time as all call sites uses the size version of the method. This avoids
        having to walk the DOM twice to accumulate the offsets.

        Also remove the relativePositionOffsetX and Y methods as they are no
        longer used.

        No new tests, covered by existing tests.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::layoutOverflowRectForPropagation):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::accumulateRelativePositionOffsets):
        (WebCore::RenderBoxModelObject::relativePositionOffset):
        * rendering/RenderBoxModelObject.h:
        (RenderBoxModelObject):

2012-05-25  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118395.
        http://trac.webkit.org/changeset/118395
        https://bugs.webkit.org/show_bug.cgi?id=87526

        Breaking sites including GMail and Yahoo mail (Requested by
        jsbell on #webkit).

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::collapseMargins):

2012-05-25  Ken Buchanan  <kenrb@chromium.org>

        Layout root not getting cleared for anonymous renderers geting destroyed
        https://bugs.webkit.org/show_bug.cgi?id=84002

        Reviewed by Abhishek Arya.

        This is a follow-up to r109406, which added a check to clear layout
        roots when they point to a renderer that is being destroyed. The
        thinking was that layout roots would never be anonymous renderers,
        but there are some cases where this is not true (in particular,
        generated content containers with overflow clips can be layout roots).

        As in r109406, this patch has no layout test. This is because any test
        that exercises this behavior is caused by an existing layout bug where
        a child is not properly getting layout (or a renderer is getting dirtied
        out of order during layout) and will fail multiple ASSERTs:
        in particular, ASSERT(!m_layoutRoot->container() || !m_layoutRoot->
        container()->needsLayout()) in FrameView::scheduleRelayoutOfSubtree(),
        and ASSERT_NOT_REACHED() in RenderObject::clearLayoutRootIfNeeded().
        We are preventing those bugs from manifesting as security issues with
        this patch.

        This also removes an ASSERT from the RenderObject destructor. This is
        redundant with the condition in RenderObject::clearLayoutRootIfNeeded()
        which is always called in RenderObject::willBeDestroyed(), so the check 
        is not needed. It had to be removed because it fails when I try to
        adjust the ASSERT condition by removing the !node()
        check, due to RenderWidget clearing its node() during destruction.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::~RenderObject):
        (WebCore::RenderObject::willBeDestroyed):

2012-05-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Hangup when continuously changing a css width value in Inspector
        https://bugs.webkit.org/show_bug.cgi?id=85802

        Reviewed by Vsevolod Vlasov.

        An error in the property whitespace prefix detection algorithm would append the previous line trailing whitespace,
        thereby enormously increasing the actual prefix during multiple incremental property changes.

        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyle::newLineAndWhitespaceDelimiters):

2012-05-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Clean up Inspector.json after r118367
        https://bugs.webkit.org/show_bug.cgi?id=87499

        Reviewed by Yury Semikhatsky.

        This cleans up the semantic inconsistencies introduced into type/field names r118367.

        No new tests, as this is a refactoring.

        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::detectOrigin):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::create):
        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::buildObjectForRule):
        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
        (WebCore::InspectorStyleSheetForInlineStyle::create):
        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
        * inspector/InspectorStyleSheet.h:
        (InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::canBind):
        (InspectorStyleSheetForInlineStyle):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: speed-up HeapSnapshot._bfs method.
        https://bugs.webkit.org/show_bug.cgi?id=87502

        It had containmentEdges.length call in the loop that forced deoptimization.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
        (WebInspector.HeapSnapshot.prototype._bfs):

2012-05-25  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Speed up edges iteration in heap profiler
        https://bugs.webkit.org/show_bug.cgi?id=87286

        Add an extra node to nodes array that points to the end of edges array.
        It allows to eliminate a check for the last node in iteration code.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesStart):
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesEnd):
        (WebInspector.HeapSnapshotNodeIterator):
        (WebInspector.HeapSnapshot.prototype._buildRetainers):
        (WebInspector.HeapSnapshot.prototype._bfs):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._buildPostOrderIndex):
        (WebInspector.HeapSnapshot.prototype._buildDominatorTree):
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):

2012-05-25  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: put paint and compositing timeline events in a new category of their own
        https://bugs.webkit.org/show_bug.cgi?id=86852

        Reviewed by Pavel Feldman.

        - add forth timeline category, "Painting"; make it light-purple;
        - assign paint and compositing events to Painting category;

        * WebCore.gypi: added timelineBarLightPurple.png;
        * inspector/front-end/Images/timelineBarLightPurple.png: Added.
        * inspector/front-end/Images/timelineCheckmarks.png: added light-purple icon;
        * inspector/front-end/Images/timelineDots.png: ditto.
        * inspector/front-end/TimelineOverviewPane.js:
        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord): do not merge bars in same raw if these are from different categories;
        (WebInspector.TimelineCategoryStrips.prototype.update):
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.categories):
        (WebInspector.TimelinePresentationModel.recordStyle):
        * inspector/front-end/WebKit.qrc: added timelineBarLightPurple.png;
        * inspector/front-end/timelinePanel.css: added styles for painting category;
        (.timeline-category-statusbar-item.timeline-category-painting .timeline-category-checkbox):
        (.timeline-category-painting .timeline-graph-bar):
        (.popover .timeline-painting):
        (.timeline-category-scripting .timeline-tree-icon):
        (.timeline-category-rendering .timeline-tree-icon):
        (.timeline-category-painting .timeline-tree-icon):

2012-05-25  W. James MacLean  <wjmaclean@chromium.org>

        [chromium] LayerChromium should recognise existing layer active animations when the layer is added.
        https://bugs.webkit.org/show_bug.cgi?id=87166

        Reviewed by Adrienne Walker.

        Unit test added.

        LayerChromium needs to correctly recognize if a newly added layer has an existing
        active animation.

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::setLayerTreeHost):
        (WebCore::LayerChromium::notifyAnimationFinished):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapSnapshot: introduce performance counter for HeapSnapshotConstructorsDataGrid._aggregatesReceived method.
        https://bugs.webkit.org/show_bug.cgi?id=87393

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._aggregatesReceived):
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._populateChildren):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: drop obsolete WebInspector.Uint32Array and adjust snapshot chunk size for better transfer-snapshot metric.
        https://bugs.webkit.org/show_bug.cgi?id=87490

        Originally WebInspector.Uint32Array was used for dynamic array
        reallocation because we had no information about expected arrays sizes.
        Now we have these sizes and allocates array precisely.

        Reviewed by Yury Semikhatsky.

        * bindings/v8/ScriptHeapSnapshot.cpp:
        (WebCore):
        * inspector/front-end/HeapSnapshot.js:
        * inspector/front-end/HeapSnapshotLoader.js:
        (WebInspector.HeapSnapshotLoader.prototype._parseUintArray):
        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: drop obsolete WebInspector.Uint32Array and adjust snapshot chunk size for better transfer-snapshot metric.
        https://bugs.webkit.org/show_bug.cgi?id=87490

        Originally WebInspector.Uint32Array was used for dynamic array
        reallocation because we had no information about expected arrays sizes.
        Now we have these sizes and allocates array precisely.

        Reviewed by Yury Semikhatsky.

        * bindings/v8/ScriptHeapSnapshot.cpp:
        (WebCore):
        * inspector/front-end/HeapSnapshot.js:
        * inspector/front-end/HeapSnapshotLoader.js:
        (WebInspector.HeapSnapshotLoader.prototype._parseUintArray):
        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):

2012-05-25  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: cmd-[ shortcut navigates page and is fr-keyboard incompatible
        https://bugs.webkit.org/show_bug.cgi?id=85312

        Reviewed by Vsevolod Vlasov.

        Suppress the handling of panel history navigation events if the corresponding keyboard activities produce
        the "keypress" event (which is the case on French keyboards, where AltGr+[ is translated into Ctrl+Alt+[ on Windows).
        The event is also told to preventDefault() to avoid browser history navigation on Mac while traversing the Inspector panel history.

        * inspector/front-end/InspectorView.js:
        (WebInspector.InspectorView):
        (WebInspector.InspectorView.prototype._keyPress):
        (WebInspector.InspectorView.prototype._keyDown):
        (WebInspector.InspectorView.prototype._keyDownInternal):
        * inspector/front-end/UIUtils.js:
        (WebInspector.isWin):

2012-05-25  Yury Semikhatsky  <yurys@google.com>

        Unreviewed. Fixed closure compiler warnings.

        * inspector/front-end/NativeMemorySnapshotView.js:
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked):
        (WebInspector.NativeMemoryProfileHeader.prototype.createView):

2012-05-25  Lu Guanqun  <guanqun.lu@intel.com>

        [GTK] fix compilation warning in GtkInputMethodFilter.cpp
        https://bugs.webkit.org/show_bug.cgi?id=87475

        Reviewed by Martin Robinson.

        * platform/gtk/GtkInputMethodFilter.cpp:
        (WebCore::GtkInputMethodFilter::setWidget):

2012-05-25  Zalan Bujtas  <zbujtas@gmail.com>

        [Qt] Broken controls rendering when transform is applied.
        https://bugs.webkit.org/show_bug.cgi?id=87483

        Reviewed by Simon Hausmann.

        Use only the scaling transform value to determine the size of
        the control to be drawn. When other transforms present such as
        rotate or skew, ignore them, unless scaling also involved. In
        that case, calculate the scaling value out of the transformation.

        * ManualTests/qt/control_paiting_with_transforms.html: Added.

        * platform/qt/RenderThemeQtMobile.cpp:
        (WebCore::painterScale):
        (WebCore):
        (WebCore::StylePainterMobile::sizeForPainterScale):

2012-05-17  Andrey Kosyakov  <caseq@chromium.org>

        [chromium] add instrumentation for compositing
        https://bugs.webkit.org/show_bug.cgi?id=83928

        Reviewed by James Robinson.

        - plumb willCommit() and didBeginFrame() from CCSingleThreadProxy and CCThreadProxy to inspector instrumentation;
        - note for threaded case, didBeginFrame() is invoked upon unblocking of main thread;

        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHostClient):
        (WebCore::CCLayerTreeHost::didBeginFrame):
        (WebCore::CCLayerTreeHost::willCommit):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::commitAndComposite):
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::beginFrame):

2012-05-25  Taiju Tsuiki  <tzik@chromium.org>

        Web Inspector: Drop InspectorFileSystemInstrumentation
        https://bugs.webkit.org/show_bug.cgi?id=87460

        Inspector does not need to track DOMFileSystem object now. So we can
        drop InspectorFileSystemInstrumentation.

        Reviewed by Vsevolod Vlasov.

        * GNUmakefile.list.am:
        * Modules/filesystem/DOMFileSystem.cpp:
        (WebCore::DOMFileSystem::create):
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InspectorFileSystemAgent.cpp:
        (WebCore::InspectorFileSystemAgent::enable):
        * inspector/InspectorFileSystemAgent.h:
        (InspectorFileSystemAgent):
        * inspector/InspectorFileSystemInstrumentation.h: Removed.
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (WebCore):
        (InspectorInstrumentation):

2012-05-25  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: HeapProfiler: speed-up _calculateClassesRetainedSize and _buildAggregates.
        https://bugs.webkit.org/show_bug.cgi?id=87482

        Engine didn't inline node's classIndex method because the switch statement in it wasn't inlineable.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.classIndex):

2012-05-24  Andreas Kling  <kling@webkit.org>

        Dodge style recalc when id attribute is overwritten with same value.
        <http://webkit.org/b/87211>

        Reviewed by Eric Seidel.

        Don't force style recalc when the id attribute is set to the same value it already had.
        ~3.5% improvement on Dromaeo's "dom-attr" locally.

        * dom/Element.cpp:
        (WebCore::Element::attributeChanged):

2012-05-24  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add profile type for native memory snapshots
        https://bugs.webkit.org/show_bug.cgi?id=87400

        Reviewed by Vsevolod Vlasov.

        Introduced new profile type and view classes for native memory snapshots.
        All the stuff is hidden behind an experimental setting.

        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * inspector/compile-front-end.py:
        * inspector/front-end/NativeMemorySnapshotView.js: Added.
        (WebInspector.NativeMemorySnapshotView):
        (WebInspector.NativeMemorySnapshotView.prototype.dispose):
        (WebInspector.NativeMemorySnapshotView.prototype.get statusBarItems):
        (WebInspector.NativeMemorySnapshotView.prototype.get profile):
        (WebInspector.NativeMemoryProfileType):
        (WebInspector.NativeMemoryProfileType.prototype.get buttonTooltip):
        (WebInspector.NativeMemoryProfileType.prototype.buttonClicked):
        (WebInspector.NativeMemoryProfileType.prototype.get treeItemTitle):
        (WebInspector.NativeMemoryProfileType.prototype.get description):
        (WebInspector.NativeMemoryProfileType.prototype.createTemporaryProfile):
        (WebInspector.NativeMemoryProfileType.prototype.createProfile):
        (WebInspector.NativeMemoryProfileHeader):
        (WebInspector.NativeMemoryProfileHeader.prototype.createSidebarTreeElement):
        (WebInspector.NativeMemoryProfileHeader.prototype.createView):
        * inspector/front-end/ProfilesPanel.js:
        * inspector/front-end/Settings.js:
        (WebInspector.ExperimentsSettings):
        * inspector/front-end/WebKit.qrc:
        * inspector/front-end/inspector.html:

2012-05-25  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: make some profiler methods private
        https://bugs.webkit.org/show_bug.cgi?id=87479

        Reviewed by Vsevolod Vlasov.

        - Removed unused methods.
        - Renamed private methods so that their names start with underscore. 
        - ProfileLauncherView methods are called directly from ProfilesPanel instead
          of sending events.

        * inspector/front-end/CPUProfileView.js:
        * inspector/front-end/CSSSelectorProfileView.js:
        (WebInspector.CSSSelectorProfileType.prototype.buttonClicked):
        (WebInspector.CSSSelectorProfileType.prototype._startRecordingProfile):
        (WebInspector.CSSSelectorProfileType.prototype.createTemporaryProfile):
        * inspector/front-end/ProfileLauncherView.js:
        (WebInspector.ProfileLauncherView.prototype.profileStarted):
        (WebInspector.ProfileLauncherView.prototype.profileFinished):
        * inspector/front-end/ProfilesPanel.js:
        (WebInspector.ProfileType.prototype.createProfile):
        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):
        (WebInspector.ProfilesPanel.prototype._reset):
        (WebInspector.ProfilesPanel.prototype._populateProfiles.populateCallback.var):
        (WebInspector.ProfilesPanel.prototype._populateProfiles.populateCallback):
        (WebInspector.ProfilesPanel.prototype._populateProfiles):
        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot.done):
        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot):

2012-05-25  Keishi Hattori  <keishi@webkit.org>

        Bad checkValidity result on recently "enabled" form fields
        https://bugs.webkit.org/show_bug.cgi?id=85704

        Reviewed by Kent Tamura.

        Test: fast/forms/disabled-attr-checkvalidity.html

        We were tripping on the assertion m_isValid == validity()->valid()
        inside HTMLFormControlElement::isValidFormControlElement.
        m_isValid was becoming stale because setNeedsValidityCheck wasn't called
        after m_willValidate changed.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::willValidate): We used const_cast
        because it was too difficult to remove const. We are checking if the
        value from willValidate has changed to avoid an infinite loop.
        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):

2012-05-24  Kinuko Yasuda  <kinuko@chromium.org>

        [chromium] DataTransferItem.webkitGetAsEntry() shouldn't be exposed without flag yet
        https://bugs.webkit.org/show_bug.cgi?id=87457

        Reviewed by Kent Tamura.

        No new tests, marking some tests SKIP as we stop exposing this by default.

        * Modules/filesystem/DataTransferItemFileSystem.idl: Removed webkitGetAsEntry

2012-05-25  Rakesh KN  <rakesh.kn@motorola.com>

        RadioNodeList does not include a object element
        https://bugs.webkit.org/show_bug.cgi?id=87371

        Reviewed by Kent Tamura.

        As per spec http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#category-listed
        Object element should also be listed in RadioNodeList object.

        Updated existing test.

        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
        Compares if test element's name/id  and form matches that of the RadioNodeList filter.
        (WebCore::RadioNodeList::nodeMatches):
        Added support for Object element, check if object elements name/id matches the RadioNodeList filter.
        * html/RadioNodeList.h:
        (RadioNodeList): Ditto

2012-05-25  Jan Keromnes  <janx@linux.com>

        Web Inspector: Resource object has no methods getContent and setContent
        https://bugs.webkit.org/show_bug.cgi?id=87424

        This fixes the extension API so that it uses the `new Resource()`
        constructor, which adds the missing `getContent` and `setContent`
        methods to a `Resource` object.

        Reviewed by Vsevolod Vlasov.

        The tests were fixed accordingly in:
        LayoutTests/inspector/extensions/extensions-resources-expected.txt

        * inspector/front-end/ExtensionAPI.js:
        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler.else.callbackWrapper):
        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler):

2012-05-24  Tim Horton  <timothy_horton@apple.com>

        Add feature defines for web-facing parts of CSS Regions and Exclusions
        https://bugs.webkit.org/show_bug.cgi?id=87442
        <rdar://problem/10887709>

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.am:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        * bindings/generic/RuntimeEnabledFeatures.h:
        (RuntimeEnabledFeatures):
        (WebCore::RuntimeEnabledFeatures::setCSSExclusionsEnabled):
        (WebCore::RuntimeEnabledFeatures::cssExclusionsEnabled):
        * bindings/js/JSCSSRuleCustom.cpp:
        (WebCore::toJS):
        * bindings/objc/DOMCSS.mm:
        (kitClass):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * css/CSSParser.cpp:
        (WebCore::isSimpleLengthPropertyID):
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::detectAtToken):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::isInheritedProperty):
        * css/CSSPropertyNames.in:
        * css/CSSRule.cpp:
        (WebCore::CSSRule::cssText):
        (WebCore::CSSRule::destroy):
        (WebCore::CSSRule::reattach):
        * css/CSSRule.h:
        (WebCore::CSSRule::isRegionRule):
        * css/CSSRule.idl:
        * css/StyleBuilder.cpp:
        (WebCore::StyleBuilder::StyleBuilder):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::getPropertyValue):
        (WebCore::StylePropertySet::asText):
        * css/StylePropertyShorthand.cpp:
        (WebCore::shorthandForProperty):
        * css/StylePropertyShorthand.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleRule.cpp:
        (WebCore::StyleRuleBase::destroy):
        (WebCore::StyleRuleBase::copy):
        (WebCore::StyleRuleBase::createCSSOMWrapper):
        * css/WebKitCSSRegionRule.cpp:
        * css/WebKitCSSRegionRule.h:
        * css/WebKitCSSRegionRule.idl:
        * dom/Document.cpp:
        * dom/Document.h:
        * dom/Document.idl:
        * page/DOMWindow.idl:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setCSSRegionsEnabled):
        (WebCore::Settings::cssRegionsEnabled):

2012-05-24  Geoffrey Garen  <ggaren@apple.com>

        WebKit should be lazy-finalization-safe (esp. the DOM)
        https://bugs.webkit.org/show_bug.cgi?id=87456

        Reviewed by Filip Pizlo.

        * bindings/js/DOMWrapperWorld.cpp:
        (WebCore::JSStringOwner::finalize):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsStringSlowCase):
        * bindings/js/JSDOMBinding.h:
        (WebCore::cacheWrapper):
        (WebCore::uncacheWrapper): Use the new idioms.

        (WebCore::jsString): Use get instead of find because get is simpler in
        the case of entries that are logically null.

        (WebCore::domObjectWrapperMapFor): Removed, since it was unused.

        * bindings/js/ScriptWrappable.h:
        (WebCore::ScriptWrappable::clearWrapper): Use the new idioms.

        * bridge/runtime_root.cpp:
        (JSC::Bindings::RootObject::invalidate): Check for null while iterating,
        since that's possible now.

        (JSC::Bindings::RootObject::addRuntimeObject):
        (JSC::Bindings::RootObject::removeRuntimeObject):
        (JSC::Bindings::RootObject::finalize): Use the new idioms.

        * bridge/runtime_root.h:
        (RootObject): Clarified the word "need".

2012-05-24  Kent Tamura  <tkent@chromium.org>

        PAGE_POPUP: window.setValueAndClosePopup should be moved to a
        per-context property of DOMWindow.
        https://bugs.webkit.org/show_bug.cgi?id=87086

        Reviewed by Adam Barth.

        - Introduce window.pagePagePopupController property as V8EnabledPerContext.
        - Move window.setValueAndClosePopup() to window.pagePopupController.
        So, we can remove ad-hoc ScriptController::installFunctionsForPagePopup().

        No behavior change.

        Test: fast/forms/date/no-page-popup-controller.html

        * Resources/calendarPicker.js:
        (submitValue): Use window.pagePopupController.
        (handleCancel): ditto.
        * WebCore.gypi: Add new files.
        * bindings/generic/ContextEnabledFeatures.cpp:
        (WebCore::ContextEnabledFeatures::pagePopupEnabled): Added.
        * bindings/generic/ContextEnabledFeatures.h:
        (ContextEnabledFeatures): Added.
        * bindings/v8/ScriptController.cpp: Remove installFunctionsForPagePopup().
        * bindings/v8/ScriptController.h: ditto.
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::allowPagePopup): Added.
        * page/DOMWindowPagePopup.cpp:
        (WebCore::DOMWindowPagePopup::DOMWindowPagePopup):
        Creates a PagePopupController object for the specified PagePopupClient.
        (WebCore::DOMWindowPagePopup::~DOMWindowPagePopup):
        Empty destructor to generate the RefPtr<PagePopupController> destructor.
        (WebCore::DOMWindowPagePopup::pagePopupController):
        * page/DOMWindowPagePopup.h:
        (DOMWindowPagePopup):
         - Remove setValueAndClosePopup()
         - Add pagePopupController()
         - Change the data member from PagePopupClient to PagePopupController.
        * page/DOMWindowPagePopup.idl: Supply per-context window.pagePopupController.
        * page/PagePopupController.cpp: Added. This object is attached to window.
        * page/PagePopupController.h: ditto.
        * page/PagePopupController.idl: ditto.

2012-05-21  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: add a file system call which captures the file metadata at once.
        https://bugs.webkit.org/show_bug.cgi?id=86995

        Reviewed by David Levin.

        Current File.slice() (webkitSlice()) implementation calls two separate platform calls,
        getFileSize() and getFileModificationTime() [both are defined in platform/FileSystem.h],
        to capture the file metadata, but we should have a single file system call to get them at once
        for two reasons: 1. save additional system call costs, and 2.  atomically obtain the file metadata.

        No new tests: existing tests (http/tests/local/fileapi/* and fast/files/*) should pass.

        * fileapi/File.cpp:
        (WebCore::File::captureSnapshot):
        * platform/FileMetadata.h:
        * platform/FileSystem.h:
        * platform/chromium/FileSystemChromium.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):
        * platform/gtk/FileSystemGtk.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/posix/FileSystemPOSIX.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/qt/FileSystemQt.cpp:
        (WebCore::getFileMetadata): Added.
        * platform/win/FileSystemWin.cpp:
        (WebCore::getFileSizeFromFindData):
        (WebCore::getFileModificationTimeFromFindData):
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata): Added.
        * platform/wince/FileSystemWinCE.cpp:
        (WebCore::getFileSizeFromFileInfo):
        (WebCore::getFileModificationTimeFromFileInfo):
        (WebCore::getFileSize):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata): Added.
        * platform/wx/FileSystemWx.cpp:
        (WebCore::getFileMetadata): Added.
        (WebCore):

2012-05-24  Hironori Bono  <hbono@chromium.org>

        Enable grammar checking on Chromium when we paste text (Take 2)
        https://bugs.webkit.org/show_bug.cgi?id=74393

        Reviewed by Ryosuke Niwa.

        This change enables grammar checking on Chromium and implements a mock grammar
        checker to fix a failing test.

        Test: editing/spelling/grammar-markers.html

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForDocumentMarker): render grammar markers in gray on Windows and Linux or in green on Mac.

2012-05-24  Dominic Mazzoni  <dmazzoni@google.com>

        Crash in WebCore::AccessibilityTable::isDataTable
        https://bugs.webkit.org/show_bug.cgi?id=87409

        Reviewed by Abhishek Arya.

        Use Node::rendererIsEditable everywhere rather than
        Node::isContentEditable because the latter can trigger a layout
        and destroy the renderer. New test covers the change to
        AccessibilityTable.cpp, changes to AccessibilityRenderObject.cpp
        are covered by existing tests.

        Test: accessibility/contenteditable-table-check-causes-crash.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::isReadOnly):
        (WebCore::AccessibilityRenderObject::contentChanged):
        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::isDataTable):

2012-05-24  Yoshifumi Inoue  <yosin@chromium.org>

        [Forms][TextArea] Too long validation message doesn't count LF as CRLF
        https://bugs.webkit.org/show_bug.cgi?id=87458

        Reviewed by Kent Tamura.

        This patch changes current number of characters in "too long" validation message
        parameter to counting newline as 2 characters (CR and LF) as submission data.

        No new tests. To have test for this change, we need to change localization
        text handling during DRT. We'll try.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::validationMessage): Use computeLengthForSubmission instead of numGraphmeClusters.

2012-05-24  Hayato Ito  <hayato@chromium.org>

        Fix crashes caused by a DOMCharacterDataModified event on a text node.
        https://bugs.webkit.org/show_bug.cgi?id=86953

        Reviewed by Dimitri Glazkov.

        TextNode can be released while CharacterData::setData() will dispatch a mutation event.
        So protect it.

        Mutation event itself should not be dispatched on the test case.
        This is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372.

        Test: fast/events/dom-character-data-modified-textarea-crash.html

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::setData):

2012-05-24  Philippe Normand  <pnormand@igalia.com>

        [GTK] Add --enable-css3-flexbox configure option after r118304.
        https://bugs.webkit.org/show_bug.cgi?id=87455

        Reviewed by Xan Lopez.

        * GNUmakefile.am:

2012-05-24  MORITA Hajime  <morrita@google.com>

        Scoped stylesheet should be per-document-configurable.
        https://bugs.webkit.org/show_bug.cgi?id=86985

        Reviewed by Kent Tamura.

        This change replaced RuntimeEnabledFeatures::styleScopedEnabled() callsites
        with newly introduced ContextEnabledFeatures::styleScopedEnabled().
        Clients can override the decision by implementing FrameLoaderClient::allowStyleScoped().

        No new tests. This isn't testable on DRT.

        * bindings/generic/ContextEnabledFeatures.cpp:
        (WebCore):
        (WebCore::ContextEnabledFeatures::styleScopedEnabled):
        * bindings/generic/ContextEnabledFeatures.h:
        (WebCore):
        (ContextEnabledFeatures):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::determineScope):
        * css/StyleResolver.h:
        (StyleResolver):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::registerWithScopingNode):
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::allowStyleScoped):

2012-05-24  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118452.
        http://trac.webkit.org/changeset/118452
        https://bugs.webkit.org/show_bug.cgi?id=87446

        Causes many tests to assert on Mac, NRWT bails out (Requested
        by sundiamonde on #webkit).

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::~RenderObject):
        (WebCore::RenderObject::clearLayoutRootIfNeeded):

2012-05-24  Kevin Ollivier  <kevino@theolliviers.com>

        [wx] Unreviewed build fix. Add contextMenuItemVector stub.

        * platform/wx/ContextMenuWx.cpp:
        (WebCore):
        (WebCore::contextMenuItemVector):

2012-05-24  Raymond Toy  <rtoy@google.com>

        Use 32-byte alignment in AudioArray if using WEBAUDIO_FFMPEG
        https://bugs.webkit.org/show_bug.cgi?id=87430

        Reviewed by Chris Rogers.

        Covered by existing tests.

        * platform/audio/AudioArray.h:
        (WebCore::AudioArray::allocate):

2012-05-24  Antoine Labour  <piman@chromium.org>

        [chromium] Add a setForceRenderSurface to WebLayer for test/bench purpose
        https://bugs.webkit.org/show_bug.cgi?id=87436

        Reviewed by James Robinson.

        Tested by CCLayerTreeHostCommonTest.verifyForceRenderSurface

        * platform/graphics/chromium/LayerChromium.cpp:
        (WebCore::LayerChromium::LayerChromium):
        (WebCore::LayerChromium::setForceRenderSurface):
        (WebCore):
        (WebCore::LayerChromium::pushPropertiesTo):
        * platform/graphics/chromium/LayerChromium.h:
        (WebCore::LayerChromium::forceRenderSurface):
        (LayerChromium):
        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
        (WebCore::CCLayerImpl::CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerImpl.h:
        (WebCore::CCLayerImpl::forceRenderSurface):
        (WebCore::CCLayerImpl::setForceRenderSurface):
        (CCLayerImpl):
        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-05-24  Ken Buchanan  <kenrb@chromium.org>

        Layout root not getting cleared for anonymous renderers geting destroyed
        https://bugs.webkit.org/show_bug.cgi?id=84002

        Reviewed by Abhishek Arya.

        This is a follow-up to r109406, which added a check to clear layout
        roots when they point to a renderer that is being destroyed. The
        thinking was that layout roots would never be anonymous renderers,
        but there are some cases where this is not true (in particular,
        generated content containers with overflow clips can be layout roots).

        As in r109406, this patch has no layout test. This is because any test
        that exercises this behavior is caused by an existing layout bug where
        a child is not properly getting layout (or a renderer is getting dirtied
        out of order during layout) and will fail multiple ASSERTs:
        in particular, ASSERT(!m_layoutRoot->container() || !m_layoutRoot->
        container()->needsLayout()) in FrameView::scheduleRelayoutOfSubtree(),
        and ASSERT_NOT_REACHED() in RenderObject::clearLayoutRootIfNeeded().
        We are preventing those bugs from manifesting as security issues with
        this patch.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::~RenderObject):
        (WebCore::RenderObject::willBeDestroyed):

2012-05-24  Anders Carlsson  <andersca@apple.com>

        Corrupted pages rendering when images are zoomed on Google+
        https://bugs.webkit.org/show_bug.cgi?id=87439
        <rdar://problem/11503078>

        Reviewed by Beth Dakin.

        The rect that's given to scrollContentsSlowPath is in frame view coordinates, but if we end up
        passing them to RenderLayer::setBackingNeedsRepaintInRect we need to account for the frame scale factor.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollContentsSlowPath):

2012-05-24  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (r112399): insertHTML doesn't respect current selection range and inserts HTML to incorrect position
        https://bugs.webkit.org/show_bug.cgi?id=87195

        Reviewed by Darin Adler.

        The bug was caused by our passing insertionPos.anchorNode() to splitTreeToNode's start node even when
        the position's type was an offset in a container. Fixed the bug by passing the node after the insert position
        or the container node if the position is at the end of the container.

        Test: editing/pasteboard/paste-at-end-of-node-followed-by-inline-element.html

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply):

2012-05-24  Emil A Eklund  <eae@chromium.org>

        REGRESSION (115573): Incorrect rounding of margins for floats
        https://bugs.webkit.org/show_bug.cgi?id=87319

        Reviewed by Eric Seidel.

        In RenderBlock::computeInlinePreferredLogicalWidths we used a float to
        accumulate margins for floating children while the children themselves
        represent their margins as LayoutUnits. Due to lack of rounding this can
        cause the block to be too small at certain certain zoom levels, causing
        unwanted wrapping. 

        This patch changes computeInlinePreferredLogicalWidths to use a
        LayoutUnit to accumulate the margins and thus ensures that the margin
        values are rounded the same way.

        Test: fast/block/float/floats-with-margin-should-not-wrap.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-05-24  Christophe Dumez  <christophe.dumez@intel.com>

        postMessage and webkitPostMessage should behave the same way
        https://bugs.webkit.org/show_bug.cgi?id=87384

        Reviewed by Adam Barth.

        Make postMessage behave the same way as webkitPostMessage, meaning
        that it supports transfer of MessagePorts and ArrayBuffers as per
        the spec. Both V8 and JSC implementations have been updated.

        Test: fast/dom/Window/window-postmessage-args.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::handlePostMessage):
        (WebCore::JSDOMWindow::postMessage):
        (WebCore::JSDOMWindow::webkitPostMessage):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8DOMWindow::postMessageCallback):
        (WebCore::V8DOMWindow::webkitPostMessageCallback):
        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
        (WebCore::V8DedicatedWorkerContext::webkitPostMessageCallback):
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8MessagePort::postMessageCallback):
        (WebCore::V8MessagePort::webkitPostMessageCallback):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::handlePostMessageCallback):
        (WebCore::V8Worker::postMessageCallback):
        (WebCore::V8Worker::webkitPostMessageCallback):

2012-05-24  Pablo Flouret  <pablof@motorola.com>

        Submit button doesn't submit the form if the form is wrapped by an anchor tag
        https://bugs.webkit.org/show_bug.cgi?id=86719

        Reviewed by Ryosuke Niwa.

        When a form's button is clicked or activated with the keyboard a
        DOMActivate event is dispatched internally and the default handler for
        it takes care of processing the form submission, but the underlying
        event that prompted it is not set as handled and so it ends up
        navigating the anchor, thereby cancelling the form submission.

        This patch sets the original click event as handled if the DOMActivate
        event was handled. This matches the rest of the browsers for form
        controls that submit a form (input type=submit, button type=submit,
        input type=image, etc), and matches IE for the rest of the controls
        (basically, IE never activates the anchor when clicking on form
        controls, Presto and Gecko mostly don't either, except in a few cases.

        Test: fast/forms/form-in-anchor-controls-activation.html

        * dom/Node.cpp:
        (WebCore::Node::dispatchDOMActivateEvent):
        (WebCore::Node::defaultEventHandler):
        * dom/Node.h:
        (Node):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::defaultEventHandler):

2012-05-24  Crystal Zhang  <haizhang@rim.com>

        [BlackBerry] Implement select popup and remove old hook to air popup
        https://bugs.webkit.org/show_bug.cgi?id=87419

        Reviewed by Rob Buis.

        Add new files to make file, add css file for select popup.

        * PlatformBlackBerry.cmake:
        * Resources/blackberry/popupControlBlackBerry.css: Added.
        (html):
        (body):
        (.bottombuttonOK):
        (.bottombuttonCancel):
        (.tablebutton):

2012-05-24  Levi Weintraub  <leviw@chromium.org>

        Avoid creating InlineBoxes for floating and positioned objects in isolates.
        https://bugs.webkit.org/show_bug.cgi?id=87277

        Reviewed by Eric Seidel.

        We currently will create a placeholder run for the first object we encounter inside an isolate. Then
        in RenderBlockLineLayout's constructBidiRuns, we replace that run with the contents of the Isolate.
        We run into problems when there are no valid contents in the Isolate. We can't simply remove the
        placeholder if there's nothing to replace it with since it may be the logically last run, which we
        track but can't rebuild by the time we're handling isolates (we've already shuffled the BidiRuns around).

        With this change, we avoid creating a placeholder altogether until we hit contents in the isolate
        that would warrant a BidiRun in the first place.

        Test: fast/text/international/float-as-only-child-of-isolate-crash.html

        * rendering/InlineIterator.h:
        (WebCore::IsolateTracker::addFakeRunIfNecessary):
        * rendering/RenderBlock.h:
        (RenderBlock):
        (WebCore::RenderBlock::shouldSkipCreatingRunsForObject):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::appendRunsForObject):

2012-05-24  Ryosuke Niwa  <rniwa@webkit.org>

        There are too many poorly named functions to create a fragment from markup
        https://bugs.webkit.org/show_bug.cgi?id=87339

        Reviewed by Eric Seidel.

        Moved all functions that create a fragment from markup to markup.h/cpp.
        There should be no behavioral change.

        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment):
        * dom/Range.h: Removed createDocumentFragmentForElement.
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setInnerHTML):
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkup):
        (WebCore::createFragmentForInnerOuterHTML): Renamed from createFragmentFromSource.
        (WebCore::createFragmentForTransformToFragment): Moved from XSLTProcessor.
        (WebCore::removeElementPreservingChildren): Moved from Range.
        (WebCore::createContextualFragment): Ditto.
        * editing/markup.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::setInnerHTML):
        (WebCore::HTMLElement::setOuterHTML):
        (WebCore::HTMLElement::insertAdjacentHTML):
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchNode): Added a FIXME since this code should be using
        one of the functions listed in markup.h
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::transformToFragment):

2012-05-24  Jer Noble  <jer.noble@apple.com>

        MediaControlTimelineElement is adjusting time 3 times per click
        https://bugs.webkit.org/show_bug.cgi?id=58160

        Reviewed by Eric Carlson.

        No new tests; we intentionally throttle timeupdate events for the same
        movie time, so there is no way to write a layout test for this case.

        Only call setCurrentTime() on mousedown or mousemove events.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTimelineElement::defaultEventHandler):

2012-05-24  John Mellor  <johnme@chromium.org>

        Font Boosting: Add compile flag and runtime setting
        https://bugs.webkit.org/show_bug.cgi?id=87394

        Reviewed by Adam Barth.

        Add ENABLE_FONT_BOOSTING compile flag and fontBoostingEnabled runtime setting.

        No functionality yet, so no new tests.

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.am:
        * Target.pri:
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::setFontBoostingEnabled):
        (WebCore):
        * page/Settings.h:
        (Settings):
        (WebCore::Settings::fontBoostingEnabled):

2012-05-24  Greg Spencer  <gspencer@chromium.org>

        MHTML files should be loadable from all schemes considered local,
        not just "file:"

        https://bugs.webkit.org/show_bug.cgi?id=86540

        Reviewed by Adam Barth.

        Existing tests should verify correct function.

        * loader/MainResourceLoader.cpp:
        (WebCore::MainResourceLoader::continueAfterContentPolicy):
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::create):

2012-05-24  Dana Jansens  <danakj@chromium.org>

        [chromium] Remove some leftover references to LayerTilerChromium
        https://bugs.webkit.org/show_bug.cgi?id=87405

        Reviewed by James Robinson.

        * platform/graphics/chromium/LayerChromium.h:
        (LayerChromium):
        * platform/graphics/chromium/SolidColorLayerChromium.h:

2012-05-24  Jessie Berlin  <jberlin@apple.com>

        REGRESSION(r109663) All the the dom/html/level2/html/HTMLFrameElement* tests crash on Windows
        https://bugs.webkit.org/show_bug.cgi?id=87410

        Reviewed by Anders Carlsson.

        Do not pass a reference type to va_start (see r75435).

        * platform/LocalizedStrings.cpp:
        (WebCore::formatLocalizedString):

2012-05-24  Yael Aharon  <yael.aharon@nokia.com>

        [Qt] Stop using the flag FIXED_POSITION_CREATES_STACKING_CONTEXT
        https://bugs.webkit.org/show_bug.cgi?id=87392

        Reviewed by Antonio Gomes.

        Remove our dependency on a build flag and use the new setting.

        No new tests.

        * css/StyleResolver.cpp:

2012-05-24  Alexey Proskuryakov  <ap@apple.com>

        [WK2] Let the client give local files universal access on a case by case basis
        https://bugs.webkit.org/show_bug.cgi?id=87174
        <rdar://problem/11024330>

        Reviewed by Maciej Stachowiak.

        * dom/Document.cpp: (WebCore::Document::initSecurityContext): When settings->allowUniversalAccessFromFileURLs()
        is false, also try asking the client for an indulgence.

        * loader/FrameLoaderClient.h: (WebCore::FrameLoaderClient::shouldForceUniversalAccessFromLocalURL):
        Default implementation doesn't change anything.

2012-05-24  Tony Chang  <tony@chromium.org>

        improve StyleRareNonInheritedData bit packing on Windows
        https://bugs.webkit.org/show_bug.cgi?id=87322

        Reviewed by Eric Seidel.

        Accessors for m_runningAcceleratedAnimation and m_hasAspectRatio are on RenderStyle already.

        Also reorder the variables in operator== to be consistent with the constructor and header file.
        This makes it easier to add or remove values.

        No new tests, just refactoring.

        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        (StyleRareNonInheritedData):

2012-05-24  Robert Hogan  <robert@webkit.org>

        Negative margin block doesn't properly clear a float enclosed by a previous sibling
        https://bugs.webkit.org/show_bug.cgi?id=10900

        Reviewed by David Hyatt.

        Tests: fast/css/clear-float-sibling.html

        Parent blocks keep a list of child floats that extend out of the parent block and
        by implication overhang into the parent's siblings. But this doesn't work if the
        sibling has collapsing margins - it will not find the float in the previous block's
        list so will ignore the float and fail to clear it.

        RenderBlock:collapseMargins() needs to check if a child's collapsing margin has 
        reduced the height of the parent up past the bottom of its previous sibling's lowest float
        and add the now overhanging float to the parent's float list if appropriate.
        
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::collapseMargins):

2012-05-24  Kinuko Yasuda  <kinuko@chromium.org>

        Cleanup: introduce toFile() to reduce static cast from Blob to File
        https://bugs.webkit.org/show_bug.cgi?id=87234

        Reviewed by Eric Seidel.

        No new tests as this must have no side effect.

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::toV8):
        * fileapi/Blob.cpp:
        (WebCore::Blob::webkitSlice):
        * fileapi/Blob.h:
        (Blob):
        * fileapi/File.h:
        (WebCore::toFile): Added.
        (WebCore):
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::readAsArrayBuffer):
        (WebCore::FileReader::readAsBinaryString):
        (WebCore::FileReader::readAsText):
        (WebCore::FileReader::readAsDataURL):
        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::WebKitBlobBuilder::append):
        * platform/chromium/ClipboardChromium.cpp:
        (WebCore::ClipboardChromium::files):
        * platform/network/FormData.cpp:
        (WebCore::FormData::appendKeyValuePairItems):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::send):

2012-05-24  Darin Adler  <darin@apple.com>

        SVGElement::addEventListener has peculiar RefPtr usage
        https://bugs.webkit.org/show_bug.cgi?id=86497

        Reviewed by Andy Estes.

        * svg/SVGElement.cpp:
        (WebCore::SVGElement::addEventListener): Switch to a more-standard style of RefPtr usage,
        getting rid of some unneeded reference count churn; also removed an unneeded special case
        for zero listeners.

2012-05-24  Raphael Kubo da Costa  <rakuco@webkit.org>

        [EFL] Modify keycode conversion functions to return keycodes with location information after r118001.
        https://bugs.webkit.org/show_bug.cgi?id=87203

        Reviewed by Andreas Kling.

        Add the required changes to make
        fast/events/keydown-leftright-keys.html pass after r118001.

        * platform/efl/EflKeyboardUtilities.cpp:
        (WebCore::createWindowsKeyMap): Translate the keycodes for
        "{left,right}{Shift,Alt,Control}" into the right windows keyboard
        definitions.

2012-05-24  Claudio Saavedra  <csaavedra@igalia.com>

        [Gtk] Wrong cursor used for ne-resize
        https://bugs.webkit.org/show_bug.cgi?id=87366

        Reviewed by Eric Seidel.

        * platform/gtk/CursorGtk.cpp:
        (WebCore::Cursor::ensurePlatformCursor): Use GDK_TOP_RIGHT_CORNER
        for Cursor::NorthEastPanning.

2012-05-24  Gabor Ballabas  <gaborb@inf.u-szeged.hu>

        [Qt]  Fix Webkit1 + V8 build.
        https://bugs.webkit.org/show_bug.cgi?id=87368

        Reviewed by Eric Seidel.

        No new tests, because this is a buildfix.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateImplementation):
        * bindings/v8/npruntime_impl.h:
        * bindings/v8/npruntime_priv.h:

2012-05-24  Dana Jansens  <danakj@chromium.org>

        [chromium] Only display frames created with memory allocations meant to be displayed
        https://bugs.webkit.org/show_bug.cgi?id=85108

        Reviewed by Adrienne Walker.

        In this patch we remove the setVisible() code paths from CCProxy, and
        instead commit visiblity state along with a frame. We also commit a
        flag with a frame that indicates if the frame is one that can be drawn.

        The impl host is set to visible during commit instead of using a
        special channel through the proxy, and the scheduler allows
        commits when we are waiting to draw our first frame but blocked on
        being non-visible.

        canDraw is gated on a new flag that indicates if the frame is one meant
        for display. A frame is meant for display if the frame was generated
        with a memory allocation meant for display. At this time, any non-zero
        memory allocation is considered meant for display.

        We prevent races by not changing the memory allocation at any time
        except during a commit. So we force a commit when the memory
        allocation needs to be adjusted and we are not visible. Similarly,
        we force a commit when visibility changes so that we are able to
        commit the visibility change to the impl tree.

        In order to prevent drawing frames that are not meant for display
        with a single thread, we prevent compositing when the impl tree
        is not visible, with an early out in CCSingleThreadProxy.

        Unit tests: CCLayerTreeHostTestVisibilityAndAllocationControlDrawing

        * platform/graphics/chromium/LayerChromium.h:
        * platform/graphics/chromium/TiledLayerChromium.cpp:
        * platform/graphics/chromium/TiledLayerChromium.h:
        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
        (WebCore::CCLayerTreeHost::setNeedsCommit):
        (WebCore):
        (WebCore::CCLayerTreeHost::setNeedsForcedCommit):
        (WebCore::CCLayerTreeHost::setVisible):
        (WebCore::CCLayerTreeHost::setContentsMemoryAllocationLimitBytes):
        (WebCore::CCLayerTreeHost::scheduleComposite):
        (WebCore::CCLayerTreeHost::updateLayers):
        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
        (CCLayerTreeHost):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
        (WebCore::CCLayerTreeHostImpl::canDraw):
        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
        (WebCore::CCLayerTreeHostImpl::sourceFrameCanBeDrawn):
        (WebCore::CCLayerTreeHostImpl::setSourceFrameCanBeDrawn):
        (CCLayerTreeHostImpl):
        * platform/graphics/chromium/cc/CCProxy.h:
        (CCProxy):
        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
        (WebCore::CCSchedulerStateMachine::drawSuspendedUntilCommit):
        (WebCore::CCSchedulerStateMachine::scheduledToDraw):
        (WebCore::CCSchedulerStateMachine::updateState):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
        (WebCore::CCSingleThreadProxy::doCommit):
        (WebCore::CCSingleThreadProxy::setNeedsCommit):
        (WebCore):
        (WebCore::CCSingleThreadProxy::setNeedsForcedCommit):
        (WebCore::CCSingleThreadProxy::doComposite):
        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
        (WebCore::CCThreadProxy::CCThreadProxy):
        (WebCore::CCThreadProxy::setNeedsForcedCommit):
        (WebCore):
        (WebCore::CCThreadProxy::setNeedsForcedCommitOnImplThread):
        (WebCore::CCThreadProxy::forceBeginFrameOnImplThread):
        (WebCore::CCThreadProxy::beginFrame):
        (WebCore::CCThreadProxy::scheduledActionCommit):
        * platform/graphics/chromium/cc/CCThreadProxy.h:
        (CCThreadProxy):

2012-05-24  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: [regression] search in formatted scripts is broken.
        https://bugs.webkit.org/show_bug.cgi?id=87377

        Reviewed by Vsevolod Vlasov.

        Using formatted content in search.

        Test: inspector/debugger/script-formatter-search.html

        * inspector/front-end/JavaScriptSource.js:
        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
        (WebInspector.JavaScriptSource.prototype.searchInContent.callbackWrapper):
        (WebInspector.JavaScriptSource.prototype.searchInContent):

2012-05-24  Philip Rogers  <pdr@google.com>

        Refactor SVGAnimateTransformElement to avoid expensive determineAnimatedPropertyType call
        https://bugs.webkit.org/show_bug.cgi?id=87309

        Reviewed by Nikolas Zimmermann.

        This is a simple refactor that matches the work done in
        https://bugs.webkit.org/show_bug.cgi?id=87309 to avoid an expensive call.

        No new tests, no actual effects beyond performance improvement.

        * svg/SVGAnimateElement.h:
        (SVGAnimateElement):
        * svg/SVGAnimateTransformElement.cpp:
        (WebCore::SVGAnimateTransformElement::hasValidAttributeType):

2012-05-24  Csaba Osztrogonác  <ossy@webkit.org>

        [Qt] Unreviewed trvial fixes.

        * Target.pri: Typo fix after r118226.
        * WebCore.pri: Warning fix after r117291.

2012-05-24  Antti Koivisto  <antti@apple.com>

        Move StyleRuleImport to a file of its own
        https://bugs.webkit.org/show_bug.cgi?id=87386

        Rubber-stamped by Andreas Kling.

        Move StyleRuleImport out from CSSImportRule.cpp/.h

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSImportRule.cpp:
        (WebCore):
        (WebCore::CSSImportRule::href):
        * css/CSSImportRule.h:
        (WebCore):
        (CSSImportRule):
        * css/CSSParser.cpp:
        * css/StyleRuleImport.cpp: Copied from Source/WebCore/css/CSSImportRule.cpp.
        (WebCore):
        * css/StyleRuleImport.h: Copied from Source/WebCore/css/CSSImportRule.h.
        (WebCore):
        * css/StyleSheetContents.cpp:

2012-05-24  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118352.
        http://trac.webkit.org/changeset/118352
        https://bugs.webkit.org/show_bug.cgi?id=87390

        Caused 6 editing/spelling tests crash/fail on chromium in
        debug. (Requested by vsevik on #webkit).

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForDocumentMarker):

2012-05-24  Alexander Pavlov  <apavlov@chromium.org>

        Web Inspector: Support hierarchical context menus
        https://bugs.webkit.org/show_bug.cgi?id=86847

        Reviewed by Pavel Feldman.

        This patch makes use of the WebMenuItemInfo SubMenu type to expose the capability of building submenu items
        in the Web Inspector's context menu. ContextMenuItems are also passed/stored by reference/value rather than pointer
        in order to be consistent with the PlatformMenuDescription typedef.

        * bindings/js/JSInspectorFrontendHostCustom.cpp:
        (WebCore::populateContextMenuItems): Enable submenu item population.
        (WebCore):
        (WebCore::JSInspectorFrontendHost::showContextMenu): Extract the menu population part into populateContextMenuItems().
        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
        (WebCore::populateContextMenuItems): Enable submenu item population.
        (WebCore):
        (WebCore::V8InspectorFrontendHost::showContextMenuCallback): Extract the menu population part into populateContextMenuItems().
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::FrontendMenuProvider::create): Use reference instead of pointer for ContextMenuItems.
        (WebCore::FrontendMenuProvider::FrontendMenuProvider): Use reference instead of pointer for ContextMenuItems.
        (WebCore::FrontendMenuProvider::populateContextMenu): Use reference instead of pointer for ContextMenuItems.
        (WebCore::FrontendMenuProvider::contextMenuCleared):
        (FrontendMenuProvider):
        (WebCore::InspectorFrontendHost::showContextMenu): Use reference instead of pointer for ContextMenuItems.
        * inspector/InspectorFrontendHost.h:
        (InspectorFrontendHost):
        * inspector/front-end/ContextMenu.js: Support the tree-like structure of context menus.
        (WebInspector.ContextMenuItem):
        (WebInspector.ContextMenuItem.prototype.id):
        (WebInspector.ContextMenuItem.prototype.type):
        (WebInspector.ContextMenuItem.prototype._buildDescriptor):
        (WebInspector.ContextSubMenuItem):
        (WebInspector.ContextSubMenuItem.prototype.appendItem):
        (WebInspector.ContextSubMenuItem.prototype.appendSubMenuItem):
        (WebInspector.ContextSubMenuItem.prototype.appendCheckboxItem):
        (WebInspector.ContextSubMenuItem.prototype.appendSeparator):
        (WebInspector.ContextSubMenuItem.prototype._buildDescriptor):
        (WebInspector.ContextMenu):
        (WebInspector.ContextMenu.prototype.nextId):
        (WebInspector.ContextMenu.prototype.show):
        (WebInspector.ContextMenu.prototype._setHandler):
        (WebInspector.ContextMenu.prototype._buildDescriptor):
        * inspector/front-end/SoftContextMenu.js:
        (.WebInspector.SoftContextMenu): Support sub-menus.
        (.WebInspector.SoftContextMenu.prototype.show):
        (.WebInspector.SoftContextMenu.prototype._parentGlassPaneElement):
        (.WebInspector.SoftContextMenu.prototype._createMenuItem):
        (.WebInspector.SoftContextMenu.prototype._createSubMenu):
        (.WebInspector.SoftContextMenu.prototype._createSeparator):
        (.WebInspector.SoftContextMenu.prototype._menuItemMouseUp):
        (.WebInspector.SoftContextMenu.prototype._focus):
        (.WebInspector.SoftContextMenu.prototype._triggerAction):
        (.WebInspector.SoftContextMenu.prototype._showSubMenu):
        (.WebInspector.SoftContextMenu.prototype._buildMouseEventForSubMenu):
        (.WebInspector.SoftContextMenu.prototype._hideSubMenu):
        (.WebInspector.SoftContextMenu.prototype._menuItemMouseOut):
        (.WebInspector.SoftContextMenu.prototype._highlightMenuItem):
        (.WebInspector.SoftContextMenu.prototype._menuKeyDown):
        (.WebInspector.SoftContextMenu.prototype._glassPaneMouseUp):
        (.WebInspector.SoftContextMenu.prototype._discardMenu):
        (.WebInspector.SoftContextMenu.prototype._discardSubMenus):
        * inspector/front-end/inspector.css: Support for sub-menus, separator improvement.
        (.soft-context-menu-separator):
        (.soft-context-menu-separator > .separator-line):
        (.soft-context-menu-item-submenu-arrow):
        * platform/chromium/ContextMenuChromium.cpp:
        (WebCore::contextMenuItemVector): Implemented.
        (WebCore):

2012-05-24  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: Breakpoints Pane should not show context menu with no breakpoints
        https://bugs.webkit.org/show_bug.cgi?id=87340

        Reviewed by Pavel Feldman.

        Removed the method _contextMenu as this would be redundant call
        because _breakpointContextMenu would take care of showing the remove
        all breakpoints option.

        * inspector/front-end/BreakpointsSidebarPane.js:
        (WebInspector.JavaScriptBreakpointsSidebarPane):
        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointContextMenu):

2012-05-24  Yury Semikhatsky  <yurys@chromium.org>

        Unreviewed. Chromium Mac build fix after r118357.
        Use full name specifier instead of "using" directive.

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::jsHeapInfo):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):

2012-05-24  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: introduce virtual resource for inspector stylesheet.
        https://bugs.webkit.org/show_bug.cgi?id=87357

        Reviewed by Vsevolod Vlasov.

        This change introduces virtual resource that represents inspector stylesheet (that is added for styles added via inspector).
        New resource has url of form "inspector://<page url folder>/inspector-stylesheet. It enables live editing and revision
        history of the inspector stylesheet.

        Test: inspector/styles/edit-inspector-stylesheet.html

        * inspector/Inspector.json:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::bindStyleSheet):
        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
        (WebCore::InspectorCSSAgent::detectOrigin):
        * inspector/InspectorCSSAgent.h:
        (InspectorCSSAgent):
        * inspector/InspectorDOMAgent.h:
        (InspectorDOMAgent):
        (WebCore::InspectorDOMAgent::pageAgent):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::create):
        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
        (WebCore::InspectorStyleSheet::buildObjectForRule):
        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
        (WebCore::InspectorStyleSheetForInlineStyle::create):
        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
        * inspector/InspectorStyleSheet.h:
        (WebCore):
        (InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::canBind):
        (InspectorStyleSheetForInlineStyle):
        * inspector/front-end/CSSStyleModel.js:
        (WebInspector.CSSStyleModel):
        (WebInspector.CSSStyleModel.prototype._undoRedoCompleted):
        (WebInspector.CSSStyleModel.prototype.getViaInspectorResourceForRule):
        (WebInspector.CSSStyleModelResourceBinding):
        (WebInspector.CSSStyleModelResourceBinding.prototype.setContent):
        (WebInspector.CSSStyleModelResourceBinding.prototype._inspectedURLChanged):
        (WebInspector.CSSStyleModelResourceBinding.prototype._loadStyleSheetHeaders):
        (WebInspector.CSSStyleModelResourceBinding.prototype._innerStyleSheetChanged):
        (WebInspector.CSSStyleModelResourceBinding.prototype._getViaInspectorResource.hadersLoaded):
        (WebInspector.CSSStyleModelResourceBinding.prototype._getViaInspectorResource):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResource.overrideRequestContent.callbackWrapper):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResource.overrideRequestContent):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResource):
        (WebInspector.CSSStyleModelResourceBinding.prototype._viaInspectorResourceURL):
        * inspector/front-end/Resource.js:
        (WebInspector.Resource):
        (WebInspector.Resource.prototype.isHidden):
        * inspector/front-end/ResourceTreeModel.js:
        (WebInspector.ResourceTreeModel.prototype._onRequestUpdateDropped):
        (WebInspector.ResourceTreeModel.prototype._addFramesRecursively):
        (WebInspector.ResourceTreeFrame.prototype._navigate):
        (WebInspector.ResourceTreeFrame.prototype.addResource):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.FrameTreeElement.prototype.appendResource):
        * inspector/front-end/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
        * inspector/front-end/StylesPanel.js:
        (WebInspector.InspectorStyleSource):
        * inspector/front-end/StylesSidebarPane.js:
        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode.callback):
        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode):
        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.successCallback):
        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):

2012-05-24  Robin Cao  <robin.cao@torchmobile.com.cn>

        [BlackBerry] Possible deadlock in the WebGL code path
        https://bugs.webkit.org/show_bug.cgi?id=87375

        Reviewed by Rob Buis.

        Fix a deadlock happening in the WebGL code path. The mutex is locked
        but is not unlocked afterword. Also fix a possible double delete,
        the mutex m_frontBufferLock will be destroyed in the base class.

        Covered by tests in fast/canvas/webgl.

        * platform/graphics/blackberry/LayerCompositingThread.cpp:
        (WebCore::LayerCompositingThread::releaseTextureResources):
        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp:
        (WebCore::WebGLLayerWebKitThread::~WebGLLayerWebKitThread):

2012-05-24  Ian Vollick  <vollick@chromium.org>

        [chromium] Forcibly sync running animations in the waiting state when synchronized start times are needed.
        https://bugs.webkit.org/show_bug.cgi?id=87153

        Reviewed by James Robinson.

        Unit test: CCLayerAnimationControllerTest.ForceSyncWhenSynchronizedStartTimeNeeded

        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):

2012-05-24  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: convert HeapSnapshotGridNode._provider into getter.
        https://bugs.webkit.org/show_bug.cgi?id=87382

        I found that we create a provider for child nodes for the each DataGrid node in advance.
        It cost us one async call to the HeapSnapshot's worker per each such the node.
        I converted the property into the getter which is initializing the provider lazily.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        * inspector/front-end/HeapSnapshotGridNodes.js:
        (WebInspector.HeapSnapshotGridNode):
        (WebInspector.HeapSnapshotGridNode.prototype.createProvider):
        (WebInspector.HeapSnapshotGridNode.prototype._provider):
        (WebInspector.HeapSnapshotGridNode.prototype.dispose):
        (WebInspector.HeapSnapshotGridNode.prototype._populate):
        (WebInspector.HeapSnapshotGridNode.prototype.expandWithoutPopulate):
        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.serializeNextChunk):
        (WebInspector.HeapSnapshotGridNode.prototype.sort):
        (WebInspector.HeapSnapshotGenericObjectNode):
        (WebInspector.HeapSnapshotGenericObjectNode.prototype.updateHasChildren):
        (WebInspector.HeapSnapshotObjectNode):
        (WebInspector.HeapSnapshotInstanceNode):
        (WebInspector.HeapSnapshotConstructorNode):
        (WebInspector.HeapSnapshotConstructorNode.prototype.createProvider):
        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId):
        (WebInspector.HeapSnapshotDiffNode):
        (WebInspector.HeapSnapshotDiffNode.prototype.createProvider):
        (WebInspector.HeapSnapshotDominatorObjectNode):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.createProvider):
        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId):

2012-05-24  Rakesh KN  <rakesh.kn@motorola.com>

        Filter for RadioNodeList should be case sensitive.
        https://bugs.webkit.org/show_bug.cgi?id=87369

        Reviewed by Kent Tamura.

        Element's id/name attribute matching criteria is case sensitive now.

        Modified existing test.

        * html/RadioNodeList.cpp:
        (WebCore::RadioNodeList::nodeMatches):
        Element matching criteria is case sensitive.

2012-05-23  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: add a command to InspectorMemoryAgent for getting process memory break down
        https://bugs.webkit.org/show_bug.cgi?id=87263

        Reviewed by Pavel Feldman.

        Introduced new protocol command Memory.getProcessMemoryDistribution which returns
        memory distribution for the inspected process. Currently only JS allocated and used
        heap size is included.

        * inspector/Inspector.json:
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::jsHeapInfo):
        (WebCore):
        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
        * inspector/InspectorMemoryAgent.h:
        (InspectorMemoryAgent):
        * platform/chromium/PlatformSupport.h:
        (PlatformSupport):

2012-05-24  Nikolas Zimmermann  <nzimmermann@rim.com>

        SVGZoomAndPan constants are missing from window object
        https://bugs.webkit.org/show_bug.cgi?id=15494

        Reviewed by Rob Buis.

        Generate the SVGZoomAndPanConstructor, so that the constants defined in the IDL
        can be reached from the bindings. Provide a stub-implementation of ref/deref
        that's never used, as we don't actually use JSSVGZoomAndPan which needs this, but
        only the JSSVGZoomAndPanConstructor.

        Add a new IDL flag "SuppressToJSObject" which disables generation of toJS/toV8
        methods for classes that are only used in SVGs interfaces via multiple inheritance.
        This affects: SVGFitToViewBox, SVGTests, SVGLangSapce, SVGExternalResourcesRequired, etc.

        Unlike those classes SVGZoomAndPan defines constants, and thus needs a generated Constructor.
        That requires us to build JSSVGZoomAndPan.* (JSSVGFitToViewBox/etc. is generated, but not built!).
        Unfortunately this causes compilation problems on Windows, as it builds all sources in a single-file.
        MSVC can't decide whether it should call toJS(Node*) or toJS(SVGZoomAndPan*) for a SVGSVGElement.
        To avoid these problems stop generating toJS/toV8 completely for all SVG MI types. They were
        never used before, so there's no point in actually generating them, as it's now causing problems.

        This is a preparation towards bug 15495, which covers implementing
        SVGSVGElement.currentView and the SVGViewSpec interface.

        No new tests. The SVGZoomAndPan constructor is covered by existing tests, now that its enabled.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * WebCore.gyp/WebCore.gyp:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldGenerateToJSDeclaration):
        (ShouldGenerateToJSImplementation):
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        * bindings/scripts/IDLAttributes.txt:
        * gyp/WebCore.gyp:
        * page/DOMWindow.idl:
        * svg/SVGDocument.cpp:
        (WebCore::SVGDocument::zoomAndPanEnabled):
        * svg/SVGExternalResourcesRequired.idl:
        * svg/SVGFitToViewBox.idl:
        * svg/SVGLangSpace.idl:
        * svg/SVGLocatable.idl:
        * svg/SVGRenderingIntent.idl:
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::SVGSVGElement):
        (WebCore::SVGSVGElement::parseAttribute):
        (WebCore::SVGSVGElement::viewBoxToViewTransform):
        (WebCore::SVGSVGElement::setupInitialView):
        (WebCore::SVGSVGElement::inheritViewAttributes):
        * svg/SVGSVGElement.h:
        (SVGSVGElement):
        (WebCore::SVGSVGElement::useCurrentView):
        (WebCore::SVGSVGElement::setUseCurrentView):
        (WebCore::SVGSVGElement::zoomAndPan):
        (WebCore::SVGSVGElement::setZoomAndPan):
        * svg/SVGStylable.idl:
        * svg/SVGTests.idl:
        * svg/SVGURIReference.idl:
        * svg/SVGUnitTypes.idl:
        * svg/SVGViewElement.cpp:
        (WebCore::SVGViewElement::SVGViewElement):
        (WebCore::SVGViewElement::parseAttribute):
        * svg/SVGViewElement.h:
        (SVGViewElement):
        (WebCore::SVGViewElement::zoomAndPan):
        (WebCore::SVGViewElement::setZoomAndPan):
        * svg/SVGViewSpec.cpp:
        (WebCore::SVGViewSpec::SVGViewSpec):
        (WebCore::SVGViewSpec::setTransformString):
        (WebCore::SVGViewSpec::parseViewSpec):
        * svg/SVGViewSpec.h:
        (SVGViewSpec):
        (WebCore::SVGViewSpec::transformBaseValue):
        (WebCore::SVGViewSpec::zoomAndPan):
        (WebCore::SVGViewSpec::setZoomAndPanBaseValue):
        * svg/SVGZoomAndPan.cpp:
        (WebCore::SVGZoomAndPan::isKnownAttribute):
        (WebCore::SVGZoomAndPan::addSupportedAttributes):
        (WebCore):
        (WebCore::SVGZoomAndPan::parseZoomAndPan):
        (WebCore::SVGZoomAndPan::ref):
        (WebCore::SVGZoomAndPan::deref):
        (WebCore::SVGZoomAndPan::setZoomAndPan):
        * svg/SVGZoomAndPan.h:
        (SVGZoomAndPan):
        (WebCore::SVGZoomAndPan::parseFromNumber):
        (WebCore::SVGZoomAndPan::parseAttribute):
        (WebCore::SVGZoomAndPan::zoomAndPan):
        * svg/SVGZoomAndPan.idl:

2012-05-24  Hironori Bono  <hbono@chromium.org>

        Enable grammar checking on Chromium when we paste text.
        https://bugs.webkit.org/show_bug.cgi?id=74393

        Reviewed by Hajime Morita.

        This change enables grammar checking on Chromium and implements a mock grammar
        checker to fix a failing test.

        Test: editing/spelling/grammar-markers.html

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawLineForDocumentMarker): render grammar markers in gray on Windows and Linux or in green on Mac.

2012-05-17  Andrey Kosyakov  <caseq@chromium.org>

        Web Inspector: add inspector instrumentation interface for compositing
        https://bugs.webkit.org/show_bug.cgi?id=83842

        Reviewed by Pavel Feldman.

        - added instrumentation methods to mark start/end of layer compositing;
        - added associated timeline record type (CompositeLayers);
        - plumbed the calls from instrumentation up to the timeline panel;
        - actual call-sites are platform-specific and will come as separate patches.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::willCompositeImpl):
        (WebCore):
        (WebCore::InspectorInstrumentation::didCompositeImpl):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::willComposite):
        (WebCore):
        (WebCore::InspectorInstrumentation::didComposite):
        * inspector/InspectorTimelineAgent.cpp:
        (TimelineRecordType):
        (WebCore::InspectorTimelineAgent::willComposite):
        (WebCore):
        (WebCore::InspectorTimelineAgent::didComposite):
        * inspector/InspectorTimelineAgent.h:
        (InspectorTimelineAgent):
        * inspector/front-end/TimelineModel.js:
        * inspector/front-end/TimelinePresentationModel.js:
        (WebInspector.TimelinePresentationModel.recordStyle):

2012-05-24  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed Web Inspector: remove obsolete isDetailedSnapshot method from HeapSnapshotView.

        * inspector/front-end/HeapSnapshotView.js:

2012-05-24  Vivek Galatage  <vivekgalatage@gmail.com>

        Web Inspector: localStorage items are not updated when the storage changes
        https://bugs.webkit.org/show_bug.cgi?id=83012

        Reviewed by Pavel Feldman.

        Renamed the inspector protocol UpdateDOMStorage to domStorageUpdated.
        Instrumented StorageEventDispatcher to send the update event to the
        front-end. Also removed the way DOM Storage Agent used to listen for
        the storage events. Added new test to verify the update notifications.

        Test: inspector/storage-panel-dom-storage-update.html

        * dom/EventListener.h:
        * inspector/Inspector.json:
        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore):
        (WebCore::InspectorDOMStorageAgent::getDOMStorageEntries):
        (WebCore::InspectorDOMStorageAgent::storageId):
        (WebCore::InspectorDOMStorageAgent::didUseDOMStorage):
        (WebCore::InspectorDOMStorageAgent::didDispatchDOMStorageEvent):
        * inspector/InspectorDOMStorageAgent.h:
        (InspectorDOMStorageAgent):
        * inspector/InspectorDOMStorageResource.cpp:
        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
        (WebCore::InspectorDOMStorageResource::isSameHostAndType):
        (WebCore::InspectorDOMStorageResource::unbind):
        * inspector/InspectorDOMStorageResource.h:
        (WebCore):
        (InspectorDOMStorageResource):
        (WebCore::InspectorDOMStorageResource::create):
        (WebCore::InspectorDOMStorageResource::id):
        (WebCore::InspectorDOMStorageResource::storageArea):
        (WebCore::InspectorDOMStorageResource::frame):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didDispatchDOMStorageEventImpl):
        (WebCore):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentation):
        (WebCore::InspectorInstrumentation::didUseDOMStorage):
        (WebCore):
        (WebCore::InspectorInstrumentation::didDispatchDOMStorageEvent):
        * inspector/front-end/DOMStorage.js:
        (WebInspector.DOMStorageDispatcher.prototype.domStorageUpdated):
        * inspector/front-end/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.domStorageUpdated):
        * storage/StorageEventDispatcher.cpp:
        (WebCore::StorageEventDispatcher::dispatch):

2012-05-23  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: introduce console proxy object for HeapSnapshot worker.
        https://bugs.webkit.org/show_bug.cgi?id=87346

        There is no console object in html5 workers at the moment.
        This makes me sad when I'm troubleshooting the HeapSnapshot stuff.
        I wrote a simplest proxy object which sends the log, info and error messages
        to the WebInspector window.

        Reviewed by Pavel Feldman.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotRealWorker.prototype._messageReceived):
        * inspector/front-end/HeapSnapshotWorker.js:
        (WebInspector.WorkerConsole):
        (WebInspector.WorkerConsole.prototype.log):
        (WebInspector.WorkerConsole.prototype.error):
        (WebInspector.WorkerConsole.prototype.info):
        (WebInspector.WorkerConsole.prototype._postMessage):

2012-05-24  Shinya Kawanaka  <shinyak@chromium.org>

        Elements in Shadow DOM are not resizable.
        https://bugs.webkit.org/show_bug.cgi?id=87342

        Reviewed by Ryosuke Niwa.

        In RenderLayer::resize(), shadowAncestorNode() was used but if the ancestor node is used,
        it is not possible to resize elements in Shadow DOM.

        The comments said it is necessary for textarea, however actually it is not necessary now.
        Existing test (fast/css/resize-corner-tracking) covers it.

        Test: fast/dom/shadow/resize-in-shadow-dom.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::resize):

2012-05-24  Antti Koivisto  <antti@apple.com>

        Move StyleSheetContents to a separate file
        https://bugs.webkit.org/show_bug.cgi?id=87354

        Reviewed by Eric Seidel.

        Move StyleSheetContents class to StyleSheetContents.h/cpp.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSFontFaceSrcValue.cpp:
        * css/CSSGrammar.y:
        * css/CSSImportRule.cpp:
        * css/CSSParser.cpp:
        * css/CSSPrimitiveValue.cpp:
        * css/CSSRule.cpp:
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::create):
        (WebCore::CSSStyleSheet::href):
        (WebCore):
        (WebCore::CSSStyleSheet::baseURL):
        (WebCore::CSSStyleSheet::isLoading):
        * css/CSSStyleSheet.h:
        (WebCore):
        (CSSStyleSheet):
        * css/StylePropertySet.cpp:
        * css/StyleResolver.cpp:
        * css/StyleSheetContents.cpp: Copied from css/CSSStyleSheet.cpp.
        (WebCore):
        * css/StyleSheetContents.h: Copied from css/CSSStyleSheet.h.
        (WebCore):
        * dom/DOMImplementation.cpp:
        (WebCore::XMLMIMETypeRegExp::XMLMIMETypeRegExp):
        * dom/Document.cpp:
        * dom/ProcessingInstruction.cpp:
        * dom/StyleElement.cpp:
        * html/HTMLLinkElement.cpp:
        * html/HTMLStyleElement.cpp:
        * inspector/InspectorStyleSheet.cpp:
        * loader/cache/CachedCSSStyleSheet.cpp:
        * page/PageSerializer.cpp:

2012-05-24  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>

        [Qt] Buildfix for the minimal build because the r118197 broke it.
        https://bugs.webkit.org/show_bug.cgi?id=87096

        Reviewed by Csaba Osztrogonác.

        * plugins/PluginData.cpp:
        (WebCore):
        (WebCore::PluginData::refresh):
        (WebCore::PluginData::initPlugins):

2012-05-23  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed: Web Inspector single line fix for r118162.

        * inspector/front-end/HeapSnapshotDataGrids.js:
        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._populateChildren):

2012-05-23  Lu Guanqun  <guanqun.lu@intel.com>

        sort the array 'non_wrapper_types'
        https://bugs.webkit.org/show_bug.cgi?id=87335

        Reviewed by Kentaro Hara.

        * bindings/scripts/CodeGeneratorV8.pm:

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        Document.elementFromPoint exposes inner element of Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87235

        Reviewed by Dimitri Glazkov.

        Document::elementFromPoint didn't consider nested Shadow DOM.
        The container node should be adjusted up to document TreeScope beyond ShadowRoot TreeScope.

        Test: fast/dom/shadow/element-from-point-in-nested-shadow.html

        * dom/Document.cpp:
        (WebCore::Document::elementFromPoint):

2012-05-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118297.
        http://trac.webkit.org/changeset/118297
        https://bugs.webkit.org/show_bug.cgi?id=87338

        It caused several layout failures on Mac (Requested by
        sundiamonde on #webkit).

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        Document.caretRangeFromPoint exposes inner elemnet of Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87231

        Reviewed by Dimitri Glazkov.

        Document::caretRangeFromPoint didn't consider nested Shadow DOM.
        The container node should be adjusted up to document TreeScope beyond ShadowRoot TreeScope.

        Test: fast/dom/shadow/caret-range-from-point-in-nested-shadow.html

        * dom/Document.cpp:
        (WebCore::Document::caretRangeFromPoint):

2012-05-23  Julien Chaffraix  <jchaffraix@webkit.org>

        Crash in RenderTableCol::nextColumn
        https://bugs.webkit.org/show_bug.cgi?id=87314

        Reviewed by Abhishek Arya.

        Tests: fast/table/canvas-column-in-column-group.html
               fast/table/columngroup-inside-columngroup.html

        The issue comes from elements not abiding by the display property (e.g. canvas). This means
        that any renderer with display: table-column would pass the current isChildAllowed check and
        would confuse our algorithm to iterate.

        We were getting away with allowing those children as table columns or column groups don't
        paint themselves but it's better to just not allow such children in the first place.

        * rendering/RenderTableCol.cpp:
        (WebCore::RenderTableCol::isChildAllowed):
        Fixed the logic to only accept proper column renderer (RenderTableCol with display: column
        to ignore column-groups). Also removed an unneeded NULL-check.

2012-05-23  Jer Noble  <jer.noble@apple.com>

        REGRESSION: compositing/video/video-poster.html fails on Mac
        https://bugs.webkit.org/show_bug.cgi?id=87199

        Reviewed by Maciej Stachowiak.

        No new tests; fixes failing compositing/video/video-poster.html test.

        Instead of creating the video layer directly, simply allow the layer
        to be created in updateStates() by changing the definition of
        isReadyForVideoSetup() to bypass the m_isAllowedToRender check if
        the player reports a video track is present.  This causes the video layer
        to be created and for future calls to prepareForRendering() to result
        in calls to mediaPlayerRenderingModeChanged().

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::isReadyForVideoSetup):
        (WebCore::MediaPlayerPrivateAVFoundation::metadataLoaded):

2012-05-23  Nico Weber  <thakis@chromium.org>

        [chromium/mac] Unbreak popup menus.
        https://bugs.webkit.org/show_bug.cgi?id=87325

        Reviewed by David Levin.

        http://svn.webkit.org/repository/webkit/trunk@117607 added this function, but the
        Chromium/Mac build doesn't use the file added in that change and hence didn't have
        the category method.. Adding it doesn't help, as the category calls a
        10.7-only function. Just don't use the category for chromium/mac. Fixes
        http://crbug.com/129418

        * platform/mac/WebCoreNSCellExtras.h:

2012-05-23  Ojan Vafai  <ojan@chromium.org>

        add back the ability to disable flexbox
        https://bugs.webkit.org/show_bug.cgi?id=87147

        Reviewed by Tony Chang.

        * Configurations/FeatureDefines.xcconfig:
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow] mousewheel event isn't fired on nodes in Shadow DOM.
        https://bugs.webkit.org/show_bug.cgi?id=87218

        Reviewed by Dimitri Glazkov.

        EventHander::handleWheelEvent re-targets an event to a shadow ancestor node,
        however it should be done by adjusting event target. So we don't need to have it.

        Tests: fast/dom/shadow/wheel-event-in-shadow-dom.html
               fast/dom/shadow/wheel-event-on-input-in-shadow-dom.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleWheelEvent):

2012-05-23  Huang Dongsung  <luxtella@company100.net>

        Remove an unused setter in CachedResource.h.
        https://bugs.webkit.org/show_bug.cgi?id=87324

        CachedResource::setInLiveDecodedResourcesList was defined in r24925, but it has
        been unused.

        Reviewed by Darin Adler.

        * loader/cache/CachedResource.h:

2012-05-23  Hayato Ito  <hayato@chromium.org>

        Adjust a target node of a mouse event correctly when a distributed text node is clicked.
        https://bugs.webkit.org/show_bug.cgi?id=86999

        Reviewed by Dimitri Glazkov.

        Make EventHandler::updateMouseEventTargetNode() be aware of shadow dom subtree
        so that an insertion point can receive an event when a distributed text node is clicked.

        Tests: fast/dom/shadow/shadow-dom-event-dispatching.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateMouseEventTargetNode):

2012-05-23  Shinya Kawanaka  <shinyak@chromium.org>

        [Shadow] drop event is not fired on nodes in Shadow DOM
        https://bugs.webkit.org/show_bug.cgi?id=85774

        Reviewed by Dimitri Glazkov.

        EventHander::updateDragAndDrop re-targets an event to a shadow ancestor node,
        however it should be done by adjusting event target. So we don't need to have it.

        Tests: fast/dom/shadow/drop-event-for-input-in-shadow.html
               fast/dom/shadow/drop-event-in-shadow.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateDragAndDrop):

2012-05-23  Emil A Eklund  <eae@chromium.org>

        REGRESSION (115573): Incorrect rounding of margins for floats
        https://bugs.webkit.org/show_bug.cgi?id=87319

        Reviewed by Eric Seidel.

        In RenderBlock::computeInlinePreferredLogicalWidths we used a float to
        accumulate margins for floating children while the children themselves
        represent their margins as LayoutUnits. Due to lack of rounding this can
        cause the block to be too small at certain certain zoom levels, causing
        unwanted wrapping. 

        This patch changes computeInlinePreferredLogicalWidths to use a
        LayoutUnit to accumulate the margins and thus ensures that the margin
        values are rounded the same way.

        Test: fast/block/float/floats-with-margin-should-not-wrap.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):

2012-05-23  Huang Dongsung  <luxtella@company100.net>

        Remove unused declarations in MemoryCache.h
        https://bugs.webkit.org/show_bug.cgi?id=87323

        It is originated from r75912.

        Reviewed by Darin Adler.

        * loader/cache/MemoryCache.h:

2012-05-23  Eric Seidel  <eric@webkit.org>

        Add seamless layout code (and pass most of the remaining seamless tests)
        https://bugs.webkit.org/show_bug.cgi?id=86608

        Reviewed by Ojan Vafai.

        This patch contains almost all the layout changes needed for seamless iframes.
        I removed the scroll-bar avoiding code at the last moment, as it didn't
        work for platforms other than mac-lion.  I'll add that, as well as the
        HTMLIFrameElement.seamless idl attribute in a follow-up patch.

        Seamless iframes piggy-back a bit on the existing frame-flattening
        logic, however seamless is different from frame-flattening in a few ways:
        - Frame flattening can only ever make an iframe larger (seamless just behaves like a normal div).
        - Frame flattening disables scrollbars (seamless frames behave like normal overflow: auto divs).
        - Seamless only has to work with iframes (flattening works with frame/frameset as well).
        - Seamless support shrink-wrap size negotiation when the iframe is inline.

        Test: fast/frames/seamless/seamless-percent-height.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle): map inline -> inline-block for seamless iframes.
        * dom/Document.cpp:
        (WebCore::Document::scheduleStyleRecalc):
         - Seamless iframes don't manage their own style recalc.
        (WebCore::Document::recalcStyle):
         - We should make sure our parent is resolved before we are, but currently that causes some tests to crash
           I don't have a test to demonstrate this need yet, as presumably it's fulfilled through other codepaths atm.
        * page/FrameView.cpp:
        (WebCore::FrameView::scheduleRelayout): Do the cheaper check first.
        (WebCore::FrameView::isInChildFrameWithFrameFlattening): Make frameview layout abort child layouts like how frame flattening does.
        * rendering/RenderBox.h:
        (WebCore::RenderBox::stretchesToViewport): Disable the stretch-to-viewport quirk for seamless iframes (it makes no sense and breaks the layout code).
        * rendering/RenderIFrame.cpp:
        (WebCore::RenderIFrame::computeLogicalHeight):
         - This function is needed for the child document to participate in the normal block shrink-wrap algorithm.
           Thankfully all the shrink-wrap logic is in RenderBox instead of RenderBlock. In the future we may make
           RenderIframe a RenderBlock for the seamless case. We may just split RenderIframe into two renderers.
        (WebCore::RenderIFrame::computeLogicalWidth):
        (WebCore::RenderIFrame::shouldComputeSizeAsReplaced):
         - seamless iframes behave like blocks, not inline replaced elements.
        (WebCore):
        (WebCore::RenderIFrame::isInlineBlockOrInlineTable):
         - Behave like an inline-block when marked inline.
        (WebCore::RenderIFrame::minPreferredLogicalWidth):
         - When asked for our pref widths, return those of our child document.
        (WebCore::RenderIFrame::maxPreferredLogicalWidth):
        (WebCore::RenderIFrame::isSeamless): helper function
        (WebCore::RenderIFrame::contentRootRenderer): helper function
        (WebCore::RenderIFrame::flattenFrame): seamless iframes never use the frame-flattening feature.
        (WebCore::RenderIFrame::layoutSeamlessly): The guts of seamless layout.
        (WebCore::RenderIFrame::layout):
        * rendering/RenderIFrame.h:
        (WebCore):
        (RenderIFrame):

2012-05-23  Rafael Brandao  <rafael.lobo@openbossa.org>

        [Qt] GraphicsContext should avoid converting rotation angle to degrees
        https://bugs.webkit.org/show_bug.cgi?id=87317

        Reviewed by Noam Rosenthal.

        The angle for rotate is already in radians, so we should take advantage of it
        by using QTransform::rotateRadians, rather than converting it back internally.

        * platform/graphics/qt/GraphicsContextQt.cpp:
        (WebCore::GraphicsContext::rotate):

2012-05-23  David Tseng  <dtseng@google.com>

        AX: Prevents assertion from potentially dereferencing null pointer.
        https://bugs.webkit.org/show_bug.cgi?id=87290

        Reviewed by Chris Fleizach.

        Changes to assertions. Coverage by existing tests.

        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::cellForColumnAndRow):

2012-05-23  Tony Chang  <tony@chromium.org>

        auto margins on flexbox should allocate space in the cross direction
        https://bugs.webkit.org/show_bug.cgi?id=86913

        Reviewed by Ojan Vafai.

        Test: css3/flexbox/auto-margins.html

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::hasAutoMarginsInCrossAxis):
        (WebCore):
        (WebCore::RenderFlexibleBox::updateAutoMarginsInCrossAxis):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): If we have flex-align: baseline and auto margins, we ignore flex-align: baseline.
        (WebCore::RenderFlexibleBox::alignChildren): auto margins apply before flex-align.
        * rendering/RenderFlexibleBox.h:

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118120.
        http://trac.webkit.org/changeset/118120
        https://bugs.webkit.org/show_bug.cgi?id=87193

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateHeader):
        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestException.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNode.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestObj.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (WebCore::toV8):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118129.
        http://trac.webkit.org/changeset/118129
        https://bugs.webkit.org/show_bug.cgi?id=87202

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateFunctionCallback):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::valueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::readonlyValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118133.
        http://trac.webkit.org/changeset/118133
        https://bugs.webkit.org/show_bug.cgi?id=87207

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSRuleCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSValueCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::typesAccessorGetter):
        * bindings/v8/custom/V8CoordinatesCustom.cpp:
        (WebCore::V8Coordinates::altitudeAccessorGetter):
        (WebCore::V8Coordinates::altitudeAccuracyAccessorGetter):
        (WebCore::V8Coordinates::headingAccessorGetter):
        (WebCore::V8Coordinates::speedAccessorGetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
        (WebCore::V8DeviceMotionEvent::accelerationAccessorGetter):
        (WebCore::V8DeviceMotionEvent::accelerationIncludingGravityAccessorGetter):
        (WebCore::V8DeviceMotionEvent::rotationRateAccessorGetter):
        (WebCore::V8DeviceMotionEvent::intervalAccessorGetter):
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        (WebCore::V8DeviceOrientationEvent::alphaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::betaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::gammaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::absoluteAccessorGetter):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorGetter):
        * bindings/v8/custom/V8EntryCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EntrySyncCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EventCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float64ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::toV8):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r118134.
        http://trac.webkit.org/changeset/118134
        https://bugs.webkit.org/show_bug.cgi?id=87209

        some LayoutTests crash since the patch passes a NULL to
        Null(isolate)

        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::toV8):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::stateAccessorGetter):
        * bindings/v8/custom/V8IDBAnyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8IDBKeyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ImageDataCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::dataAccessorGetter):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        (WebCore::toV8Slow):
        * bindings/v8/custom/V8PopStateEventCustom.cpp:
        (WebCore::V8PopStateEvent::stateAccessorGetter):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGElementCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGPathSegCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8TrackEventCustom.cpp:
        (WebCore::V8TrackEvent::trackAccessorGetter):
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::toV8):

2012-05-23  James Robinson  <jamesr@chromium.org>

        Add a Setting to make position:fixed form a new stacking context
        https://bugs.webkit.org/show_bug.cgi?id=87186

        Reviewed by Adam Barth.

        position:fixed elements form a new stacking context in several mobile WebKit ports and in the Qt port always. To
        be consistent across devices, we want to try turning it on everywhere. This will likely cause compatibility
        issues, so we need a runtime setting in order to stage the change carefully.

        Tests: fast/block/positioning/fixed-position-stacking-context.html
               fast/block/positioning/fixed-position-stacking-context2.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setFixedPositionCreatesStackingContext):
        (WebCore::Settings::fixedPositionCreatesStackingContext):
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setFixedPositionCreatesStackingContext):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-23  Michael Nordman  <michaeln@google.com>

        [chromium] DomStorage events handling needs TLC (3)
        https://bugs.webkit.org/show_bug.cgi?id=87031
        https://code.google.com/p/chromium/issues/detail?id=128482
        Create WebCore::Storage instances as a side effect of attaching storage event handlers.
        This allows storage events in chromium to be propagated with less IPC chatter.

        Worth noting that in non-chromium ports, creation of the localStorage instance can have
        an additional side effect of scheduling a background task to read the area's values
        from disk, which given the interest in events is probably a beneficial side effect.

        Reviewed by Adam Barth.

        No new tests. Existing tests cover this.

        * page/DOMWindow.cpp:
        (WebCore::didAddStorageEventListener):
        (WebCore::DOMWindow::addEventListener):

2012-05-23  Michael Saboff  <msaboff@apple.com>

        Crash in fast/files/read tests during Garbage Collection
        https://bugs.webkit.org/show_bug.cgi?id=87165

        Reviewed by Alexey Proskuryakov.

        Changed hasPendingActivity() processing to use ActiveDOMObject::hasPendingActivity()
        and associated setPendingActivity() / unsetPendingActivity().

        Fixed two existing tests with change.

        * Modules/filesystem/FileWriter.cpp:
        (WebCore::FileWriter::stop):
        (WebCore::FileWriter::write):
        (WebCore::FileWriter::truncate):
        (WebCore::FileWriter::signalCompletion):
        * Modules/filesystem/FileWriter.h:
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::readInternal):
        (WebCore::FileReader::doAbort):
        (WebCore::FileReader::didFinishLoading):
        (WebCore::FileReader::didFail):
        * fileapi/FileReader.h:

2012-05-23  Abhishek Arya  <inferno@chromium.org>

        Crash in run-ins with continuations while moving back to original position.
        https://bugs.webkit.org/show_bug.cgi?id=87264

        Reviewed by Julien Chaffraix.

        Run-in that are now placed in sibling block can break up into continuation
        chains when new children are added to it. We cannot easily send them back to their
        original place since that requires writing integration logic with RenderInline::addChild
        and all other places that might cause continuations to be created (without blowing away
        |this|). Disabling this feature for now to prevent crashes.

        Test: fast/runin/runin-continuations-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::moveRunInToOriginalPosition):

2012-05-23  Abhishek Arya  <inferno@chromium.org>

        Crash in RenderInline::linesVisualOverflowBoundingBox.
        https://bugs.webkit.org/show_bug.cgi?id=85804

        Reviewed by Dave Hyatt.

        Defer layout of replaced elements to the next line break function.
        We shouldn't do it while we are clearing our inline chilren
        lineboxes in full layout mode.

        Test: fast/block/inline-children-root-linebox-crash.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutInlineChildren):
        (WebCore::RenderBlock::LineBreaker::nextLineBreak):

2012-05-23  Chris Rogers  <crogers@google.com>

        AudioParam must support fan-in (multiple audio connections) (take 2)
        https://bugs.webkit.org/show_bug.cgi?id=83610

        Reviewed by Kenneth Russell.
        
        This re-lands bug: https://bugs.webkit.org/show_bug.cgi?id=83610
        Now that a fix has been landed: http://trac.webkit.org/changeset/118099

        Test: webaudio/audioparam-summingjunction.html

        * Modules/webaudio/AudioParam.cpp:
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::calculateSampleAccurateValues):
        (WebCore::AudioParam::calculateAudioRateSignalValues):
        Sums intrinsic parameter value with all audio-rate connections.
        
        (WebCore::AudioParam::connect):
        (WebCore::AudioParam::disconnect):
        Support multiple connections.
        
        (WebCore::AudioParam::hasSampleAccurateValues):
        If we have one or more audio-rate connections.
        
        (WebCore::AudioParam::AudioParam):
        AudioParam now sub-classes AudioSummingJunction.

2012-05-23  Christophe Dumez  <christophe.dumez@intel.com>

        [EFL] webintents/web-intents-delivery-reuse.html is failing on EFL port
        https://bugs.webkit.org/show_bug.cgi?id=87092

        Reviewed by Adam Barth.

        Remove readonly keyword from the webkitIntent attribute. This is
        needed otherwise the [Replaceable] extended attribute has not effect
        with JSC. This is tested by webintents/web-intents-delivery-reuse.html
        test case.

        * Modules/intents/DOMWindowIntents.idl:

2012-05-23  Abhishek Arya  <inferno@chromium.org>

        ASSERT failure toRenderProgress in HTMLProgressElement::didElementStateChange
        https://bugs.webkit.org/show_bug.cgi?id=87274

        Reviewed by Darin Adler.

        Progress bar can't run-in. Prevent it from becoming a run-in, leading to an
        unworkable RenderInline.

        Test: fast/runin/progress-run-in-crash.html

        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::didElementStateChange):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):

2012-05-23  Andrew Lo  <anlo@rim.com>

        [BlackBerry] UI thread unnecessarily blocks on WebKit thread when servicing requestAnimationFrames
        https://bugs.webkit.org/show_bug.cgi?id=87289

        Reviewed by Antonio Gomes.

        requestAnimationFrame already covered by tests in LayoutTests/fast/animation.

        If UI thread cannot acquire DisplayRefreshMonitor mutex immediately,
        avoid blocking on the mutex, it can trigger the frame change on the next
        animation tick instead.

        * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp:
        (WebCore::DisplayRefreshMonitor::displayLinkFired):

2012-05-23  Alec Flett  <alecflett@chromium.org>

        Implement DOM4 DOMError
        https://bugs.webkit.org/show_bug.cgi?id=87055

        Reviewed by Adam Barth.

        Implement the DOMError class and it's IDL interface.

        No new tests. Not testable yet, as it's not used.

        * WebCore.gypi:
        * dom/DOMError.cpp: Added.
        (WebCore):
        (WebCore::DOMError::DOMError):
        * dom/DOMError.h: Added.
        (WebCore):
        (DOMError):
        (WebCore::DOMError::create):
        (WebCore::DOMError::name):
        * dom/DOMError.idl: Added.

2012-05-23  Kenneth Russell  <kbr@google.com>

        REGRESSION(117918) - 4 webgl/tex-iomage-and-sub-image-2d-with-image tests failing on Mac bots.
        https://bugs.webkit.org/show_bug.cgi?id=87136

        Reviewed by Stephen White.

        Fixed longstanding bug in GraphicsContext3D constructor in Mac
        port, and logic error in tracking of texture bound to unit 0. Also
        fixed up Cairo port's constructor by code inspection. This code is
        ripe for cleanup; Bug 87198 filed for this.

        Covered by existing tests.

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
            Initialize missing members.
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
            Correctly initialize m_activeTexture.
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::bindTexture):
            Fix logic error in tracking of texture bound to unit 0.

2012-05-23  Dana Jansens  <danakj@chromium.org>

        [chromium] Layers on main thread should get a RenderSurface for animating transform only if masksToBounds is true also
        https://bugs.webkit.org/show_bug.cgi?id=87184

        Reviewed by James Robinson.

        Layers on main thread get a RenderSurface if their impl counterpart may
        have a RenderSurface due to its animating transform. We currently create
        a RenderSurface for all layers with an animating transform and
        a descendant that drawsContents. But a RenderSurface on impl also
        implies that the layer masksToBounds. So only make a RenderSurface on
        main thread when the layer also masksToBounds.

        Modified unit test CCLayerTreeHostCommonTest.verifyAnimationsForRenderSurfaceHierarchy.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::subtreeShouldRenderToSeparateSurface):

2012-05-23  Chris Fleizach  <cfleizach@apple.com>

        Regression(r112694): Crash in WebCore::AXObjectCache::postNotification 
        https://bugs.webkit.org/show_bug.cgi?id=86029

        Reviewed by Abhishek Arya.

        Test: accessibility/content-changed-notification-causes-crash.html

        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isDetached):
        (AccessibilityObject):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::contentChanged):

2012-05-23  Robin Dunn  <robin@alldunn.com>

        [wx] Fix memory leak in FontHolder.
        https://bugs.webkit.org/show_bug.cgi?id=87281

        Reviewed by Kevin Ollivier.

        * platform/graphics/wx/FontPlatformData.h:

2012-05-23  Robin Dunn  <robin@alldunn.com>

        [wx] Make sure we do not create a substitute font if the facename is not found.
        https://bugs.webkit.org/show_bug.cgi?id=87280

        Reviewed by Kevin Ollivier.

        * platform/graphics/wx/FontCacheWx.cpp:
        (WebCore::FontCache::createFontPlatformData):

2012-05-23  Robin Dunn  <robin@alldunn.com>

        [wx] Implement transparency layer support.
        https://bugs.webkit.org/show_bug.cgi?id=87279

        Reviewed by Kevin Ollivier.

        * platform/graphics/wx/GraphicsContextWx.cpp:
        (WebCore::GraphicsContext::beginPlatformTransparencyLayer):
        (WebCore::GraphicsContext::endPlatformTransparencyLayer):
        (WebCore::GraphicsContext::supportsTransparencyLayers):

2012-05-23  Jer Noble  <jer.noble@apple.com>

        GenericClock loses precision due to float->double conversion.
        https://bugs.webkit.org/show_bug.cgi?id=87227

        Reviewed by Darin Adler.

        No new tests; fixes media/media-controller-time.html on Chromium.

        Only narrow to float after the entire calculation is complete. This requires now() and m_offset
        to be double-precision.

        * platform/ClockGeneric.cpp:
        (ClockGeneric::currentTime): 
        (ClockGeneric::now): Make double-precision.
        * platform/ClockGeneric.h:
        (ClockGeneric): Make m_offset double-precision.

2012-05-22  Jer Noble  <jer.noble@apple.com>

        PlatformClockCM has uninitialized m_rate member.
        https://bugs.webkit.org/show_bug.cgi?id=87217

        Reviewed by Eric Carlson.

        Test: media/media-controller-time.html

        Initialize the m_rate member to a default of 1 (second-per-second), matching the implementation
        of ClockGeneric.

        * platform/mac/PlatformClockCM.mm:
        (PlatformClockCM::PlatformClockCM):

2012-05-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118096.
        http://trac.webkit.org/changeset/118096
        https://bugs.webkit.org/show_bug.cgi?id=87285

        caused multiple crashes on the mac bots (Requested by
        jessieberlin on #webkit).

        * dom/ContainerNodeAlgorithms.h:

2012-05-23  Darin Adler  <darin@apple.com>

        Speed up traverseNextNode when called on a ContainerNode or Element
        https://bugs.webkit.org/show_bug.cgi?id=87224

        Reviewed by Geoffrey Garen.

        * dom/ContainerNode.h: Added overrides of traverseNextNode for ContainerNode.
        That way, when we know at compile time something is ContainerNode, we can
        skip a branch at the start of this hot function.

2012-05-23  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>

        Use PluginDataNone.cpp always when NETSCAPE_PLUGIN_API is OFF
        https://bugs.webkit.org/show_bug.cgi?id=87096

        Reviewed by Andy Estes.

        Fix a build error by adding an extra check in PluginData.cpp to use
        PluginStrategy only when NETSCAPE_PLUGIN_API is ON.

        No new tests. This is only a build fix.

        * plugins/PluginData.cpp:
        (WebCore):

2012-05-23  Malcolm MacLeod  <malcolm.macleod@tshwanedje.com>

        [wx] Fix scrollbar drawing under wxGTK.
        https://bugs.webkit.org/show_bug.cgi?id=87150

        Reviewed by Kevin Ollivier.

        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
        (wxRenderer_DrawScrollbar):

2012-05-23  Antti Koivisto  <antti@apple.com>

        Rename StyleSheetInternal to StyleSheetContents
        https://bugs.webkit.org/show_bug.cgi?id=87272

        Reviewed by Andreas Kling.

        The name is more descriptive and the code reads better.
        
        Plain "StyleSheet" would be good too but that is a CSSOM type and the name can't be used without
        changing idl code generation and resolving bunch of other issues.

        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs):
        * css/CSSFontFaceSrcValue.h:
        (CSSFontFaceSrcValue):
        * css/CSSImportRule.cpp:
        (WebCore::StyleRuleImport::setCSSStyleSheet):
        (WebCore::StyleRuleImport::requestStyleSheet):
        * css/CSSImportRule.h:
        (WebCore):
        (WebCore::StyleRuleImport::parentStyleSheet):
        (WebCore::StyleRuleImport::setParentStyleSheet):
        (WebCore::StyleRuleImport::styleSheet):
        (StyleRuleImport):
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::insertRule):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseSheet):
        (WebCore::CSSParser::parseRule):
        (WebCore::CSSParser::parseKeyframeRule):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseSelector):
        (WebCore::CSSParser::parseDeclaration):
        (WebCore::CSSParser::setStyleSheet):
        (WebCore::CSSParser::parseFlowThread):
        * css/CSSParser.h:
        (WebCore):
        (CSSParser):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs):
        * css/CSSPrimitiveValue.h:
        (CSSPrimitiveValue):
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::addSubresourceStyleURLs):
        * css/CSSReflectValue.h:
        (CSSReflectValue):
        * css/CSSRule.cpp:
        (WebCore::CSSRule::parserContext):
        * css/CSSStyleSheet.cpp:
        (WebCore::StyleSheetContents::estimatedSizeInBytes):
        (WebCore::StyleSheetContents::StyleSheetContents):
        (WebCore::StyleSheetContents::~StyleSheetContents):
        (WebCore::StyleSheetContents::isCacheable):
        (WebCore::StyleSheetContents::parserAppendRule):
        (WebCore::StyleSheetContents::ruleAt):
        (WebCore::StyleSheetContents::ruleCount):
        (WebCore::StyleSheetContents::clearCharsetRule):
        (WebCore::StyleSheetContents::clearRules):
        (WebCore::StyleSheetContents::parserSetEncodingFromCharsetRule):
        (WebCore::StyleSheetContents::wrapperInsertRule):
        (WebCore::StyleSheetContents::wrapperDeleteRule):
        (WebCore::StyleSheetContents::parserAddNamespace):
        (WebCore::StyleSheetContents::determineNamespace):
        (WebCore::StyleSheetContents::parseAuthorStyleSheet):
        (WebCore::StyleSheetContents::parseString):
        (WebCore::StyleSheetContents::parseStringAtLine):
        (WebCore::StyleSheetContents::isLoading):
        (WebCore::StyleSheetContents::checkLoaded):
        (WebCore::StyleSheetContents::notifyLoadedSheet):
        (WebCore::StyleSheetContents::startLoadingDynamicSheet):
        (WebCore::StyleSheetContents::rootStyleSheet):
        (WebCore::StyleSheetContents::singleOwnerNode):
        (WebCore::StyleSheetContents::singleOwnerDocument):
        (WebCore::StyleSheetContents::completeURL):
        (WebCore::StyleSheetContents::addSubresourceStyleURLs):
        (WebCore::StyleSheetContents::parentStyleSheet):
        (WebCore::StyleSheetContents::registerClient):
        (WebCore::StyleSheetContents::unregisterClient):
        (WebCore::StyleSheetContents::addedToMemoryCache):
        (WebCore::StyleSheetContents::removedFromMemoryCache):
        (WebCore::CSSStyleSheet::createInline):
        (WebCore::CSSStyleSheet::CSSStyleSheet):
        (WebCore::CSSStyleSheet::~CSSStyleSheet):
        (WebCore::CSSStyleSheet::willMutateRules):
        (WebCore::CSSStyleSheet::didMutateRules):
        (WebCore::CSSStyleSheet::reattachChildRuleCSSOMWrappers):
        (WebCore::CSSStyleSheet::length):
        (WebCore::CSSStyleSheet::item):
        (WebCore::CSSStyleSheet::rules):
        (WebCore::CSSStyleSheet::insertRule):
        (WebCore::CSSStyleSheet::deleteRule):
        (WebCore::CSSStyleSheet::cssRules):
        * css/CSSStyleSheet.h:
        (WebCore::StyleSheetContents::create):
        (StyleSheetContents):
        (WebCore::StyleSheetContents::copy):
        (WebCore::CSSStyleSheet::create):
        (WebCore::CSSStyleSheet::contents):
        (CSSStyleSheet):
        * css/CSSValue.cpp:
        (WebCore::CSSValue::addSubresourceStyleURLs):
        * css/CSSValue.h:
        (WebCore):
        (CSSValue):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::addSubresourceStyleURLs):
        * css/CSSValueList.h:
        (CSSValueList):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::contextStyleSheet):
        * css/PropertySetCSSStyleDeclaration.h:
        (WebCore):
        (PropertySetCSSStyleDeclaration):
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::setProperty):
        (WebCore::StylePropertySet::parseDeclaration):
        (WebCore::StylePropertySet::addSubresourceStyleURLs):
        * css/StylePropertySet.h:
        (WebCore):
        (StylePropertySet):
        * css/StyleResolver.cpp:
        (RuleSet):
        (WebCore):
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::StyleResolver::addAuthorRulesAndCollectUserRulesFromSheets):
        (WebCore::StyleResolver::appendAuthorStylesheets):
        (WebCore::parseUASheet):
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * css/WebKitCSSKeyframesRule.cpp:
        (WebCore::WebKitCSSKeyframesRule::insertRule):
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createCSSStyleSheet):
        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):
        (WebCore::Document::updateBaseURL):
        (WebCore::Document::pageUserSheet):
        (WebCore::Document::pageGroupUserSheets):
        (WebCore::Document::addUserSheet):
        (WebCore::Document::testAddedStylesheetRequiresStyleRecalc):
        (WebCore::Document::analyzeStylesheetChange):
        (WebCore::styleSheetsUseRemUnits):
        * dom/Document.h:
        (WebCore):
        (Document):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::updateInlineStyleAvoidingMutation):
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::setCSSStyleSheet):
        (WebCore::ProcessingInstruction::parseStyleSheet):
        * dom/StyleElement.cpp:
        (WebCore::StyleElement::createSheet):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::setInlineStyleProperty):
        (WebCore::StyledElement::addSubresourceAttributeURLs):
        (WebCore::StyledElement::addPropertyToAttributeStyle):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::setCSSStyleSheet):
        (WebCore::HTMLLinkElement::styleSheetIsLoading):
        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::fillMediaListChain):
        (WebCore::InspectorStyle::setPropertyText):
        (WebCore::InspectorStyleSheet::styleSheetURL):
        (WebCore::InspectorStyleSheet::reparseStyleSheet):
        (WebCore::InspectorStyleSheet::ensureSourceData):
        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
        (WebCore::CachedCSSStyleSheet::saveParsedStyleSheet):
        * loader/cache/CachedCSSStyleSheet.h:
        (WebCore):
        (CachedCSSStyleSheet):
        * page/PageSerializer.cpp:
        (WebCore::PageSerializer::serializeCSSStyleSheet):

2012-05-23  Darin Adler  <darin@apple.com>

        Use ContainerNode instead of Node where possible
        https://bugs.webkit.org/show_bug.cgi?id=87220

        Reviewed by Geoffrey Garen.

        It's better to use a more specific type; in some cases we even generate
        more efficient code if we have a more specific type. Also, we want any
        type casts to be as close as possible to the corresponding type checks,
        so eliminating these uses of toContainerNode is a plus, also.

        * dom/ContainerNodeAlgorithms.h: Changed insertionPoint to be a ContainerNode
        instead of a Node. Fixed spelling error "inseretions". Changed
        (WebCore::ChildFrameDisconnector::Target::Target): Changed type of frame owner
        element to HTMLFrameOwnerElement from Node.

        * dom/DocumentType.cpp:
        (WebCore::DocumentType::insertedInto):
        (WebCore::DocumentType::removedFrom):
        * dom/DocumentType.h:
        * dom/Element.cpp:
        (WebCore::Element::insertedInto):
        (WebCore::Element::removedFrom):
        * dom/Element.h:
        * dom/Node.cpp:
        (WebCore::Node::insertedInto):
        (WebCore::Node::removedFrom):
        * dom/Node.h:
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::insertedInto):
        (WebCore::ProcessingInstruction::removedFrom):
        * dom/ProcessingInstruction.h:
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::insertedInto):
        * dom/ScriptElement.h:
        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::insertedInto):
        (WebCore::FormAssociatedElement::removedFrom):
        * html/FormAssociatedElement.h:
        * html/HTMLBaseElement.cpp:
        (WebCore::HTMLBaseElement::insertedInto):
        (WebCore::HTMLBaseElement::removedFrom):
        * html/HTMLBaseElement.h:
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::insertedInto):
        (WebCore::HTMLBodyElement::didNotifyDescendantInsertions):
        * html/HTMLBodyElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::insertedInto):
        (WebCore::HTMLFormControlElement::removedFrom):
        * html/HTMLFormControlElement.h:
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::insertedInto):
        (WebCore::HTMLFormElement::didNotifyDescendantInsertions):
        (WebCore::HTMLFormElement::removedFrom):
        * html/HTMLFormElement.h:
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::insertedInto):
        (WebCore::HTMLFrameElementBase::didNotifyDescendantInsertions):
        * html/HTMLFrameElementBase.h:
        * html/HTMLFrameSetElement.cpp:
        (WebCore::HTMLFrameSetElement::insertedInto):
        (WebCore::HTMLFrameSetElement::removedFrom):
        * html/HTMLFrameSetElement.h:
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::insertedInto):
        (WebCore::HTMLIFrameElement::removedFrom):
        * html/HTMLIFrameElement.h:
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::insertedInto):
        (WebCore::HTMLImageElement::removedFrom):
        * html/HTMLImageElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::insertedInto):
        (WebCore::HTMLInputElement::removedFrom):
        * html/HTMLInputElement.h:
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::insertedInto):
        (WebCore::HTMLLinkElement::removedFrom):
        * html/HTMLLinkElement.h:
        * html/HTMLMapElement.cpp:
        (WebCore::HTMLMapElement::insertedInto):
        (WebCore::HTMLMapElement::removedFrom):
        * html/HTMLMapElement.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::insertedInto):
        (WebCore::HTMLMediaElement::removedFrom):
        * html/HTMLMediaElement.h:
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::insertedInto):
        * html/HTMLMetaElement.h:
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::insertedInto):
        (WebCore::HTMLObjectElement::removedFrom):
        * html/HTMLObjectElement.h:
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::insertedInto):
        * html/HTMLOptionElement.h:
        * html/HTMLQuoteElement.cpp:
        (WebCore::HTMLQuoteElement::insertedInto):
        * html/HTMLQuoteElement.h:
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::insertedInto):
        * html/HTMLScriptElement.h:
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::insertedInto):
        * html/HTMLSelectElement.h:
        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::insertedInto):
        (WebCore::HTMLSourceElement::removedFrom):
        * html/HTMLSourceElement.h:
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::insertedInto):
        (WebCore::HTMLStyleElement::removedFrom):
        * html/HTMLStyleElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::insertedInto):
        * html/HTMLTextFormControlElement.h:
        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::insertedInto):
        (WebCore::HTMLTitleElement::removedFrom):
        * html/HTMLTitleElement.h:
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::insertedInto):
        (WebCore::HTMLTrackElement::removedFrom):
        * html/HTMLTrackElement.h:
        * mathml/MathMLMathElement.cpp:
        (WebCore::MathMLMathElement::insertedInto):
        * mathml/MathMLMathElement.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::removedFrom):
        * svg/SVGElement.h:
        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::insertedInto):
        (WebCore::SVGFEImageElement::removedFrom):
        * svg/SVGFEImageElement.h:
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::insertedInto):
        (WebCore::SVGFontFaceElement::removedFrom):
        * svg/SVGFontFaceElement.h:
        * svg/SVGFontFaceUriElement.cpp:
        (WebCore::SVGFontFaceUriElement::insertedInto):
        * svg/SVGFontFaceUriElement.h:
        * svg/SVGGlyphElement.cpp:
        (WebCore::SVGGlyphElement::insertedInto):
        (WebCore::SVGGlyphElement::removedFrom):
        * svg/SVGGlyphElement.h:
        * svg/SVGHKernElement.cpp:
        (WebCore::SVGHKernElement::insertedInto):
        (WebCore::SVGHKernElement::removedFrom):
        * svg/SVGHKernElement.h:
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::insertedInto):
        * svg/SVGImageElement.h:
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::insertedInto):
        (WebCore::SVGSVGElement::removedFrom):
        * svg/SVGSVGElement.h:
        * svg/SVGScriptElement.cpp:
        (WebCore::SVGScriptElement::insertedInto):
        * svg/SVGScriptElement.h:
        * svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::insertedInto):
        (WebCore::SVGStyleElement::removedFrom):
        * svg/SVGStyleElement.h:
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::insertedInto):
        (WebCore::SVGStyledElement::removedFrom):
        * svg/SVGStyledElement.h:
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::insertedInto):
        (WebCore::SVGTRefElement::removedFrom):
        * svg/SVGTRefElement.h:
        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::insertedInto):
        * svg/SVGTextPathElement.h:
        * svg/SVGTitleElement.cpp:
        (WebCore::SVGTitleElement::insertedInto):
        (WebCore::SVGTitleElement::removedFrom):
        * svg/SVGTitleElement.h:
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::insertedInto):
        (WebCore::SVGUseElement::removedFrom):
        * svg/SVGUseElement.h:
        * svg/SVGVKernElement.cpp:
        (WebCore::SVGVKernElement::insertedInto):
        (WebCore::SVGVKernElement::removedFrom):
        * svg/SVGVKernElement.h:
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::insertedInto):
        (WebCore::SVGSMILElement::removedFrom):
        * svg/animation/SVGSMILElement.h:
        Changed arguments of insertedInto and removedFrom to ContainerNode instead of Node.
        Did the same with didNotifyDescendantInsertions, while fixing the typo in its name.

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply): Put a typecast toHTMLElement here.
        The check for isListElement and isLegacyAppleStyleSpan takes care of the type checking.
        (WebCore::ReplaceSelectionCommand::insertAsListItems): Changed this function to take
        an HTMLElement instead of a Node, then we can drop use of the toContainerNode function.
        * editing/ReplaceSelectionCommand.h:

        * editing/TextIterator.cpp: Fixed a typo in a comment.

2012-05-23  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: filter out debugging stuff from the heap class view
        https://bugs.webkit.org/show_bug.cgi?id=86723

        We mark objects that are accessible from user roots (e.g. Window)
        with pageObject attribute. This fix filters out all non-pageObjects
        from the classes view.

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotNode.prototype.isPageObject):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._calculateClassesRetainedSize):
        (WebInspector.HeapSnapshot.prototype._buildPostOrderIndex):
        (WebInspector.HeapSnapshot.prototype._markPageOwnedNodes):
        (WebInspector.HeapSnapshot.prototype.createNodesProviderForClass):

2012-05-23  Andrei Bucur  <abucur@adobe.com>

        [CSSRegions]Implement NamedFlow::name attribute
        https://bugs.webkit.org/show_bug.cgi?id=79645

        Implementation for the NamedFlow::name attribute per the CSS Regions WD 3-May-2012 recommendation:
        http://www.w3.org/TR/2012/WD-css3-regions-20120503/

        Reviewed by Andreas Kling.

        Test: fast/regions/webkit-named-flow-name.html

        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::name):
        (WebCore):
        * dom/WebKitNamedFlow.h:
        (WebKitNamedFlow):
        * dom/WebKitNamedFlow.idl:

2012-05-23  Andreas Kling  <kling@webkit.org>

        Let the compiler generate FontFamily's copy ctor and assignment operator.

        Blindly rubberstamped by the brave Antti Koivisto.

        * platform/graphics/FontFamily.cpp:
        * platform/graphics/FontFamily.h:

2012-05-23  Andreas Kling  <kling@webkit.org>

        CSSParser: Simplify StylePropertySet creation.
        <http://webkit.org/b/87259>

        Reviewed by Alexis Menard.

        Turn CSSParser's filteredProperties() into createStylePropertySet() which filters the parsed
        properties and creates a new StylePropertySet, adopting the vector to avoid the Vector copy we
        were previously incurring.

        Added a StylePropertyVector typedef for Vector<CSSProperty, 4> since we need to pass this type
        to the constructor for Vector::swap() to work.

        And thus StylePropertySet::create(const Vector<CSSProperty>&, CSSParserMode) became
        StylePropertySet::adopt(StylePropertyVector&, CSSParserMode).

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::copyPropertiesInSet):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::createStylePropertySet):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createKeyframe):
        * css/CSSParser.h:
        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::StylePropertySet):
        (WebCore::StylePropertySet::removePropertiesInSet):
        (WebCore::StylePropertySet::copyPropertiesInSet):
        (SameSizeAsStylePropertySet):
        * css/StylePropertySet.h:
        (WebCore::StylePropertySet::adopt):
        (StylePropertySet):

2012-05-23  Andreas Kling  <kling@webkit.org>

        Kill some frivolous null-checking of Element::m_attributeData.
        <http://webkit.org/b/87248>

        Reviewed by Antti Koivisto.

        Replace unnecessary Element::m_attributeData with assertions where it makes sense.
        Others are flat out removed because it should be obvious from context that it's non-null.
        E.g if an attribute has changed, we're obviously storing it somewhere.

        Also added a short-circuit to Element::normalize() if there are no Attr objects
        associated with the element.

        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore::Element::attributeChanged):
        (WebCore::Element::insertedInto):
        (WebCore::Element::removedFrom):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::normalizeAttributes):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::classAttributeChanged):

2012-05-23  Andreas Kling  <kling@webkit.org>

        Let Element::detachAttribute() handle removal of the attribute.
        <http://webkit.org/b/87242>

        Reviewed by Antti Koivisto.

        All the call sites were removing the attribute after detaching it, so move
        that into detachAttribute(). The function name already made it sound like it
        removes the attribute anyway.

        Also sprinkle some assertions wrt being called with guaranteed presence of
        attributeData() and the provided index in the attribute vector.

        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::removeAttributeNode):
        * dom/NamedNodeMap.cpp:
        (WebCore::NamedNodeMap::removeNamedItem):
        (WebCore::NamedNodeMap::removeNamedItemNS):

2012-05-23  Andreas Kling  <kling@webkit.org>

        Streamline Element teardown for the no-Attr-objects case.
        <http://webkit.org/b/87228>

        Reviewed by Antti Koivisto.

        Dodge one function call in ~Element() if the element has no Attr objects
        associated (the typical case.)

        Renamed detachAttributes to detachAttrObjectsFromElement to reduce ambiguity.

        * dom/Element.cpp:
        (WebCore::Element::~Element):
        * dom/ElementAttributeData.cpp:
        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
        (WebCore::ElementAttributeData::clearAttributes):
        * dom/ElementAttributeData.h:
        (ElementAttributeData):

2012-05-23  Jochen Eisinger  <jochen@chromium.org>

        Fix incomplete switch statement in CSSParser after r118082
        https://bugs.webkit.org/show_bug.cgi?id=87250

        Reviewed by Alexis Menard.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):

2012-05-23  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118105.
        http://trac.webkit.org/changeset/118105
        https://bugs.webkit.org/show_bug.cgi?id=87255

        New LayoutTest is causing several cookie tests to fail on
        numerous bots (Requested by steveblock on #webkit).

        * platform/blackberry/CookieJarBlackBerry.cpp:
        (WebCore::setCookies):
        * platform/blackberry/CookieManager.cpp:
        (WebCore::CookieManager::setCookies):
        (WebCore::CookieManager::checkAndTreatCookie):
        (WebCore::CookieManager::addCookieToMap):
        (WebCore::CookieManager::setPrivateMode):
        (WebCore):
        * platform/blackberry/CookieManager.h:
        * platform/blackberry/CookieMap.cpp:
        (WebCore::CookieMap::addOrReplaceCookie):
        (WebCore::CookieMap::removeCookie):
        * platform/blackberry/CookieMap.h:
        (CookieMap):

2012-05-23  Zan Dobersek  <zandobersek@gmail.com>

        [Gtk] EventSender should properly handle (left|right)(control|shift|alt) after r118001
        https://bugs.webkit.org/show_bug.cgi?id=87221

        Reviewed by Martin Robinson.

        No new tests - covered by fast/events/keydown-leftright-keys.html.

        Windows key code for shift, control and alt keys should respect the
        left or right position of that key. This way the DOM location code of
        a key event is properly determined for these keys.

        * platform/gtk/PlatformKeyboardEventGtk.cpp:
        (WebCore::PlatformKeyboardEvent::windowsKeyCodeForGdkKeyCode):

2012-05-23  Ilya Tikhonovsky  <loislo@chromium.org>

        Web Inspector: eliminate getters from HeapSnapshot.js
        https://bugs.webkit.org/show_bug.cgi?id=87241

        getters can't be inlined by engine at the moment.
        I found that conversion getters into functions gives us about 600 ms

        RESULT heap-snapshot: switch-to-containment-view= 1920 ms
        vs
        RESULT heap-snapshot: switch-to-containment-view= 1367 ms

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshot.js:
        (WebInspector.HeapSnapshotEdge.prototype.hasStringName):
        (WebInspector.HeapSnapshotEdge.prototype.isElement):
        (WebInspector.HeapSnapshotEdge.prototype.isHidden):
        (WebInspector.HeapSnapshotEdge.prototype.isWeak):
        (WebInspector.HeapSnapshotEdge.prototype.isInternal):
        (WebInspector.HeapSnapshotEdge.prototype.isInvisible):
        (WebInspector.HeapSnapshotEdge.prototype.isShortcut):
        (WebInspector.HeapSnapshotEdge.prototype.name):
        (WebInspector.HeapSnapshotEdge.prototype.node):
        (WebInspector.HeapSnapshotEdge.prototype.nodeIndex):
        (WebInspector.HeapSnapshotEdge.prototype.rawEdges):
        (WebInspector.HeapSnapshotEdge.prototype.toString):
        (WebInspector.HeapSnapshotEdge.prototype.type):
        (WebInspector.HeapSnapshotEdge.prototype._hasStringName):
        (WebInspector.HeapSnapshotEdge.prototype._name):
        (WebInspector.HeapSnapshotEdge.prototype._nameOrIndex):
        (WebInspector.HeapSnapshotEdgeIterator.prototype.index):
        (WebInspector.HeapSnapshotEdgeIterator.prototype.setIndex):
        (WebInspector.HeapSnapshotEdgeIterator.prototype.item):
        (WebInspector.HeapSnapshotRetainerEdge):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.clone):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.hasStringName):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isElement):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isHidden):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isInternal):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isInvisible):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isShortcut):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.isWeak):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.name):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.node):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.nodeIndex):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.retainerIndex):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.setRetainerIndex):
        (WebInspector.HeapSnapshotRetainerEdge.prototype._node):
        (WebInspector.HeapSnapshotRetainerEdge.prototype._edge):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.toString):
        (WebInspector.HeapSnapshotRetainerEdge.prototype.type):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.first):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.hasNext):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.index):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.setIndex):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.item):
        (WebInspector.HeapSnapshotRetainerEdgeIterator.prototype.next):
        (WebInspector.HeapSnapshotNode.prototype.canBeQueried):
        (WebInspector.HeapSnapshotNode.prototype.distanceToWindow):
        (WebInspector.HeapSnapshotNode.prototype.className):
        (WebInspector.HeapSnapshotNode.prototype.dominatorIndex):
        (WebInspector.HeapSnapshotNode.prototype.edges):
        (WebInspector.HeapSnapshotNode.prototype.edgesCount):
        (WebInspector.HeapSnapshotNode.prototype.flags):
        (WebInspector.HeapSnapshotNode.prototype.id):
        (WebInspector.HeapSnapshotNode.prototype.isHidden):
        (WebInspector.HeapSnapshotNode.prototype.isNative):
        (WebInspector.HeapSnapshotNode.prototype.isSynthetic):
        (WebInspector.HeapSnapshotNode.prototype.isWindow):
        (WebInspector.HeapSnapshotNode.prototype.isDetachedDOMTreesRoot):
        (WebInspector.HeapSnapshotNode.prototype.isDetachedDOMTree):
        (WebInspector.HeapSnapshotNode.prototype.isRoot):
        (WebInspector.HeapSnapshotNode.prototype.name):
        (WebInspector.HeapSnapshotNode.prototype.rawEdges):
        (WebInspector.HeapSnapshotNode.prototype.retainedSize):
        (WebInspector.HeapSnapshotNode.prototype.retainers):
        (WebInspector.HeapSnapshotNode.prototype.selfSize):
        (WebInspector.HeapSnapshotNode.prototype.type):
        (WebInspector.HeapSnapshotNode.prototype._name):
        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesEnd):
        (WebInspector.HeapSnapshotNode.prototype._nextNodeIndex):
        (WebInspector.HeapSnapshotNode.prototype._type):
        (WebInspector.HeapSnapshotNodeIterator):
        (WebInspector.HeapSnapshotNodeIterator.prototype.hasNext):
        (WebInspector.HeapSnapshotNodeIterator.prototype.index):
        (WebInspector.HeapSnapshotNodeIterator.prototype.setIndex):
        (WebInspector.HeapSnapshotNodeIterator.prototype.item):
        (WebInspector.HeapSnapshotNodeIterator.prototype.next):
        (WebInspector.HeapSnapshot.prototype._allNodes):
        (WebInspector.HeapSnapshot.prototype.rootNode):
        (WebInspector.HeapSnapshot.prototype.get totalSize):
        (WebInspector.HeapSnapshot.prototype._dominatedNodesOfNode):
        (WebInspector.HeapSnapshot.prototype.aggregatesForDiff):
        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
        (WebInspector.HeapSnapshot.prototype._buildAggregates):
        (WebInspector.HeapSnapshot.prototype._calculateClassesRetainedSize):
        (WebInspector.HeapSnapshot.prototype._sortAggregateIndexes):
        (WebInspector.HeapSnapshot.prototype._markInvisibleEdges):
        (WebInspector.HeapSnapshot.prototype._markDetachedDOMTreeNodes):
        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
        (WebInspector.HeapSnapshot.prototype._calculateDiffForClass):
        (WebInspector.HeapSnapshot.prototype._nodeForSnapshotObjectId):
        (WebInspector.HeapSnapshot.prototype.nodeClassName):
        (WebInspector.HeapSnapshot.prototype.dominatorIdsForNode):
        (WebInspector.HeapSnapshot.prototype.createEdgesProvider):
        (WebInspector.HeapSnapshot.prototype.createRetainingEdgesProvider):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype._createIterationOrder):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.isEmpty):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.item):
        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.serializeItemsRange):
        (WebInspector.HeapSnapshotEdgesProvider.prototype.serializeItem):
        (WebInspector.HeapSnapshotEdgesProvider.prototype.sort.compareEdgeFieldName):
        (WebInspector.HeapSnapshotEdgesProvider.prototype.sort.compareNodeField):
        (WebInspector.HeapSnapshotNodesProvider):
        (WebInspector.HeapSnapshotNodesProvider.prototype.nodePosition):
        (WebInspector.HeapSnapshotNodesProvider.prototype.serializeItem):
        (WebInspector.HeapSnapshotNodesProvider.prototype.sort.sortByNodeField):
        * inspector/front-end/HeapSnapshotGridNodes.js:
        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotProviderProxy.prototype.isEmpty):

2012-05-22  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: Debugger should correctly show catch scope
        https://bugs.webkit.org/show_bug.cgi?id=87197

        Reviewed by Vsevolod Vlasov.

        * bindings/v8/DebuggerScript.js: In case of Catch scope the scope object
        is a synthetic one which means that it contains all standard object properties.
        When passing this object further we need to leave only properties available in
        the catch block(only variable thar stores the exception in fact).

2012-05-23  Allan Sandfeld Jensen  <allan.jensen@nokia.com>

        [Qt] FloatSize Qt Support
        https://bugs.webkit.org/show_bug.cgi?id=87237

        Reviewed by Andreas Kling.

        No new functionality. No new tests.

        * Target.pri:
        * platform/graphics/FloatSize.h:
        (FloatSize):
        * platform/graphics/qt/FloatSizeQt.cpp: Added.
        (WebCore::FloatSize::FloatSize):
        (WebCore::FloatSize::operator QSizeF):

2012-05-23  Alexei Filippov  <alexeif@chromium.org>

        Web Inspector: Enable HeapSnapshotRealWorker in production mode.
        https://bugs.webkit.org/show_bug.cgi?id=87240

        Reviewed by Yury Semikhatsky.

        * inspector/front-end/HeapSnapshotProxy.js:
        (WebInspector.HeapSnapshotWorker):

2012-05-23  'Pavel Feldman'  <pfeldman@chromium.org>

        Not reviewed: inspector's Find is not consuming event as of r117974.

        * inspector/front-end/AdvancedSearchController.js:
        (WebInspector.AdvancedSearchController.prototype.handleShortcut):
        * inspector/front-end/SearchController.js:
        (WebInspector.SearchController.prototype.handleShortcut):

2012-05-23  Pavel Feldman  <pfeldman@chromium.org>

        Web Inspector: enable drag-an-drop from the navigator panel.
        https://bugs.webkit.org/show_bug.cgi?id=87238

        Reviewed by Vsevolod Vlasov.

        Making tree item draggable.

        * inspector/front-end/NavigatorView.js:
        (WebInspector.NavigatorSourceTreeElement.prototype.onattach):
        (WebInspector.NavigatorSourceTreeElement.prototype._onmousedown.callback):
        (WebInspector.NavigatorSourceTreeElement.prototype._onmousedown):
        (WebInspector.NavigatorSourceTreeElement.prototype._ondragstart):

2012-05-23  Ryosuke Niwa  <rniwa@webkit.org>

        WebKit spends ~20% of time in HTMLTextAreaElement::defaultValue() when opening a review page
        https://bugs.webkit.org/show_bug.cgi?id=86813

        Reviewed by Eric Seidel.

        Replace String and calls to String::operator+= by StringBuilder and calls to append respectively.
        While there are other optimizations we can implement such as not replacing all nodes in the shadow DOM,
        or not serializing the value when detecting whether the value had changed, they require considerable
        amount of refactoring and this change alone seems to buy us a lot so let us defer those 'til later time.

        Also avoid the redundant call to setValue in childrenChanged when the value is dirty.
        This should halve the time we spend in setting the value.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::childrenChanged):
        (WebCore::HTMLTextAreaElement::defaultValue):

2012-05-23  Alice Boxhall  <aboxhall@chromium.org>

        AX: Contenteditable tables should always be exposed as data tables
        https://bugs.webkit.org/show_bug.cgi?id=87052

        Reviewed by Chris Fleizach.

        Tested in accessibility/table-detection.html.

        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::isDataTable): Return true if the node is contenteditable.

2012-05-23  Ryosuke Niwa  <rniwa@webkit.org>

        Fix a typo per Darin's comment.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRuns):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8::Null() in custom bindings (Part 2)
        https://bugs.webkit.org/show_bug.cgi?id=87209

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8::Null() in custom bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8HTMLElementCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::toV8):
        * bindings/v8/custom/V8HistoryCustom.cpp:
        (WebCore::V8History::stateAccessorGetter):
        * bindings/v8/custom/V8IDBAnyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8IDBKeyCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ImageDataCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8MessageEventCustom.cpp:
        (WebCore::V8MessageEvent::dataAccessorGetter):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        (WebCore::toV8Slow):
        * bindings/v8/custom/V8PopStateEventCustom.cpp:
        (WebCore::V8PopStateEvent::stateAccessorGetter):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGElementCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8SVGPathSegCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8StyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8TrackEventCustom.cpp:
        (WebCore::V8TrackEvent::trackAccessorGetter):
        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::toV8Object):
        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::toV8):

2012-05-23  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8::Null() in custom bindings (Part 1)
        https://bugs.webkit.org/show_bug.cgi?id=87207

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8::Null() in custom bindings.

        Also this patch makes V8DeviceMotionEventCustom::createAccelerationObject()
        and V8DeviceMotionEventCustom::createRotationRateObject() static.

        No tests. No change in behavior.

        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSRuleCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8CSSValueCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::typesAccessorGetter):
        * bindings/v8/custom/V8CoordinatesCustom.cpp:
        (WebCore::V8Coordinates::altitudeAccessorGetter):
        (WebCore::V8Coordinates::altitudeAccuracyAccessorGetter):
        (WebCore::V8Coordinates::headingAccessorGetter):
        (WebCore::V8Coordinates::speedAccessorGetter):
        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
        (WebCore::V8DeviceMotionEvent::accelerationAccessorGetter):
        (WebCore::V8DeviceMotionEvent::accelerationIncludingGravityAccessorGetter):
        (WebCore::V8DeviceMotionEvent::rotationRateAccessorGetter):
        (WebCore::V8DeviceMotionEvent::intervalAccessorGetter):
        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
        (WebCore::V8DeviceOrientationEvent::alphaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::betaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::gammaAccessorGetter):
        (WebCore::V8DeviceOrientationEvent::absoluteAccessorGetter):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::V8Document::locationAccessorGetter):
        * bindings/v8/custom/V8EntryCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EntrySyncCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8EventCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8Float64ArrayCustom.cpp:
        (WebCore::toV8):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::V8HTMLCanvasElement::getContextCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::toV8):

2012-05-22  MORITA Hajime  <morrita@google.com>

        [Refactoring] ElementShadow::m_needsRedistributing  should be on ContentDistributor
        https://bugs.webkit.org/show_bug.cgi?id=87216

        Reviewed by Kentaro Hara.

        Moved ElementShadow::m_needsRedistributing to ContentDistributor::m_needsRedistributing

        No new tests. No behavior change.

        * dom/ElementShadow.cpp:
        (WebCore::ElementShadow::recalcStyle):
        (WebCore::ElementShadow::needsRedistributing):
        (WebCore::ElementShadow::setNeedsRedistributing):
        * dom/ElementShadow.h:
        (ElementShadow):
        * dom/ShadowRoot.h: Removed outdated declarations.
        * html/shadow/ContentDistributor.cpp:
        (WebCore::ContentDistributor::ContentDistributor):
        * html/shadow/ContentDistributor.h:
        (WebCore::ContentDistributor::needsRedistributing):
        (WebCore::ContentDistributor::setNeedsRedistributing):
        (WebCore::ContentDistributor::clearNeedsRedistributing):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to v8::Null() in CodeGeneratorV8.pm
        https://bugs.webkit.org/show_bug.cgi?id=87202

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to v8::Null() in CodeGeneratorV8.pm.

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateNormalAttrGetter):
        (GenerateFunctionCallback):
        (NativeToJSValue):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::valueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::readonlyValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):

2012-05-22  Andreas Kling  <kling@webkit.org>

        Short-circuit Element::attrIfExists() when the Element has no Attr list.
        <http://webkit.org/b/87214>

        Reviewed by Ryosuke Niwa.

        This function was lukewarm on Dromaeo/dom-attr (0.4% of samples.)
        Added an early return if !hasAttrList() to avoid the function call overhead of
        ElementAttributeData::attrIfExists().

        * dom/Element.cpp:
        (WebCore::Element::attrIfExists):

2012-05-22  Hayato Ito  <hayato@chromium.org>

        Remove an assertion since an event's target might be a shadow root if a text node is clicked.
        https://bugs.webkit.org/show_bug.cgi?id=87072

        Reviewed by Dimitri Glazkov.

        Tests: fast/dom/shadow/shadow-dom-event-dispatching.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::ComposedShadowTreeWalker):

2012-05-22  Dongwoo Im  <dw.im@samsung.com>

        [EFL] Implements the registerProtocolHandler method and option.
        https://bugs.webkit.org/show_bug.cgi?id=73638

        Reviewed by Andreas Kling.

        The registerProtocolHandler() method allows Web sites to register themselves
        as possible handlers for particular schemes.

        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler

        * CMakeLists.txt: Add page/NavigatorRegisterProtocolHandler.idl into WebCore_IDL_FILES.

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8][Performance] Pass Isolate to v8::Null() in V8Node::toV8()
        https://bugs.webkit.org/show_bug.cgi?id=87193

        Reviewed by Adam Barth.

        This patch improves the performance of Bindings/undefined-first-child.html by 58.7%,
        Bindings/undefined-get-element-by-id.html by 26.8%,
        Dromaeo/dom-query.html(getElementById (not in document)) by 9.8%,
        and Dromaeo/dom-query.html(getElementsByName (not in document)) by 2.1%.
        These benchmarks test the performance of accessing an undefined Node object.

        Performance test results in my Linux desktop:

        [Bindings/undefined-first-child.html]
          - without my patch
          RESULT Bindings: undefined-first-child= 481.843775891 runs/s
          median= 474.934036939 runs/s, stdev= 17.7753278263 runs/s, min= 471.204188482 runs/s, max= 534.629404617 runs/s

          - with my patch
          RESULT Bindings: undefined-first-child= 764.720531908 runs/s
          median= 803.515696424 runs/s, stdev= 54.7402312963 runs/s, min= 688.806888069 runs/s, max= 807.061790668 runs/s

        [Bindings/undefined-get-element-by-id.html]
          - without my patch
          RESULT Bindings: undefined-get-element-by-id= 236.642705579 runs/s
          median= 234.527786832 runs/s, stdev= 5.77090297761 runs/s, min= 231.362467866 runs/s, max= 246.305418719 runs/s

          - with my patch
          RESULT Bindings: undefined-get-element-by-id= 300.031032067 runs/s
          median= 303.797468354 runs/s, stdev= 6.99060409266 runs/s, min= 287.581699346 runs/s, max= 304.955527319 runs/s

        [Dromaeo/dom-query.html(getElementById (not in document))]
          - without my patch
          2855.80runs/s ±0.30%

          - with my patch
          3136.20runs/s ±0.22%

        [Dromaeo/dom-query.html(getElementsByName (not in document))]
          - without my patch
          2198.00runs/s ±0.50%

          - with my patch
          2243.40runs/s ±3.39%

        Currently v8::Null() looks up Isolate, which is a bottleneck of
        V8Node::toV8() for undefined Nodes. This patch removes the Isolate
        look-up by passing Isolate to v8::Null(), like v8::Null(isolate).

        * bindings/scripts/CodeGeneratorV8.pm: Modified as described above.
        (GenerateHeader):

        * bindings/scripts/test/V8/V8TestActiveDOMObject.h: Updated run-bindings-tests results.
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestEventTarget.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestException.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestInterface.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestNode.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestObj.h:
        (WebCore::toV8):
        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
        (WebCore::toV8):

2012-05-22  MORITA Hajime  <morrita@google.com>

        REGRESSION(r116629) tests for <style scoped> is crashing
        https://bugs.webkit.org/show_bug.cgi?id=87191

        Reviewed by Kent Tamura.

        unregisterWithScopingNode() and registerWithScopingNode() doesn't follow
        refactoring around removedFrom(), insertedInto() and willRemove().
        This change aligns them to such recent changes.

        No new tests. Covered by existing tests.

        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::unregisterWithScopingNode)
        (WebCore::HTMLStyleElement::insertedInto):
        - Allowed registerWithScopingNode() only for in-document traversal.
          That is how it originally did.
        (WebCore::HTMLStyleElement::removedFrom):
        - Gave ex-parent to unregisterWithScopingNode().
        * html/HTMLStyleElement.h:
        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
        (HTMLStyleElement):

2012-05-21  Shawn Singh  <shawnsingh@chromium.org>

        Improve W3C conformance of backface-visibility
        https://bugs.webkit.org/show_bug.cgi?id=84195

        Reviewed by Adrienne Walker.

        Tests: compositing/backface-visibility/backface-visibility-3d.html
               compositing/backface-visibility/backface-visibility-hierarchical-transform.html
               compositing/backface-visibility/backface-visibility-non3d.html
               compositing/backface-visibility/backface-visibility-simple.html

        Unit Tests: CCLayerTreeHostCommonTest::verifyBackFaceCullingWithoutPreserves3d
                    CCLayerTreeHostCommonTest::verifyBackFaceCullingWithPreserves3d

        Also updated a few other layout and unit tests.

        This patch updates chromium to conform to the W3C spec on CSS
        transforms, Section 12 about backface visibility. This patch also
        updates layout tests to reflect the latest W3C spec. In
        particular, rule #1 on section 12, http://dev.w3.org/csswg/css3-transforms/#backface-visibility-property
        states which transforms should be used to determine backface-visibility.

        Because chromium has an additional quirk of the concept of render
        surfaces, unit tests needed to be updated as well.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::layerIsRootOfNewRenderingContext):
        (WebCore):
        (WebCore::isLayerBackFaceVisible):
        (WebCore::isSurfaceBackFaceVisible):
        (WebCore::calculateVisibleLayerRect):
        (WebCore::layerShouldBeSkipped):
        (WebCore::calculateDrawTransformsAndVisibilityInternal):

2012-05-22  Sheriff Bot  <webkit.review.bot@gmail.com>

        Unreviewed, rolling out r118095.
        http://trac.webkit.org/changeset/118095
        https://bugs.webkit.org/show_bug.cgi?id=87201

        "Causing crashes on Mac in
        WebCore::StyleResolver::adjustRenderStyle (Requested by
        sundiamonde on #webkit).

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-22  Levi Weintraub  <leviw@chromium.org>

        NULL ptr in WebCore::RenderBlock::layoutRunsAndFloatsInRange
        https://bugs.webkit.org/show_bug.cgi?id=77786

        Reviewed by Ryosuke Niwa.

        InlineBidiResolver adds one fake TextRun for isolated inlines in the process of creating the
        list of TextRuns to send to the UBA. After the UBA has been run and the TextRuns reordered,
        we re-run InlineBidiResolver rooted in the isolate and replace the fake run with those
        generated by the subsequent pass by calling the method BidiRunList::replaceRunWithRuns.
        This method assumes there are runs to replace the fake run with.

        Positioned inline children are ignored when creating TextRuns, so when an isolated inline
        has only positioned children we end up with an empty set of runs to pass to replaceRunWithRuns.
        Ideally, we'd remove the fake run and not replace it with anything, but BidiRunList keeps
        a pointer to the logically last run, which we're unable to easily re-determine after the UBA
        has been run. Instead, we leave the fake run in the list and simply avoid calling
        replaceRunWithRuns when we don't have any replacement runs.

        Test: fast/block/line-layout/crash-in-isolate-with-positioned-child.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRuns):

2012-05-22  Kent Tamura  <tkent@chromium.org>

        [V8] Refactor generation code for non-standard functions
        https://bugs.webkit.org/show_bug.cgi?id=87185

        Reviewed by Kentaro Hara.

        No behavior change. Just a refactoring.

        * bindings/scripts/CodeGeneratorV8.pm:
        (IsStandardFunction): Introduce a new function to check if a
        function can be in a batch registration.
        (GenerateNonStandardFunction): Factor out a code to generate
        non-standard functions.
        (GenerateImplementation):
        Use IsStandardFunction and GenerateNonStandardFunction.

2012-05-22  Hayato Ito  <hayato@chromium.org>

        Make ComposedShadowTreeWalker traverse inactive insertion points correctly.
        https://bugs.webkit.org/show_bug.cgi?id=86830

        Reviewed by Dimitri Glazkov.

        Fixed InsertionPoint::isActive() issue, which may return true
        wrongly even if the insertion point is not in Shadow DOM subtree.
        Now ComposedShadowTreeWalker can traverse inactive insertion
        points correctly using InsertionPoint::isActive().

        Test: fast/dom/shadow/composed-shadow-tree-walker.html

        * dom/ComposedShadowTreeWalker.cpp:
        (WebCore::ComposedShadowTreeWalker::traverseNode):
        (WebCore::ComposedShadowTreeWalker::escapeFallbackContentElement):
        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
        * html/shadow/InsertionPoint.cpp:
        (WebCore::InsertionPoint::isActive):
        * html/shadow/InsertionPoint.h:
        (WebCore::isActiveInsertionPoint):
        (WebCore):

2012-05-22  Mark Pilgrim  <pilgrim@chromium.org>

        [Chromium] Call canAccelerate2dCanvas directly
        https://bugs.webkit.org/show_bug.cgi?id=86893

        Reviewed by James Robinson.

        Part of a refactoring series. See tracking bug 82948.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::shouldAccelerate):
        * platform/chromium/PlatformSupport.h:

2012-05-22  Jason Liu  <jason.liu@torchmobile.com.cn>

        [BlackBerry] Possible to clobber httponly cookie.
        https://bugs.webkit.org/show_bug.cgi?id=86067

        Reviewed by Rob Buis.

        If a cookie is set by javaScript and there is already a same httpOnly cookie in cookieManager,
        we should reject it. If it has a httpOnly property, we reject it, too.

        Test: http/tests/cookies/js-get-and-set-http-only-cookie.php

        * platform/blackberry/CookieJarBlackBerry.cpp:
        (WebCore::setCookies):
        * platform/blackberry/CookieManager.cpp:
        (WebCore::CookieManager::setCookies):
        (WebCore::CookieManager::shouldRejectNotHttpCookie):
        (WebCore):
        * platform/blackberry/CookieManager.h:

2012-05-22  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't drop children of a RenderSurface from the renderSurfaceLayerList when then position of the surface in its clipRect is not known
        https://bugs.webkit.org/show_bug.cgi?id=87181

        Reviewed by Adrienne Walker.

        We want to avoid dropping things from the renderSurfaceLayerList on main
        thread when they may be in the renderSurfaceLayerList on impl thread due
        to animation. A render surface would drop all its children if its
        contentRect was clipped to become empty by its parent. But when the
        surface is being animated, then we can't be sure how its parent will
        clip the surface's content, so we don't clip it at all.

        Chromium bug: http://crbug.com/128739

        Unit test: CCLayerTreeHostCommonTest.verifyClipRectCullsSurfaceWithoutVisibleContent

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateDrawTransformsAndVisibilityInternal):

2012-05-22  Kangil Han  <kangil.han@samsung.com>

        [EFL][DRT] Implement touch event
        https://bugs.webkit.org/show_bug.cgi?id=86720

        Reviewed by Hajime Morita.

        Currently EFL DRT doesn't support touch event.
        Therefore, this patch enabled it and implemented some eventSender function callbacks.

        * platform/PlatformTouchEvent.h:
        (PlatformTouchEvent): Implement meta state.
        * platform/efl/PlatformTouchEventEfl.cpp:
        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Implement meta state.

2012-05-22  Chris Rogers  <crogers@google.com>

        AudioNodeOutput::disconnectAllParams() must take care when iterating through its parameter list
        https://bugs.webkit.org/show_bug.cgi?id=87190

        Reviewed by Kenneth Russell.

        No new tests. Covered by existing tests.

        * Modules/webaudio/AudioNodeOutput.cpp:
        (WebCore::AudioNodeOutput::disconnectAllParams):

2012-05-22  MORITA Hajime  <morrita@google.com>

        <shadow> and <content> should be hidden behind ContextEnabledFeatures
        https://bugs.webkit.org/show_bug.cgi?id=87063

        This change repalces "runtimeConditional" tag definition property
        with new "contextConditional" property, which refers
        ContextEnabledFeatures instead of RuntimeEnabledFeatures.

        Reviewed by Dimitri Glazkov.

        No new tests. DRT cannot test this. No behaviour change on DRT.

        * dom/make_names.pl:
        (defaultTagPropertyHash):
        (printConstructorInterior):
        (printFactoryCppFile):
        (printWrapperFunctions):
        (printWrapperFactoryCppFile):
        * html/HTMLTagNames.in:

2012-05-22  Kent Tamura  <tkent@chromium.org>

        Fix a crash in HTMLFormControlElement::disabled().
        https://bugs.webkit.org/show_bug.cgi?id=86534

        Reviewed by Hajime Morita.

        Node::removedFrom() was not called in some cases. This patch fixes it.

        No new tests. It's almost impossible to make a reliable test.

        * dom/ContainerNodeAlgorithms.h:
        Remove inDocument() check so that Node::removedFrom() is called even if
        a parent node in an orphan tree is deleted but a child node remains,

2012-05-22  James Robinson  <jamesr@chromium.org>

        Add a Setting to make position:fixed form a new stacking context
        https://bugs.webkit.org/show_bug.cgi?id=87186

        Reviewed by Adam Barth.

        position:fixed elements form a new stacking context in several mobile WebKit ports and in the Qt port always. To
        be consistent across devices, we want to try turning it on everywhere. This will likely cause compatibility
        issues, so we need a runtime setting in order to stage the change carefully.

        Tests: fast/block/positioning/fixed-position-stacking-context.html
               fast/block/positioning/fixed-position-stacking-context2.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setFixedPositionCreatesStackingContext):
        (WebCore::Settings::fixedPositionCreatesStackingContext):
        (Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::InternalSettings):
        (WebCore::InternalSettings::restoreTo):
        (WebCore::InternalSettings::setFixedPositionCreatesStackingContext):
        (WebCore):
        * testing/InternalSettings.h:
        (InternalSettings):
        * testing/InternalSettings.idl:

2012-05-22  Adam Barth  <abarth@webkit.org>

        RenderInline::absoluteRects does some incorrect layout math
        https://bugs.webkit.org/show_bug.cgi?id=87036

        Reviewed by Eric Seidel.

        http://trac.webkit.org/changeset/88297/trunk/Source/WebCore/rendering/RenderInline.cpp
        contained a typo.  We should accumulate offsets, not add sizes to
        offsets.

        Test: fast/inline/boundingBox-with-continuation.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::absoluteRects):
        (WebCore):

2012-05-22  Dana Jansens  <danakj@chromium.org>

        [chromium] Don't force the visibleLayerRect to be empty for animating layers whose front face is not visible
        https://bugs.webkit.org/show_bug.cgi?id=86886

        Reviewed by Adrienne Walker.

        Previously we would force the visibleLayerRect to be empty for these
        animating layers, and then special case the pre-painting code to
        paint them if they were within some size limit, to avoid having the
        layer steal too much memory.

        Instead, just use the visibleLayerRect given to the layer. Since the
        transform flips the layer such that its back face is visible, it will
        also compute a visibleLayerRect in the front face of the layer, and
        its size will be bounded by the viewport. This will cause the
        layer to be painted with visible priority instead of prepainted, but
        ensures the visible parts of the layer is painted and ready to go when
        the animation flips the layer around.

        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
        (WebCore::calculateVisibleLayerRect):

2012-05-22  Jer Noble  <jer.noble@apple.com>

        REGRESSION (r98359): Video does not render on http://panic.com/dietcoda/
        https://bugs.webkit.org/show_bug.cgi?id=87171

        Reviewed by Maciej Stachowiak.

        No new tests; behavior is very timing specific and only occurs on a subset of all platforms.

        Instead of calling prepareForRendering() from metadataLoaded(), which may fail and cause subsequent
        calls to prepareForRendering() to short circuit, call createVideoLayer() directly, which achieves
        the original goals of the fix for http://webkit.org/b/70448, but without breaking subsequent calls
        to prepareForRendering() if called at the wrong time.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::metadataLoaded):

2012-05-22  Tim Horton  <timothy_horton@apple.com>

        Add a quirk for applications that depend on the relative ordering of progressCompleted/didFinishLoad
        https://bugs.webkit.org/show_bug.cgi?id=87178
        <rdar://problem/11468434>

        Reviewed by Maciej Stachowiak.

        Some applications depend on the relative ordering of progressCompleted/didFinishLoad, which was changed
        to be more correct in http://trac.webkit.org/changeset/94105. For applications built before 94105, we can
        provide the old behavior. For the time being, this will only apply to Mail.app.

        No new tests, will not affect behavior for any application except Mail.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/Settings.h:
        (WebCore::Settings::setNeedsDidFinishLoadOrderQuirk):
        (WebCore::Settings::needsDidFinishLoadOrderQuirk):

2012-05-22  Alexis Menard  <alexis.menard@openbossa.org>

        Move some CSS regions properties to CSSParser::isValidKeywordPropertyAndValue.
        https://bugs.webkit.org/show_bug.cgi?id=87169

        Reviewed by Tony Chang.

        Move some CSS regions properties to the fast path implemented by
        CSSParser::isValidKeywordPropertyAndValue.

        No new tests : Existing tests should cover.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):

2012-05-22  Emil A Eklund  <eae@chromium.org>

        Represents margins as box and simplify writing mode logic
        https://bugs.webkit.org/show_bug.cgi?id=86952

        Reviewed by Eric Seidel.
        
        Add a new class, FractionalLayoutBox, that represents the four sides of a
        box and change RenderBox to use it to represent margins.

        The new box class is intended to be used to represent things like
        margins, paddings and borders where the current rect class isn't a good
        fit. It also encapsulated a lot of the horizontal/vertical writing mode
        and bidi logic allowing it to be reused.

        No new tests, no change in functionality.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        * Target.pri:
        * WebCore.gypi:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/FractionalLayoutBoxExtent.cpp: Added.
        * platform/graphics/FractionalLayoutBoxExtent.h: Added.
        * rendering/LayoutTypes.h:
        * rendering/RenderBlock.cpp:
        * rendering/RenderBox.cpp:
        * rendering/RenderBox.h:
        * rendering/RenderScrollbarPart.cpp:
        * rendering/RenderScrollbarPart.h:

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace 'throwTypeError(); return Undefined();' with 'return throwTypeError();'
        https://bugs.webkit.org/show_bug.cgi?id=87106

        Reviewed by Adam Barth.

        This patch replaces

            throwTypeError();
            return v8::Undefined();

        with

            return throwTypeError();

        No tests. No change in behavior.

        * bindings/scripts/CodeGeneratorV8.pm:
        (GenerateOverloadedFunctionCallback):
        (GenerateParametersCheck):
        * bindings/scripts/test/V8/V8TestObj.cpp:
        (WebCore::TestObjV8Internal::overloadedMethodCallback):
        (WebCore::TestObjV8Internal::overloadedMethod1Callback):

2012-05-22  Dan Bernstein  <mitz@apple.com>

        REGRESSION (r105513): CSS max-width is not applied to SVG element
        https://bugs.webkit.org/show_bug.cgi?id=87050

        Reviewed by Darin Adler.

        Tests: svg/css/max-height.html
               svg/css/max-width.html

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): Changed to also call into the base
        class implementation of this function if max-width was specified.
        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Changed to call into the bas class
        implementation of this function if either height or max-height were specified.

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Pass Isolate to throwTypeError()
        https://bugs.webkit.org/show_bug.cgi?id=87111

        Reviewed by Adam Barth.

        The objective is to pass Isolate around in V8 bindings.
        This patch passes Isolate to throwTypeError() in custom bindings.

        No tests. No change in behavior.

        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
        (WebCore::V8ArrayBuffer::constructorCallback):
        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::constructWebGLArray):
        * bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp:
        (WebCore::V8AudioBufferSourceNode::bufferAccessorSetter):
        * bindings/v8/custom/V8AudioContextCustom.cpp:
        (WebCore::V8AudioContext::constructorCallback):
        * bindings/v8/custom/V8BlobCustom.cpp:
        (WebCore::V8Blob::constructorCallback):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::V8Clipboard::setDragImageCallback):
        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
        (WebCore::V8DOMFormData::constructorCallback):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::constructorCallback):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::V8HTMLDocument::openCallback):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::v8HTMLImageElementConstructorCallback):
        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionStartAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionEndAccessorSetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorGetter):
        (WebCore::V8HTMLInputElement::selectionDirectionAccessorSetter):
        (WebCore::V8HTMLInputElement::setSelectionRangeCallback):
        * bindings/v8/custom/V8HTMLMediaElementCustom.cpp:
        (WebCore::V8HTMLMediaElement::controllerAccessorSetter):
        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):
        * bindings/v8/custom/V8IntentConstructor.cpp:
        (WebCore::V8Intent::constructorCallback):
        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
        (WebCore::V8MessageChannel::constructorCallback):
        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
        (WebCore::V8NotificationCenter::requestPermissionCallback):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::V8SQLResultSetRowList::itemCallback):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::constructorCallback):
        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
        (WebCore::V8WebKitPoint::constructorCallback):
        * bindings/v8/custom/V8WebSocketCustom.cpp:
        (WebCore::V8WebSocket::constructorCallback):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::V8XMLHttpRequest::constructorCallback):

2012-05-22  Kentaro Hara  <haraken@chromium.org>

        [V8] Replace 'setDOMException(); return Undefined();' with 'return setDOMException();'
        https://bugs.webkit.org/show_bug.cgi?id=87102

        Reviewed by Adam Barth.

        This patch replaces

            setDOMException();
            return v8::Undefined();

        with

            return setDOMException();

        In addition, just in case, this patch replaces

            if (...)
                setDOMException();
            return v8::Undefined();

        with

            if (...)
                return setDOMException();
            return v8::Undefined();

        because people might insert some code just above
        'return v8::Undefined()' in the future.

        No tests. No change in behavior.

        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
        (WebCore::constructWebGLArrayWithArrayBufferArgument):
        (WebCore::setWebGLArrayHelper):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::WindowSetTimeoutImpl):
        * bindings/v8/custom/V8DataViewCustom.cpp:
        (WebCore::V8DataView::getInt8Callback):
        (WebCore::V8DataView::getUint8Callback):
        (WebCore::V8DataView::setInt8Callback):
        (WebCore::V8DataView::setUint8Callback):
        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp:
        (WebCore::V8DirectoryEntrySync::getDirectoryCallback):
        (WebCore::V8DirectoryEntrySync::getFileCallback):
        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
        (WebCore::V8HTMLOptionsCollection::addCallback):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::V8Node::insertBeforeCallback):
        (WebCore::V8Node::replaceChildCallback):
        (WebCore::V8Node::removeChildCallback):
        (WebCore::V8Node::appendChildCallback):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::V8SVGLength::valueAccessorGetter):
        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
        (WebCore::getObjectParameter):
        (WebCore::V8WebGLRenderingContext::getFramebufferAttachmentParameterCallback):
        (WebCore::V8WebGLRenderingContext::getParameterCallback):
        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
        (WebCore::V8WebGLRenderingContext::getUniformCallback):
        (WebCore::vertexAttribAndUniformHelperf):
        (WebCore::uniformHelperi):
        (WebCore::uniformMatrixHelper):
        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
        (WebCore::V8WebKitMutationObserver::observeCallback):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::responseAccessorGetter):

2012-05-22  Martin Robinson  <mrobinson@igalia.com>

        [TextureMapper] [Cairo] Implement repaint counters
        https://bugs.webkit.org/show_bug.cgi?id=87062

        Reviewed by Gustavo Noronha Silva.

        No new tests. This just adds a debugging feature that shouldn't
        affect the normal drawing of a page.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::updateBackingStore): Now, if repaint counters are
        enabled, increment the repaint count and call drawRepaintCounter.
        (WebCore::TextureMapperLayer::drawRepaintCounter): Added.
        * platform/graphics/texmap/TextureMapperLayer.h:
        (TextureMapperLayer): Added declaration for drawRepaintCounter.

2012-05-22  Simon Fraser  <simon.fraser@apple.com>

        Use the same animation begin time while updating compositing layers
        https://bugs.webkit.org/show_bug.cgi?id=87080

        Reviewed by Dean Jackson.
        
        Tidied up some beginAnimationUpdate/endAnimationUpdate logic,
        but further cleaning is required. We currently bracket some calls
        to recaclcStyle() with begin/endAnimationUpdate, but not all.
        We don't bracket layout, or compositing updates. This patch
        adds bracketing around compositing updates, in order to be
        able to add some assertions in a later patch that rely on
        RenderLayer::currentTransform() giving consistent results,
        since currentTransform() depends on the animation begin time.
        
        Made AnimationController::beginAnimationUpdate() and
        AnimationController::endAnimationUpdate() nestable by adding
        a counter.
        
        Added a stack-based class, AnimationUpdateBlock, which
        calls begin/endAnimationUpdate.
        
        Replaced calls to begin/endAnimationUpdate in Document::updateStyleIfNeeded()
        and Document::styleResolverChanged() with AnimationUpdateBlock. Filed a bug
        to cover other calls to recalcStyle which might need this (87159).
        
        Removed a call to beginAnimationUpdate() in Document::implicitOpen(),
        which was added in r42415. I believe that r57390 makes this unnecessary,
        and was not able to reproduce the original bug after removing it. It
        was the only unpaired beginAnimationUpdate call.
        
        Made AnimationControllerPrivate::getAnimatedStyleForRenderer() not 
        use a new beginTime each time it was called, so its beginTime now
        depends on some earlier beginAnimationUpdate.
        
        Fixed CSSComputedStyleDeclaration::getPropertyCSSValue() to use
        an AnimationUpdateBlock so that calls to computed style do
        use the current time to compute an animating value (as before).

        Not testable.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
        * dom/Document.cpp:
        (WebCore::Document::updateStyleIfNeeded):
        (WebCore::Document::implicitOpen):
        (WebCore::Document::styleResolverChanged):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
        (WebCore::AnimationController::AnimationController):
        (WebCore::AnimationController::beginAnimationUpdate):
        (WebCore::AnimationController::endAnimationUpdate):
        * page/animation/AnimationController.h:
        (AnimationController):
        (WebCore):
        (AnimationUpdateBlock):
        (WebCore::AnimationUpdateBlock::AnimationUpdateBlock):
        (WebCore::AnimationUpdateBlock::~AnimationUpdateBlock):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateCompositingLayers):

2012-05-22  Tony Chang  <tony@chromium.org>

        REGRESSION(r117613): Dromaeo/jslib-style-prototype regressed by 20%
        https://bugs.webkit.org/show_bug.cgi?id=87142

        Reviewed by Alexis Menard.

        Move CSSPropertyDisplay back into isValidKeywordPropertyAndValue.
        Pass in the parser context so we can check whether we're grid or not.

        No new tests. Covered by Dromaeo/jslib-style-prototype perf test.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::parseKeywordValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFont):

== Rolled over to ChangeLog-2012-05-22 ==